tools_sanity_unittest.cc | Explore in Territory

// Copyright 2012 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#ifdef UNSAFE_BUFFERS_BUILD
// TODO(crbug.com/40284755): Remove this and spanify to fix the errors.
#pragma allow_unsafe_buffers
#endif

// This file contains intentional memory errors, some of which may lead to
// crashes if the test is ran without special memory testing tools. We use these
// errors to verify the sanity of the tools.

#include <stddef.h>

#include "base/atomicops.h"
#include "base/cfi_buildflags.h"
#include "base/debug/asan_invalid_access.h"
#include "base/debug/profiler.h"
#include "base/logging.h"
#include "base/memory/raw_ptr.h"
#include "base/sanitizer_buildflags.h"
#include "base/threading/thread.h"
#include "build/build_config.h"
#include "testing/gtest/include/gtest/gtest.h"
#include "third_party/abseil-cpp/absl/base/dynamic_annotations.h"

#if BUILDFLAG(IS_WIN)
#include <windows.h>
#else
#include <dlfcn.h>
#endif

namespace base {

namespace {

const base::subtle::Atomic32 kMagicValue = …;

// Helper for memory accesses that can potentially corrupt memory or cause a
// crash during a native run.
#if defined(ADDRESS_SANITIZER)
#define HARMFUL_ACCESS …
#elif BUILDFLAG(IS_HWASAN)
#define HARMFUL_ACCESS …
#else
#define HARMFUL_ACCESS …
#define HARMFUL_ACCESS_IS_NOOP
#endif

void DoReadUninitializedValue(volatile char *ptr) { … }

void ReadUninitializedValue(volatile char *ptr) { … }

#ifndef HARMFUL_ACCESS_IS_NOOP
void ReadValueOutOfArrayBoundsLeft(char *ptr) {
  char c = ptr[-2];
  VLOG(1) << "Reading a byte out of bounds: " << c;
}

void ReadValueOutOfArrayBoundsRight(char *ptr, size_t size) {
  char c = ptr[size + 1];
  VLOG(1) << "Reading a byte out of bounds: " << c;
}

void WriteValueOutOfArrayBoundsLeft(char *ptr) {
  ptr[-1] = kMagicValue;
}

void WriteValueOutOfArrayBoundsRight(char *ptr, size_t size) {
  ptr[size] = kMagicValue;
}
#endif  // HARMFUL_ACCESS_IS_NOOP

void MakeSomeErrors(char *ptr, size_t size) { … }

}  // namespace

#if defined(ADDRESS_SANITIZER) || defined(LEAK_SANITIZER) ||  \
    defined(MEMORY_SANITIZER) || defined(THREAD_SANITIZER) || \
    defined(UNDEFINED_SANITIZER)
// build/sanitizers/sanitizer_options.cc defines symbols like
// __asan_default_options which the sanitizer runtime calls if they exist
// in the executable. If they don't, the sanitizer runtime silently uses an
// internal default value instead. The build puts the symbol
// _sanitizer_options_link_helper (which the sanitizer runtime doesn't know
// about, it's a chrome thing) in that file and then tells the linker that
// that symbol must exist. This causes sanitizer_options.cc to be part of
// our binaries, which in turn makes sure our __asan_default_options are used.
// We had problems with __asan_default_options not being used, so this test
// verifies that _sanitizer_options_link_helper actually makes it into our
// binaries.
#if BUILDFLAG(IS_ANDROID) || BUILDFLAG(IS_WIN)
// TODO(crbug.com/40224191): Sanitizer options are currently broken
// on Android.
// TODO(crbug.com/40223949): __asan_default_options should be used
// on Windows too, but currently isn't.
#define MAYBE_LinksSanitizerOptions …
#else
#define MAYBE_LinksSanitizerOptions …
#endif
TEST(ToolsSanityTest, MAYBE_LinksSanitizerOptions) {
  constexpr char kSym[] = "_sanitizer_options_link_helper";
#if BUILDFLAG(IS_WIN)
  auto sym = GetProcAddress(GetModuleHandle(nullptr), kSym);
#else
  void* sym = dlsym(RTLD_DEFAULT, kSym);
#endif
  EXPECT_TRUE(sym != nullptr);
}
#endif  // sanitizers

