gcc address sanitizer stack-use-after-scope false positives

Description

Saw some of this with gcc7 on arm.

But now seeing with gcc 8.1 (my build) - on x86 - even more.
=================================================================
==22733==ERROR: AddressSanitizer: stack-use-after-scope on address 0x7fed2e4fde30 at pc 0x0000009e51ac bp 0x7fed2e4fdd40 sp 0x7fed2e4fdd38
WRITE of size 32 at 0x7fed2e4fde30 thread T38
#0 0x9e51ab in Stroika::Foundation::Memory::Optional<unsigned long, Stroika::Foundation::Memory::Optional_Traits_Inplace_Storage<unsigned long> > Stroika::Foundation::Containers:rivate::IndexOf_<int, std::equal_to<int> >(Stroika::Foundation::Traversal::Iterable<int> const&, std::conditional<((sizeof (int))<=((2)(sizeof (void))))&&std::is_trivially_copyable<int>::value, int, int const&>::type, std::equal_to<int> const&) (/home/lewis/Sandbox/Stroika-Regression-Tests/Builds/my-g+-8.1-debug-c+17/Test39+0x9e51ab)
#1 0x9c95af in Stroika::Foundation::Memory::Optional<unsigned long, Stroika::Foundation::Memory::Optional_Traits_Inplace_Storage<unsigned long> > Stroika::Foundation::Containers::Sequence<int>::IndexOf<std::equal_to<int> >(int, std::equal_to<int> const&) const (/home/lewis/Sandbox/Stroika-Regression-Tests/Builds/my-g+-8.1-debug-c+17/Test39+0x9c95af)
#2 0x93735c in operator() /home/lewis/Sandbox/Stroika-Regression-Tests/Tests/39/Test.cpp:703
#3 0x94ce4b in operator() /home/lewis/Sandbox/Stroika-Regression-Tests/Tests/39/Test.cpp:571
#4 0x98b180 in _M_invoke /home/lewis/gcc-8.1.0/include/c++/8.1.0/bits/std_function.h:297
#5 0xf6d681 in std::function<void ()>::operator()() const /home/lewis/gcc-8.1.0/include/c++/8.1.0/bits/std_function.h:687
#6 0xf65bc9 in void Stroika::Foundation::Execution::Function<void ()>::operator()<>() const ../Execution/Function.inl:46
#7 0xf4bf65 in Stroika::Foundation::Execution::Thread::Rep_::Run_() /home/lewis/Sandbox/Stroika-Regression-Tests/Library/Sources/Stroika/Foundation/Execution/Thread.cpp:348
#8 0xf4f0c6 in Stroika::Foundation::Execution::Thread::Rep_::ThreadMain_(std::shared_ptr<Stroika::Foundation::Execution::Thread::Rep_> const*) /home/lewis/Sandbox/Stroika-Regression-Tests/Library/Sources/Stroika/Foundation/Execution/Thread.cpp:591
#9 0xf4b399 in operator() /home/lewis/Sandbox/Stroika-Regression-Tests/Library/Sources/Stroika/Foundation/Execution/Thread.cpp:310
#10 0xf5bbb1 in _invoke_impl<void, Stroika::Foundation::Execution::Thread::Rep:oCreate(const std::shared_ptr<Stroika::Foundation::Execution::Thread::Rep_>*)::<lambda()> > /home/lewis/gcc-8.1.0/include/c++/8.1.0/bits/invoke.h:60
#11 0xf59d8a in _invoke<Stroika::Foundation::Execution::Thread::Rep:oCreate(const std::shared_ptr<Stroika::Foundation::Execution::Thread::Rep_>*)::<lambda()> > /home/lewis/gcc-8.1.0/include/c++/8.1.0/bits/invoke.h:95
#12 0xf5faef in _M_invoke<0> /home/lewis/gcc-8.1.0/include/c++/8.1.0/thread:234
#13 0xf5fa11 in operator() /home/lewis/gcc-8.1.0/include/c++/8.1.0/thread:243
#14 0xf5f9ab in _M_run /home/lewis/gcc-8.1.0/include/c++/8.1.0/thread:186
#15 0x127d1ae in execute_native_thread_routine /home/lewis/Sandbox/Stroika-Dev/BUILD-GCC-8.1.0/objdir/../gcc-8.1.0/libstdc+-v3/src/c+11/thread.cc:80
#16 0x7fed32fdf6da in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76da)
#17 0x7fed3162688e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x12188e)

