1############################################################################# 2# UBSan vptr blacklist. 3# Function and type based blacklisting use a mangled name, and it is especially 4# tricky to represent C++ types. For now, any possible changes by name manglings 5# are simply represented as wildcard expressions of regexp, and thus it might be 6# over-blacklisted. 7 8############################################################################# 9# Identical layouts. 10# If base and derived classes have identifical memory layouts (i.e., the same 11# object size) and both have no virtual functions, we blacklist them as there 12# would be not much security implications. 13 14fun:*LifecycleNotifier*addObserver* 15fun:*LifecycleNotifier*removeObserver* 16fun:*toWebInputElement* 17type:*base*MessageLoopForIO* 18type:*BlockRefType* 19type:*SkAutoTUnref* 20type:*WDResult* 21type:*ExecutionContext* 22type:*WebInputElement* 23type:*WebFormControlElement* 24 25# Avoid identical layout cases for 86 different classes in InspectorTypeBuilder, 26# all of which are guarded using COMPILER_ASSERT on the object size. Two more 27# types are also blacklisted due to the template class (JSONArray <-> Array<T>). 28 29src:*InspectorTypeBuilder.h* 30type:*TypeBuilder* 31type:*JSONArray* 32 33############################################################################# 34# Base class's constructor accesses a derived class's member. 35 36fun:*DoublyLinkedListNode* 37type:*content*WebUIExtensionData* 38 39# RenderFrameObserverTracker<T>::RenderFrameObserverTracker() 40fun:*content*RenderFrameObserverTracker*RenderFrame* 41 42# RenderViewObserverTracker<T>::RenderViewObserverTracker() 43fun:*content*RenderViewObserverTracker*RenderView* 44 45############################################################################# 46# Base class's destructor accesses a derived class. 47 48fun:*DatabaseContext*contextDestroyed* 49 50# FIXME: Cannot handle template function LifecycleObserver<>::setContext, 51# so exclude source file for now. 52src:*LifecycleObserver.h* 53 54############################################################################# 55# static_cast into itself in the constructor. 56 57fun:*RefCountedGarbageCollected*makeKeepAlive* 58fun:*ThreadSafeRefCountedGarbageCollected*makeKeepAlive* 59 60############################################################################# 61# Accessing data in destructors where the class has virtual inheritances. 62 63type:*content*RenderWidgetHost* 64 65# Match mangled name for X::~X(). 66fun:*content*RenderThreadImplD* 67fun:*content*RenderViewHostImplD* 68fun:*content*UtilityThreadImplD* 69 70############################################################################# 71# Using raw pointer values. 72# 73# A raw pointer value (16) is used to infer the field offset by 74# GOOGLE_PROTOBUF_GENERATED_MESSAGE_FIELD_OFFSET. 75 76src:*/third_party/protobuf/src/google/protobuf/compiler/plugin.pb.cc 77src:*/third_party/protobuf/src/google/protobuf/compiler/cpp/cpp_message.cc 78src:*/third_party/protobuf/src/google/protobuf/descriptor.pb.cc 79 80############################################################################# 81# Avoid link errors. 82# Ubsan vptr needs typeinfo on the target class, but it looks like typeinfo is 83# not avaiable if the class is not exported. For now, simply blacklisted to 84# avoid link errors; e.g., undefined reference to 'typeinfo for [CLASS_NAME]'. 85 86# obj/ppapi/libppapi_proxy.a(obj/ppapi/proxy/ppapi_proxy.proxy_channel.o):../../ppapi/proxy/proxy_channel.cc:__unnamed_53: error: undefined reference to 'typeinfo for IPC::TestSink' 87src:*/ppapi/proxy/proxy_channel.cc 88 89# obj/chrome/libbrowser.a(obj/chrome/browser/net/browser.predictor.o):../../chrome/browser/net/predictor.cc:__unnamed_577: error: undefined reference to 'typeinfo for ProxyAdvisor' 90src:*/chrome/browser/net/predictor.cc 91 92# obj/third_party/pdfium/libfpdfapi.a(obj/third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdfapi.fpdf_render_text.o):../../third_party/pdfium/core/src/fpdfapi/fpdf_render/:__unnamed_360: error: undefined reference to 'typeinfo for CPDF_InlineImages' 93src:*/third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_text.cpp 94 95# obj/third_party/libwebm/libwebm.a(obj/third_party/libwebm/source/libwebm.mkvmuxer.o)(.data.rel..L__unnamed_2+0x18): error: undefined reference to 'typeinfo for mkvparser::IMkvReader' 96src:*/third_party/libwebm/source/mkvmuxer.cpp 97 98############################################################################# 99# LLVM is not UBSan vptr clean. 100src:*third_party/swiftshader/third_party/LLVM* 101 102############################################################################# 103# UBSan seems to be emit false positives when virtual base classes are 104# involved, see e.g. crbug.com/448102. 105 106type:*v8*internal*OFStream* 107 108############################################################################# 109# UBsan is unable to handle static_cast<A*>(nullptr) and crashes on SIGSEGV. 110# 111 112# static_cast<StartPageService*> in StartPageServiceFactory::GetForProfile. 113type:*StartPageService* 114 115# Remove once function attribute level blacklisting is implemented. 116# See crbug.com/476063. 117fun:*forbidGCDuringConstruction* 118 119############################################################################# 120# UBsan goes into an infinite recursion when __dynamic_cast instrumented with 121# "vptr". See crbug.com/609786. 122 123src:*/third_party/libc\+\+abi/trunk/src/private_typeinfo.cpp 124 125############################################################################# 126# invalid downcasts for IPC messages 127# https://crbug.com/520760 128src:*nacl_message_scanner.cc 129