New issue
Advanced search Search tips

Issue 895664 link

Starred by 1 user

Issue metadata

Status: Untriaged
Owner: ----
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 3
Type: Bug



Sign in to add a comment

SuperSize: Symbols with the identical full_name but in different sections lead to bogus symbols.

Project Member Reported by hua...@chromium.org, Oct 16

Issue description

SuperSize uses full_name to look up source paths. However, there are weird cases where two unrelated symbols with the same name, but in different sections can be mashed together, leading to bogus symbols.

An example for chrome_public_apk is the symbol with full_name 'clip1'. Both LLD and LLD-LTO exhibit this, but let's look at the *non-LTO LLD* build (since the .o files are ELF and easier to deal with). In SuperSize console:

>>> for s in [s for s in size_info.raw_symbols if s.name == 'clip1']: Print(s)
b@0x2f267a8  383 (size=766) third_party/libwebp/src/dsp/dec_clip_tables.c
    clip1 (num_aliases=2)
b@0x2f267a8  383 (size=766) third_party/libwebp/src/dsp/enc.c
    clip1 (num_aliases=2)

However, looking at the sources, we see:

********
enc.c: https://cs.corp.google.com/piper///depot/google3/third_party/libwebp/v0_2/src/dsp/enc.c?rcl=193265058&l=87

static uint8_t clip1[255 + 510 + 1];    // clips [-255,510] to [0,255]

********
dec_clip_tables.c: https://cs.corp.google.com/piper///depot/google3/third_party/libwebp/v0_2/src/dsp/dec_clip_tables.c?rcl=172184170&l=264

#if (USE_STATIC_TABLES == 1)
...
static const uint8_t clip1[255 + 511 + 1] = {
...
#else
...
static uint8_t clip1[255 + 511 + 1];
...
#endif


The two variables have sizes 766 and 767 respectively. So somehow the second one disappeared?

Let's look at the .map file (need to decompress lib.unstripped/libchrome.so.map.gz):
$ grep \\bclip1\\b --line-number libchrome.so.map
1720877: 304b11c  304b11c      2fe     1         obj/third_party/libwebp/libwebp_dsp.a(libwebp_dsp/enc.o):(.bss.clip1)
1720878: 304b11c  304b11c      2fe     1                 clip1

So only enc.o one made it to the ELF?

Let's run llvm-nm on the separate .o files (in /obj/third_party/libwebp/libwebp_dsp/):

$ nm enc.o | grep \\bclip1\\b
00000000 b clip1

$ nm dec_clip_tables.o | grep \\bclip1\\b
00000000 r clip1

So the 'clip1' symbol are in different sections (.bss and .rodata), and the second one was trimmed, and probably should be excluded. But it seems that when SuperSize runs nm on enc.o and dec_clip_tables.o, it stores

  {..., 'clip1': ['.../enc.o', '.../dec_clip_table.o'], ...}

which _AssignNmAliasPathsAndCreatePathAliases() used to duplicate 'clip1' found in the .map file!

 
Another way to repro this faster is to manually add similar things into Zucchini:

*** components/zucchini/zucchini_gen.cc ***

(right after #includes)

int asdf[128];

int doStuff1() {
  int ret = 0;
  for (int i = 0; i < 128; ++i) {
    asdf[i] = 1024 * i;
    ret += asdf[i] / 3;
  }
  return ret;
}

int blah1 = doStuff1();

*** components/zucchini/zucchini_apply.cc ***

(right after #includes)

const int asdf[160] = {3, 1, 4, 1, 5, 9, 2, 6, 5, 3, 5, 8, 9, 7, 9, 3};

int doStuff2() {
  int ret = 1;
  for (int i = 0; i < 160; ++i) {
    printf("%d\n", asdf[i]);
    ret *= asdf[i];
  }
  return ret;
}

int blah2 = doStuff2();

========

The diff is attached.

Running SuperSize on Zucchini (LLD, no LTO):

$ supersize archive -f zucchini zuc.size
$ supersize console zuc.size
>>> for s in [s for s in size_info.raw_symbols if s.full_name == 'asdf']: Print(s)
r@0x2086f0   323 (size=646) components/zucchini/zucchini_apply.cc
    asdf (num_aliases=2)
r@0x2086f0   323 (size=646) components/zucchini/zucchini_gen.cc
    asdf (num_aliases=2)
b@0x2bcda0   256 (size=512) components/zucchini/zucchini_apply.cc
    asdf (num_aliases=2)
b@0x2bcda0   256 (size=512) components/zucchini/zucchini_gen.cc
    asdf (num_aliases=2)

zuc.diff
1.2 KB Download
This might be a fringe issue, so I tried to hack a quick-and-dirty solution to see what the impact is on Chrome. Tried to do this by embedding the section letter as the key for |object_paths_by_name|, and removing it where applicable (e.g., for demangling & _CreatePakObjectMap()), but I haven't gotten this to run yet.
Note: This problem was found after fixing 892651: I was comparing symbols before and after https://chromium-review.googlesource.com/c/1278959 , and the 'clip1' issue is the first item. Still need to see if there are other types of oddity.

Sign in to add a comment