| OLD | NEW |
| (Empty) |
| 1 ############################################################################# | |
| 2 # UBSan vptr blacklist. | |
| 3 # Function and type based blacklisting use a mangled name, and it is especially | |
| 4 # tricky to represent C++ types. For now, any possible changes by name manglings | |
| 5 # are simply represented as wildcard expressions of regexp, and thus it might be | |
| 6 # over-blacklisted. | |
| 7 | |
| 8 ############################################################################# | |
| 9 # Identical layouts. | |
| 10 # If base and derived classes have identifical memory layouts (i.e., the same | |
| 11 # object size) and both have no virtual functions, we blacklist them as there | |
| 12 # would be not much security implications. | |
| 13 | |
| 14 fun:*LifecycleNotifier*addObserver* | |
| 15 fun:*LifecycleNotifier*removeObserver* | |
| 16 fun:*toWebInputElement* | |
| 17 type:*base*MessageLoopForIO* | |
| 18 type:*BlockRefType* | |
| 19 type:*SkAutoTUnref* | |
| 20 type:*WDResult* | |
| 21 type:*ExecutionContext* | |
| 22 type:*WebInputElement* | |
| 23 type:*WebFormControlElement* | |
| 24 | |
| 25 # Avoid identical layout cases for 86 different classes in InspectorTypeBuilder, | |
| 26 # all of which are guarded using COMPILER_ASSERT on the object size. Two more | |
| 27 # types are also blacklisted due to the template class (JSONArray <-> Array<T>). | |
| 28 | |
| 29 src:*InspectorTypeBuilder.h* | |
| 30 type:*TypeBuilder* | |
| 31 type:*JSONArray* | |
| 32 | |
| 33 ############################################################################# | |
| 34 # Base class's constructor accesses a derived class's member. | |
| 35 | |
| 36 fun:*DoublyLinkedListNode* | |
| 37 type:*content*WebUIExtensionData* | |
| 38 | |
| 39 # RenderFrameObserverTracker<T>::RenderFrameObserverTracker() | |
| 40 fun:*content*RenderFrameObserverTracker*RenderFrame* | |
| 41 | |
| 42 # RenderViewObserverTracker<T>::RenderViewObserverTracker() | |
| 43 fun:*content*RenderViewObserverTracker*RenderView* | |
| 44 | |
| 45 ############################################################################# | |
| 46 # Base class's destructor accesses a derived class. | |
| 47 | |
| 48 fun:*DatabaseContext*contextDestroyed* | |
| 49 | |
| 50 ############################################################################# | |
| 51 # static_cast into itself in the constructor. | |
| 52 | |
| 53 fun:*RefCountedGarbageCollected*makeKeepAlive* | |
| 54 fun:*ThreadSafeRefCountedGarbageCollected*makeKeepAlive* | |
| 55 | |
| 56 ############################################################################# | |
| 57 # Accessing data in destructurors where the class has virtual inheritances. | |
| 58 | |
| 59 type:*content*RenderWidgetHost* | |
| 60 | |
| 61 # Mangled name for content::RenderViewHostImpl::~RenderViewHostImpl() | |
| 62 fun:*content*RenderViewHostImpl* | |
| 63 | |
| 64 ############################################################################# | |
| 65 # Using raw pointer values. | |
| 66 # | |
| 67 # A raw pointer value (16) is used to infer the field offset by | |
| 68 # GOOGLE_PROTOBUF_GENERATED_MESSAGE_FIELD_OFFSET. | |
| 69 | |
| 70 src:*/third_party/protobuf/src/google/protobuf/compiler/plugin.pb.cc | |
| 71 src:*/third_party/protobuf/src/google/protobuf/compiler/cpp/cpp_message.cc | |
| 72 src:*/third_party/protobuf/src/google/protobuf/descriptor.pb.cc | |
| 73 | |
| 74 ############################################################################# | |
| 75 # Avoid link errors. | |
| 76 # Ubsan vptr needs typeinfo on the target class, but it looks like typeinfo is | |
| 77 # not avaiable if the class is not exported. For now, simply blacklisted to | |
| 78 # avoid link errors; e.g., undefined reference to 'typeinfo for [CLASS_NAME]'. | |
| 79 | |
| 80 # obj/ppapi/libppapi_proxy.a(obj/ppapi/proxy/ppapi_proxy.proxy_channel.o):../../
ppapi/proxy/proxy_channel.cc:__unnamed_53: error: undefined reference to 'typein
fo for IPC::TestSink' | |
| 81 src:*/ppapi/proxy/proxy_channel.cc | |
| 82 | |
| 83 # obj/chrome/libbrowser.a(obj/chrome/browser/net/browser.predictor.o):../../chro
me/browser/net/predictor.cc:__unnamed_577: error: undefined reference to 'typein
fo for ProxyAdvisor' | |
| 84 src:*/chrome/browser/net/predictor.cc | |
| 85 | |
| 86 # obj/third_party/pdfium/libfpdfapi.a(obj/third_party/pdfium/core/src/fpdfapi/fp
df_render/fpdfapi.fpdf_render_text.o):../../third_party/pdfium/core/src/fpdfapi/
fpdf_render/:__unnamed_360: error: undefined reference to 'typeinfo for CPDF_Inl
ineImages' | |
| 87 src:*/third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_text.cpp | |
| 88 | |
| 89 # obj/third_party/libwebm/libwebm.a(obj/third_party/libwebm/source/libwebm.mkvmu
xer.o)(.data.rel..L__unnamed_2+0x18): error: undefined reference to 'typeinfo fo
r mkvparser::IMkvReader' | |
| 90 src:*/third_party/libwebm/source/mkvmuxer.cpp | |
| OLD | NEW |