[SERVER-77527] mongodbtoolchain/v3 stdlib unsafe against self-moves Created: 26/May/23  Updated: 29/Oct/23  Resolved: 29/Jun/23

Status: Closed
Project: Core Server
Component/s: None
Affects Version/s: None
Fix Version/s: 7.1.0-rc0, 6.3.2, 5.0.19, 4.4.23, 7.0.0-rc6, 6.0.8

Type: Bug Priority: Major - P3
Reporter: Billy Donahue Assignee: Daniel Moody
Resolution: Fixed Votes: 0
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Issue Links:
Depends
Assigned Teams:
Server Development Platform
Backwards Compatibility: Fully Compatible
Operating System: ALL
Participants:
Linked BF Score: 0

 Description   

Capturing action recommendations from BF investigation.
A LOT of technical details are included in BF-27032 for this.

allison.easton@mongodb.com summarized well here:

std::shuffle has a bug in which it will sometimes try to swap an object with itself. This results in a self move of the object. Some stl types (including vector) had bugs relating to self move operations and debug assertions that they cannot be move assigned to themselves. These problems are fixed in the v4 toolchain due to fixes in libstdc+, but these fixes are not present in the v3 toolchain. We need to upgrade libstdc+ in the v3 toolchain so that these containers have the fixes for self moves.

billy.donahue@mongodb.com and matt.diener@mongodb.com confirmed this assessment after further investigation into whether this could be confined to tests. Unfortunately it is not.

The toolchain v3 standard library would need to be patched or abandoned to get us past this.

It's unknown at this time what the impact of leaving v3 toolchain unpatched would be. We'd have to study the faulty move operations and write tests against them. My guess is that this would be at least as much work as patching the toolchain, likely more. In the meantime we're looking at undefined behavior or worse and we should not let that continue.

It's also possible the answer here is to have C++ engineers study the self-move bugs in the standard library implementations more closely.



 Comments   
Comment by Daniel Moody [ 28/Jun/23 ]

I verified this was fixed with the test code:

test.cpp

#include <vector>
#include <random>
#include <algorithm>
 
struct Type {
        std::vector<int> ints;
};
 
int main() {
        std::vector<Type> intVectors = {{{1}}, {{1, 2}}};
        std::shuffle(intVectors.begin(), intVectors.end(), std::mt19937());
}

Then compiling with the old v3 toolchain:

/opt/mongodbtoolchain/revisions/11316f1e7b36f08dcdd2ad0640af18f9287876f4/v3/bin/g++ ./test.cpp -D_GLIBCXX_DEBUG

gives:

❯ ./a.out
/opt/mongodbtoolchain/revisions/11316f1e7b36f08dcdd2ad0640af18f9287876f4/stow/gcc-v3.cmc/include/c++/8.5.0/debug/safe_container.h:83:
Error: attempt to self move assign.

Objects involved in the operation:
sequence "this" @ 0x0x1fe9ee8

Unknown macro: { type = __gnu_debug}

Aborted (core dumped)

now compiling with the latest v3:

/opt/mongodbtoolchain/revisions/69f4f0673ffcb290ce2307560a4883ecf2ad138c/v3/bin/g++ ./test.cpp -D_GLIBCXX_DEBUG

gives no error:

❯ ./a.out

Comment by Daniel Moody [ 27/Jun/23 ]

toolchain is deployed in almost all the platforms, I will verify if I can detect the UB with some of billy.donahue@mongodb.com's examples

Comment by Daniel Moody [ 15/Jun/23 ]

after the toolchain is deployed in BUILD-17505 the stdlibc++ patch can be verified to be deployed in v3 builders and we can close this.

Generated at Thu Feb 08 06:35:50 UTC 2024 using Jira 9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66.