New issue
Advanced search Search tips

Issue 855773 link

Starred by 4 users

Issue metadata

Status: Fixed
Owner:
Closed: Jan 11
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 3
Type: Bug

Blocked on:
issue 752720



Sign in to add a comment

All c++ operator new/delete symbols should have strong linkage

Project Member Reported by thomasanderson@chromium.org, Jun 22 2018

Issue description

$ nm -D --defined-only /opt/google/chrome/chrome
...
00000000035878b0 T _ZdaPv
0000000001838410 W _ZdaPvm
000000000186e680 W _ZdaPvmSt11align_val_t
00000000035878b0 T _ZdaPvRKSt9nothrow_t
000000000186e650 W _ZdaPvSt11align_val_t
000000000186e670 W _ZdaPvSt11align_val_tRKSt9nothrow_t
00000000035878b0 T _ZdlPv
0000000001838410 W _ZdlPvm
000000000186e660 W _ZdlPvmSt11align_val_t
00000000035878b0 T _ZdlPvRKSt9nothrow_t
0000000001845e50 W _ZdlPvSt11align_val_t
000000000186e650 W _ZdlPvSt11align_val_tRKSt9nothrow_t
0000000003587850 T _Znam
0000000003587850 T _ZnamRKSt9nothrow_t
000000000186e610 W _ZnamSt11align_val_t
000000000186e620 W _ZnamSt11align_val_tRKSt9nothrow_t
0000000003587850 T _Znwm
0000000003587850 T _ZnwmRKSt9nothrow_t
000000000186e540 W _ZnwmSt11align_val_t
000000000186e5e0 W _ZnwmSt11align_val_tRKSt9nothrow_t

12 out of the 20 symbols are weak symbols.  This means that if a library gets linked in that has a custom allocator, it can override our weak versions of op new/delete.  This can lead to allocating memory on one heap and trying to deallocate it on another, which will almost certainly lead to a crash.
 
Blockedon: 752720
Components: Build
So unfortunately we have to wait until c++17 is enabled to fix this.

The reason some symbols are weak and others are strong:
* The strong symbols are added by //base/allocator/allocator_shim_override_cpp_symbols.h
* The weak symbols are added by //buildtools/third_party/libc++/trunk/src/new.cpp

Actually, libc++ adds weak symbols for all 20 symbols that are exported by chrome, but only 8 of them are overriden by the allocator shim, so that's why some are strong and some are weak.

The two missing classes of allocation symbols are: sized delete, and aligned new/delete.  We could add the sized delete ones right now I think, but we can't add the aligned ones until c++17 is enabled, because that's when std::align_val_t was added.

I think we've gotten away with this so far because sized delete was c++14 and aligned new/delete was c++17, so I guess it's pretty unlikely that any of Chrome's dependencies would be using these features right now.
Project Member

Comment 2 by bugdroid1@chromium.org, Jun 25 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/1f404f7107727532c665a6aed5806b5ff8ef46dd

commit 1f404f7107727532c665a6aed5806b5ff8ef46dd
Author: Tom Anderson <thomasanderson@chromium.org>
Date: Mon Jun 25 20:51:43 2018

Add sized delete operators to allocator shim

Sized deletion was added in c++14.  Now that Chrome is building with c++14, we
must override sized operator delete for symbol linkage consistency (see bug
855773).

R=thakis
BUG= 855773 

Change-Id: Idb673307939119ec520f71911e2074db2496b5ae
Reviewed-on: https://chromium-review.googlesource.com/1112731
Commit-Queue: Thomas Anderson <thomasanderson@chromium.org>
Reviewed-by: Nico Weber <thakis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#570172}
[modify] https://crrev.com/1f404f7107727532c665a6aed5806b5ff8ef46dd/base/allocator/allocator_shim_override_cpp_symbols.h

Oh wow scary bug, thanks for fixing sized delete in #2.

> This means that if a library gets linked in that has a custom allocator,

If that happens (linking a library that has a custom allocator), Chrome is likely to be busted (read: crash) anyways on Linux, even if all 20 symbols are defined.
By default the allocator shim will route all allocations through libc (see allocator_shim_default_dispatch_to_glibc.cc), so if we link any 3p library that redefines malloc & co we'd end up in a situation where both "chrome" (the root executable) and "lib3p.so" define malloc.
The "malloc" in chrome will always win the resolution over "malloc" in lib3p.so (because IIRC strong symbols are resolved using a BFS starting from the root link unit), but then the code in lib3p.so will very likely have internal calls to its own allocator which don't go through PLT (unless it's linked with -Bsymbolic or something similar), and end up in a split-heap situation regardless.
Cc: primiano@chromium.org
> If that happens (linking a library that has a custom allocator), Chrome is likely to be busted (read: crash) anyways on Linux

Oh no D:
That sounds like what libwidevinecdm.so does (bug 760259).
> if a library gets linked in that has a custom allocator, it can override our weak versions of op new/delete

