Skip to content

[Asan + MSVC] Boost\libs\phoenix failed to build with stack-use-after-scope on windows #128

Description

@PhoebeHui

Issue Description:

Building Boost\libs\phoenix with Asan on windows failed due to stack-use-after-scope, could you please take a look? Thanks in advance.

Reproduce Steps:

1. git clone -c core.autocrlf=true --recursive ​https://github.com/boostorg/boost.git C:\gitP\boostorg and checkout commit 1a80576
2. open a VS 2022 x64 command prompt and browse to C:\gitP\boostorg
3. set _CL_= /fsanitize=address /GS- /wd5072 /DBOOST_TIMER_ENABLE_DEPRECATED & set _LINK_= /InferASanLibs /incremental:no /debug
4. .\bootstrap
5. .\b2 headers variant=release --build-dir=C:\gitP\boostorg\boost\amd64 address-model=64 architecture=x86
6. .\b2 variant=release --build-dir=C:\gitP\boostorg\boost\amd64 address-model=64 architecture=x86
7. .\b2 -j16 variant=release --build-dir=C:\gitP\boostorg\boost\amd64 libs\phoenix\test address-model=64 

Failures:

testing.capture-output C:\gitP\boostorg\boost\amd64\boost\bin.v2\libs\phoenix\test\bind_dm_test.test\msvc-14.3\release\x86_64\threading-multi\bind_dm_test.run
====== BEGIN OUTPUT ======
=================================================================
==3924==ERROR: AddressSanitizer: stack-use-after-scope on address 0x0078ad59fb78 at pc 0x7ff67240428b bp 0x0078ad59f910 sp 0x0078ad59f910
READ of size 4 at 0x0078ad59fb78 thread T0
    #0 0x7ff67240428a in main (C:\gitP\boostorg\boost\amd64\boost\bin.v2\libs\phoenix\test\bind_dm_test.test\msvc-14.3\release\x86_64\threading-multi\bind_dm_test.exe+0x14000428a)
    #1 0x7ff67240598e in invoke_main C:\repos\msvc\src\vctools\crt\vcstartup\src\startup\exe_common.inl:78
    #2 0x7ff67240598e in __scrt_common_main_seh C:\repos\msvc\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288
    #3 0x7fff8bf5e956  (C:\WINDOWS\System32\KERNEL32.DLL+0x18002e956)
    #4 0x7fff8db47c1b  (C:\WINDOWS\SYSTEM32\ntdll.dll+0x180087c1b)

Address 0x0078ad59fb78 is located in stack of thread T0 at offset 568 in frame
    #0 0x7ff6724039cf in main (C:\gitP\boostorg\boost\amd64\boost\bin.v2\libs\phoenix\test\bind_dm_test.test\msvc-14.3\release\x86_64\threading-multi\bind_dm_test.exe+0x1400039cf)

  This frame has 18 object(s):
    [32, 36) 'x'
    [48, 56) 'compiler temporary'
    [64, 72) 'compiler temporary'
    [80, 88) 'compiler temporary'
    [96, 112) 'compiler temporary'
    [112, 128) 'compiler temporary'
    [128, 132) 'cx'
    [144, 152) 'compiler temporary'
    [160, 168) 'compiler temporary'
    [176, 184) 'compiler temporary'
    [192, 208) 'compiler temporary'
    [208, 224) 'compiler temporary'
    [224, 248) 'compiler temporary'
    [240, 256) 'that'
    [256, 272) 'that'
    [272, 280) 'compiler temporary'
    [288, 304) 'that'
    [304, 308) 'compiler temporary' <== Memory access at offset 568 overflows this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
      (longjmp, SEH and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-use-after-scope (C:\gitP\boostorg\boost\amd64\boost\bin.v2\libs\phoenix\test\bind_dm_test.test\msvc-14.3\release\x86_64\threading-multi\bind_dm_test.exe+0x14000428a) in main
Shadow bytes around the buggy address:
  0x0078ad59f880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0078ad59f900: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 04 f2 f8 f2
  0x0078ad59f980: f8 f2 f8 f2 f8 f8 f2 f2 f2 f2 f8 f8 f2 f2 f2 f2
  0x0078ad59fa00: 04 f2 f8 f2 f8 f2 f8 f2 f8 f8 f2 f2 f2 f2 f8 f8
  0x0078ad59fa80: f2 f2 f2 f2 00 00 00 f2 f2 f2 f2 f8 f8 f2 f2 f2
=>0x0078ad59fb00: f2 f8 f8 f2 f2 f2 f2 f8 f2 f8 f8 f2 f2 f2 f2[f8]
  0x0078ad59fb80: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00
  0x0078ad59fc00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0078ad59fc80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0078ad59fd00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0078ad59fd80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==3924==ABORTING
 
