<table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Issue</th>
<td>
<a href=https://github.com/llvm/llvm-project/issues/62593>62593</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>
AddressSanitizer: use-after-poison when calling clang::CompilerInstance::createPreprocessor()
</td>
</tr>
<tr>
<th>Labels</th>
<td>
new issue
</td>
</tr>
<tr>
<th>Assignees</th>
<td>
</td>
</tr>
<tr>
<th>Reporter</th>
<td>
jerry-tom
</td>
</tr>
</table>
<pre>
we are experiencing a AddressSanitizer: use-after-poison error w/ stack trace:
```
==83195==ERROR: AddressSanitizer: use-after-poison on address 0x000106201590 at pc 0x000100e58f34 bp 0x00016eff9bf0 sp 0x00016eff9be8
READ of size 8 at 0x000106201590 thread T0
#0 0x100e58f30 in clang::IdentifierInfo::isOutOfDate() const IdentifierTable.h:415
#1 0x100e58890 in clang::Preprocessor::MacroState::getModuleInfo(clang::Preprocessor&, clang::IdentifierInfo const*) const Preprocessor.h:830
#2 0x10147fb5c in clang::Preprocessor::appendMacroDirective(clang::IdentifierInfo*, clang::MacroDirective*)+0xf4 (bkcheck_front:arm64+0x10067bb5c) (BuildId: 36c9bb3c2a7e30c49ec25b82b5646e6a32000000200000000100000000000d00)
#3 0x101481b34 in clang::Preprocessor::RegisterBuiltinMacros()+0x64 (bkcheck_front:arm64+0x10067db34) (BuildId: 36c9bb3c2a7e30c49ec25b82b5646e6a32000000200000000100000000000d00)
#4 0x10149beac in clang::Preprocessor::Preprocessor(std::__1::shared_ptr<clang::PreprocessorOptions>, clang::DiagnosticsEngine&, clang::LangOptions&, clang::SourceManager&, clang::HeaderSearch&, clang::ModuleLoader&, clang::IdentifierInfoLookup*, bool, clang::TranslationUnitKind)+0x534 (bkcheck_front:arm64+0x100697eac) (BuildId: 36c9bb3c2a7e30c49ec25b82b5646e6a32000000200000000100000000000d00)
#5 0x101d589b0 in clang::CompilerInstance::createPreprocessor(clang::TranslationUnitKind)+0x160 (bkcheck_front:arm64+0x100f549b0) (BuildId: 36c9bb3c2a7e30c49ec25b82b5646e6a32000000200000000100000000000d00)
#6 0x100e0f1a4 in PreProcess::Init() preprocess.cpp:416
#7 0x100e0ec10 in PreProcess::PreProcess() preprocess.cpp:39
#8 0x100e0f5a4 in PreProcess::PreProcess() preprocess.cpp:38
#9 0x100eae7e4 in CheckFront::CheckFront() checkfront.cpp:7
#10 0x100eae89c in CheckFront::CheckFront() checkfront.cpp:6
#11 0x100e09430 in main bkcheck_front.cpp:116
#12 0x18845bf24 (<unknown module>)
0x000106201590 is located 144 bytes inside of 4096-byte region [0x000106201500,0x000106202500)
allocated by thread T0 here:
#0 0x10318b5cc in wrap_posix_memalign+0xa4 (libclang_rt.asan_osx_dynamic.dylib:arm64e+0x435cc) (BuildId: f0a7ac5c49bc3abc851181b6f92b308a32000000200000000100000000000b00)
#1 0x18876ea18 in operator new(unsigned long, std::align_val_t)+0x38 (libc++abi.dylib:arm64e+0x17a18) (BuildId: fa1e66a848dd3435a00e4fcd9bf5de6932000000200000000100000000030d00)
#2 0x100e5a7a0 in llvm::MallocAllocator::Allocate(unsigned long, unsigned long) AllocatorBase.h:86
#3 0x100e5af68 in llvm::BumpPtrAllocatorImpl<llvm::MallocAllocator, 4096ul, 4096ul, 128ul>::StartNewSlab() Allocator.h:339
#4 0x100e5a154 in llvm::BumpPtrAllocatorImpl<llvm::MallocAllocator, 4096ul, 4096ul, 128ul>::Allocate(unsigned long, llvm::Align) Allocator.h:195
