Skip to content

UB fix: new-delete-type-mismatch in ~CodeGenTypes() #7348

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

m1kit
Copy link

@m1kit m1kit commented Apr 15, 2025

It is undefined behavior to use delete expression on something which was not created with corresponding new expression. Switching to explicit global operator delete() call to match with operator new() call at CGFunctionInfo::create().

This issue is raised by Chromium ClusterFuzz, with ASan enabled. https://crbug.com/410141973

It is undefined behavior to use `delete` expression on something
which was not created with corresponding `new` expression.
Switching to explicit global `operator delete()` call to match with
`operator new()` call at `CGFunctionInfo::create()`.

This issue is raised by Chromium ClusterFuzz, with ASan enabled.
https://crbug.com/410141973
@amaiorano
Copy link
Collaborator

Note that Mikihito also created a similar PR in LLVM: llvm/llvm-project#135787

@amaiorano amaiorano requested review from tex3d and llvm-beanz April 15, 2025 13:51
@amaiorano
Copy link
Collaborator

I noticed that for Windows builds, the option for sized deallocations was explicitly disabled here, and AFAICT, this is a DXC-specific change. The equivalent flag is not disabled for Clang/GCC (-fno-sized-deallocation), and apparently this flag is enabled by default in Clang builds, so I'm not sure why ASAN isn't tripping on this. Maybe it's a recent addition to ASAN checks, and would fail if DXC is built with a more recent Clang.

In any case, I think we will likely drop this PR because there are other delete calls that would need updating. For Chromium DXC builds, we're going to compile DXC with -fno-sized-deallocation.

@amaiorano
Copy link
Collaborator

so I'm not sure why ASAN isn't tripping on this. Maybe it's a recent addition to ASAN checks, and would fail if DXC is built with a more recent Clang.

I modified cmake/modules/HandleLLVMOptions.cmake to add -fsized-deallocation to CMAKE_CXX_FLAGS, and built an ASAN-enabled DXC with Clang 14, and running it against a no-op compute shader ([numthreads(1, 1, 1)] void main() {}) results in the same ASAN failure we're getting in our Chromium build.

As I believe -fsized-deallocation is enabled by default in a later version of Clang, these ASAN failures might already trigger for anyone using a more recent version. If the version on the Azure pipeline is updated, we'll hit it there as well. The simplest fix will be to add -fno-sized-deallocation to CMAKE_CXX_FLAGS on non-Windows builds.

@@ -47,7 +47,7 @@ CodeGenTypes::~CodeGenTypes() {

for (llvm::FoldingSet<CGFunctionInfo>::iterator
I = FunctionInfos.begin(), E = FunctionInfos.end(); I != E; )
delete &*I++;
::operator delete(&*I++);
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This prevents calling the destructor, which is maybe working because the destructors are trivial, but we probably shouldn't rely on that.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
Status: New
Development

Successfully merging this pull request may close these issues.

3 participants