New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 717228 link

Starred by 1 user

Issue metadata

Status: Archived
Owner:
Closed: May 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Chrome
Pri: 1
Type: Bug



Sign in to add a comment

amd64-generic-asan libweave fails unittests: stack-use-after-scope error

Project Member Reported by vapier@chromium.org, May 1 2017

Issue description

the first build seeing this failure:
https://uberchromegw.corp.google.com/i/chromiumos/builders/amd64-generic-asan/builds/19589/
https://uberchromegw.corp.google.com/i/chromiumos/builders/amd64-generic-asan/builds/19589/steps/UnitTest/logs/stdio

unfortunately, earlier builds were failing due to a build issue, so it's not clear when this bug started.

since libweave wasn't failing before, i'm going to guess one of the recent CLs caused this:
https://weave-review.googlesource.com/9930
https://weave-review.googlesource.com/9950

ASAN error detected:
=================================================================
==17==ERROR: AddressSanitizer: stack-use-after-scope on address 0x7ffe46172400 at pc 0x7f18125b32ce bp 0x7ffe46170910 sp 0x7ffe46170908
READ of size 8 at 0x7ffe46172400 thread T0
    #0 0x7f18125b32cd in weave::WeaveWiFiSetupTest_OfflineLongTimeWithNoSsid_Test::TestBody()::$_5::operator()() const /build/amd64-generic/var/cache/portage/chromeos-base/libweave/out/Default/../../../../../../../tmp/portage/chromeos-base/libweave-0.0.1-r250/work/libweave-0.0.1/weave/libweave/src/weave_unittest.cc:483:11
    #1 0x7f18125b32cd in void testing::internal::InvokeWithoutArgsAction<weave::WeaveWiFiSetupTest_OfflineLongTimeWithNoSsid_Test::TestBody()::$_5>::Perform<void, std::tuple<std::string const&> >(std::tuple<std::string const&> const&) /build/amd64-generic/var/cache/portage/chromeos-base/libweave/out/Default/../../../../../../../usr/include/gmock/gmock-actions.h:743
    #2 0x7f18125b32cd in testing::PolymorphicAction<testing::internal::InvokeWithoutArgsAction<weave::WeaveWiFiSetupTest_OfflineLongTimeWithNoSsid_Test::TestBody()::$_5> >::MonomorphicImpl<void (std::string const&)>::Perform(std::tuple<std::string const&> const&) /build/amd64-generic/var/cache/portage/chromeos-base/libweave/out/Default/../../../../../../../usr/include/gmock/gmock-actions.h:371
    #3 0x7f181222e63e in testing::Action<void (std::string const&)>::Perform(std::tuple<std::string const&> const&) const /build/amd64-generic/var/cache/portage/chromeos-base/libweave/out/Default/../../../../../../../usr/include/gmock/gmock-actions.h:320:19
    #4 0x7f181222cf2a in testing::internal::ActionResultHolder<void>* testing::internal::ActionResultHolder<void>::PerformAction<void (std::string const&)>(testing::Action<void (std::string const&)> const&, testing::internal::Function<void (std::string const&)>::ArgumentTuple const&) /build/amd64-generic/var/cache/portage/chromeos-base/libweave/out/Default/../../../../../../../usr/include/gmock/gmock-spec-builders.h:1392:12
    #5 0x7f181222cf2a in testing::internal::FunctionMockerBase<void (std::string const&)>::UntypedPerformAction(void const*, void const*) const /build/amd64-generic/var/cache/portage/chromeos-base/libweave/out/Default/../../../../../../../usr/include/gmock/gmock-spec-builders.h:1487
    #6 0x7f1811846e92 in testing::internal::UntypedFunctionMockerBase::UntypedInvokeWith(void const*) /build/amd64-generic/tmp/portage/dev-cpp/gmock-1.7.0-r1/work/gmock-1.7.0-abi_x86_64.amd64/../gmock-1.7.0/src/gmock-spec-builders.cc:401:15
    #7 0x7f181221d12c in testing::internal::FunctionMockerBase<void (std::string const&)>::InvokeWith(std::tuple<std::string const&> const&) /build/amd64-generic/var/cache/portage/chromeos-base/libweave/out/Default/../../../../../../../usr/include/gmock/gmock-spec-builders.h:1530:15
    #8 0x7f181221d024 in testing::internal::FunctionMocker<void (std::string const&)>::Invoke(std::string const&) /build/amd64-generic/var/cache/portage/chromeos-base/libweave/out/Default/../../../../../../../usr/include/gmock/gmock-generated-function-mockers.h:97:18
    #9 0x7f18127d39e2 in weave::privet::WifiBootstrapManager::StartBootstrapping() /build/amd64-generic/var/cache/portage/chromeos-base/libweave/out/Default/../../../../../../../tmp/portage/chromeos-base/libweave-0.0.1-r250/work/libweave-0.0.1/weave/libweave/src/privet/wifi_bootstrap_manager.cc:94:10
    #10 0x7f18127d65cc in weave::privet::WifiBootstrapManager::OnMonitorTimeout() /build/amd64-generic/var/cache/portage/chromeos-base/libweave/out/Default/../../../../../../../tmp/portage/chromeos-base/libweave-0.0.1-r250/work/libweave-0.0.1/weave/libweave/src/privet/wifi_bootstrap_manager.cc:253:3
    #11 0x7f18127d8de1 in void base::internal::RunnableAdapter<void (weave::privet::WifiBootstrapManager::*)()>::Run<weave::privet::WifiBootstrapManager*>(weave::privet::WifiBootstrapManager*&&) /build/amd64-generic/var/cache/portage/chromeos-base/libweave/out/Default/../../../../../../../usr/include/base-395517/base/bind_internal.h:186:12
