Address Sanitizer reports error whenever a C++ exception is caught

Question

Dear Experts,

When I try to use Address Sanitizer on my iOS app, it reports "attempting free on address which was not malloc()-ed" whenever a C++ exception is caught.

If first saw it inside Apple's libFontParser and filed FB13271831, but I now see it in my own code. The Address Sanitizer stack trace always starts like this:

    #1 0x215766ae8 in __cxa_decrement_exception_refcount+0x40 (/usr/lib/libc++abi.dylib:arm64e+0x13ae8)

Having looked up __cxa_decrement_exception_refcount in the C++ ABI docs, my guess is that the C++ runtime is creating and destroying the exception objects in some way that Address Sanitizer doesn't properly understand, causing it to think that they are being freed without having been allocated by malloc.

This is only really a problem because it does not seem possible to continue after ASan has reported this error; the app is terminated.

Question: is there a way to tell Address Sanitiser to ignore errors in this function? And/or, is there a way to continue after the error?

Thanks.

986

Posted by

endecotp

Reply

Add a Comment

Answer 1

Hello,

Thank you for the report! There is a known issue with ASan when running on device with iOS 17. It'll mainly show up when using C++. We expect simulator to work fine. I think there's a typo in your suggested workaround. It should be environment variable ASAN_OPTIONS with value halt_on_error=0 (i.e. 0 means do not halt on error). Unfortunately, if simulator is not appropriate, there's not really any better workarounds at the moment. I'd expect most false positives are coming from free()'ing an exception like in your backtrace __cxa_decrement_exception_refcount.

Posted by

Systems Engineer

Add a Comment

Answer 2

I worked out how to make these ASan errors not terminate the app:

Near the middle of the top edge of the Xcode window, tap on the app name/icon.
In the popup that appears, tap on "Edit scheme..."
In the window that appears, tap on "Arguments" a little below the top-centre of the window.
Below "Environment Variables", tap on "+".
Enter name = ASAN_OPTIONS and value = halt_on_error=1

Unfortunately it's now difficult to see if there are any other errors in amongst all these (presumed) false positives.

Posted by

endecotp

Add a Comment

Answer 3

Hello,

Thank you for the report! There is a known issue with ASan when running on device with iOS 17. It'll mainly show up when using C++. We expect simulator to work fine. I think there's a typo in your suggested workaround. It should be environment variable ASAN_OPTIONS with value halt_on_error=0 (i.e. 0 means do not halt on error). Unfortunately, if simulator is not appropriate, there's not really any better workarounds at the moment. I'd expect most false positives are coming from free()'ing an exception like in your backtrace __cxa_decrement_exception_refcount.

Posted by

Systems Engineer

Add a Comment

Answer 4

There is a known issue with ASan when running on device with iOS 17.

Thanks. I guess I'll downgrade my development devices back to iOS 16. Oh wait.... :-(

Posted by

endecotp

Add a Comment

Answer 5

FWIW, this should be resolved in latest iOS 17.2 beta builds.

Posted by

Systems Engineer

Add a Comment

Answer 6

hit this one today on iOS 17.1.2. took me a while to find this bug report, so I'll throw a few more keywords here to help others find it: asan reports false positive AsanDie

reproducible with something as simple as:

try {
  throw int{};
}catch (int) {        
} //<= AsanDie here

Since I'd prefer to have the app halt as soon as ASAN hits an error when I'm debugging, I'm installing the latest iOS beta 17.2 as suggested by apple above. if I don't post back here in 20 minutes then you can assume it worked for me...

Posted by

mschuck

Add a Comment

Address Sanitizer reports error whenever a C++ exception is caught

Accepted Reply

Replies