WinASan reports OOB read in WidgetTest.WindowMouseModalityTest, looks like clang bug |
|||
Issue description
[ RUN ] WidgetTest.WindowMouseModalityTest
=================================================================
==1776==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x07e0ce30 at pc 0x025e039e bp 0xdeadbeef sp 0x0021de20
READ of size 4 at 0x07e0ce30 thread T0
...
#0 0x25e039d in views::ImageView::GetHorizontalAlignment C:\c\CrWinAsan\src\uiiews\controls\image_view.cc:176
#1 0x24cd4bc in views::DialogDelegate::GetDialogWidgetInitParams C:\c\CrWinAsan\src\uiiews\window\dialog_delegate.cc:86
#2 0x24cd263 in views::DialogDelegate::CreateDialogWidget C:\c\CrWinAsan\src\uiiews\window\dialog_delegate.cc:43
#3 0x155bfa0 in views::test::WidgetTest_WindowMouseModalityTest_Test::TestBody+0xa0a (e:\swarm_slave\w\irt2ubhf\out\Releaseiews_unittests.exe+0xa0bfa0)
...
0x07e0ce30 is located 0 bytes to the right of 240-byte region [0x07e0cd40,0x07e0ce30)
allocated by thread T0 here:
#0 0x42f1b08 in malloc c:\c\crwinasan\src hird_party\llvm\projects\compiler-rt\libsansan_malloc_win.cc:65
#1 0x430d3c5 in operator new f:\ddctools\crtcstartup\src\heap\new_scalar.cpp:19
#2 0x155beb1 in views::test::WidgetTest_WindowMouseModalityTest_Test::TestBody C:\c\CrWinAsan\src\uiiews\widget\desktop_aura\desktop_native_widget_aura_unittest.cc:562
#3 0x22cf67f in testing::internal::HandleExceptionsInMethodIfSupported<testing::Test,void> C:\c\CrWinAsan\src\testing\gtest\src\gtest.cc:2458
#4 0x22cf267 in testing::Test::Run C:\c\CrWinAsan\src\testing\gtest\src\gtest.cc:2474
...
I think this is a clang bug because dialog_delegate.cc:86 is calling DialogDelegate::GetModalType(), not ImageView::GetHorizontalAlignment().
,
Aug 5 2016
It's not a clang bug, it's an ODR violation. There are two implementations of ModalDialogDelegate in two different tests, and the ASan build is picking up the wrong one I guess: https://cs.chromium.org/chromium/src/ui/views/widget/widget_unittest.cc?rcl=0&l=3640 https://cs.chromium.org/chromium/src/ui/views/widget/desktop_aura/desktop_native_widget_aura_unittest.cc?rcl=0&l=513
,
Aug 5 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/3716c0f10365f0f7c1dd225ebc95a5c6aff419f4 commit 3716c0f10365f0f7c1dd225ebc95a5c6aff419f4 Author: rnk <rnk@chromium.org> Date: Fri Aug 05 18:04:57 2016 Fix an ODR violation for ModalDialogDelegate found by ASan Move these classes into anonymous namespaces so the names of their vtables and virtual methods don't collide at link time. R=thakis@chromium.org BUG= 634960 Review-Url: https://codereview.chromium.org/2217233002 Cr-Commit-Position: refs/heads/master@{#410109} [modify] https://crrev.com/3716c0f10365f0f7c1dd225ebc95a5c6aff419f4/ui/views/widget/desktop_aura/desktop_native_widget_aura_unittest.cc [modify] https://crrev.com/3716c0f10365f0f7c1dd225ebc95a5c6aff419f4/ui/views/widget/widget_unittest.cc
,
Aug 8 2016
,
Aug 10 2016
Fixed, views_unittests is green here: https://build.chromium.org/p/chromium.fyi/builders/CrWinAsan%20tester/builds/1147 |
|||
►
Sign in to add a comment |
|||
Comment 1 by r...@chromium.org
, Aug 5 2016