ASan

gistfile1.txt

dogbert@dogbert-VirtualBox ~/repos/rakudo $ cat ~/scratch.pl6 
use v6;

use XML;

await map { start {
     my $xml = from-xml(
       '<upper id="one"><lower class="odd" id="one.1" /></upper>'
     );
} }, ^100;

dogbert@dogbert-VirtualBox ~/repos/rakudo $ ./perl6 -I /home/dogbert/repos/rakudo/install/share/perl6/site/lib/ ~/scratch.pl6
=================================================================
==27827== ERROR: AddressSanitizer: heap-use-after-free on address 0xb3160928 at pc 0xb5680c9a bp 0x9c977dc8 sp 0x9c977dbc
READ of size 2 at 0xb3160928 thread T1
    #0 0xb5680c99 in MVM_interp_run /home/dogbert/repos/rakudo/nqp/MoarVM/src/core/interp.c:5632
    #1 0xb56b8113 in start_thread /home/dogbert/repos/rakudo/nqp/MoarVM/src/core/threads.c:77
    #2 0xb59ed587 in uv__thread_start /home/dogbert/repos/rakudo/nqp/MoarVM/3rdparty/libuv/src/unix/thread.c:49
    #3 0xb61569c6 (/usr/lib/i386-linux-gnu/libasan.so.0+0x1a9c6)
    #4 0xb61462ac (/usr/lib/i386-linux-gnu/libasan.so.0+0xa2ac)
    #5 0xb52ddf71 in start_thread (/lib/i386-linux-gnu/libpthread.so.0+0x6f71)
    #6 0xb53def8d (/lib/i386-linux-gnu/libc.so.6+0xebf8d)
0xb3160928 is located 56 bytes inside of 80-byte region [0xb31608f0,0xb3160940)
freed by thread T2 here:
    #0 0xb6152774 (/usr/lib/i386-linux-gnu/libasan.so.0+0x16774)
    #1 0xb56f3966 in MVM_free /home/dogbert/repos/rakudo/nqp/MoarVM/src/core/alloc.h:29
    #2 0xb56f51b2 in MVM_fixed_size_safepoint /home/dogbert/repos/rakudo/nqp/MoarVM/src/core/fixedsizealloc.c:325
    #3 0xb5707a81 in finish_gc /home/dogbert/repos/rakudo/nqp/MoarVM/src/gc/orchestrate.c:184
    #4 0xb57083d3 in run_gc /home/dogbert/repos/rakudo/nqp/MoarVM/src/gc/orchestrate.c:332
    #5 0xb5708f50 in MVM_gc_enter_from_allocator /home/dogbert/repos/rakudo/nqp/MoarVM/src/gc/orchestrate.c:462
    #6 0xb57097cf in MVM_gc_allocate_nursery /home/dogbert/repos/rakudo/nqp/MoarVM/src/gc/allocation.c:32
    #7 0xb57095a3 in MVM_gc_allocate /home/dogbert/repos/rakudo/nqp/MoarVM/src/gc/allocation.h:13
    #8 0xb57098a8 in MVM_gc_allocate_zeroed /home/dogbert/repos/rakudo/nqp/MoarVM/src/gc/allocation.c:49
    #9 0xb570a542 in MVM_gc_allocate_frame /home/dogbert/repos/rakudo/nqp/MoarVM/src/gc/allocation.c:99
    #10 0xb569a085 in MVM_frame_force_to_heap /home/dogbert/repos/rakudo/nqp/MoarVM/src/core/frame.c:640
    #11 0xb569e009 in MVM_frame_capturelex /home/dogbert/repos/rakudo/nqp/MoarVM/src/core/frame.c:1022
    #12 0xb56118a1 in MVM_interp_run /home/dogbert/repos/rakudo/nqp/MoarVM/src/core/interp.c:1098
    #13 0xb56b8113 in start_thread /home/dogbert/repos/rakudo/nqp/MoarVM/src/core/threads.c:77
    #14 0xb59ed587 in uv__thread_start /home/dogbert/repos/rakudo/nqp/MoarVM/3rdparty/libuv/src/unix/thread.c:49
    #15 0xb61569c6 (/usr/lib/i386-linux-gnu/libasan.so.0+0x1a9c6)
    #16 0xb53def8d (/lib/i386-linux-gnu/libc.so.6+0xebf8d)
previously allocated by thread T0 here:
    #0 0xb6152854 (/usr/lib/i386-linux-gnu/libasan.so.0+0x16854)
    #1 0xb56f388d in MVM_malloc /home/dogbert/repos/rakudo/nqp/MoarVM/src/core/alloc.h:2
    #2 0xb56f49dd in MVM_fixed_size_alloc /home/dogbert/repos/rakudo/nqp/MoarVM/src/core/fixedsizealloc.c:141
    #3 0xb56f4a55 in MVM_fixed_size_alloc_zeroed /home/dogbert/repos/rakudo/nqp/MoarVM/src/core/fixedsizealloc.c:192
