global-buffer-overflow in tutorial-rcanvas-df104-py

[hahnjo]

After recent fixes on the interaction between Python and AddressSanitizer (#11621), there is now a global-buffer-overflow reported for tutorial-rcanvas-df104-py:

1148: ==4075620==ERROR: AddressSanitizer: global-buffer-overflow on address 0x7f7b0e15ea65 at pc 0x7f7b14df7aaa bp 0x7fff988d9ab0 sp 0x7fff988d9258
1148: READ of size 156 at 0x7f7b0e15ea65 thread T0
1148:     #0 0x7f7b14df7aa9 in __asan_memcpy (/usr/lib64/clang/14.0.6/lib/linux/libclang_rt.asan-x86_64.so+0x101aa9) (BuildId: e896d268897cea67bde300bc334ab7b2bfb702db)
1148:     #1 0x7f7b0fa19ba1 in TString::Replace(int, int, char const*, int) /home/jhahnfel/ROOT/src/core/base/src/TString.cxx:1069:16
1148:     #2 0x7f7b0e2d9e7d in TString::Append(char const*) /home/jhahnfel/ROOT/src/core/base/inc/TString.h:565:10
1148:     #3 0x7f7b0e2d9e7d in TBufferJSON::JsonWriteBasic(bool) /home/jhahnfel/ROOT/src/io/io/src/TBufferJSON.cxx:3963:11
1148:     #4 0x7f7b0e2d9e7d in TBufferJSON::WriteBool(bool) /home/jhahnfel/ROOT/src/io/io/src/TBufferJSON.cxx:3724:4
1148:     #5 0x7f7b0e5a62bc in operator<<(TBuffer&, bool) /home/jhahnfel/ROOT/src/core/base/inc/TBuffer.h:361:60
1148:     #6 0x7f7b0e5a62bc in int TStreamerInfoActions::WriteBasicType<bool>(TBuffer&, void*, TStreamerInfoActions::TConfiguration const*) /home/jhahnfel/ROOT/src/io/io/src/TStreamerInfoActions.cxx:253:11
1148:     #7 0x7f7b0e21d31d in TStreamerInfoActions::TConfiguredAction::operator()(TBuffer&, void*) const /home/jhahnfel/ROOT/src/io/io/inc/TStreamerInfoActions.h:123:17
1148:     #8 0x7f7b0e21d31d in TBufferText::ApplySequence(TStreamerInfoActions::TActionSequence const&, void*) /home/jhahnfel/ROOT/src/io/io/src/TBufferText.cxx:91:10
1148:     #9 0x7f7b0e21e1c1 in TBufferText::WriteClassBuffer(TClass const*, void*) /home/jhahnfel/ROOT/src/io/io/src/TBufferText.cxx:211:4
1148:     #10 0x7f7ae6a268ba in TFormula::Streamer(TBuffer&) /home/jhahnfel/ROOT/src/hist/hist/src/TFormula.cxx:3901:9
1148:     #11 0x7f7b0e2278c8 in TClass::Streamer(void*, TBuffer&, TClass const*) const /home/jhahnfel/ROOT/src/core/meta/inc/TClass.h:610:7
1148:     #12 0x7f7b0e2278c8 in TBufferJSON::JsonWriteObject(void const*, TClass const*, bool) /home/jhahnfel/ROOT/src/io/io/src/TBufferJSON.cxx:1416:35
1148:     #13 0x7f7b0e2242c7 in TBufferIO::WriteObjectAny(void const*, TClass const*, bool) /home/jhahnfel/ROOT/src/io/io/src/TBufferIO.cxx:522:7
1148:     #14 0x7f7b0e2d5991 in TBufferJSON::WriteFastArray(void**, TClass const*, int, bool, TMemberStreamer*) /home/jhahnfel/ROOT/src/io/io/src/TBufferJSON.cxx:3507:17
1148:     #15 0x7f7b0e9b7581 in int TStreamerInfo::WriteBufferAux<char**>(TBuffer&, char** const&, TStreamerInfo::TCompInfo* const*, int, int, int, int, int) /home/jhahnfel/ROOT/src/io/io/src/TStreamerInfoWriteBuffer.cxx:441:30
1148:     #16 0x7f7b0e4bcea4 in TStreamerInfoActions::GenericWriteAction(TBuffer&, void*, TStreamerInfoActions::TConfiguration const*) /home/jhahnfel/ROOT/src/io/io/src/TStreamerInfoActions.cxx:202:45
1148:     #17 0x7f7b0e21d31d in TStreamerInfoActions::TConfiguredAction::operator()(TBuffer&, void*) const /home/jhahnfel/ROOT/src/io/io/inc/TStreamerInfoActions.h:123:17
1148:     #18 0x7f7b0e21d31d in TBufferText::ApplySequence(TStreamerInfoActions::TActionSequence const&, void*) /home/jhahnfel/ROOT/src/io/io/src/TBufferText.cxx:91:10
1148:     #19 0x7f7b0e21e1c1 in TBufferText::WriteClassBuffer(TClass const*, void*) /home/jhahnfel/ROOT/src/io/io/src/TBufferText.cxx:211:4
1148:     #20 0x7f7ae69b14df in TF1::Streamer(TBuffer&) /home/jhahnfel/ROOT/src/hist/hist/src/TF1.cxx:3643:9
1148:     #21 0x7f7b0e2278c8 in TClass::Streamer(void*, TBuffer&, TClass const*) const /home/jhahnfel/ROOT/src/core/meta/inc/TClass.h:610:7
1148:     #22 0x7f7b0e2278c8 in TBufferJSON::JsonWriteObject(void const*, TClass const*, bool) /home/jhahnfel/ROOT/src/io/io/src/TBufferJSON.cxx:1416:35
1148:     #23 0x7f7b0e224288 in TBufferIO::WriteObjectAny(void const*, TClass const*, bool) /home/jhahnfel/ROOT/src/io/io/src/TBufferIO.cxx:519:7
1148:     #24 0x7f7b0e2d5991 in TBufferJSON::WriteFastArray(void**, TClass const*, int, bool, TMemberStreamer*) /home/jhahnfel/ROOT/src/io/io/src/TBufferJSON.cxx:3507:17
1148:     #25 0x7f7b0e9b7581 in int TStreamerInfo::WriteBufferAux<char**>(TBuffer&, char** const&, TStreamerInfo::TCompInfo* const*, int, int, int, int, int) /home/jhahnfel/ROOT/src/io/io/src/TStreamerInfoWriteBuffer.cxx:441:30
1148:     #26 0x7f7b0e4bcea4 in TStreamerInfoActions::GenericWriteAction(TBuffer&, void*, TStreamerInfoActions::TConfiguration const*) /home/jhahnfel/ROOT/src/io/io/src/TStreamerInfoActions.cxx:202:45
1148:     #27 0x7f7b0e21d31d in TStreamerInfoActions::TConfiguredAction::operator()(TBuffer&, void*) const /home/jhahnfel/ROOT/src/io/io/inc/TStreamerInfoActions.h:123:17
1148:     #28 0x7f7b0e21d31d in TBufferText::ApplySequence(TStreamerInfoActions::TActionSequence const&, void*) /home/jhahnfel/ROOT/src/io/io/src/TBufferText.cxx:91:10
1148:     #29 0x7f7b0e21e1c1 in TBufferText::WriteClassBuffer(TClass const*, void*) /home/jhahnfel/ROOT/src/io/io/src/TBufferText.cxx:211:4
1148:     #30 0x7f7b0e2278c8 in TClass::Streamer(void*, TBuffer&, TClass const*) const /home/jhahnfel/ROOT/src/core/meta/inc/TClass.h:610:7
