<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><br><div><div>On Jun 16, 2011, at 1:27 AM, Kostya Serebryany wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">Hello again, <div><br></div><div>The tool we announced 1.5 months ago has matured quite a bit. </div><div>In addition to heap <span class="Apple-style-span" style="border-collapse: collapse; font-family: arial, sans-serif; font-size: 13px; ">out-of-bound and use-after-free bugs it also finds stack overruns/underruns. </span></div>
<div><font class="Apple-style-span" face="arial, sans-serif"><span class="Apple-style-span" style="border-collapse: collapse;"><span class="Apple-style-span" style="font-size: 13px; ">AddressSanitizer is being actively used by the Chromium developers and already found over 20 bugs: <a href="http://blog.chromium.org/2011/06/testing-chromium-addresssanitizer-fast.html">http://blog.chromium.org/2011/06/testing-chromium-addresssanitizer-fast.html</a></span><br>
</span></font></div><div><font class="Apple-style-span" face="arial, sans-serif"><span class="Apple-style-span" style="border-collapse: collapse;"><br></span></font></div><div><font class="Apple-style-span" face="arial, sans-serif"><span class="Apple-style-span" style="border-collapse: collapse;">Question to the LLVM developers: would you consider adding the </span></font><span class="Apple-style-span" style="border-collapse: collapse; font-family: arial, sans-serif; font-size: 13px; ">AddressSanitizer code to the LLVM trunk? </span></div></blockquote><div><br></div><div>Having functionality like this in mainline would be really interesting. I haven't looked at your code yet, what are the major components, what impact does it have on the codebase?</div><div><br></div><div>-Chris</div><div><br></div><br><blockquote type="cite">
<meta http-equiv="content-type" content="text/html; charset=utf-8"><div><font class="Apple-style-span" face="arial, sans-serif"><span class="Apple-style-span" style="border-collapse: collapse;"><br></span></font></div><div>
<font class="Apple-style-span" face="arial, sans-serif"><span class="Apple-style-span" style="border-collapse: collapse;">Thanks, </span></font></div><div><font class="Apple-style-span" face="arial, sans-serif"><span class="Apple-style-span" style="border-collapse: collapse;"><br>
</span></font></div><div><font class="Apple-style-span" face="arial, sans-serif"><span class="Apple-style-span" style="border-collapse: collapse;">--kcc </span></font></div><div><font class="Apple-style-span" face="arial, sans-serif"><span class="Apple-style-span" style="border-collapse: collapse;"><br>
</span></font><div class="gmail_quote">On Tue, May 3, 2011 at 10:52 PM, Kostya Serebryany <span dir="ltr"><<a href="mailto:kcc@google.com">kcc@google.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<span style="border-collapse:collapse;font-family:arial, sans-serif;font-size:13px">Hello, <div><br></div><div>We've just released the first version of our LLVM-based address sanity checker: AddressSanitizer (<a href="http://code.google.com/p/address-sanitizer/" style="color:rgb(0, 101, 204)" target="_blank">http://code.google.com/p/address-sanitizer/</a>).</div>
<div>The tool finds out-of-bound and use-after-free bugs (the subset of bugs detectable by Valgrind/Memcheck); </div><div>it consists of a LLVM compiler plugin which performs simple code instrumentation and a malloc replacement library. </div>
<div>The main advantage of the new tool is high speed: the slowdown is usually within 2x-2.5x. </div><div>Detailed description of the algorithm is found here: <a href="http://code.google.com/p/address-sanitizer/wiki/AddressSanitizerAlgorithm" style="color:rgb(0, 101, 204)" target="_blank">http://code.google.com/p/address-sanitizer/wiki/AddressSanitizerAlgorithm</a></div>
<div>The tool is young, but it already can run the Chromium browser (interactively!) and find bugs in it. </div><div><br></div><div>Would the LLVM community be interested in adopting this code into the LLVM trunk? </div>
<div>
The instrumentation pass is ~350 LOC (<a href="http://code.google.com/p/address-sanitizer/source/browse/trunk/llvm/AddressSanitizer.cpp" target="_blank">http://code.google.com/p/address-sanitizer/source/browse/trunk/llvm/AddressSanitizer.cpp</a>), but may grow over time as we add optimizations. </div>
<div>The run-time library (malloc replacement, <a href="http://code.google.com/p/address-sanitizer/source/browse/trunk/asan/asan_rtl.cc" target="_blank">http://code.google.com/p/address-sanitizer/source/browse/trunk/asan/asan_rtl.cc</a>) is ~1500 LOC. </div>
<div><br></div><div>Thanks, </div><div><br></div><div>--kcc </div></span>
</blockquote></div><br></div>
_______________________________________________<br>LLVM Developers mailing list<br><a href="mailto:LLVMdev@cs.uiuc.edu">LLVMdev@cs.uiuc.edu</a> <a href="http://llvm.cs.uiuc.edu">http://llvm.cs.uiuc.edu</a><br><a href="http://lists.cs.uiuc.edu/mailman/listinfo/llvmdev">http://lists.cs.uiuc.edu/mailman/listinfo/llvmdev</a><br></blockquote></div><br></body></html>