Issue 352073 in chromium: ASan reports a false positive in infoplist_strings

chro...@googlecode.com

unread,

Mar 13, 2014, 4:55:58 AM3/13/14

to chromi...@chromium.org

Status: Assigned
Owner: gli...@chromium.org
CC: k...@chromium.org, tha...@chromium.org, ag...@chromium.org,
samso...@google.com
Labels: Type-Bug Pri-2 Build Stability-Memory-AddressSanitizer OS-Mac

New issue 352073 by gli...@chromium.org: ASan reports a false positive in
infoplist_strings_tool on Mac
http://code.google.com/p/chromium/issues/detail?id=352073

From
http://build.chromium.org/p/tryserver.chromium/builders/mac_asan/builds/42113/steps/compile/logs/stdio:

[19628/21488] ACTION Generating the language InfoPlist.strings files
FAILED: cd ../../chrome; export
BUILT_PRODUCTS_DIR=/Volumes/data/b/build/slave/mac_asan/build/src/out/Release;
export CONFIGURATION=Release; export
CONTENTS_FOLDER_PATH=Chromium.app/Contents; export
EXECUTABLE_NAME=Chromium; export
EXECUTABLE_PATH=Chromium.app/Contents/MacOS/Chromium; export
FULL_PRODUCT_NAME=Chromium.app; export
INFOPLIST_PATH=Chromium.app/Contents/Info.plist; export
MACH_O_TYPE=mh_execute; export PRODUCT_NAME=Chromium; export
PRODUCT_TYPE=com.apple.product-type.application; export
SDKROOT=/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX10.6.sdk;
export
SRCROOT=/Volumes/data/b/build/slave/mac_asan/build/src/out/Release/../../chrome;
export SOURCE_ROOT="${SRCROOT}"; export
TARGET_BUILD_DIR=/Volumes/data/b/build/slave/mac_asan/build/src/out/Release;
export TEMP_DIR="${TMPDIR}"; export
UNLOCALIZED_RESOURCES_FOLDER_PATH=Chromium.app/Contents/Resources; export
WRAPPER_NAME=Chromium.app;../out/Release/infoplist_strings_tool -b
chromium_strings -v ../chrome/VERSION -g ../out/Release/gen/chrome
-o ../out/Release/obj/chrome/chrome_initial.gen/app_infoplist_strings -t
main am ar bg bn ca cs da de el en-GB en-US es-419 es et fa fi fil fr gu he
hi hr hu id it ja kn ko lt lv ml mr ms nb nl pl pt-BR pt-PT ro ru sk sl sr
sv sw ta te th tr uk vi zh-CN zh-TW
=================================================================
==38424==ERROR: AddressSanitizer: global-buffer-overflow on address
0x000f8362 at pc 0x14b16d bp 0xbff7f5f8 sp 0xbff7f5e8
READ of size 1 at 0x000f8362 thread T0
#0 0x14b16c in wrap_memmove
(/Volumes/data/b/build/slave/mac_asan/build/src/third_party/llvm-build/Release+Asserts/lib/clang/3.5/lib/darwin/libclang_rt.asan_osx_dynamic.dylib+0x1716c)
#1 0x965fe351 in __CFStringAppendBytes
(/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation+0x8351)
#2 0x965fd99e in __CFStringAppendFormatCore
(/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation+0x799e)
#3 0x9664a19b in _CFStringCreateWithFormatAndArgumentsAux
(/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation+0x5419b)
#4 0x9575beed in -[NSPlaceholderString
initWithFormat:locale:arguments:]
(/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation+0x5beed)
#5 0x9575d04b in +[NSString stringWithFormat:]
(/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation+0x5d04b)
#6 0x80ab8 in main
(/Volumes/data/b/build/slave/mac_asan/build/src/chrome/../out/Release/infoplist_strings_tool+0x2ab8)
#7 0x80254 in start
(/Volumes/data/b/build/slave/mac_asan/build/src/chrome/../out/Release/infoplist_strings_tool+0x2254)

