All c++ operator new/delete symbols should have strong linkage |
|||||
Issue description$ nm -D --defined-only /opt/google/chrome/chrome ... 00000000035878b0 T _ZdaPv 0000000001838410 W _ZdaPvm 000000000186e680 W _ZdaPvmSt11align_val_t 00000000035878b0 T _ZdaPvRKSt9nothrow_t 000000000186e650 W _ZdaPvSt11align_val_t 000000000186e670 W _ZdaPvSt11align_val_tRKSt9nothrow_t 00000000035878b0 T _ZdlPv 0000000001838410 W _ZdlPvm 000000000186e660 W _ZdlPvmSt11align_val_t 00000000035878b0 T _ZdlPvRKSt9nothrow_t 0000000001845e50 W _ZdlPvSt11align_val_t 000000000186e650 W _ZdlPvSt11align_val_tRKSt9nothrow_t 0000000003587850 T _Znam 0000000003587850 T _ZnamRKSt9nothrow_t 000000000186e610 W _ZnamSt11align_val_t 000000000186e620 W _ZnamSt11align_val_tRKSt9nothrow_t 0000000003587850 T _Znwm 0000000003587850 T _ZnwmRKSt9nothrow_t 000000000186e540 W _ZnwmSt11align_val_t 000000000186e5e0 W _ZnwmSt11align_val_tRKSt9nothrow_t 12 out of the 20 symbols are weak symbols. This means that if a library gets linked in that has a custom allocator, it can override our weak versions of op new/delete. This can lead to allocating memory on one heap and trying to deallocate it on another, which will almost certainly lead to a crash.
,
Jun 25 2018
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/1f404f7107727532c665a6aed5806b5ff8ef46dd commit 1f404f7107727532c665a6aed5806b5ff8ef46dd Author: Tom Anderson <thomasanderson@chromium.org> Date: Mon Jun 25 20:51:43 2018 Add sized delete operators to allocator shim Sized deletion was added in c++14. Now that Chrome is building with c++14, we must override sized operator delete for symbol linkage consistency (see bug 855773). R=thakis BUG= 855773 Change-Id: Idb673307939119ec520f71911e2074db2496b5ae Reviewed-on: https://chromium-review.googlesource.com/1112731 Commit-Queue: Thomas Anderson <thomasanderson@chromium.org> Reviewed-by: Nico Weber <thakis@chromium.org> Cr-Commit-Position: refs/heads/master@{#570172} [modify] https://crrev.com/1f404f7107727532c665a6aed5806b5ff8ef46dd/base/allocator/allocator_shim_override_cpp_symbols.h
,
Jul 4
Oh wow scary bug, thanks for fixing sized delete in #2. > This means that if a library gets linked in that has a custom allocator, If that happens (linking a library that has a custom allocator), Chrome is likely to be busted (read: crash) anyways on Linux, even if all 20 symbols are defined. By default the allocator shim will route all allocations through libc (see allocator_shim_default_dispatch_to_glibc.cc), so if we link any 3p library that redefines malloc & co we'd end up in a situation where both "chrome" (the root executable) and "lib3p.so" define malloc. The "malloc" in chrome will always win the resolution over "malloc" in lib3p.so (because IIRC strong symbols are resolved using a BFS starting from the root link unit), but then the code in lib3p.so will very likely have internal calls to its own allocator which don't go through PLT (unless it's linked with -Bsymbolic or something similar), and end up in a split-heap situation regardless.
,
Jul 5
> If that happens (linking a library that has a custom allocator), Chrome is likely to be busted (read: crash) anyways on Linux Oh no D: That sounds like what libwidevinecdm.so does (bug 760259).
,
Jul 10
> if a library gets linked in that has a custom allocator, it can override our weak versions of op new/delete Only if the library is linked statically. The dynamic loader does not care about weak/strong, the first definition that it sees always wins (and the executable is always loaded first so its symbols always win).
