gopalshankar / address-sanitizer

Automatically exported from code.google.com/p/address-sanitizer
0 stars 0 forks source link

ASAN coverage missing DTORs and inline functions #311

Open GoogleCodeExporter opened 9 years ago

GoogleCodeExporter commented 9 years ago
#include <stdio.h>
struct AAA { virtual ~AAA() { printf("~AAA\n"); } };
struct BBB : public AAA {};
struct CCC: public BBB { virtual ~CCC() { printf("~CCC\n"); } };
AAA *a = new CCC;
int main() { delete a; }

clang++ -O1 -g   -fsanitize=address -mllvm -asan-coverage=1   ~/tmp/dtor3.cc

Objdump shows the following DTORs (do not demangle the symbols to see the 
differences):
_ZN3AAAD0Ev
_ZN3AAAD2Ev
_ZN3BBBD0Ev
_ZN3CCCD0Ev
_ZN3CCCD2Ev

When coverage is run, only these are covered -- no BBB is present: 
_ZN3CCCD2Ev
_ZN3CCCD0Ev
_ZN3AAAD2Ev

Original issue reported on code.google.com by aa...@google.com on 19 May 2014 at 3:37

GoogleCodeExporter commented 9 years ago

Original comment by konstant...@gmail.com on 19 May 2014 at 4:05

GoogleCodeExporter commented 9 years ago
we have similar problem with regular functions, not just DTORs. 

==> foo.cc <==
int Foo(int i) { return i; }
__attribute__((noinline))
int Bar() { return Foo(0); }
extern int Zab();
int main(int argc, char **argv) {
  if (argc == 1) Bar();
  else Zab();
}

==> zab.cc <==
extern int Foo(int i);
int Zab() { return Foo(1); }

We have two calls to Foo(); 
One call is inlined and is executed. 
Another call is not inlined and is not executed. 

The current asan coverage with -O2 will show that Foo() is present in the list 
of instrumented symbols but is not covered. 
I dislike both of the straightforward solutions (stop inlining and instrument 
for coverage before inlining). 
And I don't see any good performance-neutral solution... 

The situation with empty DTORs is a bit different because empty DTORs are 
inlined 
even at -O1 (but not at -O0)

Original comment by konstant...@gmail.com on 20 May 2014 at 7:33