New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 686829 link

Starred by 5 users

Issue metadata

Status: Archived
Owner:
Closed: Jun 2017
Cc:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 3
Type: Bug



Sign in to add a comment

Clang static analyzer false positive tracking bug

Project Member Reported by kmarshall@chromium.org, Jan 30 2017

Issue description

Link any bugs or CLs resulting from Clang false positives (spurious errors) to this bug so that we can investigate and fix them.
 
At a minimum, please provide:

* the file in question;
* the platform you are building on and GN label you built;
* the analysis output text;
* a brief explanation as to why the analysis is incorrect.

Thanks
Building anything with gtest/gmock generates a massive amount of log spam, a la:

In file included from ../../media/filters/source_buffer_state_unittest.cc:12:
In file included from ../../media/base/gmock_callback_support.h:8:
In file included from ../../testing/gmock/include/gmock/gmock.h:61:
In file included from ../../testing/gmock/include/gmock/gmock-generated-function-mockers.h:43:
../../testing/gmock/include/gmock/gmock-spec-builders.h:1272:5: warning: Use of memory after it is freed
    return function_mocker_->AddNewExpectation(

This snowballs into a bunch of other issues. You can see this by building media_unittests (or even just base_unittests) on ToT Linux.
Usage detail - to use clang static analyzer put use_clang_static_analyzer = true in your gn args.

Is there an FYI builder? That would make it simpler to check for interesting results.

The VC++ /analyze builder ( crbug.com/427616 ) just found a bug. The CL to fix it is here:

https://codereview.chromium.org/2664253003/

I'd be interested in knowing whether clang's static analyzer also finds it, but I'm not quite energetic enough to spin up my Linux VM to find out.

False positive "Use of memory after it is freed" error for refptrs.

The analyzer doesn't understand ref counted pointer semantics. When a refptr is nulled out, it explores *both* conditional paths of ==0 references and >0 references.

Refptrs should probably be immune to use-after-free checks as A) they solve that problem at runtime already, and B) their inherent nondeterminism makes it impossible to verify at compile time.


Example:
[9182/12054] CXX obj/content/renderer/renderer/video_encoder_shim.o
../../content/renderer/pepper/video_encoder_shim.cc:285:5: warning: Use of memory after it is freed
    renderer_task_runner_->ReleaseSoon(FROM_HERE, raw_frame);
    ^
../../content/renderer/pepper/video_encoder_shim.cc:268:3: note: Taking false branch
  if (config_.rc_target_bitrate == bitrate_kbit)
  ^
../../content/renderer/pepper/video_encoder_shim.cc:272:7: note: Assuming the condition is true
  if (vpx_codec_enc_config_set(&encoder_, &config_) != VPX_CODEC_OK)
      ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
../../content/renderer/pepper/video_encoder_shim.cc:272:3: note: Taking true branch
  if (vpx_codec_enc_config_set(&encoder_, &config_) != VPX_CODEC_OK)
  ^
../../content/renderer/pepper/video_encoder_shim.cc:273:5: note: Calling 'EncoderImpl::NotifyError'
    NotifyError(media::VideoEncodeAccelerator::kPlatformFailureError);
    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
../../content/renderer/pepper/video_encoder_shim.cc:359:3: note: Calling 'EncoderImpl::Stop'
  Stop();
  ^~~~~~
../../content/renderer/pepper/video_encoder_shim.cc:278:10: note: Assuming the condition is true
  while (!frames_.empty()) {
         ^~~~~~~~~~~~~~~~
../../content/renderer/pepper/video_encoder_shim.cc:278:3: note: Loop condition is true.  Entering loop body
  while (!frames_.empty()) {
  ^
../../content/renderer/pepper/video_encoder_shim.cc:284:5: note: Calling 'scoped_refptr::operator='
    frame.frame = nullptr;
    ^~~~~~~~~~~~~~~~~~~~~
../../base/memory/ref_counted.h:328:5: note: Taking false branch
    if (p)
    ^

Cc: thakis@chromium.org
Cc: mbjorge@chromium.org
Status: Archived (was: Assigned)
Closing this bug in favor of simply filing individual bugs as issues are encountered. 

Filed crbug.com/731917 for the refptr issue.

Sign in to add a comment