    #4 0xb568935a in deserialize_extop_records /home/dogbert/repos/rakudo/nqp/MoarVM/src/core/bytecode.c:315
    #5 0xb5690de5 in MVM_bytecode_unpack /home/dogbert/repos/rakudo/nqp/MoarVM/src/core/bytecode.c:870
    #6 0xb56821d6 in MVM_cu_from_bytes /home/dogbert/repos/rakudo/nqp/MoarVM/src/core/compunit.c:21
    #7 0xb568293f in MVM_cu_map_from_file_handle /home/dogbert/repos/rakudo/nqp/MoarVM/src/core/compunit.c:93
    #8 0xb56c791e in MVM_load_bytecode_fh /home/dogbert/repos/rakudo/nqp/MoarVM/src/core/loadbytecode.c:96
    #9 0xb5642d33 in MVM_interp_run /home/dogbert/repos/rakudo/nqp/MoarVM/src/core/interp.c:3147
    #10 0xb5984faa in MVM_vm_run_file /home/dogbert/repos/rakudo/nqp/MoarVM/src/moar.c:309
    #11 0x8049388 in main /home/dogbert/repos/rakudo/nqp/MoarVM/src/main.c:192
    #12 0xb530caf2 (/lib/i386-linux-gnu/libc.so.6+0x19af2)
Thread T1 created by T0 here:
    #0 0xb61461d0 (/usr/lib/i386-linux-gnu/libasan.so.0+0xa1d0)
    #1 0xb59ed67b in uv_thread_create /home/dogbert/repos/rakudo/nqp/MoarVM/3rdparty/libuv/src/unix/thread.c:66
    #2 0xb56b876a in MVM_thread_run /home/dogbert/repos/rakudo/nqp/MoarVM/src/core/threads.c:129
    #3 0xb5658a72 in MVM_interp_run /home/dogbert/repos/rakudo/nqp/MoarVM/src/core/interp.c:4000
    #4 0xb5984faa in MVM_vm_run_file /home/dogbert/repos/rakudo/nqp/MoarVM/src/moar.c:309
    #5 0x8049388 in main /home/dogbert/repos/rakudo/nqp/MoarVM/src/main.c:192
    #6 0xb530caf2 (/lib/i386-linux-gnu/libc.so.6+0x19af2)
Thread T2 created by T0 here:
    #0 0xb61461d0 (/usr/lib/i386-linux-gnu/libasan.so.0+0xa1d0)
    #1 0xb59ed67b in uv_thread_create /home/dogbert/repos/rakudo/nqp/MoarVM/3rdparty/libuv/src/unix/thread.c:66
    #2 0xb56b876a in MVM_thread_run /home/dogbert/repos/rakudo/nqp/MoarVM/src/core/threads.c:129
    #3 0xb5658a72 in MVM_interp_run /home/dogbert/repos/rakudo/nqp/MoarVM/src/core/interp.c:4000
    #4 0xb5984faa in MVM_vm_run_file /home/dogbert/repos/rakudo/nqp/MoarVM/src/moar.c:309
    #5 0x8049388 in main /home/dogbert/repos/rakudo/nqp/MoarVM/src/main.c:192
    #6 0xb530caf2 (/lib/i386-linux-gnu/libc.so.6+0x19af2)
SUMMARY: AddressSanitizer: heap-use-after-free /home/dogbert/repos/rakudo/nqp/MoarVM/src/core/interp.c:5632 MVM_interp_run
Shadow bytes around the buggy address:
  0x3662c0d0: fd fd fd fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x3662c0e0: fd fa fa fa fa fa fd fd fd fd fd fd fd fd fd fa
  0x3662c0f0: fa fa fa fa fd fd fd fd fd fd fd fd fd fa fa fa
  0x3662c100: fa fa fd fd fd fd fd fd fd fd fd fa fa fa fa fa
  0x3662c110: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fd fd
=>0x3662c120: fd fd fd fd fd[fd]fd fd fa fa fa fa fd fd fd fd
  0x3662c130: fd fd fd fd fd fa fa fa fa fa fd fd fd fd fd fd
  0x3662c140: fd fd fd fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x3662c150: fd fa fa fa fa fa fd fd fd fd fd fd fd fd fd fa
  0x3662c160: fa fa fa fa fd fd fd fd fd fd fd fd fd fa fa fa
  0x3662c170: fa fa 00 00 00 00 00 00 00 00 00 fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:     fa
  Heap righ redzone:     fb
  Freed Heap region:     fd
  Stack left redzone:    f1
  Stack mid redzone:     f2
  Stack right redzone:   f3
  Stack partial redzone: f4
  Stack after return:    f5
  Stack use after scope: f8
  Global redzone:        f9
  Global init order:     f6
  Poisoned by user:      f7
  ASan internal:         fe
==27827== ABORTING