0x000f8362 is located 2 bytes inside of global variable '.str119'
from '../../chrome/tools/mac_helpers/infoplist_strings_util.mm' (0xf8360)
of size 12
'.str119' is ascii string '%d.%d.%d.%d'
0x000f8362 is located 27 bytes to the right of global variable '.str117'
from '../../chrome/tools/mac_helpers/infoplist_strings_util.mm' (0xf8340)
of size 7
'.str117' is ascii string 'PATCH='
SUMMARY: AddressSanitizer: global-buffer-overflow ??:0 wrap_memmove
Shadow bytes around the buggy address:
0x2001f010: 03 f9 f9 f9 f9 f9 f9 f9 00 00 00 00 02 f9 f9 f9
0x2001f020: 03 f9 f9 f9 02 f9 f9 f9 03 f9 f9 f9 02 f9 f9 f9
0x2001f030: 03 f9 f9 f9 02 f9 f9 f9 03 f9 f9 f9 f9 f9 f9 f9
0x2001f040: 00 00 00 00 00 05 f9 f9 f9 f9 f9 f9 00 00 00 00
0x2001f050: 00 00 00 00 00 00 00 00 07 f9 f9 f9 f9 f9 f9 f9
=>0x2001f060: 07 f9 f9 f9 07 f9 f9 f9 07 f9 f9 f9[f9]04 f9 f9
0x2001f070: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00
0x2001f080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x2001f090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x2001f0a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x2001f0b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Contiguous container OOB:fc
ASan internal: fe
==38424==ABORTING
ninja: build stopped: subcommand failed.

--
You received this message because this project is configured to send all
issue notifications to this address.
You may adjust your notification preferences at:
https://code.google.com/hosting/settings

chro...@googlecode.com

unread,

Mar 13, 2014, 5:26:58 AM3/13/14

to chromi...@chromium.org

Comment #1 on issue 352073 by gli...@chromium.org: ASan reports a false

positive in infoplist_strings_tool on Mac
http://code.google.com/p/chromium/issues/detail?id=352073

Because the highlighted shadow byte is inside the global variable of size
12, its value must be 0x00, not 0xF9.
We've also received an external report about a similar problem on OSX
recently.

chro...@googlecode.com

unread,

Mar 13, 2014, 7:17:38 AM3/13/14

to chromi...@chromium.org

Comment #2 on issue 352073 by bugdro...@chromium.org: ASan reports a false

positive in infoplist_strings_tool on Mac

http://code.google.com/p/chromium/issues/detail?id=352073#c2

------------------------------------------------------------------------
r256799 | gli...@chromium.org | 2014-03-13T10:55:07.979099Z

Changed paths:
M
http://src.chromium.org/viewvc/chrome/trunk/src/build/common.gypi?r1=256799&r2=256798&pathrev=256799

Disable ASan instrumentation for globals on Mac to work around issue 352073

BUG=352073
TBR=tha...@chromium.org

Review URL: https://codereview.chromium.org/198773002
------------------------------------------------------------------------

chro...@googlecode.com

unread,

Mar 13, 2014, 9:18:32 AM3/13/14

to chromi...@chromium.org

Updates:
Blockedon: address-sanitizer:274

Comment #3 on issue 352073 by gli...@chromium.org: ASan reports a false

positive in infoplist_strings_tool on Mac
http://code.google.com/p/chromium/issues/detail?id=352073

(No comment was entered for this change.)

chro...@googlecode.com

unread,

Mar 13, 2014, 12:42:55 PM3/13/14

to chromi...@chromium.org

Comment #4 on issue 352073 by tha...@chromium.org: ASan reports a false

positive in infoplist_strings_tool on Mac
http://code.google.com/p/chromium/issues/detail?id=352073

Is it understood why this happens? It used to work, right? Which llvm
change broke this?

Is it certain that this is Mac only?

chro...@googlecode.com

unread,

Mar 13, 2014, 12:44:55 PM3/13/14

to chromi...@chromium.org

Comment #5 on issue 352073 by tha...@chromium.org: ASan reports a false

positive in infoplist_strings_tool on Mac
http://code.google.com/p/chromium/issues/detail?id=352073

Oh, looks like address-sanitizer:274 answers all this :-)

chro...@googlecode.com

unread,

Dec 8, 2014, 11:19:31 AM12/8/14

to chromi...@chromium.org

Comment #8 on issue 352073 by bugdro...@chromium.org: ASan reports a false

positive in infoplist_strings_tool on Mac

https://code.google.com/p/chromium/issues/detail?id=352073#c8

The following revision refers to this bug:

https://chromium.googlesource.com/chromium/src.git/+/964445e21b60278ff6e0de560c4110d8a161be36

commit 964445e21b60278ff6e0de560c4110d8a161be36
Author: glider <gli...@chromium.org>
Date: Mon Dec 08 15:48:39 2014

Re-enable globals instrumentation under ASan on Mac.
The corresponding bug in ASan has been fixed in March 2014.

