New issue
Advanced search Search tips

Issue 827810 link

Starred by 1 user
Status: Fixed
Owner:
thakis@chromium.org
Closed: Apr 2018
Cc:
thomasanderson@chromium.org
h...@chromium.org
thakis@chromium.org
inglorion@chromium.org
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 3
Type: Bug

Blocking:
issue 826683



Sign in to add a comment

Windows Clang 32-bit ToT debug builds assert in VTableBuilder.cpp on virtual_audio_output_stream_unittest.cpp

Project Member Reported by r...@chromium.org, Mar 31 2018 
I think this must be debug info related, because it correlates with bots that set symbol_level=2. Here are some example failing builds:
https://ci.chromium.org/buildbot/chromium.clang/ToTWin%28dbg%29/595
https://ci.chromium.org/buildbot/chromium.clang/CrWinClngLLDdbg/467
https://ci.chromium.org/buildbot/chromium.clang/ToTWin64%28dll%29/430

Strangely, somehow ToTWin64(dll) healed itself in the next build, got past the assertion, compiled successfully, but failed the relevant unit test:
https://ci.chromium.org/buildbot/chromium.clang/ToTWin64%28dll%29/431

The failure looks like:
[15307/49540] CXX obj/media/audio/unit_tests/virtual_audio_output_stream_unittest.obj
FAILED: obj/media/audio/unit_tests/virtual_audio_output_stream_unittest.obj 
...
Assertion failed: VBInfo.VBTableIndices.count(VBase), file C:\b\c\b\ToTWin64_dll_\src\third_party\llvm\tools\clang\lib\AST\VTableBuilder.cpp, line 3706
...

I thought we enabled debug info for clang in our ToT bots. For some reason the stack isn't symbolized.

I strongly suspect r328723 may have caused this, but I have not set up my Windows machine for remote access so I cannot confirm this until Monday.

Comment 1 by thakis@chromium.org, Mar 31 2018 

I had seen this, tried and failed to reproduce locally, saw that the bot healed itself, and dropped it.  Let me check if I had symbols enabled and try again, I still have things set up...

Comment 2 by thakis@chromium.org, Mar 31 2018 

I had symbol_level=1. With symbol_level=2 it repros (in this case, 64-bit); attached.
virtual_audio_output_stream_unittest-616b5d.zip
1.7 MB Download

Comment 3 by thakis@chromium.org, Mar 31 2018 

Reverting 328723 seems to not help afaict. I'll hunt around a bit.

Comment 4 by thakis@chromium.org, Mar 31 2018 

(stack:

clang-7.0: /usr/local/google/home/thakis/src/llvm-rw/tools/clang/lib/AST/VTableBuilder.cpp:3691: unsigned int clang::MicrosoftVTableContext::getVBTableIndex(const clang::CXXRecordDecl*, const clang::CXXRecordDecl*): Assertion `VBInfo.VBTableIndices.count(VBase)' failed.
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(_ZN4llvm3sys15PrintStackTraceERNS_11raw_ostreamE+0x1a)[0x55d8acef1b1a]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(_ZN4llvm3sys17RunSignalHandlersEv+0x56)[0x55d8aceef856]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(+0x15d0bc5)[0x55d8aceefbc5]
/lib/x86_64-linux-gnu/libpthread.so.0(+0x110c0)[0x7fc4171790c0]
/lib/x86_64-linux-gnu/libc.so.6(gsignal+0xcf)[0x7fc415d0afcf]
/lib/x86_64-linux-gnu/libc.so.6(abort+0x16a)[0x7fc415d0c3fa]
/lib/x86_64-linux-gnu/libc.so.6(+0x2be37)[0x7fc415d03e37]
/lib/x86_64-linux-gnu/libc.so.6(+0x2bee2)[0x7fc415d03ee2]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(_ZN5clang22MicrosoftVTableContext15getVBTableIndexEPKNS_13CXXRecordDeclES3_+0x99)[0x55d8aeabc039]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(+0x18bf016)[0x55d8ad1de016]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(+0x19e138e)[0x55d8ad30038e]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(_ZN5clang7CodeGen15CodeGenFunction14EmitScalarExprEPKNS_4ExprEb+0x53)[0x55d8ad300a13]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(_ZN5clang7CodeGen15CodeGenFunction11EmitAnyExprEPKNS_4ExprENS0_12AggValueSlotEb+0xbe)[0x55d8ad2c127e]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(_ZN5clang7CodeGen15CodeGenFunction17EmitAnyExprToTempEPKNS_4ExprE+0x52)[0x55d8ad2c1442]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(_ZN5clang7CodeGen15CodeGenFunction11EmitCallArgERNS0_11CallArgListEPKNS_4ExprENS_8QualTypeE+0x99c)[0x55d8ad2794ec]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(_ZN5clang7CodeGen15CodeGenFunction12EmitCallArgsERNS0_11CallArgListEN4llvm8ArrayRefINS_8QualTypeEEENS4_14iterator_rangeINS_4Stmt17ConstExprIteratorEEENS1_14AbstractCalleeEjNS1_15EvaluationOrderE+0x174)[0x55d8ad281664]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(+0x18b8257)[0x55d8ad1d7257]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(_ZN5clang7CodeGen15CodeGenFunction8EmitCallENS_8QualTypeERKNS0_8CGCalleeEPKNS_8CallExprENS0_15ReturnValueSlotEPN4llvm5ValueE+0x593)[0x55d8ad2d0f33]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(_ZN5clang7CodeGen15CodeGenFunction12EmitCallExprEPKNS_8CallExprENS0_15ReturnValueSlotE+0x140)[0x55d8ad2dbe70]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(+0x6c22eb)[0x55d8abfe12eb]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(+0x6c24c9)[0x55d8abfe14c9]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(+0x19c1acb)[0x55d8ad2e0acb]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(_ZN5clang7CodeGen15CodeGenFunction11EmitAggExprEPKNS_4ExprENS0_12AggValueSlotE+0x9a)[0x55d8ad2e147a]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(_ZN5clang7CodeGen15CodeGenFunction16EmitAnyExprToMemEPKNS_4ExprENS0_7AddressENS_10QualifiersEb+0x94)[0x55d8ad2d57a4]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(_ZN5clang7CodeGen15CodeGenFunction28EmitMaterializeTemporaryExprEPKNS_24MaterializeTemporaryExprE+0x8d4)[0x55d8ad2db644]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(_ZN5clang7CodeGen15CodeGenFunction10EmitLValueEPKNS_4ExprE+0x3a6)[0x55d8ad2d2646]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(_ZN5clang7CodeGen15CodeGenFunction26EmitReferenceBindingToExprEPKNS_4ExprE+0x1e)[0x55d8ad2d2ace]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(_ZN5clang7CodeGen15CodeGenFunction11EmitCallArgERNS0_11CallArgListEPKNS_4ExprENS_8QualTypeE+0x50c)[0x55d8ad27905c]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(_ZN5clang7CodeGen15CodeGenFunction12EmitCallArgsERNS0_11CallArgListEN4llvm8ArrayRefINS_8QualTypeEEENS4_14iterator_rangeINS_4Stmt17ConstExprIteratorEEENS1_14AbstractCalleeEjNS1_15EvaluationOrderE+0x174)[0x55d8ad281664]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(+0x18b8257)[0x55d8ad1d7257]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(_ZN5clang7CodeGen15CodeGenFunction8EmitCallENS_8QualTypeERKNS0_8CGCalleeEPKNS_8CallExprENS0_15ReturnValueSlotEPN4llvm5ValueE+0x593)[0x55d8ad2d0f33]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(_ZN5clang7CodeGen15CodeGenFunction12EmitCallExprEPKNS_8CallExprENS0_15ReturnValueSlotE+0x140)[0x55d8ad2dbe70]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(+0x6c22eb)[0x55d8abfe12eb]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(+0x6c24c9)[0x55d8abfe14c9]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(+0x19c1acb)[0x55d8ad2e0acb]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(+0x19c1fec)[0x55d8ad2e0fec]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(+0x19c1bfe)[0x55d8ad2e0bfe]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(_ZN5clang7CodeGen15CodeGenFunction11EmitAggExprEPKNS_4ExprENS0_12AggValueSlotE+0x9a)[0x55d8ad2e147a]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(_ZN5clang7CodeGen15CodeGenFunction20EmitCXXConstructExprEPKNS_16CXXConstructExprENS0_12AggValueSlotE+0x4d4)[0x55d8ad2e6364]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(+0x6c1b9a)[0x55d8abfe0b9a]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(+0x19c1adb)[0x55d8ad2e0adb]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(+0x19c1fec)[0x55d8ad2e0fec]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(_ZN5clang7CodeGen15CodeGenFunction11EmitAggExprEPKNS_4ExprENS0_12AggValueSlotE+0x9a)[0x55d8ad2e147a]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(_ZN5clang7CodeGen15CodeGenFunction11EmitCallArgERNS0_11CallArgListEPKNS_4ExprENS_8QualTypeE+0x1196)[0x55d8ad279ce6]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(_ZN5clang7CodeGen15CodeGenFunction12EmitCallArgsERNS0_11CallArgListEN4llvm8ArrayRefINS_8QualTypeEEENS4_14iterator_rangeINS_4Stmt17ConstExprIteratorEEENS1_14AbstractCalleeEjNS1_15EvaluationOrderE+0x174)[0x55d8ad281664]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(+0x18b8257)[0x55d8ad1d7257]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(_ZN5clang7CodeGen15CodeGenFunction22EmitCXXConstructorCallEPKNS_18CXXConstructorDeclENS_11CXXCtorTypeEbbNS0_7AddressEPKNS