[Bug 279560] FreeBSD 14.1 ships libc++ which passes wrong size to sized operator delete

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=279560

            Bug ID: 279560
           Summary: FreeBSD 14.1 ships libc++ which passes wrong size to
                    sized operator delete
           Product: Base System
           Version: 14.0-RELEASE
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Many People
          Priority: ---
         Component: standards
          Assignee: standards@FreeBSD.org
          Reporter: alkondratenko@gmail.com

Hi. I maintain gperftools (https://github.com/gperftools/gperftools). I noticed
announcement of release of 14.1 and installed it in VM. When I run gperftools
unit tests "debug" configurations pretty much ~all fail due to mismatch between
requested allocation size and allocation size passed to sized delete.

It should be straighforward to reproduce by simply git cloning from github and
running ./autogen.sh && ./configure && make check

I don't have capacity to investigate more, but I have backtrace of allocation:

#0  MallocBlock::Initialize (this=this@entry=0xc480f0, size=size@entry=25,
type=type@entry=-21308287) at src/debugallocation.cc:382
#1  0x0000000000225e4c in MallocBlock::Allocate (size=size@entry=25,
type=-21308287) at src/debugallocation.cc:560
#2  0x00000000002245d1 in DebugAllocate (size=25, type=type@entry=-21308287) at
src/debugallocation.cc:1051
#3  0x000000000026eff4 in debug_cpp_alloc (size=12878064, new_type=-21308287,
nothrow=false) at src/debugallocation.cc:1220
#4  tc_new (size=12878064) at src/debugallocation.cc:1328
#5  0x0000000000256edd in
std::__1::__libcpp_operator_new[abi:se180100]<unsigned long>(unsigned long)
(__args=25) at /usr/include/c++/v1/new:271
#6  std::__1::__libcpp_allocate[abi:se180100](unsigned long, unsigned long)
(__size=25, __align=1) at /usr/include/c++/v1/new:295
#7  std::__1::allocator<char>::allocate[abi:se180100](unsigned long)
(this=0x7fffffffd878, __n=25) at /usr/include/c++/v1/__memory/allocator.h:125
#8  std::__1::__allocate_at_least[abi:se180100]<std::__1::allocator<char>
>(std::__1::allocator<char>&, unsigned long) (__alloc=..., __n=25)
    at /usr/include/c++/v1/__memory/allocate_at_least.h:55
#9  std::__1::basic_string<char, std::__1::char_traits<char>,
std::__1::allocator<char> >::__init (this=0x7fffffffd878, __sz=23,
__s=<optimized out>) at /usr/include/c++/v1/string:2212
#10
_ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEC2B8se180100ILi0EEEPKc
(this=0x7fffffffd878, __s=<optimized out>) at /usr/include/c++/v1/string:954
#11 testing::internal::UnitTestImpl::GetTestSuite (this=0xc50020,
test_suite_name=0xc4e021 "MallocExtensionTest", type_param=0x0,
set_up_tc=set_up_tc@entry=0x0, 
    tear_down_tc=tear_down_tc@entry=0x0) at
vendor/googletest/googletest/src/gtest.cc:5786
#12 0x000000000025d7d2 in testing::internal::UnitTestImpl::AddTestInfo
(this=<optimized out>, set_up_tc=0x0, tear_down_tc=0x0,
test_info=test_info@entry=0xc4e020)
    at ./vendor/googletest/googletest/src/gtest-internal-inl.h:690
#13 0x0000000000242ba3 in testing::internal::MakeAndRegisterTestInfo
(test_suite_name=<optimized out>, name=0x209287 "Basics",
type_param=type_param@entry=0x0, 
    value_param=value_param@entry=0x0, code_location=...,
fixture_class_id=fixture_class_id@entry=0x4237f1
<testing::internal::TypeIdHelper<testing::Test>::dummy_>, set_up_tc=0x0, 
    tear_down_tc=0x0, factory=0xc4c020) at
vendor/googletest/googletest/src/gtest.cc:2794
#14 0x0000000000221fdb in __cxx_global_var_init () at
src/tests/malloc_extension_test.cc:47
#15 0x0000000000221fdb in _GLOBAL__sub_I_malloc_extension_test.cc ()
#16 0x000000080027df5d in objlist_call_init (list=list@entry=0x7fffffffe9c8,
lockstate=lockstate@entry=0x7fffffffe7d8) at
/usr/src/libexec/rtld-elf/rtld.c:3150
#17 0x000000080027cb89 in _rtld (sp=<optimized out>, exit_proc=0x7fffffffea40,
objp=0x7fffffffea48) at /usr/src/libexec/rtld-elf/rtld.c:990
#18 0x0000000800279df9 in rtld_start () at
/usr/src/libexec/rtld-elf/amd64/rtld_start.S:40