Only if the library is linked statically. The dynamic loader does not care about weak/strong, the first definition that it sees always wins (and the executable is always loaded first so its symbols always win).
Project Member

Comment 6 by bugdroid1@chromium.org, Jan 9

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/c301d11bc17d7ed21d81927dfc14ade33b3c2512

commit c301d11bc17d7ed21d81927dfc14ade33b3c2512
Author: Tom Anderson <thomasanderson@chromium.org>
Date: Wed Jan 09 18:44:13 2019

Add aligned new/delete operators to allocator shim

BUG= 855773 
R=thakis

Change-Id: Ieaad3b59d07b4b655f55b87c55aebfc31f8ab531
Reviewed-on: https://chromium-review.googlesource.com/c/1401050
Reviewed-by: Primiano Tucci <primiano@chromium.org>
Reviewed-by: Nico Weber <thakis@chromium.org>
Commit-Queue: Thomas Anderson <thomasanderson@chromium.org>
Cr-Commit-Position: refs/heads/master@{#621242}
[modify] https://crrev.com/c301d11bc17d7ed21d81927dfc14ade33b3c2512/base/BUILD.gn
[modify] https://crrev.com/c301d11bc17d7ed21d81927dfc14ade33b3c2512/base/allocator/allocator_shim.cc
[modify] https://crrev.com/c301d11bc17d7ed21d81927dfc14ade33b3c2512/base/allocator/allocator_shim_override_cpp_symbols.h

Status: Fixed (was: Assigned)
Status: Started (was: Fixed)
Project Member

Comment 9 by bugdroid1@chromium.org, Jan 9

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/867312ae0daf4e7a1bc19701e71c815804ac8f40

commit 867312ae0daf4e7a1bc19701e71c815804ac8f40
Author: Thomas Anderson <thomasanderson@chromium.org>
Date: Wed Jan 09 21:48:39 2019

Revert "Add aligned new/delete operators to allocator shim"

This reverts commit c301d11bc17d7ed21d81927dfc14ade33b3c2512.

Reason for revert: Causing build failure in certain configs that use precompiled headers

Original change's description:
> Add aligned new/delete operators to allocator shim
> 
> BUG= 855773 
> R=​thakis
> 
> Change-Id: Ieaad3b59d07b4b655f55b87c55aebfc31f8ab531
> Reviewed-on: https://chromium-review.googlesource.com/c/1401050
> Reviewed-by: Primiano Tucci <primiano@chromium.org>
> Reviewed-by: Nico Weber <thakis@chromium.org>
> Commit-Queue: Thomas Anderson <thomasanderson@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#621242}

TBR=thakis@chromium.org,primiano@chromium.org,thomasanderson@chromium.org

Change-Id: Ie2bbc18d2cae6559169a1820b10dd15aa1fd9ccf
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug:  855773 
Reviewed-on: https://chromium-review.googlesource.com/c/1404065
Reviewed-by: Thomas Anderson <thomasanderson@chromium.org>
Commit-Queue: Thomas Anderson <thomasanderson@chromium.org>
Cr-Commit-Position: refs/heads/master@{#621299}
[modify] https://crrev.com/867312ae0daf4e7a1bc19701e71c815804ac8f40/base/BUILD.gn
[modify] https://crrev.com/867312ae0daf4e7a1bc19701e71c815804ac8f40/base/allocator/allocator_shim.cc
[modify] https://crrev.com/867312ae0daf4e7a1bc19701e71c815804ac8f40/base/allocator/allocator_shim_override_cpp_symbols.h

Project Member

Comment 10 by bugdroid1@chromium.org, Jan 11

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/2ce48fbdc4fdcddf11c95135618b26e8aa66f58a

commit 2ce48fbdc4fdcddf11c95135618b26e8aa66f58a
Author: Tom Anderson <thomasanderson@chromium.org>
Date: Fri Jan 11 22:19:34 2019

[Reland] Add aligned new/delete operators to allocator shim

This CL is a reland of [1] with a fix for when using precompiled headers.  The
object file allocator_shim.o is byte-for-byte identical to the one built at [1]
(at least on a Linux release build).

[1] https://chromium-review.googlesource.com/c/chromium/src/+/1401050

BUG= 855773 
R=thakis

Change-Id: Ic4321f5c1526e1ecfdffcb58cfb2687875316fa5
Reviewed-on: https://chromium-review.googlesource.com/c/1407435
Reviewed-by: Nico Weber <thakis@chromium.org>
Reviewed-by: Primiano Tucci <primiano@chromium.org>
Commit-Queue: Thomas Anderson <thomasanderson@chromium.org>
Cr-Commit-Position: refs/heads/master@{#622185}
[modify] https://crrev.com/2ce48fbdc4fdcddf11c95135618b26e8aa66f58a/base/allocator/allocator_shim.cc
[modify] https://crrev.com/2ce48fbdc4fdcddf11c95135618b26e8aa66f58a/base/allocator/allocator_shim_override_cpp_symbols.h

Status: Fixed (was: Started)

Sign in to add a comment