1148:     #31 0x7f7b0e2278c8 in TBufferJSON::JsonWriteObject(void const*, TClass const*, bool) /home/jhahnfel/ROOT/src/io/io/src/TBufferJSON.cxx:1416:35
1148:     #32 0x7f7b0e224288 in TBufferIO::WriteObjectAny(void const*, TClass const*, bool) /home/jhahnfel/ROOT/src/io/io/src/TBufferIO.cxx:519:7
1148:     #33 0x7f7b0e3ac0a5 in TGenCollectionStreamer::WriteObjects(int, TBuffer&) /home/jhahnfel/ROOT/src/io/io/src/TGenCollectionStreamer.cxx:982:16
1148:     #34 0x7f7b0e3ae662 in TGenCollectionStreamer::Streamer(TBuffer&) /home/jhahnfel/ROOT/src/io/io/src/TGenCollectionStreamer.cxx:1452:22
1148:     #35 0x7f7b0e32a94d in TCollectionStreamer::Streamer(TBuffer&, void*, int, TClass*) /home/jhahnfel/ROOT/src/io/io/src/TCollectionProxyFactory.cxx:166:18
1148:     #36 0x7f7b0e2278c8 in TClass::Streamer(void*, TBuffer&, TClass const*) const /home/jhahnfel/ROOT/src/core/meta/inc/TClass.h:610:7
1148:     #37 0x7f7b0e2278c8 in TBufferJSON::JsonWriteObject(void const*, TClass const*, bool) /home/jhahnfel/ROOT/src/io/io/src/TBufferJSON.cxx:1416:35
1148:     #38 0x7f7b0e2d48d1 in TBufferJSON::WriteFastArray(void*, TClass const*, int, TMemberStreamer*) /home/jhahnfel/ROOT/src/io/io/src/TBufferJSON.cxx:3458:10
1148:     #39 0x7f7b0e9b95fd in int TStreamerInfo::WriteBufferAux<char**>(TBuffer&, char** const&, TStreamerInfo::TCompInfo* const*, int, int, int, int, int) /home/jhahnfel/ROOT/src/io/io/src/TStreamerInfoWriteBuffer.cxx:611:24
1148:     #40 0x7f7b0e4bcea4 in TStreamerInfoActions::GenericWriteAction(TBuffer&, void*, TStreamerInfoActions::TConfiguration const*) /home/jhahnfel/ROOT/src/io/io/src/TStreamerInfoActions.cxx:202:45
1148:     #41 0x7f7b0e21d31d in TStreamerInfoActions::TConfiguredAction::operator()(TBuffer&, void*) const /home/jhahnfel/ROOT/src/io/io/inc/TStreamerInfoActions.h:123:17
1148:     #42 0x7f7b0e21d31d in TBufferText::ApplySequence(TStreamerInfoActions::TActionSequence const&, void*) /home/jhahnfel/ROOT/src/io/io/src/TBufferText.cxx:91:10
1148:     #43 0x7f7b0e21e1c1 in TBufferText::WriteClassBuffer(TClass const*, void*) /home/jhahnfel/ROOT/src/io/io/src/TBufferText.cxx:211:4
1148:     #44 0x7f7b0fbf6e16 in TClass::WriteBuffer(TBuffer&, void*, char const*) /home/jhahnfel/ROOT/src/core/meta/src/TClass.cxx:6770:6
1148:     #45 0x7f7b0fc67e80 in TStreamerBase::WriteBuffer(TBuffer&, char*) /home/jhahnfel/ROOT/src/core/meta/src/TStreamerElement.cxx
1148:     #46 0x7f7b0e5a7d47 in TStreamerInfoActions::WriteTextBaseClass(TBuffer&, void*, TStreamerInfoActions::TConfiguration const*) /home/jhahnfel/ROOT/src/io/io/src/TStreamerInfoActions.cxx:277:30
1148:     #47 0x7f7b0e21d31d in TStreamerInfoActions::TConfiguredAction::operator()(TBuffer&, void*) const /home/jhahnfel/ROOT/src/io/io/inc/TStreamerInfoActions.h:123:17
1148:     #48 0x7f7b0e21d31d in TBufferText::ApplySequence(TStreamerInfoActions::TActionSequence const&, void*) /home/jhahnfel/ROOT/src/io/io/src/TBufferText.cxx:91:10
1148:     #49 0x7f7b0e21e1c1 in TBufferText::WriteClassBuffer(TClass const*, void*) /home/jhahnfel/ROOT/src/io/io/src/TBufferText.cxx:211:4
1148:     #50 0x7f7b0e2278c8 in TClass::Streamer(void*, TBuffer&, TClass const*) const /home/jhahnfel/ROOT/src/core/meta/inc/TClass.h:610:7
1148:     #51 0x7f7b0e2278c8 in TBufferJSON::JsonWriteObject(void const*, TClass const*, bool) /home/jhahnfel/ROOT/src/io/io/src/TBufferJSON.cxx:1416:35
1148:     #52 0x7f7b0e224288 in TBufferIO::WriteObjectAny(void const*, TClass const*, bool) /home/jhahnfel/ROOT/src/io/io/src/TBufferIO.cxx:519:7
1148:     #53 0x7f7b0e3ac0a5 in TGenCollectionStreamer::WriteObjects(int, TBuffer&) /home/jhahnfel/ROOT/src/io/io/src/TGenCollectionStreamer.cxx:982:16
1148:     #54 0x7f7b0e3ae662 in TGenCollectionStreamer::Streamer(TBuffer&) /home/jhahnfel/ROOT/src/io/io/src/TGenCollectionStreamer.cxx:1452:22
1148:     #55 0x7f7b0e32a94d in TCollectionStreamer::Streamer(TBuffer&, void*, int, TClass*) /home/jhahnfel/ROOT/src/io/io/src/TCollectionProxyFactory.cxx:166:18
1148:     #56 0x7f7b0e2278c8 in TClass::Streamer(void*, TBuffer&, TClass const*) const /home/jhahnfel/ROOT/src/core/meta/inc/TClass.h:610:7
1148:     #57 0x7f7b0e2278c8 in TBufferJSON::JsonWriteObject(void const*, TClass const*, bool) /home/jhahnfel/ROOT/src/io/io/src/TBufferJSON.cxx:1416:35
1148:     #58 0x7f7b0e2d48d1 in TBufferJSON::WriteFastArray(void*, TClass const*, int, TMemberStreamer*) /home/jhahnfel/ROOT/src/io/io/src/TBufferJSON.cxx:3458:10
1148:     #59 0x7f7b0e9b95fd in int TStreamerInfo::WriteBufferAux<char**>(TBuffer&, char** const&, TStreamerInfo::TCompInfo* const*, int, int, int, int, int) /home/jhahnfel/ROOT/src/io/io/src/TStreamerInfoWriteBuffer.cxx:611:24
1148:     #60 0x7f7b0e4bcea4 in TStreamerInfoActions::GenericWriteAction(TBuffer&, void*, TStreamerInfoActions::TConfiguration const*) /home/jhahnfel/ROOT/src/io/io/src/TStreamerInfoActions.cxx:202:45
1148:     #61 0x7f7b0e21d31d in TStreamerInfoActions::TConfiguredAction::operator()(TBuffer&, void*) const /home/jhahnfel/ROOT/src/io/io/inc/TStreamerInfoActions.h:123:17
1148:     #62 0x7f7b0e21d31d in TBufferText::ApplySequence(TStreamerInfoActions::TActionSequence const&, void*) /home/jhahnfel/ROOT/src/io/io/src/TBufferText.cxx:91:10
1148:     #63 0x7f7b0e21e1c1 in TBufferText::WriteClassBuffer(TClass const*, void*) /home/jhahnfel/ROOT/src/io/io/src/TBufferText.cxx:211:4
1148:     #64 0x7f7b0fbf6e16 in TClass::WriteBuffer(TBuffer&, void*, char const*) /home/jhahnfel/ROOT/src/core/meta/src/TClass.cxx:6770:6
1148:     #65 0x7f7b0fc67e80 in TStreamerBase::WriteBuffer(TBuffer&, char*) /home/jhahnfel/ROOT/src/core/meta/src/TStreamerElement.cxx
1148:     #66 0x7f7b0e5a7d47 in TStreamerInfoActions::WriteTextBaseClass(TBuffer&, void*, TStreamerInfoActions::TConfiguration const*) /home/jhahnfel/ROOT/src/io/io/src/TStreamerInfoActions.cxx:277:30
1148:     #67 0x7f7b0e21d31d in TStreamerInfoActions::TConfiguredAction::operator()(TBuffer&, void*) const /home/jhahnfel/ROOT/src/io/io/inc/TStreamerInfoActions.h:123:17
1148:     #68 0x7f7b0e21d31d in TBufferText::ApplySequence(TStreamerInfoActions::TActionSequence const&, void*) /home/jhahnfel/ROOT/src/io/io/src/TBufferText.cxx:91:10
1148:     #69 0x7f7b0e21e1c1 in TBufferText::WriteClassBuffer(TClass const*, void*) /home/jhahnfel/ROOT/src/io/io/src/TBufferText.cxx:211:4
1148:     #70 0x7f7b0e2278c8 in TClass::Streamer(void*, TBuffer&, TClass const*) const /home/jhahnfel/ROOT/src/core/meta/inc/TClass.h:610:7
1148:     #71 0x7f7b0e2278c8 in TBufferJSON::JsonWriteObject(void const*, TClass const*, bool) /home/jhahnfel/ROOT/src/io/io/src/TBufferJSON.cxx:1416:35
1148:     #72 0x7f7b0e2265db in TBufferJSON::StoreObject(void const*, TClass const*) /home/jhahnfel/ROOT/src/io/io/src/TBufferJSON.cxx:708:7
1148:     #73 0x7f7ad3c6329b in ROOT::Experimental::RCanvasPainter::CreateSnapshot[abi:cxx11](ROOT::Experimental::RDrawable::RDisplayContext&) /home/jhahnfel/ROOT/src/gui/canvaspainter/src/RCanvasPainter.cxx:739:20
1148:     #74 0x7f7ad3c669ad in ROOT::Experimental::RCanvasPainter::ProduceBatchOutput(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, int, int) /home/jhahnfel/ROOT/src/gui/canvaspainter/src/RCanvasPainter.cxx:461:20
1148:     #75 0x7f7afc354443 in ROOT::Experimental::RCanvas::SaveAs(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) /home/jhahnfel/ROOT/src/graf2d/gpadv7/src/RCanvas.cxx:176:21
1148:     #76 0x7f7afeafe017  (<unknown module>)
1148:     #77 0x7f7b121bc8c9 in WrapperCall(long, unsigned long, void*, void*, void*) /home/jhahnfel/ROOT/src/bindings/pyroot/cppyy/cppyy-backend/clingwrapper/src/clingwrapper.cxx:778:13
1148:     #78 0x7f7b121bd174 in unsigned char CallT<unsigned char>(long, void*, unsigned long, void*) /home/jhahnfel/ROOT/src/bindings/pyroot/cppyy/cppyy-backend/clingwrapper/src/clingwrapper.cxx:816:9