EXIT STATUS: 1 
====== END OUTPUT ======


testing.capture-output C:\gitP\boostorg\boost\amd64\boost\bin.v2\libs\phoenix\test\more_let_tests.test\msvc-14.3\release\x86_64\threading-multi\more_let_tests.run
====== BEGIN OUTPUT ======
=================================================================
==30784==ERROR: AddressSanitizer: stack-use-after-scope on address 0x00568beff450 at pc 0x7ff732d29b94 bp 0x00568beff090 sp 0x00568beff090
READ of size 4 at 0x00568beff450 thread T0
    #0 0x7ff732d29b93 in main (C:\gitP\boostorg\boost\amd64\boost\bin.v2\libs\phoenix\test\more_let_tests.test\msvc-14.3\release\x86_64\threading-multi\more_let_tests.exe+0x140009b93)
    #1 0x7ff732d2c08e in invoke_main C:\repos\msvc\src\vctools\crt\vcstartup\src\startup\exe_common.inl:78
    #2 0x7ff732d2c08e in __scrt_common_main_seh C:\repos\msvc\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288
    #3 0x7fff8bf5e956  (C:\WINDOWS\System32\KERNEL32.DLL+0x18002e956)
    #4 0x7fff8db47c1b  (C:\WINDOWS\SYSTEM32\ntdll.dll+0x180087c1b)

Address 0x00568beff450 is located in stack of thread T0 at offset 912 in frame
    #0 0x7ff732d290ff in main (C:\gitP\boostorg\boost\amd64\boost\bin.v2\libs\phoenix\test\more_let_tests.test\msvc-14.3\release\x86_64\threading-multi\more_let_tests.exe+0x1400090ff)

  This frame has 64 object(s):
    [32, 40) 'compiler temporary'
    [48, 56) 'compiler temporary'
    [64, 72) 'compiler temporary'
    [80, 88) 'compiler temporary'
    [96, 100) 'y'
    [112, 117) 'compiler temporary'
    [128, 132) 'y'
    [144, 149) 'compiler temporary'
    [160, 164) 'y'
    [176, 184) 'compiler temporary'
    [192, 193) 'compiler temporary'
    [208, 211) 'compiler temporary'
    [224, 236) 'compiler temporary'
    [240, 244) 'y'
    [256, 264) 'compiler temporary'
    [272, 273) 'compiler temporary'
    [288, 291) 'compiler temporary'
    [304, 316) 'compiler temporary'
    [320, 324) 'y'
    [336, 344) 'compiler temporary'
    [352, 353) 'compiler temporary'
    [368, 371) 'compiler temporary'
    [384, 396) 'compiler temporary'
    [400, 404) 'y'
    [416, 424) 'compiler temporary'
    [432, 433) 'compiler temporary'
    [448, 451) 'compiler temporary'
    [464, 476) 'compiler temporary'
    [480, 484) 'y'
    [496, 497) 'compiler temporary'
    [512, 515) 'compiler temporary'
    [528, 540) 'compiler temporary'
    [544, 548) 'y'
    [560, 561) 'compiler temporary'
    [576, 579) 'compiler temporary'
    [592, 604) 'compiler temporary'
    [608, 609) 'compiler temporary'
    [624, 632) 'env'
    [640, 641) 'compiler temporary'
    [656, 672) 'compiler temporary'
    [672, 680) 'env'
    [688, 692) 'vars_'
    [704, 712) 'locals'
    [720, 736) 'env'
    [736, 737) 'compiler temporary'
    [752, 753) 'compiler temporary'
    [768, 784) 'compiler temporary'
    [784, 800) 'env'
    [800, 808) 'locals'
    [816, 832) 'env'
    [832, 848) 'compiler temporary'
    [848, 849) 'compiler temporary'
    [864, 876) 'that'
    [880, 881) 'compiler temporary'
    [896, 897) 'd'
    [912, 928) 'env' <== Memory access at offset 912 is inside this variable
    [928, 929) 'compiler temporary'
    [944, 960) 'compiler temporary'
    [960, 968) 'vars_'
    [976, 992) 'locals'
    [992, 1016) 'env'
    [1008, 1024) 'compiler temporary'
    [1024, 1025) 'compiler temporary'
    [1040, 1041) 'd'
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
      (longjmp, SEH and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-use-after-scope (C:\gitP\boostorg\boost\amd64\boost\bin.v2\libs\phoenix\test\more_let_tests.test\msvc-14.3\release\x86_64\threading-multi\more_let_tests.exe+0x140009b93) in main
Shadow bytes around the buggy address:
  0x00568beff180: 01 f2 03 f2 00 04 f2 f2 f2 f2 04 f2 00 f2 01 f2
  0x00568beff200: 03 f2 00 04 f2 f2 f2 f2 04 f2 00 f2 01 f2 03 f2
  0x00568beff280: 00 04 f2 f2 f2 f2 04 f2 00 f2 01 f2 03 f2 00 04
  0x00568beff300: f2 f2 f2 f2 04 f2 01 f2 03 f2 00 04 f2 f2 f2 f2
  0x00568beff380: 04 f2 01 f2 03 f2 00 04 f2 f2 f2 f2 f8 f2 f8 f2
=>0x00568beff400: f8 f2 f8 f8 f2 f2 f2 f2 f8 f2[f8]f2 f8 f2 00 00
  0x00568beff480: f2 f2 f2 f2 01 f2 01 f2 00 00 f2 f2 f2 f2 00 00
  0x00568beff500: f2 f2 f2 f2 00 f2 00 00 f2 f2 f2 f2 00 00 f2 f2
  0x00568beff580: f2 f2 01 f2 00 04 f2 f2 f2 f2 01 f2 01 f2 00 00
  0x00568beff600: f2 f2 f2 f2 01 f2 00 00 f2 f2 f2 f2 00 f2 00 00
  0x00568beff680: f2 f2 f2 f2 00 00 00 f2 f2 f2 f2 00 00 f2 f2 f2
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==30784==ABORTING
 
EXIT STATUS: 1 
====== END OUTPUT ======

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions