================================================================= ==14610==ERROR: AddressSanitizer: heap-use-after-free on address 0x6210023e1138 at pc 0x7f4f598b2551 bp 0x7f4f3faf3a20 sp 0x7f4f3faf3a10 READ of size 8 at 0x6210023e1138 thread T50 (QThread) qtc.clangbackend.jobs: Document revision changed for results of Job<192,"clangcodemodelserver-test.cpp",UpdateAnnotations,PreviouslyParsed> qtc.clangbackend.jobs: [ clangcodemodelserver-test.cpp ] Finishing Job<192,"clangcodemodelserver-test.cpp",UpdateAnnotations,PreviouslyParsed> qtc.clangbackend.jobs: [ clangcodemodelserver-test.cpp ] Not choosing due to dirty document: Job<200,"clangcodemodelserver-test.cpp",UpdateExtraAnnotations,RecentlyParsed> qtc.clangbackend.jobs: [ clangcodemodelserver-test.cpp ] Not choosing due to dirty document: Job<201,"clangcodemodelserver-test.cpp",RequestReferences,RecentlyParsed> qtc.clangbackend.jobs: [ clangcodemodelserver-test.cpp ] Running Job<199,"clangcodemodelserver-test.cpp",UpdateAnnotations,PreviouslyParsed> with TranslationUnit {7de1a73d-c24e-4a94-8aa8-d0a18a8a7ea9} #0 0x7f4f598b2550 in clang::CodeCompletionString::size() const (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x33af550) #1 0x7f4f598a74d3 in clang_getNumCompletionChunks (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x33a44d3) #2 0x55ef50e08193 in ClangBackEnd::CodeCompletionsExtractor::extractText() source/codecompletionsextractor.cpp:241 #3 0x55ef50e09c93 in ClangBackEnd::CodeCompletionsExtractor::next() source/codecompletionsextractor.cpp:60 #4 0x55ef50e0ba92 in ClangBackEnd::CodeCompletionsExtractor::extractAll(bool) source/codecompletionsextractor.cpp:98 #5 0x55ef50e057a8 in toCodeCompletions source/codecompleter.cpp:59 #6 0x55ef50e057a8 in ClangBackEnd::CodeCompleter::complete(unsigned int, unsigned int, int, int) source/codecompleter.cpp:123 #7 0x55ef50df5c9b in ClangBackEnd::TranslationUnit::complete(ClangBackEnd::UnsavedFiles&, unsigned int, unsigned int, int, int) const source/clangtranslationunit.cpp:118 #8 0x55ef50daf3f7 in operator() source/clangcompletecodejob.cpp:54 #9 0x55ef50daf3f7 in _M_invoke /usr/include/c++/7/bits/std_function.h:302 #10 0x55ef50db2f35 in std::function ()>::operator()() const /usr/include/c++/7/bits/std_function.h:706 #11 0x55ef50db2f35 in void Utils::Internal::runAsyncReturnVoidDispatch, std::function ()>>(std::integral_constant, QFutureInterface >, std::function ()>&&) ../../libs/utils/runextensions.h:250 #12 0x55ef50db2f35 in void Utils::Internal::runAsyncQFutureInterfaceDispatch, std::function ()>>(std::integral_constant, QFutureInterface >, std::function ()>&&) ../../libs/utils/runextensions.h:264 #13 0x55ef50db2f35 in void Utils::Internal::runAsyncMemberDispatch, std::function ()>, , void>(QFutureInterface >, std::function ()>&&) ../../libs/utils/runextensions.h:274 #14 0x55ef50db3606 in void Utils::Internal::runAsyncImpl, std::function ()>>(QFutureInterface >, std::function ()>&&) ../../libs/utils/runextensions.h:303 #15 0x55ef50db3606 in void Utils::Internal::AsyncJob, std::function ()>&>::runHelper<0ul>(std::integer_sequence) ../../libs/utils/runextensions.h:372 #16 0x55ef50db3606 in Utils::Internal::AsyncJob, std::function ()>&>::run() ../../libs/utils/runextensions.h:352 #17 0x7f4f6b98b4bc in Utils::Internal::RunnableThread::run() (/d1/creator/ut/4.8/release/libexec/qtcreator/../../lib/qtcreator/libUtils.so.4+0x1664bc) #18 0x7f4f55ac2563 in QThreadPrivate::start(void*) (/home/nik/opt/qt-5.11.2/5.11.2/gcc_64/lib/libQt5Core.so.5+0xae563) #19 0x7f4f54a5e6da in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76da) #20 0x7f4f551a388e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x12188e) 0x6210023e1138 is located 56 bytes inside of 4096-byte region [0x6210023e1100,0x6210023e2100) freed by thread T51 (QThread) here: #0 0x7f4f6c26c7b8 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xde7b8) #1 0x7f4f5981009d in llvm::MallocAllocator::Deallocate(void const*, unsigned long) (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x330d09d) #2 0x7f4f598c1ef4 in llvm::BumpPtrAllocatorImpl::DeallocateSlabs(void**, void**) (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x33beef4) #3 0x7f4f598c1c3e in llvm::BumpPtrAllocatorImpl::~BumpPtrAllocatorImpl() (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x33bec3e) #4 0x7f4f598c163b in clang::CodeCompletionAllocator::~CodeCompletionAllocator() (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x33be63b) #5 0x7f4f598c28f1 in clang::GlobalCodeCompletionAllocator::~GlobalCodeCompletionAllocator() (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x33bf8f1) #6 0x7f4f598c2911 in void __gnu_cxx::new_allocator::destroy(clang::GlobalCodeCompletionAllocator*) (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x33bf911) #7 0x7f4f598c28c8 in void std::allocator_traits >::destroy(std::allocator&, clang::GlobalCodeCompletionAllocator*) (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x33bf8c8) #8 0x7f4f598c25fe in std::_Sp_counted_ptr_inplace, (__gnu_cxx::_Lock_policy)2>::_M_dispose() (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x33bf5fe) #9 0x7f4f5984f7fa in std::_Sp_counted_base<(__gnu_cxx::_Lock_policy)2>::_M_release() (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x334c7fa) #10 0x7f4f59839073 in std::__shared_count<(__gnu_cxx::_Lock_policy)2>::~__shared_count() (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x3336073) #11 0x7f4f598358ed in std::__shared_ptr::~__shared_ptr() (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x33328ed) #12 0x7f4f598ba962 in std::__shared_ptr::operator=(std::__shared_ptr&&) (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x33b7962) #13 0x7f4f598b7b09 in std::shared_ptr::operator=(std::shared_ptr&&) (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x33b4b09) #14 0x7f4f5a37f800 in clang::ASTUnit::ClearCachedCompletionResults() (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x3e7c800) #15 0x7f4f5a37df68 in clang::ASTUnit::CacheCodeCompletionResults() (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x3e7af68) #16 0x7f4f5a390660 in clang::ASTUnit::Reparse(std::shared_ptr, llvm::ArrayRef, std::allocator >, llvm::MemoryBuffer*> >, llvm::IntrusiveRefCntPtr) (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x3e8d660) #17 0x7f4f597cf4a6 in clang_reparseTranslationUnit_Impl(CXTranslationUnitImpl*, llvm::ArrayRef, unsigned int) (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x32cc4a6) #18 0x7f4f597cf7ad in clang_reparseTranslationUnit::{lambda()#1}::operator()() const (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x32cc7ad) #19 0x7f4f598084cb in void llvm::function_ref::callback_fn(long) (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x33054cb) #20 0x7f4f5df9976b in llvm::function_ref::operator()() const (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x7a9676b) #21 0x7f4f5df98fad in llvm::CrashRecoveryContext::RunSafely(llvm::function_ref) (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x7a95fad) #22 0x7f4f597fe53f in clang::RunSafely(llvm::CrashRecoveryContext&, llvm::function_ref, unsigned int) (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x32fb53f) #23 0x7f4f597cfc68 in clang_reparseTranslationUnit (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x32ccc68) #24 0x55ef50dfb2f7 in ClangBackEnd::TranslationUnitUpdater::reparse() source/clangtranslationunitupdater.cpp:147 #25 0x7f4f4ba3fa1f () previously allocated by thread T47 (QThread) here: #0 0x7f4f6c26cb50 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xdeb50) #1 0x7f4f597a4cf2 in llvm::safe_malloc(unsigned long) (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x32a1cf2) #2 0x7f4f5981007b in llvm::MallocAllocator::Allocate(unsigned long, unsigned long) (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x330d07b) #3 0x7f4f59853e5b in llvm::BumpPtrAllocatorImpl::StartNewSlab() (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x3350e5b) #4 0x7f4f5983e2ee in llvm::BumpPtrAllocatorImpl::Allocate(unsigned long, unsigned long) (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x333b2ee) #5 