==1864==ERROR: AddressSanitizer: heap-use-after-free on address 0x6210023d3510 at pc 0x7f033c2ff551 bp 0x7f032e48ca20 sp 0x7f032e48ca10 READ of size 8 at 0x6210023d3510 thread T48 (QThread) qtc.clangbackend.jobs: [ clangcodemodelserver-test.cpp ] Adding Job<186,"clangcodemodelserver-test.cpp",RequestReferences,RecentlyParsed> qtc.clangbackend.jobs: [ clangcodemodelserver-test.cpp ] Not choosing due to dirty document: Job<184,"clangcodemodelserver-test.cpp",UpdateExtraAnnotations,RecentlyParsed> qtc.clangbackend.jobs: [ clangcodemodelserver-test.cpp ] Not choosing due to dirty document: Job<185,"clangcodemodelserver-test.cpp",RequestReferences,RecentlyParsed> qtc.clangbackend.jobs: [ clangcodemodelserver-test.cpp ] Not choosing due to dirty document: Job<186,"clangcodemodelserver-test.cpp",RequestReferences,RecentlyParsed> #0 0x7f033c2ff550 in clang::CodeCompletionString::size() const (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x33af550) #1 0x7f033c2f44d3 in clang_getNumCompletionChunks (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x33a44d3) #2 0x56412789d193 in ClangBackEnd::CodeCompletionsExtractor::extractText() source/codecompletionsextractor.cpp:241 #3 0x56412789ec93 in ClangBackEnd::CodeCompletionsExtractor::next() source/codecompletionsextractor.cpp:60 #4 0x5641278a0a92 in ClangBackEnd::CodeCompletionsExtractor::extractAll(bool) source/codecompletionsextractor.cpp:98 #5 0x56412789a7a8 in toCodeCompletions source/codecompleter.cpp:59 #6 0x56412789a7a8 in ClangBackEnd::CodeCompleter::complete(unsigned int, unsigned int, int, int) source/codecompleter.cpp:123 qtc.clangbackend.jobs: [ clangcodemodelserver-test.cpp ] Adding Job<187,"clangcodemodelserver-test.cpp",UpdateAnnotations,PreviouslyParsed> qtc.clangbackend.jobs: [ clangcodemodelserver-test.cpp ] Adding Job<188,"clangcodemodelserver-test.cpp",UpdateExtraAnnotations,RecentlyParsed> qtc.clangbackend.jobs: [ clangcodemodelserver-test.cpp ] Expired: Job<183,"clangcodemodelserver-test.cpp",UpdateAnnotations,PreviouslyParsed> "outdated unsaved files" qtc.clangbackend.jobs: [ clangcodemodelserver-test.cpp ] Expired: Job<184,"clangcodemodelserver-test.cpp",UpdateExtraAnnotations,RecentlyParsed> "outdated unsaved files" qtc.clangbackend.jobs: [ clangcodemodelserver-test.cpp ] Expired: Job<185,"clangcodemodelserver-test.cpp",RequestReferences,RecentlyParsed> "changed document revision" qtc.clangbackend.jobs: [ clangcodemodelserver-test.cpp ] Not choosing due to dirty document: Job<186,"clangcodemodelserver-test.cpp",RequestReferences,RecentlyParsed> qtc.clangbackend.jobs: [ clangcodemodelserver-test.cpp ] Not choosing due to dirty document: Job<188,"clangcodemodelserver-test.cpp",UpdateExtraAnnotations,RecentlyParsed> #7 0x56412788ac9b in ClangBackEnd::TranslationUnit::complete(ClangBackEnd::UnsavedFiles&, unsigned int, unsigned int, int, int) const source/clangtranslationunit.cpp:118 #8 0x5641278443f7 in operator() source/clangcompletecodejob.cpp:54 #9 0x5641278443f7 in _M_invoke /usr/include/c++/7/bits/std_function.h:302 #10 0x564127847f35 in std::function ()>::operator()() const /usr/include/c++/7/bits/std_function.h:706 #11 0x564127847f35 in void Utils::Internal::runAsyncReturnVoidDispatch, std::function ()>>(std::integral_constant, QFutureInterface >, std::function ()>&&) ../../libs/utils/runextensions.h:250 #12 0x564127847f35 in void Utils::Internal::runAsyncQFutureInterfaceDispatch, std::function ()>>(std::integral_constant, QFutureInterface >, std::function ()>&&) ../../libs/utils/runextensions.h:264 #13 0x564127847f35 in void Utils::Internal::runAsyncMemberDispatch, std::function ()>, , void>(QFutureInterface >, std::function ()>&&) ../../libs/utils/runextensions.h:274 #14 0x564127848606 in void Utils::Internal::runAsyncImpl, std::function ()>>(QFutureInterface >, std::function ()>&&) ../../libs/utils/runextensions.h:303 #15 0x564127848606 in void Utils::Internal::AsyncJob, std::function ()>&>::runHelper<0ul>(std::integer_sequence) ../../libs/utils/runextensions.h:372 #16 0x564127848606 in Utils::Internal::AsyncJob, std::function ()>&>::run() ../../libs/utils/runextensions.h:352 #17 0x7f034e3d84bc in Utils::Internal::RunnableThread::run() (/d1/creator/ut/4.8/release/libexec/qtcreator/../../lib/qtcreator/libUtils.so.4+0x1664bc) #18 