#5 0x1014a2778 in std::__1::pair<llvm::StringMapIterator<clang::IdentifierInfo*>, bool> llvm::StringMap<clang::IdentifierInfo*, llvm::BumpPtrAllocatorImpl<llvm::MallocAllocator, 4096ul, 4096ul, 128ul>>::try_emplace<std::nullptr_t>(llvm::StringRef, std::nullptr_t&&)+0x78 (bkcheck_front:arm64+0x10069e778) (BuildId: 36c9bb3c2a7e30c49ec25b82b5646e6a32000000200000000100000000000d00)
#6 0x1014a25c8 in clang::IdentifierTable::get(llvm::StringRef)+0x28 (bkcheck_front:arm64+0x10069e5c8) (BuildId: 36c9bb3c2a7e30c49ec25b82b5646e6a32000000200000000100000000000d00)
#7 0x10149bd40 in clang::Preprocessor::Preprocessor(std::__1::shared_ptr<clang::PreprocessorOptions>, clang::DiagnosticsEngine&, clang::LangOptions&, clang::SourceManager&, clang::HeaderSearch&, clang::ModuleLoader&, clang::IdentifierInfoLookup*, bool, clang::TranslationUnitKind)+0x3c8 (bkcheck_front:arm64+0x100697d40) (BuildId: 36c9bb3c2a7e30c49ec25b82b5646e6a32000000200000000100000000000d00)
#8 0x101d589b0 in clang::CompilerInstance::createPreprocessor(clang::TranslationUnitKind)+0x160 (bkcheck_front:arm64+0x100f549b0) (BuildId: 36c9bb3c2a7e30c49ec25b82b5646e6a32000000200000000100000000000d00)
#9 0x100e0f1a4 in PreProcess::Init() preprocess.cpp:416
#10 0x100e0ec10 in PreProcess::PreProcess() preprocess.cpp:39
#11 0x100e0f5a4 in PreProcess::PreProcess() preprocess.cpp:38
#12 0x100eae7e4 in CheckFront::CheckFront() checkfront.cpp:7
#13 0x100eae89c in CheckFront::CheckFront() checkfront.cpp:6
#14 0x100e09430 in main bkcheck_front.cpp:116
#15 0x18845bf24 (<unknown module>)
SUMMARY: AddressSanitizer: use-after-poison IdentifierTable.h:415 in clang::IdentifierInfo::isOutOfDate() const
Shadow bytes around the buggy address:
0x007020c60260: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x007020c60270: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x007020c60280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x007020c60290: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x007020c602a0: 00 00 00 04 f7 f7 f7 00 00 00 03 f7 f7 f7 00 00
=>0x007020c602b0: 00 01[f7]f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x007020c602c0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x007020c602d0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x007020c602e0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x007020c602f0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x007020c60300: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==83195==ABORTING
```
the code :
```c++
m_compilerInst.createDiagnostics(nullptr, false);
m_compilerInst.getTargetOpts().Triple = llvm::sys::getDefaultTargetTriple();
clang::TargetInfo* pTargetInfo = clang::TargetInfo::CreateTargetInfo(m_compilerInst.getDiagnostics(), m_compilerInst.getInvocation().TargetOpts);
m_compilerInst.setTarget(pTargetInfo);
m_compilerInst.createFileManager();
m_compilerInst.createSourceManager(m_compilerInst.getFileManager());
m_compilerInst.createPreprocessor(clang::TU_Complete);
m_compilerInst.getDiagnosticClient().BeginSourceFile(m_compilerInst.getLangOpts(), &m_compilerInst.getPreprocessor());
