Skip to content

[Asan + MSVC] Boost\libs\phoenix failed to build with stack-use-after-scope on windows #128

Description

@PhoebeHui

Issue Description:

Building Boost\libs\phoenix with Asan on windows failed due to stack-use-after-scope, could you please take a look? Thanks in advance.

Reproduce Steps:

1. git clone -c core.autocrlf=true --recursive ​https://github.com/boostorg/boost.git C:\gitP\boostorg and checkout commit 1a80576
2. open a VS 2022 x64 command prompt and browse to C:\gitP\boostorg
3. set _CL_= /fsanitize=address /GS- /wd5072 /DBOOST_TIMER_ENABLE_DEPRECATED & set _LINK_= /InferASanLibs /incremental:no /debug
4. .\bootstrap
5. .\b2 headers variant=release --build-dir=C:\gitP\boostorg\boost\amd64 address-model=64 architecture=x86
6. .\b2 variant=release --build-dir=C:\gitP\boostorg\boost\amd64 address-model=64 architecture=x86
7. .\b2 -j16 variant=release --build-dir=C:\gitP\boostorg\boost\amd64 libs\phoenix\test address-model=64 

Failures:

testing.capture-output C:\gitP\boostorg\boost\amd64\boost\bin.v2\libs\phoenix\test\bind_dm_test.test\msvc-14.3\release\x86_64\threading-multi\bind_dm_test.run
====== BEGIN OUTPUT ======
=================================================================
==3924==ERROR: AddressSanitizer: stack-use-after-scope on address 0x0078ad59fb78 at pc 0x7ff67240428b bp 0x0078ad59f910 sp 0x0078ad59f910
READ of size 4 at 0x0078ad59fb78 thread T0
    #0 0x7ff67240428a in main (C:\gitP\boostorg\boost\amd64\boost\bin.v2\libs\phoenix\test\bind_dm_test.test\msvc-14.3\release\x86_64\threading-multi\bind_dm_test.exe+0x14000428a)
    #1 0x7ff67240598e in invoke_main C:\repos\msvc\src\vctools\crt\vcstartup\src\startup\exe_common.inl:78
    #2 0x7ff67240598e in __scrt_common_main_seh C:\repos\msvc\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288
    #3 0x7fff8bf5e956  (C:\WINDOWS\System32\KERNEL32.DLL+0x18002e956)
    #4 0x7fff8db47c1b  (C:\WINDOWS\SYSTEM32\ntdll.dll+0x180087c1b)

Address 0x0078ad59fb78 is located in stack of thread T0 at offset 568 in frame
    #0 0x7ff6724039cf in main (C:\gitP\boostorg\boost\amd64\boost\bin.v2\libs\phoenix\test\bind_dm_test.test\msvc-14.3\release\x86_64\threading-multi\bind_dm_test.exe+0x1400039cf)

  This frame has 18 object(s):
    [32, 36) 'x'
    [48, 56) 'compiler temporary'
    [64, 72) 'compiler temporary'
    [80, 88) 'compiler temporary'
    [96, 112) 'compiler temporary'
    [112, 128) 'compiler temporary'
    [128, 132) 'cx'
    [144, 152) 'compiler temporary'
    [160, 168) 'compiler temporary'
    [176, 184) 'compiler temporary'
    [192, 208) 'compiler temporary'
    [208, 224) 'compiler temporary'
    [224, 248) 'compiler temporary'
    [240, 256) 'that'
    [256, 272) 'that'
    [272, 280) 'compiler temporary'
    [288, 304) 'that'
    [304, 308) 'compiler temporary' <== Memory access at offset 568 overflows this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
      (longjmp, SEH and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-use-after-scope (C:\gitP\boostorg\boost\amd64\boost\bin.v2\libs\phoenix\test\bind_dm_test.test\msvc-14.3\release\x86_64\threading-multi\bind_dm_test.exe+0x14000428a) in main
Shadow bytes around the buggy address:
  0x0078ad59f880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0078ad59f900: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 04 f2 f8 f2
  0x0078ad59f980: f8 f2 f8 f2 f8 f8 f2 f2 f2 f2 f8 f8 f2 f2 f2 f2
  0x0078ad59fa00: 04 f2 f8 f2 f8 f2 f8 f2 f8 f8 f2 f2 f2 f2 f8 f8
  0x0078ad59fa80: f2 f2 f2 f2 00 00 00 f2 f2 f2 f2 f8 f8 f2 f2 f2
=>0x0078ad59fb00: f2 f8 f8 f2 f2 f2 f2 f8 f2 f8 f8 f2 f2 f2 f2[f8]
  0x0078ad59fb80: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00
  0x0078ad59fc00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0078ad59fc80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0078ad59fd00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0078ad59fd80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==3924==ABORTING
 
