<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:SimSun;
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:SimSun;
panose-1:2 1 6 0 3 1 1 1 1 1;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
text-align:justify;
text-justify:inter-ideograph;
font-size:10.5pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
/* Page Definitions */
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 90.0pt 72.0pt 90.0pt;}
div.WordSection1
{page:WordSection1;}
-->
</style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="ZH-CN" link="blue" vlink="purple" style="text-justify-trim:punctuation">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt">In </span><span lang="EN-US" style="font-size:10.0pt">AnalysisConsumer::HandleTranslationUnit, the last statement “Mgr.reset(NULL)” would destroy the AnalysisManager which the local object BR
is using. However, when existing the same function scope, the destructor of BR would get invoked, which would then invokes BugReporter::FlushReports(). The problem is, in FlushReports, the executuation path could lead to the usage of the destroyed AnalysisManager
(actually, through its base class pointer which is type BugReportData), a dangling pointer. So bad things may happen, from access violation to dying message like “pure virtual function called”, depends on compiler. For the record, here is a callstack that
I got it hit:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt"> clang.exe!clang::ento::BugReporter::getPathDiagnosticClient() Line 301 + 0x12 bytes C++<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt"> clang.exe!clang::ento::BugReporter::FlushReport(clang::ento::BugReportEquivClass & EQ={...}) Line 1806 + 0x8 bytes C++<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt"> clang.exe!clang::ento::BugReporter::FlushReports() Line 1326 C++<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt">> clang.exe!clang::ento::BugReporter::~BugReporter() Line 1305 + 0x1f bytes C++<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt"> clang.exe!`anonymous namespace'::AnalysisConsumer::HandleTranslationUnit(clang::ASTContext & C={...}) Line 247 + 0xb bytes C++<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt"> clang.exe!clang::ParseAST(clang::Sema & S={...}, bool PrintStats=false) Line 80 + 0x18 bytes C++<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt"> clang.exe!clang::ASTFrontendAction::ExecuteAction() Line 367 + 0x1f bytes C++<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt"> clang.exe!clang::FrontendAction::Execute() Line 287 + 0xf bytes C++<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt"> clang.exe!clang::CompilerInstance::ExecuteAction(clang::FrontendAction & Act={...}) Line 563 C++<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt"> clang.exe!clang::ExecuteCompilerInvocation(clang::CompilerInstance * Clang=0x0221c2a8) Line 154 + 0x11 bytes C++<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt">I can reproduce this problem using my checker, which uses EmitBasicReport to report bugs. When my checker reports a bug, a new bug type will be added into the “BugTypes” data member of BugReporter,
so in FlushReport the dangling pointer will get hit when iterating the bug types and emit report. However, I can not reproduce it using clang’s build in checkers (the vanilla Analysis tests all passed), and it looks like when using the clang’s build in checkers
the BugTypes data member of BugReporter would always be empty, which will make the FlushReport return immediately without ever hitting the dangling pointer. A side note is my checker is working now after I removed the Mgr.reset(NULL), which seems is not necessary
if the purpose is just to get the correct diagnostics, as all reports will get flushed when the AnalysisConsumer is destroyed, I think..<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt">I notice this problem doesn’t exist when the checkers are registered using old approach (the ActionXXXChecker stuff</span><span lang="EN-US" style="font-size:10.0pt;
font-family:Wingdings">J</span><span lang="EN-US" style="font-size:10.0pt">);
it just happens after I migrating my checker to use new checker registeration scheme and updating to latest revision of AnalysisConsumer.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt">So could any one confirm is this a bug ? Or am I misused the Emit(Basic)Report functions?
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt">Thanks<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt">Michael<o:p></o:p></span></p>
</div>
</body>
</html>