BUG=352073
TBR=eart...@chromium.org

Review URL: https://codereview.chromium.org/740663003

Cr-Commit-Position: refs/heads/master@{#307253}

[modify]
http://crrev.com/964445e21b60278ff6e0de560c4110d8a161be36/build/common.gypi

chro...@googlecode.com

unread,

Dec 9, 2014, 3:46:24 AM12/9/14

to chromi...@chromium.org

Updates:
Status: Fixed

Comment #9 on issue 352073 by gli...@chromium.org: ASan reports a false

positive in infoplist_strings_tool on Mac
https://code.google.com/p/chromium/issues/detail?id=352073

Finally fixed.

chro...@googlecode.com

unread,

Dec 10, 2014, 4:57:36 PM12/10/14

to chromi...@chromium.org

Comment #10 on issue 352073 by bugdro...@chromium.org: ASan reports a false

positive in infoplist_strings_tool on Mac

https://code.google.com/p/chromium/issues/detail?id=352073#c10

The following revision refers to this bug:

https://chromium.googlesource.com/chromium/src.git/+/75812af2fc918c3f22cc79dd83214bc1b2ec187c

commit 75812af2fc918c3f22cc79dd83214bc1b2ec187c
Author: hans <ha...@chromium.org>
Date: Wed Dec 10 21:33:16 2014

Roll Clang 218707:223109 (+r223211, +r223219, -r220714), take 2

This also reverts:

"Re-enable globals instrumentation under ASan on Mac."

chro...@googlecode.com

unread,

Jan 7, 2016, 10:32:15 AM1/7/16

to chromi...@chromium.org

Comment #14 on issue 352073 by ru...@google.com: ASan reports a false

positive in infoplist_strings_tool on Mac

https://code.google.com/p/chromium/issues/detail?id=352073

Not sure if this is related, but I just hit an actual segmentation fault on
Mac (not running under any sanitizer) and I cannot build Chrome because of
it. This happened after applying a local patch on top of master. Master
does compile.

GYP_DEFINES='OS=mac use_goma=1 gomadir=/Users/chromium/goma disable_nacl=1
component=shared_library'

[48/107] ACTION Generating the language InfoPlist.strings files
FAILED: cd ../../chrome; export
BUILT_FRAMEWORKS_DIR=/Volumes/SSD/chromium-code/src/out/Release; export
BUILT_PRODUCTS_DIR=/Volumes/SSD/chromium-code/src/out/Release; export

CONFIGURATION=Release; export CONTENTS_FOLDER_PATH=Chromium.app/Contents;
export EXECUTABLE_NAME=Chromium; export
EXECUTABLE_PATH=Chromium.app/Contents/MacOS/Chromium; export
FULL_PRODUCT_NAME=Chromium.app; export
INFOPLIST_PATH=Chromium.app/Contents/Info.plist; export
MACH_O_TYPE=mh_execute; export PRODUCT_NAME=Chromium; export
PRODUCT_TYPE=com.apple.product-type.application; export

SDKROOT=/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX10.10.sdk;
export SRCROOT=/Volumes/SSD/chromium-code/src/out/Release/../../chrome;

export SOURCE_ROOT="${SRCROOT}"; export

TARGET_BUILD_DIR=/Volumes/SSD/chromium-code/src/out/Release; export

TEMP_DIR="${TMPDIR}"; export
UNLOCALIZED_RESOURCES_FOLDER_PATH=Chromium.app/Contents/Resources; export
WRAPPER_NAME=Chromium.app;../out/Release/infoplist_strings_tool -b
chromium_strings -v ../chrome/VERSION -g ../out/Release/gen/chrome
-o ../out/Release/obj/chrome/chrome_initial.gen/app_infoplist_strings -t
main am ar bg bn ca cs da de el en-GB en-US es-419 es et fa fi fil fr gu he
hi hr hu id it ja kn ko lt lv ml mr ms nb nl pl pt-BR pt-PT ro ru sk sl sr
sv sw ta te th tr uk vi zh-CN zh-TW

/bin/sh: line 1: 80547 Segmentation fault:
11 ../out/Release/infoplist_strings_tool -b chromium_strings

-v ../chrome/VERSION -g ../out/Release/gen/chrome
-o ../out/Release/obj/chrome/chrome_initial.gen/app_infoplist_strings -t
main am ar bg bn ca cs da de el en-GB en-US es-419 es et fa fi fil fr gu he
hi hr hu id it ja kn ko lt lv ml mr ms nb nl pl pt-BR pt-PT ro ru sk sl sr
sv sw ta te th tr uk vi zh-CN zh-TW

Reply all

Reply to author

Forward

Issue 352073 in chromium: ASan reports a false positive in infoplist_strings_tool on Mac

chro...@googlecode.com

chro...@googlecode.com

chro...@googlecode.com

chro...@googlecode.com

chro...@googlecode.com

chro...@googlecode.com

chro...@googlecode.com

chro...@googlecode.com

chro...@googlecode.com

chro...@googlecode.com