1148:     #79 0x7f7b121bd174 in Cppyy::CallB(long, void*, unsigned long, void*) /home/jhahnfel/ROOT/src/bindings/pyroot/cppyy/cppyy-backend/clingwrapper/src/clingwrapper.cxx:833:1
1148:     #80 0x7f7b0ffe1a61 in CPyCppyy::(anonymous namespace)::BoolExecutor::Execute(long, void*, CPyCppyy::CallContext*) /home/jhahnfel/ROOT/src/bindings/pyroot/cppyy/CPyCppyy/src/Executors.cxx:148:19
1148:     #81 0x7f7b0ffaf717 in CPyCppyy::CPPMethod::ExecuteFast(void*, long, CPyCppyy::CallContext*) /home/jhahnfel/ROOT/src/bindings/pyroot/cppyy/CPyCppyy/src/CPPMethod.cxx:74:29
1148:     #82 0x7f7b0ffaeb24 in CPyCppyy::CPPMethod::Execute(void*, long, CPyCppyy::CallContext*) /home/jhahnfel/ROOT/src/bindings/pyroot/cppyy/CPyCppyy/src/CPPMethod.cxx:725:18
1148:     #83 0x7f7b0ffaeb24 in CPyCppyy::CPPMethod::Call(CPyCppyy::CPPInstance*&, _object*, _object*, CPyCppyy::CallContext*) /home/jhahnfel/ROOT/src/bindings/pyroot/cppyy/CPyCppyy/src/CPPMethod.cxx:783:40
1148:     #84 0x7f7b0ffb1e23 in CPyCppyy::(anonymous namespace)::mp_call(CPyCppyy::CPPOverload*, _object*, _object*) /home/jhahnfel/ROOT/src/bindings/pyroot/cppyy/CPyCppyy/src/CPPOverload.cxx:566:40
1148:     #85 0x7f7b14466aea in _PyObject_FastCallKeywords (/lib64/libpython3.6m.so.1.0+0x19caea) (BuildId: 465cb4e335b590c1226116d08bd8586548d89519)
1148:     #86 0x7f7b144674b5  (/lib64/libpython3.6m.so.1.0+0x19d4b5) (BuildId: 465cb4e335b590c1226116d08bd8586548d89519)
1148:     #87 0x7f7b14467fb7 in _PyEval_EvalFrameDefault (/lib64/libpython3.6m.so.1.0+0x19dfb7) (BuildId: 465cb4e335b590c1226116d08bd8586548d89519)
1148:     #88 0x7f7b143c3983  (/lib64/libpython3.6m.so.1.0+0xf9983) (BuildId: 465cb4e335b590c1226116d08bd8586548d89519)
1148:     #89 0x7f7b14484bd2 in PyEval_EvalCode (/lib64/libpython3.6m.so.1.0+0x1babd2) (BuildId: 465cb4e335b590c1226116d08bd8586548d89519)
1148:     #90 0x7f7b144d3941  (/lib64/libpython3.6m.so.1.0+0x209941) (BuildId: 465cb4e335b590c1226116d08bd8586548d89519)
1148:     #91 0x7f7b143a44ea in PyRun_FileExFlags (/lib64/libpython3.6m.so.1.0+0xda4ea) (BuildId: 465cb4e335b590c1226116d08bd8586548d89519)
1148:     #92 0x7f7b143a9624 in PyRun_SimpleFileExFlags (/lib64/libpython3.6m.so.1.0+0xdf624) (BuildId: 465cb4e335b590c1226116d08bd8586548d89519)
1148:     #93 0x7f7b143a9f73  (/lib64/libpython3.6m.so.1.0+0xdff73) (BuildId: 465cb4e335b590c1226116d08bd8586548d89519)
1148:     #94 0x562b1934eb95 in main (/usr/libexec/platform-python3.6+0xb95) (BuildId: f236d8f7fc650f4e7be110015de1de715f85b20c)
1148:     #95 0x7f7b13594d84 in __libc_start_main (/lib64/libc.so.6+0x3ad84) (BuildId: f65c85bfdb904b623d4fe2139b4d7c25cf8c0b58)
