Closed ramosian-glider closed 9 years ago
The problem is reproducible only when Chromium Framework is build with component=shared_library
(opposed to component=static_library)
Looks like in this case __CFAllocatorInitialize isn't called before __asan_init(),
and __kCFAllocatorSystemDefault._context.info isn't initialized, which leads to a NULL
deref.
Because it's hard to call __CFAllocatorInitialize directly, the fix should probably
just initialize __kCFAllocatorSystemDefault._context.info with the return value malloc_zone_default()
before it has been replaced by ASan.
Reported by ramosian.glider
on 2012-07-05 10:16:19
Looks like it's insufficient to re-implement parts of __CFAllocatorInitialize in the
runtime, so I've ended up trying to call some existing initialization routine.
__CFAllocatorInitialize can't be called solely: it's a private symbol, moreover, CF
relies on the fact it's called after
__kCFNotATypeTypeID = _CFRuntimeRegisterClass(&__CFNotATypeClass);
__kCFTypeTypeID = _CFRuntimeRegisterClass(&__CFTypeClass);
, which also initialize private symbols (see http://opensource.apple.com/source/CF/CF-550.43/CFRuntime.c)
Thus, one needs to call at least __CFInitialize in order to initialize properly.
Doing so has caused many assertions to fire (__CFInitialize() uses calloc(), malloc(),
strdup(), strchr() etc.) and finally caused error reports about unallocated memory
being passed to free().
My current idea is to intercept __CFInitialize and replace the default CFAllocator
right after the exit from it: until then neither of the CFAllocators can be used reliably,
so this should be safe.
Reported by ramosian.glider
on 2012-07-05 13:40:33
r159749 should fix the issue.
Reported by ramosian.glider
on 2012-07-05 14:47:26
Fixed
Because __CFRuntimeClassTableSize is unavailable on 10.7, I've landed r159819, which
unconditionally calls CFAllocatorSetDefault() from __asan_init() on Lion.
This means the described bug may (possibly) re-appear on Lion, and in order to prevent
this we'll need to check some bits in __kCFAllocatorSystemDefault.
However I couldn't reproduce the problem with Chromium tests in both component=shared_library
and component=static_library, so this is a minor problem now.
Reported by ramosian.glider
on 2012-07-06 12:17:37
Started
I've got rid of the __CFRuntimeClassTableSize (checking for kCFAllocatorSystemDefault._base._cfisa
instead), but it turns out that CFAllocatorCreate() depends on __CFInitialize() on
Lion, so it should be moved to the __CFInitialize() wrapper as well.
Reported by ramosian.glider
on 2012-07-06 13:08:26
Ok, now CFAllocatorReplace() is called from __asan_init() or CFInitialize() depending
on which is called later. I've checked that ASan tests pass and Chromium base_unittests
run when built in both modes on both Lion and Snow Leopard.
Reported by ramosian.glider
on 2012-07-06 14:14:58
Fixed
Adding Project:AddressSanitizer as part of GitHub migration.
Reported by ramosian.glider
on 2015-07-30 09:12:59
Originally reported on Google Code with ID 87
Reported by
ramosian.glider
on 2012-07-04 17:05:56