Address 0x7fed2e4fde30 is located in stack of thread T38 at offset 160 in frame
#0 0x9e4fc4 in Stroika::Foundation::Memory::Optional<unsigned long, Stroika::Foundation::Memory::Optional_Traits_Inplace_Storage<unsigned long> > Stroika::Foundation::Containers:rivate::IndexOf_<int, std::equal_to<int> >(Stroika::Foundation::Traversal::Iterable<int> const&, std::conditional<((sizeof (int))<=((2)(sizeof (void))))&&std::is_trivially_copyable<int>::value, int, int const&>::type, std::equal_to<int> const&) (/home/lewis/Sandbox/Stroika-Regression-Tests/Builds/my-g+-8.1-debug-c+17/Test39+0x9e4fc4)

This frame has 4 object(s):
[32, 36) 'item'
[96, 104) 'n'
[160, 192) '__for_end' <== Memory access at offset 160 is inside this variable
[224, 256) '<unknown>'
HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext
(longjmp and C++ exceptions are supported)
Thread T38 created by T0 here:
#0 0x7fed33243630 in __interceptor_pthread_create /home/lewis/Sandbox/Stroika-Dev/BUILD-GCC-8.1.0/objdir/../gcc-8.1.0/libsanitizer/asan/asan_interceptors.cc:202
#1 0x127d434 in __gthread_create /home/lewis/Sandbox/Stroika-Dev/BUILD-GCC-8.1.0/objdir/x86_64-pc-linux-gnu/libstdc++-v3/include/x86_64-pc-linux-gnu/bits/gthr-default.h:662
#2 0x127d434 in std::thread::_M_start_thread(std::unique_ptr<std::thread::_State, std::default_delete<std::thread::_State> >, void ()) /home/lewis/Sandbox/Stroika-Dev/BUILD-GCC-8.1.0/objdir/../gcc-8.1.0/libstdc+-v3/src/c+11/thread.cc:135
#3 0xf4b644 in Stroika::Foundation::Execution::Thread::Rep_:oCreate(std::shared_ptr<Stroika::Foundation::Execution::Thread::Rep_> const*) /home/lewis/Sandbox/Stroika-Regression-Tests/Library/Sources/Stroika/Foundation/Execution/Thread.cpp:310
#4 0xf53861 in Stroika::Foundation::Execution::Thread:tr::Start() const /home/lewis/Sandbox/Stroika-Regression-Tests/Library/Sources/Stroika/Foundation/Execution/Thread.cpp:819
#5 0x9b49d3 in Stroika::Foundation::Execution::Thread::Start(Stroika::Foundation::Traversal::Iterable<Stroika::Foundation::Execution::Thread:tr> const&)::{lambda(Stroika::Foundation::Execution::Thread:tr const&)#1}::operator()(Stroika::Foundation::Execution::Thread:tr const&) const (/home/lewis/Sandbox/Stroika-Regression-Tests/Builds/my-g+-8.1-debug-c+17/Test39+0x9b49d3)
#6 0x9d133d in std::_Function_handler<void (Stroika::Foundation::Execution::Thread:tr const&), Stroika::Foundation::Execution::Thread::Start(Stroika::Foundation::Traversal::Iterable<Stroika::Foundation::Execution::Thread:tr> const&)::{lambda(Stroika::Foundation::Execution::Thread:tr const&)#1}>::_M_invoke(std::_Any_data const&, Stroika::Foundation::Execution::Thread:tr const&) (/home/lewis/Sandbox/Stroika-Regression-Tests/Builds/my-g+-8.1-debug-c+17/Test39+0x9d133d)