0x7f4f5aabd7c6 in clang::CodeCompletionAllocator::CopyString(llvm::Twine const&) (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x45ba7c6) #6 0x7f4f5ab73dcf in AddTypedNameChunk(clang::ASTContext&, clang::PrintingPolicy const&, clang::NamedDecl const*, clang::CodeCompletionBuilder&) (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x4670dcf) #7 0x7f4f5ab75fb0 in clang::CodeCompletionResult::CreateCodeCompletionString(clang::ASTContext&, clang::Preprocessor&, clang::CodeCompletionContext const&, clang::CodeCompletionAllocator&, clang::CodeCompletionTUInfo&, bool) (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x4672fb0) #8 0x7f4f5ab74322 in clang::CodeCompletionResult::CreateCodeCompletionString(clang::Sema&, clang::CodeCompletionContext const&, clang::CodeCompletionAllocator&, clang::CodeCompletionTUInfo&, bool) (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x4671322) #9 0x7f4f5a37e40e in clang::ASTUnit::CacheCodeCompletionResults() (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x3e7b40e) #10 0x7f4f5a390660 in clang::ASTUnit::Reparse(std::shared_ptr, llvm::ArrayRef, std::allocator >, llvm::MemoryBuffer*> >, llvm::IntrusiveRefCntPtr) (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x3e8d660) #11 0x7f4f597cf4a6 in clang_reparseTranslationUnit_Impl(CXTranslationUnitImpl*, llvm::ArrayRef, unsigned int) (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x32cc4a6) #12 0x7f4f597cf7ad in clang_reparseTranslationUnit::{lambda()#1}::operator()() const (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x32cc7ad) #13 0x7f4f598084cb in void llvm::function_ref::callback_fn(long) (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x33054cb) #14 0x7f4f5df9976b in llvm::function_ref::operator()() const (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x7a9676b) #15 0x7f4f5df98fad in llvm::CrashRecoveryContext::RunSafely(llvm::function_ref) (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x7a95fad) #16 0x7f4f597fe53f in clang::RunSafely(llvm::CrashRecoveryContext&, llvm::function_ref, unsigned int) (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x32fb53f) #17 0x7f4f597cfc68 in clang_reparseTranslationUnit (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x32ccc68) #18 0x55ef50dfb2f7 in ClangBackEnd::TranslationUnitUpdater::reparse() source/clangtranslationunitupdater.cpp:147 #19 0x60700010ea7f () Thread T50 (QThread) created by T0 here: #0 0x7f4f6c1c5d2f in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x37d2f) #1 0x7f4f55ac1c57 in QThread::start(QThread::Priority) (/home/nik/opt/qt-5.11.2/5.11.2/gcc_64/lib/libQt5Core.so.5+0xadc57) Thread T51 (QThread) created by T0 here: #0 0x7f4f6c1c5d2f in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x37d2f) #1 0x7f4f55ac1c57 in QThread::start(QThread::Priority) (/home/nik/opt/qt-5.11.2/5.11.2/gcc_64/lib/libQt5Core.so.5+0xadc57) Thread T47 (QThread) created by T0 here: #0 0x7f4f6c1c5d2f in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x37d2f) #1 0x7f4f55ac1c57 in QThread::start(QThread::Priority) (/home/nik/opt/qt-5.11.2/5.11.2/gcc_64/lib/libQt5Core.so.5+0xadc57) SUMMARY: AddressSanitizer: heap-use-after-free (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x33af550) in clang::CodeCompletionString::size() const Shadow bytes around the buggy address: 0x0c42804741d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c42804741e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c42804741f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c4280474200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c4280474210: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa =>0x0c4280474220: fd fd fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd 0x0c4280474230: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c4280474240: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c4280474250: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c4280474260: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c4280474270: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==14610==ABORTING