_16CXXConstructExprE+0x16c)[0x55d8ad291efc]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(_ZN5clang7CodeGen15CodeGenFunction20EmitCXXConstructExprEPKNS_16CXXConstructExprENS0_12AggValueSlotE+0x101)[0x55d8ad2e5f91]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(+0x6c1b9a)[0x55d8abfe0b9a]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(+0x19c1adb)[0x55d8ad2e0adb]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(+0x6c2e45)[0x55d8abfe1e45]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(+0x19c1abb)[0x55d8ad2e0abb]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(+0x19c1fec)[0x55d8ad2e0fec]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(+0x19c1bfe)[0x55d8ad2e0bfe]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(_ZN5clang7CodeGen15CodeGenFunction11EmitAggExprEPKNS_4ExprENS0_12AggValueSlotE+0x9a)[0x55d8ad2e147a]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(_ZN5clang7CodeGen15CodeGenFunction20EmitCXXConstructExprEPKNS_16CXXConstructExprENS0_12AggValueSlotE+0x4d4)[0x55d8ad2e6364]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(+0x6c1b9a)[0x55d8abfe0b9a]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(+0x19c1adb)[0x55d8ad2e0adb]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(+0x19c1fec)[0x55d8ad2e0fec]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(_ZN5clang7CodeGen15CodeGenFunction11EmitAggExprEPKNS_4ExprENS0_12AggValueSlotE+0x9a)[0x55d8ad2e147a]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(_ZN5clang7CodeGen15CodeGenFunction11EmitCallArgERNS0_11CallArgListEPKNS_4ExprENS_8QualTypeE+0x1196)[0x55d8ad279ce6]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(_ZN5clang7CodeGen15CodeGenFunction12EmitCallArgsERNS0_11CallArgListEN4llvm8ArrayRefINS_8QualTypeEEENS4_14iterator_rangeINS_4Stmt17ConstExprIteratorEEENS1_14AbstractCalleeEjNS1_15EvaluationOrderE+0x174)[0x55d8ad281664]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(+0x18b8257)[0x55d8ad1d7257]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(+0x19c6761)[0x55d8ad2e5761]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(_ZN5clang7CodeGen15CodeGenFunction27EmitCXXMemberOrOperatorCallEPKNS_13CXXMethodDeclERKNS0_8CGCalleeENS0_15ReturnValueSlotEPN4llvm5ValueESB_NS_8QualTypeEPKNS_8CallExprEPNS0_11CallArgListE+0xe5)[0x55d8ad2e5cd5]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(_ZN5clang7CodeGen15CodeGenFunction37EmitCXXMemberOrOperatorMemberCallExprEPKNS_8CallExprEPKNS_13CXXMethodDeclENS0_15ReturnValueSlotEbPNS_19NestedNameSpecifierEbPKNS_4ExprE+0xc60)[0x55d8ad2e74e0]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(_ZN5clang7CodeGen15CodeGenFunction21EmitCXXMemberCallExprEPKNS_17CXXMemberCallExprENS0_15ReturnValueSlotE+0xe4)[0x55d8ad2e8134]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(_ZN5clang7CodeGen15CodeGenFunction12EmitCallExprEPKNS_8CallExprENS0_15ReturnValueSlotE+0x71)[0x55d8ad2dbda1]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(+0x6c65d8)[0x55d8abfe55d8]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(+0x19e06ac)[0x55d8ad2ff6ac]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(+0x6c85b9)[0x55d8abfe75b9]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(+0x19e08a3)[0x55d8ad2ff8a3]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(_ZN5clang7CodeGen15CodeGenFunction14EmitScalarExprEPKNS_4ExprEb+0x53)[0x55d8ad300a13]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(_ZN5clang7CodeGen15CodeGenFunction11EmitAnyExprEPKNS_4ExprENS0_12AggValueSlotEb+0xbe)[0x55d8ad2c127e]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(_ZN5clang7CodeGen15CodeGenFunction15EmitIgnoredExprEPKNS_4ExprE+0x46)[0x55d8ad2d2aa6]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(_ZN5clang7CodeGen15CodeGenFunction8EmitStmtEPKNS_4StmtEN4llvm8ArrayRefIPKNS_4AttrEEE+0xbf)[0x55d8ad10ce5f]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(_ZN5clang7CodeGen15CodeGenFunction28EmitCompoundStmtWithoutScopeERKNS_12CompoundStmtEbNS0_12AggValueSlotE+0x53)[0x55d8ad10d513]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(_ZN5clang7CodeGen15CodeGenFunction16EmitFunctionBodyERNS0_15FunctionArgListEPKNS_4StmtE+0x8d)[0x55d8ad1469fd]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(_ZN5clang7CodeGen15CodeGenFunction12GenerateCodeENS_10GlobalDeclEPN4llvm8FunctionERKNS0_14CGFunctionInfoE+0x246)[0x55d8ad1531a6]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(_ZN5clang7CodeGen13CodeGenModule28EmitGlobalFunctionDefinitionENS_10GlobalDeclEPN4llvm11GlobalValueE+0x16a)[0x55d8ad17a79a]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(_ZN5clang7CodeGen13CodeGenModule20EmitGlobalDefinitionENS_10GlobalDeclEPN4llvm11GlobalValueE+0x225)[0x55d8ad18ca65]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(_ZN5clang7CodeGen13CodeGenModule10EmitGlobalENS_10GlobalDeclE+0x478)[0x55d8ad18da48]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(+0x186f6f5)[0x55d8ad18e6f5]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(_ZN5clang7CodeGen13CodeGenModule15EmitDeclContextEPKNS_11DeclContextE+0xc6)[0x55d8ad18ecd6]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(+0x186f3b9)[0x55d8ad18e3b9]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(+0x1f1637d)[0x55d8ad83537d]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(+0x1f0b9cd)[0x55d8ad82a9cd]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(_ZN5clang8ParseASTERNS_4SemaEbb+0x1a3)[0x55d8ae0aa9b3]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(_ZN5clang13CodeGenAction13ExecuteActionEv+0x80)[0x55d8ad8328a0]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(_ZN5clang14FrontendAction7ExecuteEv+0x8e)[0x55d8ad4da17e]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(_ZN5clang16CompilerInstance13ExecuteActionERNS_14FrontendActionE+0x17e)[0x55d8ad4a200e]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(_ZN5clang25ExecuteCompilerInvocationEPNS_16CompilerInstanceE+0x86b)[0x55d8ad576c9b]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(_Z8cc1_mainN4llvm8ArrayRefIPKcEES2_Pv+0x8c8)[0x55d8ac1e8b78]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(main+0x193f)[0x55d8ac19febf]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf1)[0x7fc415cf82b1]
/usr/local/google/home/thakis/src/llvm-build/bin/clang-7.0(_start+0x2a)[0x55d8ac1e4c3a]