(we see it uses size of 25 bytes)

and this is backtrace of deallocation (which passes 24 bytes):

#0  0x0000000000227ecb in MallocBlock::CheckAndClear (this=0xc480f0,
type=<optimized out>, given_size=24) at src/debugallocation.cc:417
#1  0x0000000000227d66 in MallocBlock::Deallocate (this=0x4, type=2,
given_size=2138871) at src/debugallocation.cc:338
#2  0x0000000000224152 in DebugDeallocate (ptr=<optimized out>, type=2,
given_size=2138871) at src/debugallocation.cc:1065
#3  0x000000000026f460 in tc_delete_sized (p=<optimized out>, size=<optimized
out>) at src/debugallocation.cc:1350
#4  0x0000000000256f51 in
std::__1::__libcpp_operator_delete[abi:se180100]<void*, unsigned long>(void*,
unsigned long) (__args=2, __args=2) at /usr/include/c++/v1/new:280
#5  std::__1::__do_deallocate_handle_size[abi:se180100]<>(void*, unsigned long)
(__ptr=0x4, __size=2) at /usr/include/c++/v1/new:304
#6  std::__1::__libcpp_deallocate[abi:se180100](void*, unsigned long, unsigned
long) (__ptr=0x4, __size=2, __align=1) at /usr/include/c++/v1/new:317
#7  std::__1::allocator<char>::deallocate[abi:se180100](char*, unsigned long)
(this=0x7fffffffd878, __p=0x4 <error: Cannot access memory at address 0x4>,
__n=2)
    at /usr/include/c++/v1/__memory/allocator.h:139
#8  std::__1::allocator_traits<std::__1::allocator<char>
>::deallocate[abi:se180100](std::__1::allocator<char>&, char*, unsigned long)
(__a=..., 
    __p=0x4 <error: Cannot access memory at address 0x4>, __n=2) at
/usr/include/c++/v1/__memory/allocator_traits.h:289
#9  std::__1::basic_string<char, std::__1::char_traits<char>,
std::__1::allocator<char> >::~basic_string (this=0x7fffffffd878) at
/usr/include/c++/v1/string:1105
#10 testing::internal::UnitTestImpl::GetTestSuite (this=0xc50020,
test_suite_name=0xc4e021 "MallocExtensionTest", type_param=0x0,
set_up_tc=set_up_tc@entry=0x0, 
    tear_down_tc=tear_down_tc@entry=0x0) at
vendor/googletest/googletest/src/gtest.cc:5786
#11 0x000000000025d7d2 in testing::internal::UnitTestImpl::AddTestInfo
(this=<optimized out>, set_up_tc=0x0, tear_down_tc=0x0,
test_info=test_info@entry=0xc4e020)
    at ./vendor/googletest/googletest/src/gtest-internal-inl.h:690
#12 0x0000000000242ba3 in testing::internal::MakeAndRegisterTestInfo
(test_suite_name=<optimized out>, name=0x209287 "Basics",
type_param=type_param@entry=0x0, 
    value_param=value_param@entry=0x0, code_location=...,
fixture_class_id=fixture_class_id@entry=0x4237f1
<testing::internal::TypeIdHelper<testing::Test>::dummy_>, set_up_tc=0x0, 
    tear_down_tc=0x0, factory=0xc4c020) at
vendor/googletest/googletest/src/gtest.cc:2794
#13 0x0000000000221fdb in __cxx_global_var_init () at
src/tests/malloc_extension_test.cc:47
#14 0x0000000000221fdb in _GLOBAL__sub_I_malloc_extension_test.cc ()
#15 0x000000080027df5d in objlist_call_init (list=list@entry=0x7fffffffe9c8,
lockstate=lockstate@entry=0x7fffffffe7d8) at
/usr/src/libexec/rtld-elf/rtld.c:3150
#16 0x000000080027cb89 in _rtld (sp=<optimized out>, exit_proc=0x7fffffffea40,
objp=0x7fffffffea48) at /usr/src/libexec/rtld-elf/rtld.c:990
#17 0x0000000800279df9 in rtld_start () at
/usr/src/libexec/rtld-elf/amd64/rtld_start.S:40

Most likely, it is some sort of a bug in upstream clang's libc++ in whatever
version you ship. Although it is somewhat odd, given that Google runs with
sized deallocation enabled and with ~always latest clang/llvm bits, but maybe
they exercise different configuration.

-- 
You are receiving this mail because:
You are the assignee for the bug.