Updates:
Cc: [email protected]
Comment #6 on issue 3645 by [email protected]: MSan vs. Serializer:
Fight!
https://code.google.com/p/v8/issues/detail?id=3645
CC'ing eugenis@ as requested.
Repro: try to compile MSan-Chrome in Debug mode, or at least the d8 target:
$ export GYP_DEFINES="msan=1 and_any_other_flags_you_like=1"
$ build/gyp_chromium
$ ninja -C out/Debug d8
The build will fail during the "mksnapshot" step.
For your convenience, this is the report:
==23352== WARNING: MemorySanitizer: use-of-uninitialized-value
#0 0x7f6cedf7c90a in v8::internal::SnapshotByteSink::PutSection(int,
char const*)
/usr/local/google/home/jkummerow/chrome/src/out/Debug/../../v8/src/snapshot-source-sink.h:76:5
#1 0x7f6cf0e73a6f in
v8::internal::Serializer::ObjectSerializer::OutputRawData(unsigned char*,
v8::internal::Serializer::ObjectSerializer::ReturnSkip)
/usr/local/google/home/jkummerow/chrome/sr
c/out/Debug/../../v8/src/serialize.cc:1844:7
#2 0x7f6cf0e61b30 in
v8::internal::Serializer::ObjectSerializer::Serialize()
/usr/local/google/home/jkummerow/chrome/src/out/Debug/../../v8/src/serialize.cc:1627:3
#3 0x7f6cf0e5e76c in
v8::internal::StartupSerializer::SerializeObject(v8::internal::Object*,
v8::internal::SerializerDeserializer::HowToCode,
v8::internal::SerializerDeserializer::WhereToPoint,
int)
/usr/local/google/home/jkummerow/chrome/src/out/Debug/../../v8/src/serialize.cc:1411:5
#4 0x7f6cf0e761cf in
v8::internal::Serializer::ObjectSerializer::VisitPointers(v8::internal::Object**,
v8::internal::Object**)
/usr/local/google/home/jkummerow/chrome/src/out/Debug/../../v8/src
/serialize.cc:1663:9
#5 0x7f6cf04c71b7 in v8::internal::FixedBodyDescriptor<8, 24,
32>::IterateBody(v8::internal::HeapObject*, v8::internal::ObjectVisitor*)
/usr/local/google/home/jkummerow/chrome/src/out/Debug/../
../v8/src/objects-inl.h:7217:5
#6 0x7f6cf04c3b8f in
v8::internal::HeapObject::IterateBody(v8::internal::InstanceType, int,
v8::internal::ObjectVisitor*)
/usr/local/google/home/jkummerow/chrome/src/out/Debug/../../v8/src/obje
cts.cc:1604:7
#7 0x7f6cf0e619ce in
v8::internal::Serializer::ObjectSerializer::Serialize()
/usr/local/google/home/jkummerow/chrome/src/out/Debug/../../v8/src/serialize.cc:1626:3
#8 0x7f6cf0e5e76c in
v8::internal::StartupSerializer::SerializeObject(v8::internal::Object*,
v8::internal::SerializerDeserializer::HowToCode,
v8::internal::SerializerDeserializer::WhereToPoint,
int)
/usr/local/google/home/jkummerow/chrome/src/out/Debug/../../v8/src/serialize.cc:1411:5
#9 0x7f6cf0e761cf in
v8::internal::Serializer::ObjectSerializer::VisitPointers(v8::internal::Object**,
v8::internal::Object**)
/usr/local/google/home/jkummerow/chrome/src/out/Debug/../../v8/src
/serialize.cc:1663:9
#10 0x7f6cf04c8297 in v8::internal::FixedBodyDescriptor<24, 72,
72>::IterateBody(v8::internal::HeapObject*, v8::internal::ObjectVisitor*)
/usr/local/google/home/jkummerow/chrome/src/out/Debug/.
./../v8/src/objects-inl.h:7217:5
#11 0x7f6cf04c3d23 in
v8::internal::HeapObject::IterateBody(v8::internal::InstanceType, int,
v8::internal::ObjectVisitor*)
/usr/local/google/home/jkummerow/chrome/src/out/Debug/../../v8/src/obj
ects.cc:1616:7
#12 0x7f6cf0e619ce in
v8::internal::Serializer::ObjectSerializer::Serialize()
/usr/local/google/home/jkummerow/chrome/src/out/Debug/../../v8/src/serialize.cc:1626:3
#13 0x7f6cf0e5e76c in
v8::internal::StartupSerializer::SerializeObject(v8::internal::Object*,
v8::internal::SerializerDeserializer::HowToCode,
v8::internal::SerializerDeserializer::WhereToPoint
, int)
/usr/local/google/home/jkummerow/chrome/src/out/Debug/../../v8/src/serialize.cc:1411:5
#14 0x7f6cf0e670b0 in
v8::internal::Serializer::ObjectSerializer::SerializePrologue(int, int,
v8::internal::Map*)
/usr/local/google/home/jkummerow/chrome/src/out/Debug/../../v8/src/serialize.cc
:1548:3
#15 0x7f6cf0e6171f in
v8::internal::Serializer::ObjectSerializer::Serialize()
/usr/local/google/home/jkummerow/chrome/src/out/Debug/../../v8/src/serialize.cc:1620:3
#16 0x7f6cf0e5e76c in
v8::internal::StartupSerializer::SerializeObject(v8::internal::Object*,
v8::internal::SerializerDeserializer::HowToCode,
v8::internal::SerializerDeserializer::WhereToPoint
, int)
/usr/local/google/home/jkummerow/chrome/src/out/Debug/../../v8/src/serialize.cc:1411:5
#17 0x7f6cf0e761cf in
v8::internal::Serializer::ObjectSerializer::VisitPointers(v8::internal::Object**,
v8::internal::Object**)
/usr/local/google/home/jkummerow/chrome/src/out/Debug/../../v8/sr
c/serialize.cc:1663:9
#18 0x7f6cf04c8297 in v8::internal::FixedBodyDescriptor<24, 72,
72>::IterateBody(v8::internal::HeapObject*, v8::internal::ObjectVisitor*)
/usr/local/google/home/jkummerow/chrome/src/out/Debug/.
./../v8/src/objects-inl.h:7217:5
#19 0x7f6cf04c3d23 in
v8::internal::HeapObject::IterateBody(v8::internal::InstanceType, int,
v8::internal::ObjectVisitor*)
/usr/local/google/home/jkummerow/chrome/src/out/Debug/../../v8/src/obj
ects.cc:1616:7
#20 0x7f6cf0e619ce in
v8::internal::Serializer::ObjectSerializer::Serialize()
/usr/local/google/home/jkummerow/chrome/src/out/Debug/../../v8/src/serialize.cc:1626:3
#21 0x7f6cf0e5e76c in
v8::internal::StartupSerializer::SerializeObject(v8::internal::Object*,
v8::internal::SerializerDeserializer::HowToCode,
v8::internal::SerializerDeserializer::WhereToPoint
, int)
/usr/local/google/home/jkummerow/chrome/src/out/Debug/../../v8/src/serialize.cc:1411:5
#22 0x7f6cf0e670b0 in
v8::internal::Serializer::ObjectSerializer::SerializePrologue(int, int,
v8::internal::Map*)
/usr/local/google/home/jkummerow/chrome/src/out/Debug/../../v8/src/serialize.cc:1548:3
#23 0x7f6cf0e6171f in
v8::internal::Serializer::ObjectSerializer::Serialize()
/usr/local/google/home/jkummerow/chrome/src/out/Debug/../../v8/src/serialize.cc:1620:3
#24 0x7f6cf0e5e76c in
v8::internal::StartupSerializer::SerializeObject(v8::internal::Object*,
v8::internal::SerializerDeserializer::HowToCode,
v8::internal::SerializerDeserializer::WhereToPoint, int)
/usr/local/google/home/jkummerow/chrome/src/out/Debug/../../v8/src/serialize.cc:1411:5
#25 0x7f6cf0e58951 in
v8::internal::Serializer::VisitPointers(v8::internal::Object**,
v8::internal::Object**)
/usr/local/google/home/jkummerow/chrome/src/out/Debug/../../v8/src/serialize.cc:1280:7
#26 0x7f6cef33f0ee in
v8::internal::Heap::IterateStrongRoots(v8::internal::ObjectVisitor*,
v8::internal::VisitMode)
/usr/local/google/home/jkummerow/chrome/src/out/Debug/../../v8/src/heap/heap.cc:4787:3
#27 0x7f6cf0e5605d in
v8::internal::StartupSerializer::SerializeStrongReferences()
/usr/local/google/home/jkummerow/chrome/src/out/Debug/../../v8/src/serialize.cc:1245:3
#28 0x7f6cedf6230c in main
/usr/local/google/home/jkummerow/chrome/src/out/Debug/../../v8/src/mksnapshot.cc:411:5
#29 0x7f6ce8a55ec4 in __libc_start_main
/build/buildd/eglibc-2.19/csu/libc-start.c:287
#30 0x7f6cedf02763 in _start
(/usr/local/google/home/jkummerow/chrome/src/out/Debug/mksnapshot+0xc3763)
Uninitialized value was created by a heap allocation
#0 0x7f6cedf0d049 in __msan_allocated_memory
(/usr/local/google/home/jkummerow/chrome/src/out/Debug/mksnapshot+0xce049)