)

Comment 5 by thakis@chromium.org, Mar 31 2018 

Reverting 328845 helps. This looks like a pretty harmless change; surprising...

Comment 6 by thakis@chromium.org, Mar 31 2018 

$ svn commit -m 'Revert r328845, it caused  crbug.com/827810 .'
Sending        include/clang/AST/Mangle.h
Sending        include/clang/AST/VTableBuilder.h
Sending        lib/AST/MicrosoftMangle.cpp
Sending        lib/AST/VTableBuilder.cpp
Sending        lib/CodeGen/CGDebugInfo.cpp
Sending        lib/CodeGen/MicrosoftCXXABI.cpp
Transmitting file data ......done
Committing transaction...
Committed revision 328922.

Let's see if that helps on the bots too.

Comment 7 by thakis@chromium.org, Mar 31 2018 

(If it's that, then thomasanderson's r328716 doesn't have this bug yet and might be landable.)

Comment 8 by r...@chromium.org, Mar 31 2018 

Thanks! From glancing at the change and the fact that this is non-deterministic, I suspect I introduced a stale reference into a hash table or some other unstable container. MethodVFTableLocation has gotten larger over time, so I figured it would be better to use const references.

Comment 9 by thakis@chromium.org, Apr 2 2018

Owner: thakis@chromium.org
Status: Fixed (was: Assigned)
The bots linked in comment 0 cycled green.

Comment 10 by r...@chromium.org, Apr 2 2018 

I took that reproducer, ran it under ASan, and found the DenseMap rehash UAF bug. When I relanded in r329007, I included some changes to avoid returning pointers to DenseMap memory.
►

Sign in to add a comment