#7 0xb6494a in std::function<void (Stroika::Foundation::Execution::Thread:tr const&)>::operator()(Stroika::Foundation::Execution::Thread:tr const&) const /home/lewis/gcc-8.1.0/include/c++/8.1.0/bits/std_function.h:687
#8 0xb2cb2e in Stroika::Foundation::Traversal::Iterable<Stroika::Foundation::Execution::Thread:tr>::_IRep::_Apply(std::function<void (Stroika::Foundation::Execution::Thread:tr const&)> const&) const (/home/lewis/Sandbox/Stroika-Regression-Tests/Builds/my-g+-8.1-debug-c+17/Test39+0xb2cb2e)
#9 0xaef04f in Stroika::Foundation::Traversal::IterableFromIterator<Stroika::Foundation::Execution::Thread:tr, Stroika::Foundation::Traversal:rivate_::GenItWrapper_<Stroika::Foundation::Execution::Thread:tr>, std::function<Stroika::Foundation::Memory::Optional<Stroika::Foundation::Execution::Thread:tr, Stroika::Foundation::Memory::Optional_Traits_Inplace_Storage<Stroika::Foundation::Execution::Thread:tr> > ()> >::_Rep::Apply(std::function<void (Stroika::Foundation::Execution::Thread:tr const&)> const&) const (/home/lewis/Sandbox/Stroika-Regression-Tests/Builds/my-g+-8.1-debug-c+17/Test39+0xaef04f)
#10 0x9bc2dd in Stroika::Foundation::Traversal::Iterable<Stroika::Foundation::Execution::Thread:tr>::Apply(std::function<void (Stroika::Foundation::Execution::Thread:tr const&)> const&) const ../Characters/../Containers/../Traversal/Iterable.inl:759
#11 0x9b4be5 in Stroika::Foundation::Execution::Thread::Start(Stroika::Foundation::Traversal::Iterable<Stroika::Foundation::Execution::Thread:tr> const&) (/home/lewis/Sandbox/Stroika-Regression-Tests/Builds/my-g+-8.1-debug-c+17/Test39+0x9b4be5)
#12 0x94ec92 in TestBasics_<Stroika::Foundation::Containers::Sequence<int>, (anonymous namespace)::Test10_MutlipleThreadsReadingOneUpdateUsingSynchonizedContainer_:oIt()::<lambda(Stroika::Foundation::Containers::Sequence<int>, int)>, (anonymous namespace)::Test10_MutlipleThreadsReadingOneUpdateUsingSynchonizedContainer_:oIt()::<lambda(Stroika::Foundation::Containers::Sequence<int>, int)>, (anonymous namespace)::Test10_MutlipleThreadsReadingOneUpdateUsingSynchonizedContainer_:oIt()::<lambda(const Stroika::Foundation::Containers::Sequence<int>*)>, (anonymous namespace)::Test10_MutlipleThreadsReadingOneUpdateUsingSynchonizedContainer_:oIt()::<lambda(int)> > /home/lewis/Sandbox/Stroika-Regression-Tests/Tests/39/Test.cpp:688
#13 0x937d24 in DoIt /home/lewis/Sandbox/Stroika-Regression-Tests/Tests/39/Test.cpp:700
#14 0x938718 in DoRegressionTests_ /home/lewis/Sandbox/Stroika-Regression-Tests/Tests/39/Test.cpp:741
#15 0xcdb6ae in Stroika::TestHarness:rintPassOrFail(void ()) /home/lewis/Sandbox/Stroika-Regression-Tests/Tests/39/../TestHarness/TestHarness.cpp:81
#16 0x9387bd in main /home/lewis/Sandbox/Stroika-Regression-Tests/Tests/39/Test.cpp:748
#17 0x7fed31526b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)

