1361185 - Taskcluster Windows ASan builds error "0xc0000142" on launch

Status: RESOLVED FIXED

(Core :: General, defect)

Description

[Tyson Smith [:tsmith]]

This seems to be caused by updating my machine to the latest Windows 10 Pro, version 1703.

I was previously running 1607 without any issues.

Comment 1

[(Away)]

Tried this locally with the build from taskcluster but substituting my own-built clang_rt_asan_dynamic_x86_64 so that I can resolve symbols.

The asan runtime is asserting at
00 clang_rt_asan_dynamic_x86_64!__interception::InterceptionFailed
01 clang_rt_asan_dynamic_x86_64!__interception::GetInstructionSize
02 clang_rt_asan_dynamic_x86_64!__interception::OverrideFunctionWithHotPatch
03 clang_rt_asan_dynamic_x86_64!__interception::OverrideFunction
04 clang_rt_asan_dynamic_x86_64!__interception::OverrideFunction
05 clang_rt_asan_dynamic_x86_64!InitializeCommonInterceptors

Its disassembler falls over on ucrtbase!strnlen which in Win10 build 1703 looks like:
00007ffc`5a334a10 8b052a0a0c00    mov     eax,dword ptr [ucrtbase!_isa_available (00007ffc`5a3f5440)]
00007ffc`5a334a16 4c8bc9          mov     r9,rcx
00007ffc`5a334a19 83f805          cmp     eax,5
00007ffc`5a334a1c 0f8c91000000    jl      ucrtbase!strnlen+0xa3 (00007ffc`5a334ab3)

This will need an LLVM bug and a patch to https://github.com/llvm-mirror/compiler-rt/blob/master/lib/interception/interception_win.cc#L404

Comment 2

[(Away)]

This patch seems to work, just gotta get it over to LLVM. I've got my hands full with other work at the moment -- anybody want to shepherd this through?

diff --git a/compiler-rt/lib/interception/interception_win.cc b/compiler-rt/lib/interception/interception_win.cc
index e4f3d35..8e2f8c5 100644
--- a/compiler-rt/lib/interception/interception_win.cc
+++ b/compiler-rt/lib/interception/interception_win.cc
@@ -463,6 +463,9 @@ static size_t GetInstructionSize(uptr address, size_t* rel_offset = nullptr) {
     case 0xD233:  // 33 D2 : xor edx, edx
       return 2;

+    case 0x058B:  // 8B 05 XX XX XX XX : mov eax, dword ptr [XX XX XX XX]
+      return 6;
+
     // Cannot overwrite control-instruction. Return 0 to indicate failure.
     case 0x25FF:  // FF 25 XX XX XX XX : jmp [XXXXXXXX]
       return 0;

Comment 3

[(Away)]

Actually, I'm not sure if their setup gracefully handles the relocation of IP-relative addresses...

Comment 4

[(Away)]

So there's this `rel_offset` variable that will take care of the relative addresses, but there's another problem.

When hooking an API, the interceptors go through a list of `InterestingDLLsAvailable()` and patch any function with a matching name, but in build 1703, ucrtbase!strnlen and ntdll!strnlen are distinct functions. ASan ends up detouring them both to the same place, meaning they both use the same return pointer at `__interception::real_strnlen`, which causes problems.

Comment 5

[(Away)]

(For anyone curious, the distinction is that ntdll!strnlen is a straightforward "dumb" implementation, while ucrtbase!strnlen will use SSE if available.)

Comment 6

[(Away)]

With the patch at https://bugs.llvm.org/show_bug.cgi?id=32895#c2, I was able to get around this.

But I then hit an unrelated crash in ICU/strlen, for which I filed bug 1373763.

Comment 7

[Tyson Smith [:tsmith]]

Hey any updates?

Comment 8

[(Away)]

Sorry, I completely lost track of this bug.

I just tried a build and it still crashes, in a new way. I'd like to get bug 1412952 landed before investigating further just so I'm not chasing a moving target.

Comment 9

[(Away)]

This is a pain to debug without bug 1360650, which is stalled waiting on review. I'll try to get some movement there.

Comment 10

[(Away)]

Let's check back when the blocking bugs are resolved.

Comment 11

[(Away)]

(In reply to David Major [:dmajor] from comment #10)
> Let's check back when the blocking bugs are resolved.

Should be good now. Want to give it a try?

Comment 12

[Tyson Smith [:tsmith]]

(In reply to David Major [:dmajor] from comment #11)
> Should be good now. Want to give it a try?

TC builds are still out of date and I don't have a Windows environment setup to build this atm.

https://public-artifacts.taskcluster.net/TwR5llu2QzOugZi7D_xTLw/0/public/build/target.txt
20170722021023

If there are builds available somewhere I'd be happy to give them a try.

Comment 13

[(Away)]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=5134e58f15b85e52fa9020ace42acac8fe96cf77&filter-tier=1&filter-tier=2&filter-tier=3

Comment 14

[Tyson Smith [:tsmith]]

It works! Thank you.