https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=279560
Bug ID: 279560
Summary: FreeBSD 14.1 ships libc++ which passes wrong size to
sized operator delete
Product: Base System
Version: 14.0-RELEASE
Hardware: Any
OS: Any
Status: New
Severity: Affects Many People
Priority: ---
Component: standards
Assignee: [email protected]
Reporter: [email protected]
Hi. I maintain gperftools (https://github.com/gperftools/gperftools). I noticed
announcement of release of 14.1 and installed it in VM. When I run gperftools
unit tests "debug" configurations pretty much ~all fail due to mismatch between
requested allocation size and allocation size passed to sized delete.
It should be straighforward to reproduce by simply git cloning from github and
running ./autogen.sh && ./configure && make check
I don't have capacity to investigate more, but I have backtrace of allocation:
#0 MallocBlock::Initialize (this=this@entry=0xc480f0, size=size@entry=25,
type=type@entry=-21308287) at src/debugallocation.cc:382
#1 0x0000000000225e4c in MallocBlock::Allocate (size=size@entry=25,
type=-21308287) at src/debugallocation.cc:560
#2 0x00000000002245d1 in DebugAllocate (size=25, type=type@entry=-21308287) at
src/debugallocation.cc:1051
#3 0x000000000026eff4 in debug_cpp_alloc (size=12878064, new_type=-21308287,
nothrow=false) at src/debugallocation.cc:1220
#4 tc_new (size=12878064) at src/debugallocation.cc:1328
#5 0x0000000000256edd in
std::__1::__libcpp_operator_new[abi:se180100]<unsigned long>(unsigned long)
(__args=25) at /usr/include/c++/v1/new:271
#6 std::__1::__libcpp_allocate[abi:se180100](unsigned long, unsigned long)
(__size=25, __align=1) at /usr/include/c++/v1/new:295
#7 std::__1::allocator<char>::allocate[abi:se180100](unsigned long)
(this=0x7fffffffd878, __n=25) at /usr/include/c++/v1/__memory/allocatorh:125
#8 std::__1::__allocate_at_least[abi:se180100]<std::__1::allocator<char>
>(std::__1::allocator<char>&, unsigned long) (__alloc=..., __n=25)
at /usr/include/c++/v1/__memory/allocate_at_least.h:55
#9 std::__1::basic_string<char, std::__1::char_traits<char>,
std::__1::allocator<char> >::__init (this=0x7fffffffd878, __sz=23,
__s=<optimized out>) at /usr/include/c++/v1/string:2212
#10
_ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEC2B8se180100ILi0EEEPKc
(this=0x7fffffffd878, __s=<optimized out>) at /usr/include/c++/v1/string:954
#11 testing::internal::UnitTestImpl::GetTestSuite (this=0xc50020,
test_suite_name=0xc4e021 "MallocExtensionTest", type_param=0x0,
set_up_tc=set_up_tc@entry=0x0,
tear_down_tc=tear_down_tc@entry=0x0) at
vendor/googletest/googletest/src/gtest.cc:5786
#12 0x000000000025d7d2 in testing::internal::UnitTestImpl::AddTestInfo
(this=<optimized out>, set_up_tc=0x0, tear_down_tc=0x0,
test_info=test_info@entry=0xc4e020)
at ./vendor/googletest/googletest/src/gtest-internal-inl.h:690
#13 0x0000000000242ba3 in testing::internal::MakeAndRegisterTestInfo
(test_suite_name=<optimized out>, name=0x209287 "Basics",
type_param=type_param@entry=0x0,
value_param=value_param@entry=0x0, code_location=...,
fixture_class_id=fixture_class_id@entry=0x4237f1
<testing::internal::TypeIdHelper<testing::Test>::dummy_>, set_up_tc=0x0,
tear_down_tc=0x0, factory=0xc4c020) at
vendor/googletest/googletest/src/gtest.cc:2794
#14 0x0000000000221fdb in __cxx_global_var_init () at
src/tests/malloc_extension_test.cc:47
#15 0x0000000000221fdb in _GLOBAL__sub_I_malloc_extension_test.cc ()
#16 0x000000080027df5d in objlist_call_init (list=list@entry=0x7fffffffe9c8,
lockstate=lockstate@entry=0x7fffffffe7d8) at
/usr/src/libexec/rtld-elf/rtld.c:3150
#17 0x000000080027cb89 in _rtld (sp=<optimized out>, exit_proc=0x7fffffffea40,
objp=0x7fffffffea48) at /usr/src/libexec/rtld-elf/rtld.c:990
#18 0x0000000800279df9 in rtld_start () at
/usr/src/libexec/rtld-elf/amd64/rtld_start.S:40
(we see it uses size of 25 bytes)
and this is backtrace of deallocation (which passes 24 bytes):
#0 0x0000000000227ecb in MallocBlock::CheckAndClear (this=0xc480f0,
type=<optimized out>, given_size=24) at src/debugallocation.cc:417
#1 0x0000000000227d66 in MallocBlock::Deallocate (this=0x4, type=2,
given_size=2138871) at src/debugallocation.cc:338
#2 0x0000000000224152 in DebugDeallocate (ptr=<optimized out>, type=2,
given_size=2138871) at src/debugallocation.cc:1065
#3 0x000000000026f460 in tc_delete_sized (p=<optimized out>, size=<optimized
out>) at src/debugallocation.cc:1350
#4 0x0000000000256f51 in
std::__1::__libcpp_operator_delete[abi:se180100]<void*, unsigned long>(void*,
unsigned long) (__args=2, __args=2) at /usr/include/c++/v1/new:280
#5 std::__1::__do_deallocate_handle_size[abi:se180100]<>(void*, unsigned long)
(__ptr=0x4, __size=2) at /usr/include/c++/v1/new:304
#6 std::__1::__libcpp_deallocate[abi:se180100](void*, unsigned long, unsigned
long) (__ptr=0x4, __size=2, __align=1) at /usr/include/c++/v1/new:317
#7 std::__1::allocator<char>::deallocate[abi:se180100](char*, unsigned long)
(this=0x7fffffffd878, __p=0x4 <error: Cannot access memory at address 0x4>,
__n=2)
at /usr/include/c++/v1/__memory/allocator.h:139
#8 std::__1::allocator_traits<std::__1::allocator<char>
>::deallocate[abi:se180100](std::__1::allocator<char>&, char*, unsigned long)
(__a=...,
__p=0x4 <error: Cannot access memory at address 0x4>, __n=2) at
/usr/include/c++/v1/__memory/allocator_traits.h:289
#9 std::__1::basic_string<char, std::__1::char_traits<char>,
std::__1::allocator<char> >::~basic_string (this=0x7fffffffd878) at
/usr/include/c++/v1/string:1105
#10 testing::internal::UnitTestImpl::GetTestSuite (this=0xc50020,
test_suite_name=0xc4e021 "MallocExtensionTest", type_param=0x0,
set_up_tc=set_up_tc@entry=0x0,
tear_down_tc=tear_down_tc@entry=0x0) at
vendor/googletest/googletest/src/gtest.cc:5786
#11 0x000000000025d7d2 in testing::internal::UnitTestImpl::AddTestInfo
(this=<optimized out>, set_up_tc=0x0, tear_down_tc=0x0,
test_info=test_info@entry=0xc4e020)
at ./vendor/googletest/googletest/src/gtest-internal-inl.h:690
#12 0x0000000000242ba3 in testing::internal::MakeAndRegisterTestInfo
(test_suite_name=<optimized out>, name=0x209287 "Basics",
type_param=type_param@entry=0x0,
value_param=value_param@entry=0x0, code_location=...,
fixture_class_id=fixture_class_id@entry=0x4237f1
<testing::internal::TypeIdHelper<testing::Test>::dummy_>, set_up_tc=0x0,
tear_down_tc=0x0, factory=0xc4c020) at
vendor/googletest/googletest/src/gtest.cc:2794
#13 0x0000000000221fdb in __cxx_global_var_init () at
src/tests/malloc_extension_test.cc:47
#14 0x0000000000221fdb in _GLOBAL__sub_I_malloc_extension_test.cc ()
#15 0x000000080027df5d in objlist_call_init (list=list@entry=0x7fffffffe9c8,
lockstate=lockstate@entry=0x7fffffffe7d8) at
/usr/src/libexec/rtld-elf/rtld.c:3150
#16 0x000000080027cb89 in _rtld (sp=<optimized out>, exit_proc=0x7fffffffea40,
objp=0x7fffffffea48) at /usr/src/libexec/rtld-elf/rtld.c:990
#17 0x0000000800279df9 in rtld_start () at
/usr/src/libexec/rtld-elf/amd64/rtld_start.S:40
Most likely, it is some sort of a bug in upstream clang's libc++ in whatever
version you ship. Although it is somewhat odd, given that Google runs with
sized deallocation enabled and with ~always latest clang/llvm bits, but maybe
they exercise different configuration.
--
You are receiving this mail because:
You are the assignee for the bug.
lmpx.com only provides a reader for public news (NNTP) servers. It is not
affiliated with the servers or forums shown here and is not responsible for
the content of articles, which is written by their respective authors.