    #12 0x7f18127d8de1 in void base::internal::InvokeHelper<true, void, base::internal::RunnableAdapter<void (weave::privet::WifiBootstrapManager::*)()> >::MakeItSo<base::WeakPtr<weave::privet::WifiBootstrapManager>>(base::internal::RunnableAdapter<void (weave::privet::WifiBootstrapManager::*)()>, base::WeakPtr<weave::privet::WifiBootstrapManager>) /build/amd64-generic/var/cache/portage/chromeos-base/libweave/out/Default/../../../../../../../usr/include/base-395517/base/bind_internal.h:324
    #13 0x7f18127d8af0 in base::internal::Invoker<base::IndexSequence<0ul>, base::internal::BindState<base::internal::RunnableAdapter<void (weave::privet::WifiBootstrapManager::*)()>, void (weave::privet::WifiBootstrapManager*), base::WeakPtr<weave::privet::WifiBootstrapManager> >, base::internal::InvokeHelper<true, void, base::internal::RunnableAdapter<void (weave::privet::WifiBootstrapManager::*)()> >, void ()>::Run(base::internal::BindStateBase*) /build/amd64-generic/var/cache/portage/chromeos-base/libweave/out/Default/../../../../../../../usr/include/base-395517/base/bind_internal.h:362:12
    #14 0x7f18126685e8 in weave::provider::test::FakeTaskRunner::RunOnce() /build/amd64-generic/var/cache/portage/chromeos-base/libweave/out/Default/../../../../../../../tmp/portage/chromeos-base/libweave-0.0.1-r250/work/libweave-0.0.1/weave/libweave/src/test/fake_task_runner.cc:31:14
    #15 0x7f18126688fc in weave::provider::test::FakeTaskRunner::Run(unsigned long) /build/amd64-generic/var/cache/portage/chromeos-base/libweave/out/Default/../../../../../../../tmp/portage/chromeos-base/libweave-0.0.1-r250/work/libweave-0.0.1/weave/libweave/src/test/fake_task_runner.cc:37:61
    #16 0x7f18125b86aa in weave::WeaveTest::StartDevice() /build/amd64-generic/var/cache/portage/chromeos-base/libweave/out/Default/../../../../../../../tmp/portage/chromeos-base/libweave-0.0.1-r250/work/libweave-0.0.1/weave/libweave/src/weave_unittest.cc:270:18
    #17 0x7f18125aedf9 in weave::WeaveWiFiSetupTest_OfflineLongTimeWithNoSsid_Test::TestBody() /build/amd64-generic/var/cache/portage/chromeos-base/libweave/out/Default/../../../../../../../tmp/portage/chromeos-base/libweave-0.0.1-r250/work/libweave-0.0.1/weave/libweave/src/weave_unittest.cc:497:3
    #18 0x7f1811896bef in void testing::internal::HandleSehExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(), char const*) /build/amd64-generic/tmp/portage/dev-cpp/gtest-1.7.0/work/gtest-1.7.0-abi_x86_64.amd64/./src/gtest.cc:2078:10
    #19 0x7f1811896bef in void testing::internal::HandleExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(), char const*) /build/amd64-generic/tmp/portage/dev-cpp/gtest-1.7.0/work/gtest-1.7.0-abi_x86_64.amd64/./src/gtest.cc:2114
    #20 0x7f1811878111 in testing::Test::Run() /build/amd64-generic/tmp/portage/dev-cpp/gtest-1.7.0/work/gtest-1.7.0-abi_x86_64.amd64/./src/gtest.cc:2150:5
    #21 0x7f1811879510 in testing::TestInfo::Run() /build/amd64-generic/tmp/portage/dev-cpp/gtest-1.7.0/work/gtest-1.7.0-abi_x86_64.amd64/./src/gtest.cc:2326:11
    #22 0x7f1811879d56 in testing::TestCase::Run() /build/amd64-generic/tmp/portage/dev-cpp/gtest-1.7.0/work/gtest-1.7.0-abi_x86_64.amd64/./src/gtest.cc:2444:28
    #23 0x7f18118834c6 in testing::internal::UnitTestImpl::RunAllTests() /build/amd64-generic/tmp/portage/dev-cpp/gtest-1.7.0/work/gtest-1.7.0-abi_x86_64.amd64/./src/gtest.cc:4315:43
    #24 0x7f18118978af in bool testing::internal::HandleSehExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::*)(), char const*) /build/amd64-generic/tmp/portage/dev-cpp/gtest-1.7.0/work/gtest-1.7.0-abi_x86_64.amd64/./src/gtest.cc:2078:10
    #25 0x7f18118978af in bool testing::internal::HandleExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::*)(), char const*) /build/amd64-generic/tmp/portage/dev-cpp/gtest-1.7.0/work/gtest-1.7.0-abi_x86_64.amd64/./src/gtest.cc:2114
    #26 0x7f1811883081 in testing::UnitTest::Run() /build/amd64-generic/tmp/portage/dev-cpp/gtest-1.7.0/work/gtest-1.7.0-abi_x86_64.amd64/./src/gtest.cc:3926:10
    #27 0x7f1812663018 in RUN_ALL_TESTS() /build/amd64-generic/var/cache/portage/chromeos-base/libweave/out/Default/../../../../../../../usr/include/gtest/gtest.h:2288:46
    #28 0x7f1812663018 in main /build/amd64-generic/var/cache/portage/chromeos-base/libweave/out/Default/../../../../../../../tmp/portage/chromeos-base/libweave-0.0.1-r250/work/libweave-0.0.1/weave/libweave/src/test/weave_testrunner.cc:20
    #29 0x7f1810129815 in __libc_start_main /var/tmp/portage/cross-x86_64-cros-linux-gnu/glibc-2.23-r4/work/glibc-2.23/csu/../csu/libc-start.c:289
    #30 0x7f181208a5e8 in _start (/var/cache/portage/chromeos-base/libweave/out/Default/libweave_testrunner+0x7d05e8)