EXIT STATUS: 1 
====== END OUTPUT ======


testing.capture-output C:\gitP\boostorg\boost\amd64\boost\bin.v2\libs\phoenix\test\more_let_tests.test\msvc-14.3\release\x86_64\threading-multi\more_let_tests.run
====== BEGIN OUTPUT ======
=================================================================
==30784==ERROR: AddressSanitizer: stack-use-after-scope on address 0x00568beff450 at pc 0x7ff732d29b94 bp 0x00568beff090 sp 0x00568beff090
READ of size 4 at 0x00568beff450 thread T0
    #0 0x7ff732d29b93 in main (C:\gitP\boostorg\boost\amd64\boost\bin.v2\libs\phoenix\test\more_let_tests.test\msvc-14.3\release\x86_64\threading-multi\more_let_tests.exe+0x140009b93)
    #1 0x7ff732d2c08e in invoke_main C:\repos\msvc\src\vctools\crt\vcstartup\src\startup\exe_common.inl:78
    #2 0x7ff732d2c08e in __scrt_common_main_seh C:\repos\msvc\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288
    #3 0x7fff8bf5e956  (C:\WINDOWS\System32\KERNEL32.DLL+0x18002e956)
    #4 0x7fff8db47c1b  (C:\WINDOWS\SYSTEM32\ntdll.dll+0x180087c1b)

Address 0x00568beff450 is located in stack of thread T0 at offset 912 in frame
    #0 0x7ff732d290ff in main (C:\gitP\boostorg\boost\amd64\boost\bin.v2\libs\phoenix\test\more_let_tests.test\msvc-14.3\release\x86_64\threading-multi\more_let_tests.exe+0x1400090ff)

  This frame has 64 object(s):
    [32, 40) 'compiler temporary'
    [48, 56) 'compiler temporary'
    [64, 72) 'compiler temporary'
    [80, 88) 'compiler temporary'
    [96, 100) 'y'
    [112, 117) 'compiler temporary'
    [128, 132) 'y'
    [144, 149) 'compiler temporary'
    [160, 164) 'y'
    [176, 184) 'compiler temporary'
    [192, 193) 'compiler temporary'
    [208, 211) 'compiler temporary'
    [224, 236) 'compiler temporary'
    [240, 244) 'y'
    [256, 264) 'compiler temporary'
    [272, 273) 'compiler temporary'
    [288, 291) 'compiler temporary'
    [304, 316) 'compiler temporary'
    [320, 324) 'y'
    [336, 344) 'compiler temporary'
    [352, 353) 'compiler temporary'
    [368, 371) 'compiler temporary'
    [384, 396) 'compiler temporary'
    [400, 404) 'y'
    [416, 424) 'compiler temporary'
    [432, 433) 'compiler temporary'
    [448, 451) 'compiler temporary'
    [464, 476) 'compiler temporary'
    [480, 484) 'y'
    [496, 497) 'compiler temporary'
    [512, 515) 'compiler temporary'
    [528, 540) 'compiler temporary'
    [544, 548) 'y'
    [560, 561) 'compiler temporary'
    [576, 579) 'compiler temporary'
    [592, 604) 'compiler temporary'
    [608, 609) 'compiler temporary'
    [624, 632) 'env'
    [640, 641) 'compiler temporary'
    [656, 672) 'compiler temporary'
    [672, 680) 'env'
    [688, 692) 'vars_'
    [704, 712) 'locals'
    [720, 736) 'env'
    [736, 737) 'compiler temporary'
    [752, 753) 'compiler temporary'
    [768, 784) 'compiler temporary'
    [784, 800) 'env'
    [800, 808) 'locals'
    [816, 832) 'env'
    [832, 848) 'compiler temporary'
    [848, 849) 'compiler temporary'
    [864, 876) 'that'
    [880, 881) 'compiler temporary'
    [896, 897) 'd'
    [912, 928) 'env' <== Memory access at offset 912 is inside this variable
    [928, 929) 'compiler temporary'
    [944, 960) 'compiler temporary'
    [960, 968) 'vars_'
    [976, 992) 'locals'
    [992, 1016) 'env'
    [1008, 1024) 'compiler temporary'
    [1024, 1025) 'compiler temporary'
    [1040, 1041) 'd'
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
      (longjmp, SEH and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-use-after-scope (C:\gitP\boostorg\boost\amd64\boost\bin.v2\libs\phoenix\test\more_let_tests.test\msvc-14.3\release\x86_64\threading-multi\more_let_tests.exe+0x140009b93) in main
Shadow bytes around the buggy address:
  0x00568beff180: 01 f2 03 f2 00 04 f2 f2 f2 f2 04 f2 00 f2 01 f2
  0x00568beff200: 03 f2 00 04 f2 f2 f2 f2 04 f2 00 f2 01 f2 03 f2
  0x00568beff280: 00 04 f2 f2 f2 f2 04 f2 00 f2 01 f2 03 f2 00 04
  0x00568beff300: f2 f2 f2 f2 04 f2 01 f2 03 f2 00 04 f2 f2 f2 f2
  0x00568beff380: 04 f2 01 f2 03 f2 00 04 f2 f2 f2 f2 f8 f2 f8 f2
=>0x00568beff400: f8 f2 f8 f8 f2 f2 f2 f2 f8 f2[f8]f2 f8 f2 00 00
  0x00568beff480: f2 f2 f2 f2 01 f2 01 f2 00 00 f2 f2 f2 f2 00 00
  0x00568beff500: f2 f2 f2 f2 00 f2 00 00 f2 f2 f2 f2 00 00 f2 f2
  0x00568beff580: f2 f2 01 f2 00 04 f2 f2 f2 f2 01 f2 01 f2 00 00
  0x00568beff600: f2 f2 f2 f2 01 f2 00 00 f2 f2 f2 f2 00 f2 00 00
  0x00568beff680: f2 f2 f2 f2 00 00 00 f2 f2 f2 f2 00 00 f2 f2 f2
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==30784==ABORTING
 
EXIT STATUS: 1 
====== END OUTPUT ======

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions