Clang static analyzer false positive tracking bug |
||||
Issue descriptionLink any bugs or CLs resulting from Clang false positives (spurious errors) to this bug so that we can investigate and fix them.
,
Jan 30 2017
Building anything with gtest/gmock generates a massive amount of log spam, a la:
In file included from ../../media/filters/source_buffer_state_unittest.cc:12:
In file included from ../../media/base/gmock_callback_support.h:8:
In file included from ../../testing/gmock/include/gmock/gmock.h:61:
In file included from ../../testing/gmock/include/gmock/gmock-generated-function-mockers.h:43:
../../testing/gmock/include/gmock/gmock-spec-builders.h:1272:5: warning: Use of memory after it is freed
return function_mocker_->AddNewExpectation(
This snowballs into a bunch of other issues. You can see this by building media_unittests (or even just base_unittests) on ToT Linux.
,
Jan 31 2017
Usage detail - to use clang static analyzer put use_clang_static_analyzer = true in your gn args. Is there an FYI builder? That would make it simpler to check for interesting results. The VC++ /analyze builder ( crbug.com/427616 ) just found a bug. The CL to fix it is here: https://codereview.chromium.org/2664253003/ I'd be interested in knowing whether clang's static analyzer also finds it, but I'm not quite energetic enough to spin up my Linux VM to find out.
,
Feb 2 2017
False positive "Use of memory after it is freed" error for refptrs.
The analyzer doesn't understand ref counted pointer semantics. When a refptr is nulled out, it explores *both* conditional paths of ==0 references and >0 references.
Refptrs should probably be immune to use-after-free checks as A) they solve that problem at runtime already, and B) their inherent nondeterminism makes it impossible to verify at compile time.
Example:
[9182/12054] CXX obj/content/renderer/renderer/video_encoder_shim.o
../../content/renderer/pepper/video_encoder_shim.cc:285:5: warning: Use of memory after it is freed
renderer_task_runner_->ReleaseSoon(FROM_HERE, raw_frame);
^
../../content/renderer/pepper/video_encoder_shim.cc:268:3: note: Taking false branch
if (config_.rc_target_bitrate == bitrate_kbit)
^
../../content/renderer/pepper/video_encoder_shim.cc:272:7: note: Assuming the condition is true
if (vpx_codec_enc_config_set(&encoder_, &config_) != VPX_CODEC_OK)
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
../../content/renderer/pepper/video_encoder_shim.cc:272:3: note: Taking true branch
if (vpx_codec_enc_config_set(&encoder_, &config_) != VPX_CODEC_OK)
^
../../content/renderer/pepper/video_encoder_shim.cc:273:5: note: Calling 'EncoderImpl::NotifyError'
NotifyError(media::VideoEncodeAccelerator::kPlatformFailureError);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
../../content/renderer/pepper/video_encoder_shim.cc:359:3: note: Calling 'EncoderImpl::Stop'
Stop();
^~~~~~
../../content/renderer/pepper/video_encoder_shim.cc:278:10: note: Assuming the condition is true
while (!frames_.empty()) {
^~~~~~~~~~~~~~~~
../../content/renderer/pepper/video_encoder_shim.cc:278:3: note: Loop condition is true. Entering loop body
while (!frames_.empty()) {
^
../../content/renderer/pepper/video_encoder_shim.cc:284:5: note: Calling 'scoped_refptr::operator='
frame.frame = nullptr;
^~~~~~~~~~~~~~~~~~~~~
../../base/memory/ref_counted.h:328:5: note: Taking false branch
if (p)
^
,
Feb 2 2017
,
Feb 2 2017
,
Jun 9 2017
Closing this bug in favor of simply filing individual bugs as issues are encountered. Filed crbug.com/731917 for the refptr issue. |
||||
►
Sign in to add a comment |
||||
Comment 1 by kmarshall@chromium.org
, Jan 30 2017