0x7f033850f563 in QThreadPrivate::start(void*) (/home/nik/opt/qt-5.11.2/5.11.2/gcc_64/lib/libQt5Core.so.5+0xae563) #19 0x7f03374ab6da in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76da) #20 0x7f0337bf088e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x12188e) 0x6210023d3510 is located 16 bytes inside of 4096-byte region [0x6210023d3500,0x6210023d4500) freed by thread T46 (QThread) here: #0 0x7f034ecb97b8 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xde7b8) #1 0x7f033c25d09d in llvm::MallocAllocator::Deallocate(void const*, unsigned long) (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x330d09d) #2 0x7f033c30eef4 in llvm::BumpPtrAllocatorImpl::DeallocateSlabs(void**, void**) (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x33beef4) #3 0x7f033c30ec3e in llvm::BumpPtrAllocatorImpl::~BumpPtrAllocatorImpl() (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x33bec3e) #4 0x7f033c30e63b in clang::CodeCompletionAllocator::~CodeCompletionAllocator() (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x33be63b) #5 0x7f033c30f8f1 in clang::GlobalCodeCompletionAllocator::~GlobalCodeCompletionAllocator() (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x33bf8f1) #6 0x7f033c30f911 in void __gnu_cxx::new_allocator::destroy(clang::GlobalCodeCompletionAllocator*) (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x33bf911) #7 0x7f033c30f8c8 in void std::allocator_traits >::destroy(std::allocator&, clang::GlobalCodeCompletionAllocator*) (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x33bf8c8) #8 0x7f033c30f5fe in std::_Sp_counted_ptr_inplace, (__gnu_cxx::_Lock_policy)2>::_M_dispose() (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x33bf5fe) #9 0x7f033c29c7fa in std::_Sp_counted_base<(__gnu_cxx::_Lock_policy)2>::_M_release() (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x334c7fa) #10 0x7f033c286073 in std::__shared_count<(__gnu_cxx::_Lock_policy)2>::~__shared_count() (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x3336073) #11 0x7f033c2828ed in std::__shared_ptr::~__shared_ptr() (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x33328ed) #12 0x7f033c307962 in std::__shared_ptr::operator=(std::__shared_ptr&&) (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x33b7962) #13 0x7f033c304b09 in std::shared_ptr::operator=(std::shared_ptr&&) (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x33b4b09) #14 0x7f033cdcc800 in clang::ASTUnit::ClearCachedCompletionResults() (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x3e7c800) #15 0x7f033cdcaf68 in clang::ASTUnit::CacheCodeCompletionResults() (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x3e7af68) #16 0x7f033cddd660 in clang::ASTUnit::Reparse(std::shared_ptr, llvm::ArrayRef, std::allocator >, llvm::MemoryBuffer*> >, llvm::IntrusiveRefCntPtr) (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x3e8d660) #17 0x7f033c21c4a6 in clang_reparseTranslationUnit_Impl(CXTranslationUnitImpl*, llvm::ArrayRef, unsigned int) (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x32cc4a6) #18 0x7f033c21c7ad in clang_reparseTranslationUnit::{lambda()#1}::operator()() const (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x32cc7ad) #19 0x7f033c2554cb in void llvm::function_ref::callback_fn(long) (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x33054cb) #20 0x7f03409e676b in llvm::function_ref::operator()() const (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x7a9676b) #21 0x7f03409e5fad in llvm::CrashRecoveryContext::RunSafely(llvm::function_ref) (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x7a95fad) #22 0x7f033c24b53f in clang::RunSafely(llvm::CrashRecoveryContext&, llvm::function_ref, unsigned int) (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x32fb53f) #23 0x7f033c21cc68 in clang_reparseTranslationUnit (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x32ccc68) #24 0x5641278902f7 in ClangBackEnd::TranslationUnitUpdater::reparse() source/clangtranslationunitupdater.cpp:147 #25 0x7f0324636a0f () previously allocated by thread T29 (QThread) here: #0 0x7f034ecb9b50 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xdeb50) #1 0x7f033c1f1cf2 in llvm::safe_malloc(unsigned long) (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x32a1cf2) #2 