The -fsanitize=integer analysis from UBSan can be helpful to detect signed and unsigned integer overflows in the codebase. Unfortunately, those occur very frequently, making it impossible to test anything with it without the use of a huge blacklist. This patch includes a blacklist that is broad enough to silence everything that would drain performance too much. But even with this blacklist, neither tests nor fuzzing is "clean". We can however in the future combine this with static analysis to limit ourselves to interesting places to look at, or improve the dynamic analysis to omit typical benign overflows.
It also adds another attribute that can be used on functions. It is not used right now because it was initially easier to add things to the compile-time blacklist to get started.
Finally, it includes a runtime suppression list and patches various parts in the test harnesses to support that. It is currently empty and it should not be used on frequent overflows because it is expensive. However, it has the advantage that it can be used to differentiate between signed and unsigned overflows while the compile-time blacklist cannot do that. So it can be used to e.g. silence unsigned integer overflows on a file or function while still reporting signed issues. We can also use this suppression list for any other UBSan related suppressions, should we ever want to use other features from that sanitizer.
MozReview-Commit-ID: C5ofhfJdpCS
--HG--
extra : rebase_source : 952043a441b41b2f58ec4abc51ac15fa71fc142f
The -fsanitize=integer analysis from UBSan can be helpful to detect signed and unsigned integer overflows in the codebase. Unfortunately, those occur very frequently, making it impossible to test anything with it without the use of a huge blacklist. This patch includes a blacklist that is broad enough to silence everything that would drain performance too much. But even with this blacklist, neither tests nor fuzzing is "clean". We can however in the future combine this with static analysis to limit ourselves to interesting places to look at, or improve the dynamic analysis to omit typical benign overflows.
It also adds another attribute that can be used on functions. It is not used right now because it was initially easier to add things to the compile-time blacklist to get started.
Finally, it includes a runtime suppression list and patches various parts in the test harnesses to support that. It is currently empty and it should not be used on frequent overflows because it is expensive. However, it has the advantage that it can be used to differentiate between signed and unsigned overflows while the compile-time blacklist cannot do that. So it can be used to e.g. silence unsigned integer overflows on a file or function while still reporting signed issues. We can also use this suppression list for any other UBSan related suppressions, should we ever want to use other features from that sanitizer.
MozReview-Commit-ID: C5ofhfJdpCS
--HG--
extra : rebase_source : 64aa804965d24bb90b103c00c692a2ac6859e408
Mesa 9.2.1 looks to be leaking debug messages and I can't figure out how
to make it stop. The upstream code has been entirely rewritten so it's
probably not worth investigating further.
Note that we are still leaking some of these, likely due to
CompositorChild and ImageBridgeChild leaking, but they are not
detected by LSan because they are reachable from the stack.
LeanSanitizer reports two kinds of leaks: direct and indirect. A
leaked block that is pointed to by another leaked block is an
"indirect leak", while one that isn't is a "direct leak". Often,
indirect leaks are just things entrained by the "real" leak, but if
two leaked blocks are in a cycle, then they both end up being
indirect, so we need to report them, too.
This patch makes it so that indirect LSan leaks are treated the same
as direct leaks by Mochitests, which means they will turn the tree
orange. There are a few existing indirect leaks of various severity,
so I had add some suppressions. See those bugs for more details.
--HG--
extra : rebase_source : 0269666f546b6e349bebf216771fc6dfa4d9487a
There are a variety of ways that the parent and child process ensure that
the child process exits quickly in opt builds, but for AddressSanitizer
builds we want to let the child process to run to completion, so that we
can get a LeakSanitizer report.
This requires adding some addition LSan suppressions, because running
LSan in child processes detects some new leaks.
Christian Holler
Carsten "Tomcat" Book
Joel Maher
David Major
Ting-Yu Chou
Ryan VanderMeulen
Valentin Gosu
Yen Chi Hsuan
Kearwood (Kip) Gilbert
Andrew McCreight
Jeff Muizelaar
Mike Hommey
Tom Tromey
David Rajchenbach-Teller
Byron Campen [:bwc]
Andrew McCreight
Jim Blandy