<div dir="ltr"><div>It looks like the root of this is that we're treating calls to `allocsize` functions as AllocLike (e.g. any allocation function type except realloc) functions, which caused us to perform invalid optimizations. For example, in <span style="font-size:12.8px">ReallocFreedPointerTest</span>, EarlyCSE DCE'd the realloc because llvm::isInstructionTriviallyDe<wbr>ad calls llvm::isAllocLikeFn, and isAllocLikeFn would return true if it saw the allocsize attribute. It really shouldn't do that.</div><div><br></div><div>r290397 should fix this behavior by making allocsize alone insufficient to consider a function an allocation function.<br></div><div><br></div><div>Thanks for your help!</div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Dec 22, 2016 at 1:10 PM, George Burgess IV <span dir="ltr"><<a href="mailto:george.burgess.iv@gmail.com" target="_blank">george.burgess.iv@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Okay, I'm seeing this failure now if I tag my system's `realloc` declaration with `alloc_size`. (Which FreeBSD seems to do in their headers). Because all that clang does with `alloc_size` is use it to answer `__builtin_object_size` queries and lower it to LLVM's `allocsize` attribute, this is presumably a latent bug in LLVM's `allocsize` attribute.<div><br></div><div>Let me mess around for a bit and see what I can dig up. :)</div><div><div class="m_4316824880072431414h5"><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Dec 22, 2016 at 11:59 AM, Dimitry Andric <span dir="ltr"><<a href="mailto:dimitry@andric.com" target="_blank">dimitry@andric.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">This is when running "ninja check-all", in a tree with llvm, clang and compiler-rt checked out. The first program that shows a failure is projects/compiler-rt/lib/asan/<wbr>tests/default/Asan-i386-inline<wbr>-Test:<br>
<br>
[==========] Running 92 tests from 3 test cases.<br>
<span>[----------] Global test environment set-up.<br>
</span>[----------] 14 tests from AddressSanitizerInterface<br>
...<br>
<span>[ RUN ] AddressSanitizer.ReallocFreedP<wbr>ointerTest<br>
/share/dim/src/llvm/trunk/proj<wbr>ects/compiler-rt/lib/asan/test<wbr>s/asan_test.cc:377: Failure<br>
Death test: ptr = realloc(ptr, 77)<br>
Result: failed to die.<br>
Error msg:<br>
[ DEATH ]<br>
</span>[ FAILED ] AddressSanitizer.ReallocFreedP<wbr>ointerTest (48 ms)<br>
<br>
A similar failure shows when running projects/compiler-rt/lib/asan/<wbr>tests/default/Asan-i386-with-c<wbr>alls-Test:<br>
<br>
[==========] Running 92 tests from 3 test cases.<br>
<span>[----------] Global test environment set-up.<br>
</span>[----------] 14 tests from AddressSanitizerInterface<br>
...<br>
<span>[ RUN ] AddressSanitizer.ReallocFreedP<wbr>ointerTest<br>
/share/dim/src/llvm/trunk/proj<wbr>ects/compiler-rt/lib/asan/test<wbr>s/asan_test.cc:377: Failure<br>
Death test: ptr = realloc(ptr, 77)<br>
Result: failed to die.<br>
Error msg:<br>
[ DEATH ]<br>
</span>[ FAILED ] AddressSanitizer.ReallocFreedP<wbr>ointerTest (55 ms)<br>
<br>
Interestingly, the Asan-i386-inline-Noinst-Test and Asan-i386-with-calls-Noinst-Te<wbr>st do not show this particular failure.<br>
<br>
The other test that fails is projects/compiler-rt/test/asan<wbr>/I386FreeBSDConfig/TestCases/P<wbr>osix/Output/free_hook_realloc.<wbr>cc.tmp, which simply returns 1 without printing any output. Debugging the program shows that it seems to be skipping completely over the realloc() call, and jumping directly to the _exit(1), but this may be due to optimization.<br>
<span class="m_4316824880072431414m_-7582739283635708581m_-4858160217797511334m_1240219273849732586HOEnZb"><font color="#888888"><br>
-Dimitry<br>
</font></span><div class="m_4316824880072431414m_-7582739283635708581m_-4858160217797511334m_1240219273849732586HOEnZb"><div class="m_4316824880072431414m_-7582739283635708581m_-4858160217797511334m_1240219273849732586h5"><br>
> On 22 Dec 2016, at 20:27, George Burgess IV <<a href="mailto:george.burgess.iv@gmail.com" target="_blank">george.burgess.iv@gmail.com</a>> wrote:<br>
><br>
> Yes, this was reapplied in r290297 with fixes for the msan issue we caught; these asan unit test failures are news to me. Can you give me the command that you're using to run these tests, please?<br>
><br>
> On Thu, Dec 22, 2016 at 11:10 AM, Dimitry Andric <<a href="mailto:dimitry@andric.com" target="_blank">dimitry@andric.com</a>> wrote:<br>
> On 20 Dec 2016, at 09:28, Chandler Carruth via cfe-commits <<a href="mailto:cfe-commits@lists.llvm.org" target="_blank">cfe-commits@lists.llvm.org</a>> wrote:<br>
> > Author: chandlerc<br>
> > Date: Tue Dec 20 02:28:19 2016<br>
> > New Revision: 290169<br>
> ><br>
> > URL: <a href="http://llvm.org/viewvc/llvm-project?rev=290169&view=rev" rel="noreferrer" target="_blank">http://llvm.org/viewvc/llvm-pr<wbr>oject?rev=290169&view=rev</a><br>
> > Log:<br>
> > Revert r290149: Add the alloc_size attribute to clang.<br>
> ><br>
> > This commit fails MSan when running test/CodeGen/object-size.c in<br>
> > a confusing way. After some discussion with George, it isn't really<br>
> > clear what is going on here. We can make the MSan failure go away by<br>
> > testing for the invalid bit, but *why* things are invalid isn't clear.<br>
> > And yet, other code in the surrounding area is doing precisely this and<br>
> > testing for invalid.<br>
> ><br>
> > George is going to take a closer look at this to better understand the<br>
> > nature of the failure and recommit it, for now backing it out to clean<br>
> > up MSan builds.<br>
><br>
> Hmm, was this reapplied later on? I'm still getting the following AddressSanitizer failures on FreeBSD, and bisecting has pointed to r290149 as the cause:<br>
><br>
> FAIL: AddressSanitizer-Unit :: Asan-i386-inline-Test/AddressS<wbr>anitizer.ReallocFreedPointerTe<wbr>st (2124 of 30204)<br>
> ******************** TEST 'AddressSanitizer-Unit :: Asan-i386-inline-Test/AddressS<wbr>anitizer.ReallocFreedPointerTe<wbr>st' FAILED ********************<br>
> Note: Google Test filter = AddressSanitizer.ReallocFreedP<wbr>ointerTest<br>
> [==========] Running 1 test from 1 test case.<br>
> [----------] Global test environment set-up.<br>
> [----------] 1 test from AddressSanitizer<br>
> [ RUN ] AddressSanitizer.ReallocFreedP<wbr>ointerTest<br>
> /share/dim/src/llvm/trunk/proj<wbr>ects/compiler-rt/lib/asan/test<wbr>s/asan_test.cc:377: Failure<br>
> Death test: ptr = realloc(ptr, 77)<br>
> Result: failed to die.<br>
> Error msg:<br>
> [ DEATH ]<br>
> [ FAILED ] AddressSanitizer.ReallocFreedP<wbr>ointerTest (30 ms)<br>
> [----------] 1 test from AddressSanitizer (30 ms total)<br>
><br>
> [----------] Global test environment tear-down<br>
> [==========] 1 test from 1 test case ran. (31 ms total)<br>
> [ PASSED ] 0 tests.<br>
> [ FAILED ] 1 test, listed below:<br>
> [ FAILED ] AddressSanitizer.ReallocFreedP<wbr>ointerTest<br>
><br>
> 1 FAILED TEST<br>
> YOU HAVE 24 DISABLED TESTS<br>
><br>
