Project

General

Profile

Bug #19095 ยป use-after-poison.txt

nobu (Nobuyoshi Nakada), 10/31/2022 05:48 AM

 
generating golf_prelude.c
=================================================================
==39298==ERROR: AddressSanitizer: use-after-poison on address 0x00010a300e20 at pc 0x000104962790 bp 0x7ff7bbc865d0 sp 0x7ff7bbc865c8
READ of size 8 at 0x00010a300e20 thread T0
#0 0x10496278f in iterate_over_shapes_with_callback variable.c:1610
#1 0x104957505 in obj_ivar_each variable.c:1626
#2 0x10495734d in rb_ivar_foreach variable.c:1718
#3 0x1045e43c5 in inspect_obj object.c:675
#4 0x1048abad4 in exec_recursive thread.c:5177
#5 0x1048aa9eb in rb_exec_recursive thread.c:5205
#6 0x1045dcf41 in rb_obj_inspect object.c:718
#7 0x104a31d48 in ractor_safe_call_cfunc_0 vm_insnhelper.c:3072
#8 0x104a39b4c in vm_call0_cfunc_with_frame vm_eval.c:150
#9 0x104a37934 in vm_call0_cfunc vm_eval.c:164
#10 0x1049c48af in vm_call0_body vm_eval.c:210
#11 0x104a3aff9 in vm_call0_cc vm_eval.c:87
#12 0x1049c7c31 in rb_funcallv_scope vm_eval.c:1051
#13 0x1049be0c9 in rb_funcallv vm_eval.c:1066
#14 0x1045d302f in rb_inspect object.c:631
#15 0x1044c5729 in rb_f_p io.c:8987
#16 0x104a31d0f in ractor_safe_call_cfunc_m1 vm_insnhelper.c:3065
#17 0x104a0ceb5 in vm_call_cfunc_with_frame vm_insnhelper.c:3255
#18 0x1049f5987 in vm_call_cfunc vm_insnhelper.c:3276
#19 0x1049f36db in vm_call_method_each_type vm_insnhelper.c:3907
#20 0x1049f3126 in vm_call_method vm_insnhelper.c:4042
#21 0x10496ee44 in vm_call_general vm_insnhelper.c:4075
#22 0x104a1ab2b in vm_sendish vm_insnhelper.c:5062
#23 0x10498fdc1 in vm_exec_core insns.def:820
#24 0x1049db644 in rb_vm_exec vm.c:2378
#25 0x1049cc7a7 in eval_string_with_scope vm_eval.c:1791
#26 0x1049cbfa7 in rb_f_eval vm_eval.c:1834
#27 0x104a31d0f in ractor_safe_call_cfunc_m1 vm_insnhelper.c:3065
#28 0x104a0ceb5 in vm_call_cfunc_with_frame vm_insnhelper.c:3255
#29 0x1049f5987 in vm_call_cfunc vm_insnhelper.c:3276
#30 0x1049f36db in vm_call_method_each_type vm_insnhelper.c:3907
#31 0x1049f3126 in vm_call_method vm_insnhelper.c:4042
#32 0x10496ee44 in vm_call_general vm_insnhelper.c:4075
#33 0x104a1ab2b in vm_sendish vm_insnhelper.c:5062
#34 0x10498fdc1 in vm_exec_core insns.def:820
#35 0x1049db644 in rb_vm_exec vm.c:2378
#36 0x104a3f3cc in invoke_block vm.c:1406
#37 0x104a3e7f3 in invoke_block_from_c_bh vm.c:1480
#38 0x1049ce642 in vm_yield_with_cref vm.c:1517
#39 0x104a3b7a0 in vm_yield vm.c:1525
#40 0x1049c9239 in rb_yield_0 vm_eval.c:1348
#41 0x1049c938b in rb_yield vm_eval.c:1364
#42 0x1042781ac in rb_ary_collect array.c:3830
#43 0x104a31d48 in ractor_safe_call_cfunc_0 vm_insnhelper.c:3072
#44 0x104a0ceb5 in vm_call_cfunc_with_frame vm_insnhelper.c:3255
#45 0x1049f5987 in vm_call_cfunc vm_insnhelper.c:3276
#46 0x1049f36db in vm_call_method_each_type vm_insnhelper.c:3907
#47 0x1049f3053 in vm_call_method vm_insnhelper.c:4031
#48 0x10496ee44 in vm_call_general vm_insnhelper.c:4075
#49 0x104a1ab2b in vm_sendish vm_insnhelper.c:5062
#50 0x10498f63d in vm_exec_core insns.def:801
#51 0x1049db781 in rb_vm_exec vm.c:2387
#52 0x1049dfd74 in rb_iseq_eval_main vm.c:2637
#53 0x10440235a in rb_ec_exec_node eval.c:283
#54 0x104401daa in ruby_run_node eval.c:324
#55 0x10425c957 in rb_main main.c:38
#56 0x10425c7d9 in main main.c:57
#57 0x10f58f52d in start+0x1cd (dyld:x86_64+0x552d)

0x00010a300e20 is located 33525280 bytes inside of 33554432-byte region [0x000108308000,0x00010a308000)
allocated by thread T0 here:
#0 0x1058495e3 in wrap_posix_memalign+0xb3 (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x4b5e3)
#1 0x10444e301 in rb_aligned_malloc gc.c:11897
#2 0x104936089 in transient_heap_block_alloc transient_heap.c:305
#3 0x104935d4b in Init_TransientHeap transient_heap.c:453
#4 0x1044aa1dd in rb_call_inits inits.c:25
#5 0x1043fef54 in ruby_setup eval.c:89
#6 0x1043ff27c in ruby_init eval.c:101
#7 0x10425c943 in rb_main main.c:37
#8 0x10425c7d9 in main main.c:57
#9 0x10f58f52d in start+0x1cd (dyld:x86_64+0x552d)

SUMMARY: AddressSanitizer: use-after-poison variable.c:1610 in iterate_over_shapes_with_callback
Shadow bytes around the buggy address:
0x100021460170: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x100021460180: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x100021460190: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x1000214601a0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x1000214601b0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
=>0x1000214601c0: f7 f7 f7 f7[f7]f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x1000214601d0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x1000214601e0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x1000214601f0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x100021460200: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x100021460210: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==39298==ABORTING
    (1-1/1)