```
llvm: 16.0.3
OS: Darwin Kernel Version 22.4.0
Compiler: clang version 14.0.3
</pre>
<img width="1px" height="1px" alt="" src="http://email.email.llvm.org/o/eJzsWtty46jWfhrlhmoXAh3QRS4cuzOTmu5JV5L5q_4rF0JLMhMZVAjnME-_C3TwOcnOdvfN3i5VbKHFx1qsAx8ovG1lpQAug_gqiOcXfG2X2lz-Dca8frF6dZHr4vXyGRA3gOClASNBCakqxBGaFoWBtr3nSlr5D5iATtG6hS-8tGC-NFq2WiEwRhv0HJBr1FouHpE1XEBApwGeB3gaJLi_uls6D-ic0TCLu59f7-5u7xzwhwbTCvFODuEXjHGIE4LDOMOIW9SIoRFDzEoaobzpWxIoyywvMWp3W4B1at19nc6RLlEr_wHEHNgevF0a4AV66M1ACKGAUIzwyzAaRlIhUXNVOdvp9KYAZWUpwdyoUndtsr1d29tyzi0EhAUkQ0Kr1qKN7APPa5gsAzqNwnhnrHAci2X7Y_0w0BgtoG216Vq-c2H0vXUD-fsK7HddrGvwyhB2qjNJAjI7bUanb0CmG923u3vFGd2dJOIVD6O0zGPxruK8aUAVXv25NCCsfIJdffcm1umyo_F-X6drQK7wSxmhgLD8USxBPC5Ko5V1A5pVEvnnIcZJmuexcMYFhF2tZV3cFC4QaSKyPKeC8BQoFlEGgsQ5I3mcRAkknBLsP_2Xj8HxU2DsVNieE9rPCQtzGr07J3dQydaCcQpZqbyBbRdAXvHkI4YVOY1-vmFRb1iWA3_f2buhx1pbdO2LRdj9aJfcQLForAno7ATUbWOlVm1Av-4FwlzySunWStF-VZVUcBjd37iqhv4HD-_12gj4zhWv4Ehm_A68AHMP3Ijl4dMu275pJ_NeVn3T-nHd9JGca13vST8YrtqaOzX_UtL-IVUxuD6mH_B9lgL_BUEdd74vYpbl-xVqpleNrJ25reVK9FVJGOAW9qLgY4aHCX7X8DKOshz_fMOTvjTjMuQ-m38Y-NFZ1LtbSdsX_GY0diKaxtf5ZAcsHcBAhPgY2Nb9CUi6qx4b1YuPq_cBRLaDmPWIHFLwiDPnhOveB87dm_t-nXMN3kk9Yrq7uOERkWXic4i70xgO6yXOom5tXnGp0E689B3DPQ-EfsViLIrzkkSuiQV0tlaPSj8rtPKJ7atNP83d3z3CIFtUa8EtFCiMIpS_WmiRVK0swBGNCGfJF9eIDFRSKxTEV9sILshmmwYSb0Udrwfk_HVDTNASzIZ2bdgJDVkeCz-nz4Y3i0a38mWxghWvZaV8qnBfQ2qZ-9RbGDvhLVcL3b4silfFV1JMitda5kN-ge8V0VgcqSol5ikXsYiyXFCeCxaHIQvzpMxITjF7O7nyw-QKO2ekCfCQOSt0A4ZbbZCC54CwtfIMt0C1VpUrnOMq4g1cPPF6YYeqQdlgaUCuAnLFc3nMtDDlITtiGg8hSTiLWFHQiMYcY4hKUWR5GReQZG-YRo_VDTJQOp5yH6J1_bQaSIxz8rTz9LBc9rdwzOq9hgyNfa942zFKlhzhIG70MmG7o1-tV80Pa0aIm1VTB3R2Wj0y8xG9rnd_hYSta5cq3XpqubF_wvN9zfM-iUcEryClx8iE0zCMo1-h4VsTvIGedomzr73b0hxZDiNO0tTP7yG9abg0O1rfWyNV9Z03N7YL8l3ac0h9O9LjOQP9io4AvQewY9n5Z7WfWGteF7Bqar8znI0TodZ13VizsN4Otq_-HZQ7Cb0Rd4QqGZI6ZR-gQJCmRzL65zAB5_NYsJMbQr_JG_dlpwzvjCMfMi4Wv8C4dOT2RfT-DvR_3P4_5fZUfMT3aRH9AorL_lu5fXZObj_S3POR-w3PPRu7D8nZ6T09O72PPk_v48_Q-_u_vn-f3v3_h08qTxzpff6QsFdjyQv93G8nuNFrVSC7BJSvq-p1OBvd7AL8MWaKCRYJJgnuSOy_dR0DSs8FxM4FlJ0LiHsgjIcrQmXaX5tGute4dbT9dRssH8HCIL4q0yCejx3fvHrNtrFEZ-GHur-FU5wJB86EU54Hh-LP42zlFKqhAlW4mqAVoHbriSua0IKyLWKIN00thV-8ulx01WLMur5A9CwPbT54PBn_wY2VvK7HnB2EcYgwcSGGI4RjhBOEx1r6O_AG1VBaZKD4R6st9E00XxuAAi2daHe0sCVU9EL3_kXNUaQyHIA6oZUsjoxGdoWMrJYHUCXdFfLlERmwa7PRqYx3hdYt9IKt0I3HKsfV6bda57w-VMfhZHtCUkmLtCm68twLDQvBD1-juwOUdbstsgkuNNPKcqnAIP0Epqz180ZrMQhNjeGvSGj9KPd8jfgodKOs4Ujnf4PYn6U8H5HuuUJSWTCK195uGB59c47qTn32jRej3--8Dw6lRH7izdv06vbu4ebP3_be06Hu3i0qQheADt_k9Wcn_cCrhdjif5OO9m3R84Cwft_mmG_J6xZ8spzoX4F94KYCe9vYnrBMHoxsaqfJfGuv2r624xZqDiVf133HTrp_PTIO4-Zqi3x6yX4PjJrNrR_kuGDHU7x5293ZoQG71ntWOzti54160l0NGezcMvz0DLXDDAWENduanO7SOeVa1psdD3tffm-PdMTQQ8R3Qd_YEPy1cDuJGux7AbKZ31ktYaCMkyuopOqUdood1bjfFG75JSDJodielnuW7edK97cPTRQmEzzpa9_tvWuZc_MsFfoDjIIa_R-Y1q0bhEyiSb8gDFson7BuStBTLxVGDu2iuKRFRjN-AZdhwmiUpJjhi-VlJEoacZFnSSlIlJY4y5jAPAlJkscswxfykmBCcYzTkEZRhCcQsZSHEU2LOIwiioMIw4rLeuL0n2hTXci2XcNlQuKMXtQ8h7r1_z1AiIJn5B8GhATx_MJcuj5f8nXVBhGuZWvbDYqVtobLD3Hl5yUoJHhdS1V9cmMZkOxiberLpbWNrwvkOiDXlbTLdT4RehWQa--f7utLY7QrxgG59va0Abn29v4rAAD__-jWusc">