><br>
> ********************<br>
> Testing: 0 .<br>
> FAIL: AddressSanitizer-Unit :: Asan-i386-with-calls-Test/Addr<wbr>essSanitizer.ReallocFreedPoint<wbr>erTest (2233 of 30204)<br>
> ******************** TEST 'AddressSanitizer-Unit :: Asan-i386-with-calls-Test/Addr<wbr>essSanitizer.ReallocFreedPoint<wbr>erTest' FAILED ********************<br>
> Note: Google Test filter = AddressSanitizer.ReallocFreedP<wbr>ointerTest<br>
> [==========] Running 1 test from 1 test case.<br>
> [----------] Global test environment set-up.<br>
> [----------] 1 test from AddressSanitizer<br>
> [ RUN ] AddressSanitizer.ReallocFreedP<wbr>ointerTest<br>
> /share/dim/src/llvm/trunk/proj<wbr>ects/compiler-rt/lib/asan/test<wbr>s/asan_test.cc:377: Failure<br>
> Death test: ptr = realloc(ptr, 77)<br>
> Result: failed to die.<br>
> Error msg:<br>
> [ DEATH ]<br>
> [ FAILED ] AddressSanitizer.ReallocFreedP<wbr>ointerTest (24 ms)<br>
> [----------] 1 test from AddressSanitizer (24 ms total)<br>
><br>
> [----------] Global test environment tear-down<br>
> [==========] 1 test from 1 test case ran. (25 ms total)<br>
> [ PASSED ] 0 tests.<br>
> [ FAILED ] 1 test, listed below:<br>
> [ FAILED ] AddressSanitizer.ReallocFreedP<wbr>ointerTest<br>
><br>
> 1 FAILED TEST<br>
> YOU HAVE 24 DISABLED TESTS<br>
><br>
><br>
> ********************<br>
> Testing: 0 .<br>
> FAIL: AddressSanitizer-i386-freebsd :: TestCases/Posix/free_hook_real<wbr>loc.cc (2399 of 30204)<br>
> ******************** TEST 'AddressSanitizer-i386-freebsd :: TestCases/Posix/free_hook_real<wbr>loc.cc' FAILED ********************<br>
> Script:<br>
> --<br>
> /home/dim/obj/llvm-290338-trun<wbr>k-freebsd12-i386-ninja-rel-1/.<wbr>/bin/clang --driver-mode=g++ -fsanitize=address -mno-omit-leaf-frame-pointer -fno-omit-frame-pointer -fno-optimize-sibling-calls -gline-tables-only -m32 -O2 /share/dim/src/llvm/trunk/proj<wbr>ects/compiler-rt/test/asan/Tes<wbr>tCases/Posix/free_hook_realloc<wbr>.cc -o /home/dim/obj/llvm-290338-trun<wbr>k-freebsd12-i386-ninja-rel-1/p<wbr>rojects/compiler-rt/test/asan/<wbr>I386FreeBSDConfig/TestCases/Po<wbr>six/Output/free_hook_realloc.c<wbr>c.tmp<br>
> /home/dim/obj/llvm-290338-trun<wbr>k-freebsd12-i386-ninja-rel-1/p<wbr>rojects/compiler-rt/test/asan/<wbr>I386FreeBSDConfig/TestCases/Po<wbr>six/Output/free_hook_realloc.c<wbr>c.tmp 2>&1 | FileCheck /share/dim/src/llvm/trunk/proj<wbr>ects/compiler-rt/test/asan/Tes<wbr>tCases/Posix/free_hook_realloc<wbr>.cc<br>
> --<br>
> Exit Code: 2<br>
><br>
> Command Output (stderr):<br>
> --<br>
> FileCheck error: '-' is empty.<br>
> FileCheck command line: FileCheck /share/dim/src/llvm/trunk/proj<wbr>ects/compiler-rt/test/asan/Tes<wbr>tCases/Posix/free_hook_realloc<wbr>.cc<br>
><br>
> --<br>
><br>
> ********************<br>
> Testing: 0 .. 10.. 20.. 30.. 40.. 50.. 60.. 70.. 80.. 90..<br>
> Testing Time: 880.55s<br>
> ********************<br>
> Failing Tests (3):<br>
> AddressSanitizer-Unit :: Asan-i386-inline-Test/AddressS<wbr>anitizer.ReallocFreedPointerTe<wbr>st<br>
> AddressSanitizer-Unit :: Asan-i386-with-calls-Test/Addr<wbr>essSanitizer.ReallocFreedPoint<wbr>erTest<br>
> AddressSanitizer-i386-freebsd :: TestCases/Posix/free_hook_real<wbr>loc.cc<br>
><br>
> Expected Passes : 26881<br>
> Expected Failures : 144<br>
> Unsupported Tests : 3176<br>
> Unexpected Failures: 3<br>
><br>
> 1 warning(s) in tests.<br>
><br>
> -Dimitry<br>
><br>
><br>
<br>
</div></div></blockquote></div><br></div></div></div></div>
</blockquote></div><br></div></div>