,
Jan 9
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/c301d11bc17d7ed21d81927dfc14ade33b3c2512 commit c301d11bc17d7ed21d81927dfc14ade33b3c2512 Author: Tom Anderson <thomasanderson@chromium.org> Date: Wed Jan 09 18:44:13 2019 Add aligned new/delete operators to allocator shim BUG= 855773 R=thakis Change-Id: Ieaad3b59d07b4b655f55b87c55aebfc31f8ab531 Reviewed-on: https://chromium-review.googlesource.com/c/1401050 Reviewed-by: Primiano Tucci <primiano@chromium.org> Reviewed-by: Nico Weber <thakis@chromium.org> Commit-Queue: Thomas Anderson <thomasanderson@chromium.org> Cr-Commit-Position: refs/heads/master@{#621242} [modify] https://crrev.com/c301d11bc17d7ed21d81927dfc14ade33b3c2512/base/BUILD.gn [modify] https://crrev.com/c301d11bc17d7ed21d81927dfc14ade33b3c2512/base/allocator/allocator_shim.cc [modify] https://crrev.com/c301d11bc17d7ed21d81927dfc14ade33b3c2512/base/allocator/allocator_shim_override_cpp_symbols.h
,
Jan 9
,
Jan 9
,
Jan 9
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/867312ae0daf4e7a1bc19701e71c815804ac8f40 commit 867312ae0daf4e7a1bc19701e71c815804ac8f40 Author: Thomas Anderson <thomasanderson@chromium.org> Date: Wed Jan 09 21:48:39 2019 Revert "Add aligned new/delete operators to allocator shim" This reverts commit c301d11bc17d7ed21d81927dfc14ade33b3c2512. Reason for revert: Causing build failure in certain configs that use precompiled headers Original change's description: > Add aligned new/delete operators to allocator shim > > BUG= 855773 > R=thakis > > Change-Id: Ieaad3b59d07b4b655f55b87c55aebfc31f8ab531 > Reviewed-on: https://chromium-review.googlesource.com/c/1401050 > Reviewed-by: Primiano Tucci <primiano@chromium.org> > Reviewed-by: Nico Weber <thakis@chromium.org> > Commit-Queue: Thomas Anderson <thomasanderson@chromium.org> > Cr-Commit-Position: refs/heads/master@{#621242} TBR=thakis@chromium.org,primiano@chromium.org,thomasanderson@chromium.org Change-Id: Ie2bbc18d2cae6559169a1820b10dd15aa1fd9ccf No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: 855773 Reviewed-on: https://chromium-review.googlesource.com/c/1404065 Reviewed-by: Thomas Anderson <thomasanderson@chromium.org> Commit-Queue: Thomas Anderson <thomasanderson@chromium.org> Cr-Commit-Position: refs/heads/master@{#621299} [modify] https://crrev.com/867312ae0daf4e7a1bc19701e71c815804ac8f40/base/BUILD.gn [modify] https://crrev.com/867312ae0daf4e7a1bc19701e71c815804ac8f40/base/allocator/allocator_shim.cc [modify] https://crrev.com/867312ae0daf4e7a1bc19701e71c815804ac8f40/base/allocator/allocator_shim_override_cpp_symbols.h
,
Jan 11
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/2ce48fbdc4fdcddf11c95135618b26e8aa66f58a commit 2ce48fbdc4fdcddf11c95135618b26e8aa66f58a Author: Tom Anderson <thomasanderson@chromium.org> Date: Fri Jan 11 22:19:34 2019 [Reland] Add aligned new/delete operators to allocator shim This CL is a reland of [1] with a fix for when using precompiled headers. The object file allocator_shim.o is byte-for-byte identical to the one built at [1] (at least on a Linux release build). [1] https://chromium-review.googlesource.com/c/chromium/src/+/1401050 BUG= 855773 R=thakis Change-Id: Ic4321f5c1526e1ecfdffcb58cfb2687875316fa5 Reviewed-on: https://chromium-review.googlesource.com/c/1407435 Reviewed-by: Nico Weber <thakis@chromium.org> Reviewed-by: Primiano Tucci <primiano@chromium.org> Commit-Queue: Thomas Anderson <thomasanderson@chromium.org> Cr-Commit-Position: refs/heads/master@{#622185} [modify] https://crrev.com/2ce48fbdc4fdcddf11c95135618b26e8aa66f58a/base/allocator/allocator_shim.cc [modify] https://crrev.com/2ce48fbdc4fdcddf11c95135618b26e8aa66f58a/base/allocator/allocator_shim_override_cpp_symbols.h
,
Jan 11
|
|||||
►
Sign in to add a comment |
|||||
Comment 1 by thomasanderson@chromium.org
, Jun 22 2018Components: Build