1148:     #96 0x562b1934ed1d in _start (/usr/libexec/platform-python3.6+0xd1d) (BuildId: f236d8f7fc650f4e7be110015de1de715f85b20c)
1148:
1148: 0x7f7b0e15ea65 is located 59 bytes to the left of global variable '<string literal>' defined in '/home/jhahnfel/ROOT/src/io/io/src/TBufferJSON.cxx:1353:110' (0x7f7b0e15eaa0) of size 12
1148:   '<string literal>' is ascii string 'JSON_object'
1148: 0x7f7b0e15ea65 is located 27 bytes to the left of global variable '<string literal>' defined in '/home/jhahnfel/ROOT/src/io/io/src/TBufferJSON.cxx:1330:33' (0x7f7b0e15ea80) of size 6
1148:   '<string literal>' is ascii string 'false'
1148: 0x7f7b0e15ea65 is located 0 bytes to the right of global variable '<string literal>' defined in '/home/jhahnfel/ROOT/src/io/io/src/TBufferJSON.cxx:1330:24' (0x7f7b0e15ea60) of size 5
1148:   '<string literal>' is ascii string 'true'
1148: SUMMARY: AddressSanitizer: global-buffer-overflow (/usr/lib64/clang/14.0.6/lib/linux/libclang_rt.asan-x86_64.so+0x101aa9) (BuildId: e896d268897cea67bde300bc334ab7b2bfb702db) in __asan_memcpy
1148: Shadow bytes around the buggy address:
1148:   0x0fefe1c23cf0: 00 00 03 f9 f9 f9 f9 f9 00 06 f9 f9 00 00 03 f9
1148:   0x0fefe1c23d00: f9 f9 f9 f9 00 f9 f9 f9 07 f9 f9 f9 00 f9 f9 f9
1148:   0x0fefe1c23d10: 00 00 01 f9 f9 f9 f9 f9 00 00 00 00 06 f9 f9 f9
1148:   0x0fefe1c23d20: f9 f9 f9 f9 00 00 00 00 00 00 07 f9 f9 f9 f9 f9
1148:   0x0fefe1c23d30: 00 00 00 00 05 f9 f9 f9 f9 f9 f9 f9 07 f9 f9 f9
1148: =>0x0fefe1c23d40: 00 00 f9 f9 00 00 00 00 f9 f9 f9 f9[05]f9 f9 f9
1148:   0x0fefe1c23d50: 06 f9 f9 f9 00 04 f9 f9 00 04 f9 f9 00 04 f9 f9
1148:   0x0fefe1c23d60: 00 00 00 00 07 f9 f9 f9 f9 f9 f9 f9 00 00 00 00
1148:   0x0fefe1c23d70: 03 f9 f9 f9 f9 f9 f9 f9 00 00 00 03 f9 f9 f9 f9
1148:   0x0fefe1c23d80: 00 00 00 00 00 04 f9 f9 f9 f9 f9 f9 03 f9 f9 f9
1148:   0x0fefe1c23d90: 02 f9 f9 f9 00 00 00 03 f9 f9 f9 f9 00 00 00 00
1148: Shadow byte legend (one shadow byte represents 8 application bytes):
1148:   Addressable:           00
1148:   Partially addressable: 01 02 03 04 05 06 07
1148:   Heap left redzone:       fa
1148:   Freed heap region:       fd
1148:   Stack left redzone:      f1
1148:   Stack mid redzone:       f2
1148:   Stack right redzone:     f3
1148:   Stack after return:      f5
1148:   Stack use after scope:   f8
1148:   Global redzone:          f9
1148:   Global init order:       f6
1148:   Poisoned by user:        f7
1148:   Container overflow:      fc
1148:   Array cookie:            ac
1148:   Intra object redzone:    bb
1148:   ASan internal:           fe
1148:   Left alloca redzone:     ca
1148:   Right alloca redzone:    cb
1148: ==4075620==ABORTING