0x7f033c25d07b in llvm::MallocAllocator::Allocate(unsigned long, unsigned long) (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x330d07b) #3 0x7f033c2a0e5b in llvm::BumpPtrAllocatorImpl::StartNewSlab() (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x3350e5b) #4 0x7f033c28b2ee in llvm::BumpPtrAllocatorImpl::Allocate(unsigned long, unsigned long) (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x333b2ee) #5 0x7f033d50a7c6 in clang::CodeCompletionAllocator::CopyString(llvm::Twine const&) (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x45ba7c6) #6 0x7f033d5c4f3f in clang::CodeCompletionResult::CreateCodeCompletionString(clang::ASTContext&, clang::Preprocessor&, clang::CodeCompletionContext const&, clang::CodeCompletionAllocator&, clang::CodeCompletionTUInfo&, bool) (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x4674f3f) #7 0x7f033d5c1322 in clang::CodeCompletionResult::CreateCodeCompletionString(clang::Sema&, clang::CodeCompletionContext const&, clang::CodeCompletionAllocator&, clang::CodeCompletionTUInfo&, bool) (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x4671322) #8 0x7f033cdcb40e in clang::ASTUnit::CacheCodeCompletionResults() (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x3e7b40e) #9 0x7f033cddd660 in clang::ASTUnit::Reparse(std::shared_ptr, llvm::ArrayRef, std::allocator >, llvm::MemoryBuffer*> >, llvm::IntrusiveRefCntPtr) (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x3e8d660) #10 0x7f033c21c4a6 in clang_reparseTranslationUnit_Impl(CXTranslationUnitImpl*, llvm::ArrayRef, unsigned int) (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x32cc4a6) #11 0x7f033c21c7ad in clang_reparseTranslationUnit::{lambda()#1}::operator()() const (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x32cc7ad) #12 0x7f033c2554cb in void llvm::function_ref::callback_fn(long) (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x33054cb) #13 0x7f03409e676b in llvm::function_ref::operator()() const (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x7a9676b) #14 0x7f03409e5fad in llvm::CrashRecoveryContext::RunSafely(llvm::function_ref) (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x7a95fad) #15 0x7f033c24b53f in clang::RunSafely(llvm::CrashRecoveryContext&, llvm::function_ref, unsigned int) (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x32fb53f) #16 0x7f033c21cc68 in clang_reparseTranslationUnit (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x32ccc68) #17 0x5641278902f7 in ClangBackEnd::TranslationUnitUpdater::reparse() source/clangtranslationunitupdater.cpp:147 #18 0x7f0324636a1f () Thread T48 (QThread) created by T0 here: #0 0x7f034ec12d2f in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x37d2f) #1 0x7f033850ec57 in QThread::start(QThread::Priority) (/home/nik/opt/qt-5.11.2/5.11.2/gcc_64/lib/libQt5Core.so.5+0xadc57) Thread T46 (QThread) created by T0 here: #0 0x7f034ec12d2f in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x37d2f) #1 0x7f033850ec57 in QThread::start(QThread::Priority) (/home/nik/opt/qt-5.11.2/5.11.2/gcc_64/lib/libQt5Core.so.5+0xadc57) Thread T29 (QThread) created by T0 here: #0 0x7f034ec12d2f in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x37d2f) #1 0x7f033850ec57 in QThread::start(QThread::Priority) (/home/nik/opt/qt-5.11.2/5.11.2/gcc_64/lib/libQt5Core.so.5+0xadc57) SUMMARY: AddressSanitizer: heap-use-after-free (/d2/llvm/7/qtc/installs/Release/lib/libclang.so.7+0x33af550) in clang::CodeCompletionString::size() const Shadow bytes around the buggy address: 0x0c4280472650: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c4280472660: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c4280472670: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c4280472680: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c4280472690: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa =>0x0c42804726a0: fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c42804726b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c42804726c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c42804726d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c42804726e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c42804726f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==1864==ABORTING