CFI: invalid cast in HeapCompact.cpp |
||
Issue descriptionChrome Version: tip OS: Linux x86-64 What steps will reproduce the problem? (1) Build browser_tests with Control Flow Integrity (CFI) enabled: $ GYP_DEFINES='buildtype=Official' gclient sync $ gn gen out/cfi-diag '--args=is_debug=false is_cfi=true use_cfi_diag=true use_cfi_cast=true symbol_level=1 dcheck_always_on=true' --check $ ninja -C out/cfi-diag browser_tests See more details at https://www.chromium.org/developers/testing/control-flow-integrity (2) Run WebstoreInlineInstallerTest.ReinstallDisabledExtension test case: $ ./out/cfi-diag-tot/browser_tests --gtest_filter=WebstoreInlineInstallerTest.ReinstallDisabledExtension Observe the following error report: ../../third_party/WebKit/Source/platform/heap/HeapCompact.cpp:86:26: runtime error: control flow integrity check for type 'blink::BasePage' failed during cast to unrelated type (vtable address 0xdd0fecaefbeadde) 0xdd0fecaefbeadde: note: invalid vtable <memory cannot be printed> Most likely, a non-initialized memory region is being cast. This breaks 'CFI Linux Full' and 'CFI Linux ToT' bots: https://build.chromium.org/p/chromium.fyi/builders/CFI%20Linux%20Full/builds/1325 https://build.chromium.org/p/chromium.fyi/builders/CFI%20Linux%20ToT/builds/5677
,
Feb 3 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/4116d5e5f6fd92ae9f75cc2bfe158068232c6dbe commit 4116d5e5f6fd92ae9f75cc2bfe158068232c6dbe Author: krasin <krasin@chromium.org> Date: Fri Feb 03 04:06:38 2017 HeapCompact: don't cast to BasePage before sanity check. Otherwise, the cast might be performed on a garbage memory and CFI will detect that the cast is invalid as the vtable is invalid. BUG= 688055 Review-Url: https://codereview.chromium.org/2673683002 Cr-Commit-Position: refs/heads/master@{#447922} [modify] https://crrev.com/4116d5e5f6fd92ae9f75cc2bfe158068232c6dbe/third_party/WebKit/Source/platform/heap/HeapCompact.cpp
,
Feb 3 2017
|
||
►
Sign in to add a comment |
||
Comment 1 by krasin@chromium.org
, Feb 2 2017