[libcxx-commits] [libcxx] [libc++] Fix vector sanitization annotations on destruction (PR #121031)

Dominic Chen via libcxx-commits libcxx-commits at lists.llvm.org
Mon Dec 23 22:13:01 PST 2024


https://github.com/ddcc created https://github.com/llvm/llvm-project/pull/121031

In D144155/D136765, the asan annotations for std::vector were modified to unpoison freed backing memory on destruction, instead of leaving it poisoned. However, calling `__clear()` instead of `clear()` skips informing the asan runtime of this decrease in the accessible container size, which breaks the invariant that the value of `old_mid` should match the value of `new_mid` from the previous call to _sanitizer_annotate_contiguous_container(), which can trip the sanity checks for the partial poison between [d1, d2) and the container redzone between [d2, c), if enabled. To fix this, ensure that `clear()` is called instead, as is already done by `__vdeallocate()`.

>From f92677ddd35178bb61f3c8f7e5d0f7ea48900b59 Mon Sep 17 00:00:00 2001
From: Dominic Chen <ddchen at apple.com>
Date: Mon, 23 Dec 2024 21:50:55 -0800
Subject: [PATCH] [libc++] Fix vector sanitization annotations on destruction

In D144155/D136765, the asan annotations for std::vector were modified to unpoison freed backing memory on destruction, instead of leaving it
poisoned. However, calling `__clear()` instead of `clear()` skips informing the asan runtime of this decrease in the accessible container size, which
breaks the invariant that the value of `old_mid` should match the value of `new_mid` from the previous call to _sanitizer_annotate_contiguous_container(),
which can trip the sanity checks for the partial poison between [d1, d2) and the container redzone between [d2, c), if enabled. To fix this, ensure that
`clear()` is called instead, as is already done by `__vdeallocate()`.
---
 libcxx/include/__vector/vector.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/libcxx/include/__vector/vector.h b/libcxx/include/__vector/vector.h
index 6ba7ba7bcf724b..fe87e825ce6d04 100644
--- a/libcxx/include/__vector/vector.h
+++ b/libcxx/include/__vector/vector.h
@@ -241,7 +241,7 @@ class _LIBCPP_TEMPLATE_VIS vector {
 
     _LIBCPP_CONSTEXPR_SINCE_CXX20 _LIBCPP_HIDE_FROM_ABI void operator()() {
       if (__vec_.__begin_ != nullptr) {
-        __vec_.__clear();
+        __vec_.clear();
         __vec_.__annotate_delete();
         __alloc_traits::deallocate(__vec_.__alloc_, __vec_.__begin_, __vec_.capacity());
       }
@@ -759,7 +759,7 @@ class _LIBCPP_TEMPLATE_VIS vector {
 
   _LIBCPP_CONSTEXPR_SINCE_CXX20 _LIBCPP_HIDE_FROM_ABI void __copy_assign_alloc(const vector& __c, true_type) {
     if (this->__alloc_ != __c.__alloc_) {
-      __clear();
+      clear();
       __annotate_delete();
       __alloc_traits::deallocate(this->__alloc_, this->__begin_, capacity());
       this->__begin_ = this->__end_ = this->__cap_ = nullptr;



More information about the libcxx-commits mailing list