Skip to content

[asan] Custom poisoning on stack is broken by optimizations #100639

Closed
@vitalybuka

Description

@vitalybuka

This is reproducer on
https://github.com/abseil/abseil-cpp/blob/c98bd9c8840f9ded87cf1fd1238455468d325628/absl/strings/cord_test.cc

Note: Revision is important as we are planing to land absl:: workaround.

libc++ also hit that issue

https://github.com/llvm/llvm-project/pull/79536/files#diff-534bc2907ddb3b074ded1353d18fd7d578daf1707943b3039bab4ed975aba3b3R772

// This must not be static to avoid aggressive optimizations.
ABSL_ATTRIBUTE_WEAK
size_t FalseReport(const absl::Cord& a, bool f);

ABSL_ATTRIBUTE_NOINLINE
size_t FalseReport(const absl::Cord& a, bool f) {
  absl::Cord b;
  const absl::Cord& ref = f ? b : a;
  // Test that sanitizers report nothing here. Without
  // InlineData::Rep::annotated_this() compiler can unconditionally load
  // poisoned parts, assuming that local variable is fully accessible.
  return ref.size();
}

TEST(CordSanitizerTest, SanitizesCordFalseReport) {
  absl::Cord c;
  for (int i = 0; i < 1000; ++i)
    c.Append("a");
  FalseReport(c, false);
}

I will add minimized repro later.

The issues is in InstCombine or SimplifyCFG, and likely should be fixed with llvm::mustSuppressSpeculation.

Metadata

Metadata

Assignees

Labels

llvm:analysisIncludes value tracking, cost tables and constant folding

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions