This is an archive of the discontinued LLVM Phabricator instance.

Fix heap-use-after-free when clearing DIEs in fission compile units.
ClosedPublic

Authored by rupprecht on Sep 13 2022, 10:53 AM.

Details

Summary

D131437 caused heap-use-after-free failures when testing TestCreateAfterAttach.py in asan mode, and "regular" crashes outside of asan.

This appears to be due to a mismatch in a couple places where we choose to clear the DIEs. When we clear the DIE of a skeleton unit, we unconditionally clear the DIE of the DWO unit if it exists. However, ~ScopedExtractDIEs() only looks at the skeleton unit when deciding to clear. If we decide to clear the skeleton unit because it is now unused, we end up clearing the DWO unit that _is_ used. This change adds a guard by checking m_cancel_scopes to prevent clearing the DWO unit.

This is 100% reproducible by running TestCreateAfterAttach.py in asan mode, although it only seems to reproduce in our internal build, so no test case is added here. If someone has suggestions on how to write one, I can add it.

Diff Detail

Event Timeline

rupprecht created this revision.Sep 13 2022, 10:53 AM
Herald added a project: Restricted Project. · View Herald TranscriptSep 13 2022, 10:53 AM
rupprecht requested review of this revision.Sep 13 2022, 10:53 AM
Herald added a project: Restricted Project. · View Herald TranscriptSep 13 2022, 10:53 AM

LGTM, but I will let Pavel comment since he did the fission support.

labath accepted this revision.Sep 14 2022, 2:25 AM
This revision is now accepted and ready to land.Sep 14 2022, 2:25 AM

Thanks for following up on this and fixing the issue!