clang-analyzer: use-after-free on ~MutexTryLock

[masaori335]

• clang version 11.1.0
• Report: https://ci.trafficserver.apache.org/clang-analyzer/github/8197/2021-08-02-201641-5958-1/

Timeline

• clang-analyzer reported the issue on the master branch
• #7596 removed the UnixNetVConnection::startEvent function to make it happy
• but it made a crash, #8184 tried to revert the commit with a fix
• clang-analyzer gave a green light on #8184 and we merged it
  https://ci.trafficserver.apache.org/job/clang-analyzer-github/14671/
• clang-analyzer start reporting the issue on the latest master again
  https://ci.trafficserver.apache.org/job/clang-analyzer-github/14682/

[masaori335]

hmm, I might be missing something, but my local clang-12 on macOS doesn't report this issue

» /usr/local/opt/llvm/bin/scan-build --keep-cc -enable-checker alpha.unix.cstring.BufferOverlap -enable-checker alpha.core.BoolAssignment -enable-checker alpha.core.CastSize -enable-checker alpha.core.SizeofPtr --status-bugs --keep-empty make -j16
scan-build: Using '/usr/local/Cellar/llvm/12.0.0_1/bin/clang-12' for static analysis
make[1]: Entering directory '/opt/src/github.com/apache/trafficserver-asf-master/iocore/net'
...
  CXX      UnixNetVConnection.o
...  
scan-build: Analysis run complete.
scan-build: No bugs found.

[masaori335]

neither with 11.1.0_2 on macOS

» /usr/local/opt/llvm@11/bin/scan-build --keep-cc -enable-checker alpha.unix.cstring.BufferOverlap -enable-checker alpha.core.BoolAssignment -enable-checker alpha.core.CastSize -enable-checker alpha.core.SizeofPtr --status-bugs --keep-empty make -j16
scan-build: Using '/usr/local/Cellar/llvm@11/11.1.0_2/bin/clang-11' for static analysis
make[1]: Entering directory '/opt/src/github.com/apache/trafficserver-asf-master/iocore/net'
...
  CXX      UnixNetVConnection.o
...  
scan-build: Analysis run complete.
scan-build: No bugs found.

[masaori335]

The last resort is

#ifndef __clang_analyzer__
// Code not to be analyzed
#endif

https://clang-analyzer.llvm.org/faq.html#exclude_code

[masaori335]

I got repro with llvm-11.1.0 & 12.0.1 on my mac, I was missing to set ccc-analyzer and c++-analyzer as compiler.

/opt/src/github.com/apache/trafficserver-asf-master/iocore/eventsystem/I_Lock.h:552:7: warning: Use of memory after it is freed [unix.Malloc]
      Mutex_unlock(m, m->thread_holding);
      ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

[masaori335]

As @SolidWallOfCode pointed out somewhere, it looks like the clang-analyzer is confused by void UnixNetVConnection::free(EThread *) and void std::free(void *). If I changed the name of the function or expand the code (like inline), the report is gone.

[masaori335]

Also, we need to check how the ci job merges PRs.

[masaori335]

#8209 fixed the report.