Avoid accessing a destroyed object in V0Fitter #21195

Dr15Jones · 2017-11-06T22:18:56Z

References to internal data of a destructed temporary were being
passed to a function. Now the temporaries are 'pinned' to stay
on the stack.

References to internal data of a destructed temporary were being passed to a function. Now the temporaries are 'pinned' to stay on the stack.

cmsbuild · 2017-11-06T22:19:15Z

The code-checks are being triggered in jenkins.

Dr15Jones · 2017-11-06T22:20:22Z

IB RelVals for the ASAN build were failing because of this bug. E.g.
https://cmssdt.cern.ch/SDT/cgi-bin/buildlogs/slc6_amd64_gcc700/CMSSW_10_0_ASAN_X_2017-11-06-1000/pyRelValMatrixLogs/run/5.1_TTbar+TTbarFS+HARVESTFS/step1_TTbar+TTbarFS+HARVESTFS.log

Dr15Jones · 2017-11-06T22:20:36Z

@davidlt thought you'd want to know

cmsbuild · 2017-11-06T22:21:16Z

+code-checks

Logs: https://cmssdt.cern.ch/SDT/code-checks/PR-21195/1847

Dr15Jones · 2017-11-06T22:21:45Z

please test

davidlt · 2017-11-06T22:22:26Z

I have something similar done over weekend: #21172

cmsbuild · 2017-11-06T22:23:00Z

The tests are being triggered in jenkins.
https://cmssdt.cern.ch/jenkins/job/ib-any-integration/24219/console Started: 2017/11/06 23:23

cmsbuild · 2017-11-06T22:23:01Z

A new Pull Request was created by @Dr15Jones (Chris Jones) for master.

It involves the following packages:

RecoVertex/V0Producer

@perrotta, @cmsbuild, @slava77 can you please review it and eventually sign? Thanks.
@makortel, @felicepantaleo, @GiacomoSguazzoni, @rovere, @VinInn, @ebrondol, @dgulhan this is something you requested to watch as well.
@davidlange6, @slava77 you are the release manager for this.

cms-bot commands are listed here

cmsbuild · 2017-11-07T00:47:35Z

-1

Tested at: f51a5e7

The following merge commits were also included on top of IB + this PR after doing git cms-merge-topic:
fcaeeab
You can see more details here:
https://cmssdt.cern.ch/SDT/jenkins-artifacts/pull-request-integration/PR-21195/24219/git-log-recent-commits
https://cmssdt.cern.ch/SDT/jenkins-artifacts/pull-request-integration/PR-21195/24219/git-merge-result

You can see the results of the tests here:
https://cmssdt.cern.ch/SDT/jenkins-artifacts/pull-request-integration/PR-21195/24219/summary.html

I found follow errors while testing this PR

Failed tests: RelVals

RelVals:

When I ran the RelVals I found an error in the following worklfows:
10042.0 step5

runTheMatrix-results/10042.0_ZMM_13+ZMM_13TeV_TuneCUETP8M1_2017_GenSimFull+DigiFull_2017+RecoFull_2017+ALCAFull_2017+HARVESTFull_2017/step5_ZMM_13+ZMM_13TeV_TuneCUETP8M1_2017_GenSimFull+DigiFull_2017+RecoFull_2017+ALCAFull_2017+HARVESTFull_2017.log

The following merge commits were also included on top of IB + this PR after doing git cms-merge-topic:
fcaeeab
You can see more details here:
https://cmssdt.cern.ch/SDT/jenkins-artifacts/pull-request-integration/PR-21195/24219/git-log-recent-commits
https://cmssdt.cern.ch/SDT/jenkins-artifacts/pull-request-integration/PR-21195/24219/git-merge-result

cmsbuild · 2017-11-07T00:47:37Z

Comparison not run due to runTheMatrix errors (RelVals and Igprof tests were also skipped)

perrotta · 2017-11-07T06:24:03Z

This is similar to #21172, which lacks however the protection
if (!posImpact.isValid() || !negImpact.isValid()) continue;
and makes a copy of the wto TrajectoryStateClosestToPoint's

@Dr15Jones @davidlt : we have to evaluate which is preferable, and close the other PR, your opinion is welcome!

davidlt · 2017-11-07T07:13:56Z

I kept the original line: if (!posTransTkPtr->impactPointTSCP().isValid() || !negTransTkPtr->impactPointTSCP().isValid()) continue; because that is still fine according to C++ rules. The temporaries are "existing" until ";" (simplified explanation) and we don't save anything on this line. Thus I didn't move this line.

slava77 · 2017-11-07T08:09:26Z

RecoVertex/V0Producer/src/V0Fitter.cc

+      auto const& negImpact = negTransTkPtr->impactPointTSCP();
+      if (!posImpact.isValid() || !negImpact.isValid()) continue;
+      FreeTrajectoryState const & posState = posImpact.theState();
+      FreeTrajectoryState const & negState = negImpact.theState();


this is semantically simpler in terms of copies.

if you grep for "impactPointTSCP" you will find the same style allovertheplace
(and is not minimal only in terms of copy also in terms of virtual call and actual computation...)

@VinInn
my comment was in context of this scope and was comparing to #21172 .
Does your comment change something in this context? I may be missing something otherwise.

No, not in this scope (even if I am not sure auto const& is correct and should not be
auto const.
I was only saying that there are many other places where isValid si first tested on the fly and then impactPointTSCP accesses again...
see
https://cmssdt.cern.ch/dxr/CMSSW/source/L1Trigger/L1TNtuples/plugins/L1MuonRecoTreeProducer.cc#829
fro instance

@Dr15Jones could you also look/fix lines 176-177 in your patch? When I checked DXR trajectoryStateClosestToPoint also returns a copy: https://github.com/cms-sw/cmssw/blob/master/TrackingTools/TransientTrack/interface/BasicTransientTrack.h#L51

@Dr15Jones ignore my comment above, const extends temporary lifetime in those lines.

slava77 · 2017-11-07T08:11:11Z

@cmsbuild please test

cmsbuild · 2017-11-07T08:11:31Z

The tests are being triggered in jenkins.
https://cmssdt.cern.ch/jenkins/job/ib-any-integration/24222/console Started: 2017/11/07 09:14

cmsbuild · 2017-11-07T09:48:08Z

+1
Tested at: f51a5e7
https://cmssdt.cern.ch/SDT/jenkins-artifacts/pull-request-integration/PR-21195/24222/summary.html

The following merge commits were also included on top of IB + this PR after doing git cms-merge-topic:
fcaeeab
You can see more details here:
https://cmssdt.cern.ch/SDT/jenkins-artifacts/pull-request-integration/PR-21195/24222/git-log-recent-commits
https://cmssdt.cern.ch/SDT/jenkins-artifacts/pull-request-integration/PR-21195/24222/git-merge-result

cmsbuild · 2017-11-07T09:48:12Z

Comparison job queued.

cmsbuild · 2017-11-07T11:49:25Z

Comparison is ready
https://cmssdt.cern.ch/SDT/jenkins-artifacts/pull-request-integration/PR-21195/24222/summary.html

There are some workflows for which there are errors in the baseline:
10042.0 step 5
The results for the comparisons for these workflows could be incomplete
This means most likely that the IB is having errors in the relvals.The error does NOT come from this pull request

Comparison Summary:

No significant changes to the logs found
Reco comparison results: 0 differences found in the comparisons
DQMHistoTests: Total files compared: 26
DQMHistoTests: Total histograms compared: 2755261
DQMHistoTests: Total failures: 1
DQMHistoTests: Total nulls: 0
DQMHistoTests: Total successes: 2755091
DQMHistoTests: Total skipped: 169
DQMHistoTests: Total Missing objects: 0
Checked 107 log files, 10 edm output root files, 26 DQM output files

slava77 · 2017-11-07T12:54:20Z

+1

for #21195 f51a5e7

fixes are in line with the description and should address stack-buffer-overflow, read of 4 bytes, EndcapPiZeroDiscriminatorAlgo::findPreshVector #21173
jenkins tests pass

cmsbuild · 2017-11-07T12:54:37Z

This pull request is fully signed and it will be integrated in one of the next master IBs (tests are also fine). This pull request will now be reviewed by the release team before it's merged. @davidlange6, @slava77, @smuzaffar (and backports should be raised in the release meeting by the corresponding L2)

davidlange6 · 2017-11-08T08:34:34Z

+1

perrotta · 2017-11-08T10:46:28Z

Just for the record: this PR addresses issue #21105, not #21173 (for which a fix is proposed in #21214. instead)

Avoid accessing a destroyed object in V0Fitter

f51a5e7

References to internal data of a destructed temporary were being passed to a function. Now the temporaries are 'pinned' to stay on the stack.

cmsbuild added this to the CMSSW_10_0_X milestone Nov 6, 2017

cmsbuild added code-checks-pending comparison-pending orp-pending pending-signatures reconstruction-pending tests-pending labels Nov 6, 2017

cmsbuild added code-checks-approved and removed code-checks-pending labels Nov 6, 2017

cmsbuild added tests-started and removed tests-pending labels Nov 6, 2017

cmsbuild added comparison-notrun tests-rejected and removed comparison-pending tests-started labels Nov 7, 2017

slava77 reviewed Nov 7, 2017

View reviewed changes

cmsbuild removed comparison-notrun tests-rejected labels Nov 7, 2017

cmsbuild added comparison-pending tests-pending tests-started and removed tests-pending labels Nov 7, 2017

cmsbuild added tests-approved and removed tests-started labels Nov 7, 2017

cmsbuild added comparison-available and removed comparison-pending labels Nov 7, 2017

davidlt mentioned this pull request Nov 7, 2017

stack-buffer-overflow, read of 4 bytes, EndcapPiZeroDiscriminatorAlgo::findPreshVector #21173

Closed

cmsbuild added fully-signed reconstruction-approved and removed pending-signatures reconstruction-pending labels Nov 7, 2017

cmsbuild added orp-approved and removed orp-pending labels Nov 8, 2017

cmsbuild merged commit a876a2e into cms-sw:master Nov 8, 2017

perrotta mentioned this pull request Nov 11, 2017

read of 1 byte, stack-use-after-scope in GlobalTrajectoryParameters::charge() #21105

Closed

Dr15Jones deleted the asanFixV0Fitter branch November 15, 2017 14:22

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Avoid accessing a destroyed object in V0Fitter #21195

Avoid accessing a destroyed object in V0Fitter #21195

Dr15Jones commented Nov 6, 2017

cmsbuild commented Nov 6, 2017

Dr15Jones commented Nov 6, 2017

Dr15Jones commented Nov 6, 2017

cmsbuild commented Nov 6, 2017

Dr15Jones commented Nov 6, 2017

davidlt commented Nov 6, 2017

cmsbuild commented Nov 6, 2017 •

edited

cmsbuild commented Nov 6, 2017

cmsbuild commented Nov 7, 2017

cmsbuild commented Nov 7, 2017

perrotta commented Nov 7, 2017

davidlt commented Nov 7, 2017

slava77 Nov 7, 2017 •

edited

VinInn Nov 7, 2017

slava77 Nov 7, 2017

VinInn Nov 7, 2017

davidlt Nov 7, 2017

davidlt Nov 7, 2017

slava77 commented Nov 7, 2017

cmsbuild commented Nov 7, 2017 •

edited

cmsbuild commented Nov 7, 2017

cmsbuild commented Nov 7, 2017

cmsbuild commented Nov 7, 2017

slava77 commented Nov 7, 2017

cmsbuild commented Nov 7, 2017

davidlange6 commented Nov 8, 2017

perrotta commented Nov 8, 2017

Avoid accessing a destroyed object in V0Fitter #21195

Avoid accessing a destroyed object in V0Fitter #21195

Conversation

Dr15Jones commented Nov 6, 2017

cmsbuild commented Nov 6, 2017

Dr15Jones commented Nov 6, 2017

Dr15Jones commented Nov 6, 2017

cmsbuild commented Nov 6, 2017

Dr15Jones commented Nov 6, 2017

davidlt commented Nov 6, 2017

cmsbuild commented Nov 6, 2017 • edited

cmsbuild commented Nov 6, 2017

cmsbuild commented Nov 7, 2017

cmsbuild commented Nov 7, 2017

perrotta commented Nov 7, 2017

davidlt commented Nov 7, 2017

slava77 Nov 7, 2017 • edited

Choose a reason for hiding this comment

VinInn Nov 7, 2017

Choose a reason for hiding this comment

slava77 Nov 7, 2017

Choose a reason for hiding this comment

VinInn Nov 7, 2017

Choose a reason for hiding this comment

davidlt Nov 7, 2017

Choose a reason for hiding this comment

davidlt Nov 7, 2017

Choose a reason for hiding this comment

slava77 commented Nov 7, 2017

cmsbuild commented Nov 7, 2017 • edited

cmsbuild commented Nov 7, 2017

cmsbuild commented Nov 7, 2017

cmsbuild commented Nov 7, 2017

slava77 commented Nov 7, 2017

cmsbuild commented Nov 7, 2017

davidlange6 commented Nov 8, 2017

perrotta commented Nov 8, 2017

cmsbuild commented Nov 6, 2017 •

edited

slava77 Nov 7, 2017 •

edited

cmsbuild commented Nov 7, 2017 •

edited