LLVM Bugzilla is read-only and represents the historical archive of all LLVM issues filled before November 26, 2021. Use github to submit LLVM bugs

Bug 26808 - Lots of sketchy behaviour masked by RecyclingAllocator
Summary: Lots of sketchy behaviour masked by RecyclingAllocator
Status: NEW
Alias: None
Product: new-bugs
Classification: Unclassified
Component: new bugs (show other bugs)
Version: trunk
Hardware: PC All
: P normal
Assignee: Unassigned LLVM Bugs
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-03-02 00:01 PST by Justin Bogner
Modified: 2016-05-09 07:11 PDT (History)
9 users (show)

See Also:
Fixed By Commit(s):


Attachments
Patch to make Recycler asan-aware (1.39 KB, application/octet-stream)
2016-03-02 00:01 PST, Justin Bogner
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Justin Bogner 2016-03-02 00:01:58 PST
Created attachment 15971 [details]
Patch to make Recycler asan-aware

The attached patch teaches Recycler (and by proxy RecyclingAllocator) to poison and unpoison memory for ASAN. Running ninja check under ASAN with this applied hits a few thousand failures. Some of the issues include:

- We don't allocate nodes in SelectionDAG correctly - we always call an SDNode allocator and upcast to the (much larger) subclasses. This mostly works since the RecyclingAllocator is set to allocate 296 bytes per node.

- SelectionDAG sets node types to "ISD::DELETED_NODE" before returning them to the free list, ostensibly to detect bugs. Then it *uses whether or not the thing is deleted* for control flow in places like UpdateChainsAndGlue. This *should not work*, but apparently it tends to in practice.

- SelectionDAG arbitrarily casts from smaller SDNodes to MachineSDNode in MorphNodeTo. This is very much undefined behaviour, but basically works since the allocations happen to be large enough.

- There's probably a use-after-free of `Tail` in TargetInstrInfo::ReplaceTailWithBranchTo.

- RegisterCoalescer::reMaterializeTrivialDef appears to have use-after-free bugs regarding MachineInstrs.
Comment 1 Hal Finkel 2016-03-02 08:08:38 PST
Wow. s/sketchy/incorrect/
Comment 2 Justin Bogner 2016-03-02 13:01:59 PST
r262500 makes us allocate SDNodes with correct sizes
Comment 3 Peter Cooper 2016-03-02 16:45:00 PST
Looking at UpdateChainsAndGlue.  The likely culprit is the dead nodes set in MorphNodeTo.  We need the nodes killed in MorphNodeTo to be removed from the lists passed to UpdateChainsAndGlue.

Also, all of this is horrible!
Comment 4 Justin Bogner 2016-04-13 18:16:37 PDT
All of the errors outside of SelectionDAG are fixed as of r266150, r266130, r264470, r264455, r264443, and r264442. SelectionDAG's harder, and I'll continue to dig into that.