#1 0x7f6ceef329e8 in v8::internal::PagedSpace::AllocateRaw(int)
/usr/local/google/home/jkummerow/chrome/src/out/Debug/../../v8/src/heap/spaces-inl.h:262:5
#2 0x7f6ceef2e8e4 in v8::internal::Heap::AllocateRaw(int,
v8::internal::AllocationSpace, v8::internal::AllocationSpace)
/usr/local/google/home/jkummerow/chrome/src/out/Debug/../../v8/src/heap/heap-inl.h:197:18
#3 0x7f6ceedfdc2e in
v8::internal::Heap::AllocateOneByteInternalizedString(v8::internal::Vector<unsigned
char const>, unsigned int)
/usr/local/google/home/jkummerow/chrome/src/out/Debug/../../v8/src/heap/heap-inl.h:97:35
#4 0x7f6ceedfa9d7 in
v8::internal::Heap::AllocateInternalizedStringFromUtf8(v8::internal::Vector<char
const>, int, unsigned int)
/usr/local/google/home/jkummerow/chrome/src/out/Debug/../../v8/src/heap/heap-inl.h:69:12
#5 0x7f6ceedf8594 in
v8::internal::Factory::NewInternalizedStringFromUtf8(v8::internal::Vector<char
const>, int, unsigned int)
/usr/local/google/home/jkummerow/chrome/src/out/Debug/../../v8/src/factory.cc:293:3
#6 0x7f6ceef3fa02 in
v8::internal::Utf8StringKey::AsHandle(v8::internal::Isolate*)
/usr/local/google/home/jkummerow/chrome/src/out/Debug/../../v8/src/objects-inl.h:608:12
#7 0x7f6cf079cdbd in
v8::internal::StringTable::LookupKey(v8::internal::Isolate*,
v8::internal::HashTableKey*)
/usr/local/google/home/jkummerow/chrome/src/out/Debug/../../v8/src/objects.cc:14776:27
#8 0x7f6ceede1460 in v8::internal::Handle<v8::internal::String>
v8::internal::Factory::InternalizeStringWithKey<v8::internal::Utf8StringKey>(v8::internal::Utf8StringKey*)
/usr/local/google/home/jkummerow/chrome/src/out/Debug/../../v8/src/factory.cc:203:10
#9 0x7f6ceede09cd in
v8::internal::Factory::InternalizeUtf8String(v8::internal::Vector<char
const>)
/usr/local/google/home/jkummerow/chrome/src/out/Debug/../../v8/src/factory.cc:171:10
#10 0x7f6cee1c7351 in v8::internal::Factory::InternalizeUtf8String(char
const*)
/usr/local/google/home/jkummerow/chrome/src/out/Debug/../../v8/src/factory.h:70:12
#11 0x7f6cf06a3deb in
v8::internal::Oddball::Initialize(v8::internal::Isolate*,
v8::internal::Handle<v8::internal::Oddball>, char const*,
v8::internal::Handle<v8::internal::Object>, unsigned char)
/usr/local/google/home/jkummerow/chrome/src/out/Debug/../../v8/src/objects.cc:9615:7
#12 0x7f6cef2e35fd in v8::internal::Heap::CreateInitialObjects()
/usr/local/google/home/jkummerow/chrome/src/out/Debug/../../v8/src/heap/heap.cc:2791:3
#13 0x7f6cef351206 in v8::internal::Heap::CreateHeapObjects()
/usr/local/google/home/jkummerow/chrome/src/out/Debug/../../v8/src/heap/heap.cc:5201:3
#14 0x7f6ceff33a8b in
v8::internal::Isolate::Init(v8::internal::Deserializer*)
/usr/local/google/home/jkummerow/chrome/src/out/Debug/../../v8/src/isolate.cc:1899:31
#15 0x7f6cee1a3034 in v8::Isolate::New(v8::Isolate::CreateParams
const&)
/usr/local/google/home/jkummerow/chrome/src/out/Debug/../../v8/src/api.cc:6610:5
#16 0x7f6cedf5fb7d in main
/usr/local/google/home/jkummerow/chrome/src/out/Debug/../../v8/src/mksnapshot.cc:337:22
#17 0x7f6ce8a55ec4 in __libc_start_main
/build/buildd/eglibc-2.19/csu/libc-start.c:287
SUMMARY: MemorySanitizer: use-of-uninitialized-value
/usr/local/google/home/jkummerow/chrome/src/out/Debug/../../v8/src/snapshot-source-sink.h:76
v8::internal::SnapshotByteSink::PutSection(int, char const*)
Exiting
re "Does this scenario actually come up in any non-trivial testing?":
Snapshotting is part of the regular build process, so this issue prevents
building V8 (or, as a consequence, Chrome) in Debug mode with MSan enabled.
Losing origins would be acceptable, I think, and it's nice to know that
MSan already supports the most important things in its API.
That means the hardest part would be extending V8's snapshotting
infrastructure to handle the additional metadata. The code would have to be
ifdeffed, and would probably be ugly.
--
You received this message because this project is configured to send all
issue notifications to this address.
You may adjust your notification preferences at:
https://code.google.com/hosting/settings
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