Address 0x7ffe46172400 is located in stack of thread T0 at offset 96 in frame
    #0 0x7f18125ae82f in weave::WeaveWiFiSetupTest_OfflineLongTimeWithNoSsid_Test::TestBody() /build/amd64-generic/var/cache/portage/chromeos-base/libweave/out/Default/../../../../../../../tmp/portage/chromeos-base/libweave-0.0.1-r250/work/libweave-0.0.1/weave/libweave/src/weave_unittest.cc:471

  This frame has 12 object(s):
    [32, 48) 'ref.tmp' (line 472)
    [64, 68) 'coerce'
    [80, 81) 's' (line 478)
    [96, 104) 'time_stamp' (line 479) <== Memory access at offset 96 is inside this variable
    [128, 152) 'ref.tmp12' (line 481)
    [192, 216) 'temp.lvalue'
    [256, 264) 'ref.tmp13' (line 481)
    [288, 289) 'ref.tmp14' (line 481)
    [304, 320) 'ref.tmp17' (line 481)
    [336, 352) 'coerce20'
    [368, 384) 'ref.tmp27' (line 488)
    [400, 416) 'coerce30'
HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-use-after-scope /build/amd64-generic/var/cache/portage/chromeos-base/libweave/out/Default/../../../../../../../tmp/portage/chromeos-base/libweave-0.0.1-r250/work/libweave-0.0.1/weave/libweave/src/weave_unittest.cc:483:11 in weave::WeaveWiFiSetupTest_OfflineLongTimeWithNoSsid_Test::TestBody()::$_5::operator()() const
Shadow bytes around the buggy address:
  0x100048c26430: f8 f8 f2 f2 f2 f2 f8 f2 f2 f2 00 f2 f2 f2 f8 f2
  0x100048c26440: f2 f2 f8 f2 f8 f2 f2 f2 f8 f2 f8 f2 f2 f2 f8 f3
  0x100048c26450: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100048c26460: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100048c26470: 00 00 00 00 f1 f1 f1 f1 f8 f8 f2 f2 04 f2 f8 f2
=>0x100048c26480:[f8]f2 f2 f2 f8 f8 f8 f2 f2 f2 f2 f2 00 00 00 f2
  0x100048c26490: f2 f2 f2 f2 f8 f2 f2 f2 f8 f2 f8 f8 f2 f2 00 00
  0x100048c264a0: f2 f2 f8 f8 f2 f2 00 00 f3 f3 f3 f3 00 00 00 00
  0x100048c264b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100048c264c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100048c264d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==17==ABORTING

 
Owner: benchan@chromium.org
Status: Started (was: Untriaged)
It seems to me the issue is that OfflineLongTimeWithNoSsid and OfflineLongTimeWithSsid tests capture the 'time_stamp' variable on stack by reference in an inner scope that is not guaranteed to survive when the lambda is executed later. Rearranging the scope of 'time_stamp' seems to fix the issue in my local build. Will submit a CL to fix it
Status: Fixed (was: Started)
https://weave-review.googlesource.com/9970

Comment 3 by dchan@chromium.org, Aug 1 2017

Labels: VerifyIn-61

Comment 4 by dchan@chromium.org, Jan 22 2018

Status: Archived (was: Fixed)

Sign in to add a comment