Note: There may be other problems in the test after this issue is fixed. Please check locally with an instrumented build that the test passes afterwards!

[linev]

How I can reproduce error?
python3 -i df104.py script runs without any error.

[hahnjo]

You have to build ROOT with AddressSanitizer instrumentation (-Dasan=ON, best results when building with Clang) and then ideally run via ctest because that will set up some needed environment variables.

[linev]

According to stack trace ROOT crashes when calling TString::Append() method of regular member TBufferJSON::fValue.
Most probably - due to memory corruption / illegal memory overwrite somewhere before. I do not think that TString::Append has problems.

But why it happens only when AddressSanitizer enabled and ROOT compiled with clang?

[hahnjo]

It always happens (that's why it should be addressed), an instrumented build is just a way of making it visible.

[linev]

It always happens

You mean it makes silently illegal memory overwrite?
But then one should check TString::Append() - I guess.

[hahnjo]

You mean it makes silently illegal memory overwrite?

Yes, likely so. At least if doing exactly what the tutorial does.

But then one should check TString::Append() - I guess.

I don't know, the error can be anywhere in the stack trace such as providing insufficient buffer etc. TString::Append is just the place that executes the illegal memory read. Also, please keep in mind that more illegal memory accesses may happen afterwards - AddressSanitizer only reports the first problem and then terminates the process. I think it is possible to keep going afterwards and see what else is going belly-up, but IIRC that is not guaranteed to work well due to internal state not being consistent...

[linev]

Ideally AddressSanitizer should detect all illegal memory operations?

Then this operation is first one? One need to check TString::Append()

[hahnjo]

ping, I still see this locally (the root-asan build is with C++14 I think, so no v7)

[linev]

With normal build I cannot reproduce error.
With clang and -Dasan=ON I getting compilation problem when generating G__Core.cxx dictionary.

[ 44%] Generating G__Core.cxx, ../lib/Core.pcm
While building module 'Core':
While building module 'std' imported from input_line_1:1:
In file included from <module-includes>:18:
In file included from /usr/include/c++/13/condition_variable:40:
/usr/include/c++/13/bits/chrono.h:251:29: error: redefinition of '__is_duration_v<duration<_Rep, _Period>>'
      inline constexpr bool __is_duration_v<duration<_Rep, _Period>> = true;
                            ^
/usr/include/c++/13/chrono:41:10: note: '/usr/include/c++/13/bits/chrono.h' included multiple times, additional include site in header from module 'std.chrono'
#include <bits/chrono.h>

Full error output: makelog.txt

I using clang 15

[hahnjo]

With clang and -Dasan=ON I getting compilation problem when generating G__Core.cxx dictionary.

[ 44%] Generating G__Core.cxx, ../lib/Core.pcm
While building module 'Core':
While building module 'std' imported from input_line_1:1:
In file included from <module-includes>:18:
In file included from /usr/include/c++/13/condition_variable:40:
/usr/include/c++/13/bits/chrono.h:251:29: error: redefinition of '__is_duration_v<duration<_Rep, _Period>>'
      inline constexpr bool __is_duration_v<duration<_Rep, _Period>> = true;
                            ^
/usr/include/c++/13/chrono:41:10: note: '/usr/include/c++/13/bits/chrono.h' included multiple times, additional include site in header from module 'std.chrono'
#include <bits/chrono.h>

Full error output: makelog.txt

I using clang 15

I guess this is a general issue with Clang + GCC 13 headers (which is not even released yet), not only with asan? But anyway, unrelated to this issue

[linev]

And when building with gcc and only asan like:

 cmake  -DCMAKE_BUILD_TYPE="Release" -Dasan=ON -Dtesting=ON -DPYTHON_EXECUTABLE=/usr/bin/python3 /home/linev/git/webgui 

I getting failure by simply starting ROOT:

==11405==ERROR: AddressSanitizer: use-after-poison on address 0x621000160c68 at pc 0x7fae6dbe9aa1 bp 0x7fff179941b0 sp 0x7fff179941a8
READ of size 8 at 0x621000160c68 thread T0
    #0 0x7fae6dbe9aa0 in clang::LookupResult::configure() (/home/linev/build/asan/lib/libCling.so+0x9be9aa0) (BuildId: b992d84f780d9cdfaac57feecd814f7d11e56300)
    #1 0x7fae66c6d0ec in clad::plugin::CladPlugin::CheckBuiltins() [clone .part.0] (/home/linev/build/asan/lib/libCling.so+0x2c6d0ec) (BuildId: b992d84f780d9cdfaac57feecd814f7d11e56300)

Full error output: start_log.txt

[linev]

I guess this is a general issue with Clang + GCC 13 headers (which is not even released yet), not only with asan? But anyway, unrelated to this issue

gcc13 is not default compiler on my system. No idea why clang tries to use them