http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55289
--- Comment #30 from Jack Howarth <howarth at nitro dot med.uc.edu> 2012-11-14
16:54:06 UTC ---
(In reply to comment #29)
Thanks with the patch applied from comment 29, now the use-after-free testcase
works without errors...
howarth% ./use-after-free
=================================================================
==30656== ERROR: AddressSanitizer heap-use-after-free on address 0x000108843f45
at pc 0x105b8bf12 bp 0x7fff5a0748e0 sp 0x7fff5a0748d8
READ of size 1 at 0x000108843f45 thread T0
#0 0x105b8bf11 (/Users/howarth/./use-after-free+0x100000f11)
#1 0x7fff8bd827e0 (/usr/lib/system/libdyld.dylib+0x27e0)
#2 0x0
0x000108843f45 is located 5 bytes inside of 80-byte region
[0x000108843f40,0x000108843f90)
freed by thread T0 here:
#0 0x105b9a7a4 (/sw/lib/gcc4.8/lib/libasan.0.dylib+0xb7a4)
#1 0x105b9a92a (/sw/lib/gcc4.8/lib/libasan.0.dylib+0xb92a)
#2 0x105b8bee5 (/Users/howarth/./use-after-free+0x100000ee5)
#3 0x7fff8bd827e0 (/usr/lib/system/libdyld.dylib+0x27e0)
#4 0x0
previously allocated by thread T0 here:
#0 0x105b9a255 (/sw/lib/gcc4.8/lib/libasan.0.dylib+0xb255)
#1 0x7fff94c3b152 (/usr/lib/system/libsystem_c.dylib+0x2d152)
#2 0x7fff94c3bba6 (/usr/lib/system/libsystem_c.dylib+0x2dba6)
#3 0x105b8beda (/Users/howarth/./use-after-free+0x100000eda)
#4 0x7fff8bd827e0 (/usr/lib/system/libdyld.dylib+0x27e0)
Shadow byte and word:
0x1000211087e8: fd
0x1000211087e8: fd fd fd fd fd fd fd fd
More shadow bytes:
0x1000211087c8: fa fa fa fa fa fa fa fa
0x1000211087d0: fa fa fa fa fa fa fa fa
0x1000211087d8: fa fa fa fa fa fa fa fa
0x1000211087e0: fa fa fa fa fa fa fa fa
=>0x1000211087e8: fd fd fd fd fd fd fd fd
0x1000211087f0: fd fd fd fd fd fd fd fd
0x1000211087f8: fa fa fa fa fa fa fa fa
0x100021108800: fa fa fa fa fa fa fa fa
0x100021108808: fa fa fa fa fa fa fa fa
Stats: 0M malloced (0M for red zones) by 1 calls
Stats: 0M realloced by 0 calls
Stats: 0M freed by 1 calls
Stats: 0M really freed by 0 calls
Stats: 0M (128 full pages) mmaped in 1 calls
mmaps by size class: 8:2047;
mallocs by size class: 8:1;
frees by size class: 8:1;
rfrees by size class:
Stats: malloc large: 0 small slow: 1
==30656== ABORTING
I'll try to test a i386-apple-darwin10 build of gcc trunk later today (unless
the multilib for libsanitizer gets fixed first and I can test -m32 on a
x86_64-apple-darwin12 build).