SUMMARY: AddressSanitizer: stack-use-after-scope (/home/lewis/Sandbox/Stroika-Regression-Tests/Builds/my-g+-8.1-debug-c+17/Test39+0x9e51ab) in Stroika::Foundation::Memory::Optional<unsigned long, Stroika::Foundation::Memory::Optional_Traits_Inplace_Storage<unsigned long> > Stroika::Foundation::Containers:rivate::IndexOf_<int, std::equal_to<int> >(Stroika::Foundation::Traversal::Iterable<int> const&, std::conditional<((sizeof (int))<=((2)(sizeof (void))))&&std::is_trivially_copyable<int>::value, int, int const&>::type, std::equal_to<int> const&)
Shadow bytes around the buggy address:
0x0ffe25c97b70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0ffe25c97b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0ffe25c97b90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0ffe25c97ba0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0ffe25c97bb0: 00 00 f1 f1 f1 f1 04 f2 f2 f2 f2 f2 f2 f2 00 f2
=>0x0ffe25c97bc0: f2 f2 f2 f2 f2 f2[f8]f8 f8 f8 f2 f2 f2 f2 00 00
0x0ffe25c97bd0: 00 00 f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00
0x0ffe25c97be0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0ffe25c97bf0: f1 f1 f1 f1 01 f2 f2 f2 f2 f2 f2 f2 00 00 f2 f2
0x0ffe25c97c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1
0x0ffe25c97c10: f1 f1 00 00 f2 f2 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==22733==ABORTING
[] (7 seconds) [39] Foundation::Execution::ThreadSafetyBuiltinObject (LD_LIBRARY_PATH=:~/gcc-8.1.0/lib64 ../Builds/my-g+-8.1-debug-c+17/Test39)
[Succeeded] (0 seconds) [40] Foundation::Execution::Other (LD_LIBRARY_PATH=:~/gcc-8.1.0/lib64 ../Builds/my-g+-8.1-debug-c+17/Test40)
[Succeeded] (0 seconds) [41] Foundation::IO::Network (LD_LIBRARY_PATH=:~/gcc-8.1.0/lib64 ../Builds/my-g+-8.1-debug-c+17/Test41)
[Succeeded] (0 seconds) [42] Foundation::IO::Network::HTTP (LD_LIBRARY_PATH=:~/gcc-8.1.0/lib64 ../Builds/my-g+-8.1-debug-c+17/Test42)
[Succeeded] (4 seconds) [43] Foundation::IO::Network::Transfer (LD_LIBRARY_PATH=:~/gcc-8.1.0/lib64 ../Builds/my-g+-8.1-debug-c+17/Test43)
=================================================================
==22864==ERROR: AddressSanitizer: stack-use-after-scope on address 0x7fff3f3ba8d0 at pc 0x0000008a0f43 bp 0x7fff3f3ba800 sp 0x7fff3f3ba7f8
WRITE of size 8 at 0x7fff3f3ba8d0 thread T0
#0 0x8a0f42 in std::shared_lock<Stroika::Foundation:ebug::AssertExternallySynchronizedLock const>::shared_lock(Stroika::Foundation:ebug::AssertExternallySynchronizedLock const&) /home/lewis/gcc-8.1.0/include/c++/8.1.0/shared_mutex:552
#1 0x8ba828 in Stroika::Foundation::Traversal::Iterable<Stroika::Foundation::IO::FileSystem::MountedFilesystemType>::_SafeReadRepAccessor<Stroika::Foundation::Traversal::Iterable<Stroika::Foundation::IO::FileSystem::MountedFilesystemType>::_IRep>::_SafeReadRepAccessor(Stroika::Foundation::Traversal::Iterable<Stroika::Foundation::IO::FileSystem::MountedFilesystemType> const*) ../../Characters/../Containers/../Traversal/Iterable.inl:82
#2 0x8b1519 in Stroika::Foundation::Traversal::Iterable<Stroika::Foundation::IO::FileSystem::MountedFilesystemType>::MakeIterator() const (/home/lewis/Sandbox/Stroika-Regression-Tests/Builds/my-g+-8.1-debug-c+17/Test44+0x8b1519)
#3 0x8a77fa in Stroika::Foundation::Traversal::Iterable<Stroika::Foundation::IO::FileSystem::MountedFilesystemType>::begin() const (/home/lewis/Sandbox/Stroika-Regression-Tests/Builds/my-g+-8.1-debug-c+17/Test44+0x8a77fa)
#4 0x894afd in DoTest /home/lewis/Sandbox/Stroika-Regression-Tests/Tests/44/Test.cpp:134
#5 0x8957a4 in DoRegressionTests_ /home/lewis/Sandbox/Stroika-Regression-Tests/Tests/44/Test.cpp:159
#6 0x92e662 in Stroika::TestHarness:rintPassOrFail(void ()) /home/lewis/Sandbox/Stroika-Regression-Tests/Tests/44/../TestHarness/TestHarness.cpp:81
#7 0x8957ed in main /home/lewis/Sandbox/Stroika-Regression-Tests/Tests/44/Test.cpp:167
#8 0x7f72722d8b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
#9 0x88ed89 in _start (/home/lewis/Sandbox/Stroika-Regression-Tests/Builds/my-g+-8.1-debug-c+17/Test44+0x88ed89)

Address 0x7fff3f3ba8d0 is located in stack of thread T0 at offset 32 in frame
#0 0x8b1479 in Stroika::Foundation::Traversal::Iterable<Stroika::Foundation::IO::FileSystem::MountedFilesystemType>::MakeIterator() const (/home/lewis/Sandbox/Stroika-Regression-Tests/Builds/my-g+-8.1-debug-c+17/Test44+0x8b1479)

This frame has 1 object(s):
[32, 64) '<unknown>' <== Memory access at offset 32 is inside this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext
(longjmp and C++ exceptions are supported)
SUMMARY: AddressSanitizer: stack-use-after-scope /home/lewis/gcc-8.1.0/include/c++/8.1.0/shared_mutex:552 in std::shared_lock<Stroika::Foundation:ebug::AssertExternallySynchronizedLock const>::shared_lock(Stroika::Foundation:ebug::AssertExternallySynchronizedLock const&)
Shadow bytes around the buggy address:
0x100067e6f4c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x100067e6f4d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x100067e6f4e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x100067e6f4f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x100067e6f500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x100067e6f510: 00 00 f8 f8 f8 f8 f1 f1 f1 f1[f8]f8 f8 f8 f3 f3
0x100067e6f520: f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x100067e6f530: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00
0x100067e6f540: 00 00 00 00 00 00 00 00 00 00 f2 f2 f2 f2 f2 f2
0x100067e6f550: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f2 f2
0x100067e6f560: f2 f2 f2 f2 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==22864==ABORTING
[] (1 seconds) [44] Foundation::IO::Other (LD_LIBRARY_PATH=:~/gcc-8.1.0/lib64 ../Builds/my-g+-8.1-debug-c+17/Test44)
[Succeeded] (1 seconds) [45] Foundation::Math (LD_LIBRARY_PATH=:~/gcc-8.1.0/lib64 ../Builds/my-g+-8.1-debug-c+17/Test45)

I tried using Stroika_Foundation_Debug_ATTRIBUTE_NO_SANITIZE ("addresss") in a targetted way but couldnt get that to work.

So just disabled on my regression testing 8.1 configuration for now.

Status

Assignee

Lewis Pringle

Reporter

Lewis Pringle

Labels

None

Fix versions

Priority

Medium
Configure