// A memory leak detector should report an error in this test.
TEST(ToolsSanityTest, MemoryLeak) { … }

TEST(ToolsSanityTest, AccessesToNewMemory) { … }

TEST(ToolsSanityTest, AccessesToMallocMemory) { … }

TEST(ToolsSanityTest, AccessesToStack) { … }

#if defined(ADDRESS_SANITIZER)

// alloc_dealloc_mismatch defaults to
// !SANITIZER_MAC && !SANITIZER_WINDOWS && !SANITIZER_ANDROID,
// in the sanitizer runtime upstream.
#if BUILDFLAG(IS_ANDROID) || BUILDFLAG(IS_MAC) || BUILDFLAG(IS_WIN) || \
    BUILDFLAG(IS_FUCHSIA)
#define MAYBE_SingleElementDeletedWithBraces …
#define MAYBE_ArrayDeletedWithoutBraces …
#else
#define MAYBE_ArrayDeletedWithoutBraces …
#define MAYBE_SingleElementDeletedWithBraces …
#endif  // defined(ADDRESS_SANITIZER)

static int* allocateArray() {
  // Clang warns about the mismatched new[]/delete if they occur in the same
  // function.
  return new int[10];
}

// This test may corrupt memory if not compiled with AddressSanitizer.
TEST(ToolsSanityTest, MAYBE_ArrayDeletedWithoutBraces) {
  // Without the |volatile|, clang optimizes away the next two lines.
  int* volatile foo = allocateArray();
  HARMFUL_ACCESS(delete foo, "alloc-dealloc-mismatch");
  // Under ASan the crash happens in the process spawned by HARMFUL_ACCESS,
  // need to free the memory in the parent.
  delete [] foo;
}

static int* allocateScalar() {
  // Clang warns about the mismatched new/delete[] if they occur in the same
  // function.
  return new int;
}

// This test may corrupt memory if not compiled with AddressSanitizer.
TEST(ToolsSanityTest, MAYBE_SingleElementDeletedWithBraces) {
  // Without the |volatile|, clang optimizes away the next two lines.
  int* volatile foo = allocateScalar();
  (void) foo;
  HARMFUL_ACCESS(delete [] foo, "alloc-dealloc-mismatch");
  // Under ASan the crash happens in the process spawned by HARMFUL_ACCESS,
  // need to free the memory in the parent.
  delete foo;
}
#endif

TEST(ToolsSanityTest, DISABLED_AddressSanitizerNullDerefCrashTest) { … }

TEST(ToolsSanityTest, DISABLED_AddressSanitizerLocalOOBCrashTest) { … }

namespace {
int g_asan_test_global_array[10];
}  // namespace

TEST(ToolsSanityTest, DISABLED_AddressSanitizerGlobalOOBCrashTest) { … }

#ifndef HARMFUL_ACCESS_IS_NOOP
TEST(ToolsSanityTest, AsanHeapOverflow) {
  HARMFUL_ACCESS(debug::AsanHeapOverflow(), "after");
}

TEST(ToolsSanityTest, AsanHeapUnderflow) {
  HARMFUL_ACCESS(debug::AsanHeapUnderflow(), "before");
}

TEST(ToolsSanityTest, AsanHeapUseAfterFree) {
  HARMFUL_ACCESS(debug::AsanHeapUseAfterFree(), "heap-use-after-free");
}

#if BUILDFLAG(IS_WIN)
// The ASAN runtime doesn't detect heap corruption, this needs fixing before
// ASAN builds can ship to the wild. See https://crbug.com/818747.
TEST(ToolsSanityTest, DISABLED_AsanCorruptHeapBlock) {
  HARMFUL_ACCESS(debug::AsanCorruptHeapBlock(), "");
}

TEST(ToolsSanityTest, DISABLED_AsanCorruptHeap) {
  // This test will kill the process by raising an exception, there's no
  // particular string to look for in the stack trace.
  EXPECT_DEATH(debug::AsanCorruptHeap(), "");
}
#endif  // BUILDFLAG(IS_WIN)
#endif  // !HARMFUL_ACCESS_IS_NOOP

namespace {

// We use caps here just to ensure that the method name doesn't interfere with
// the wildcarded suppressions.
class TOOLS_SANITY_TEST_CONCURRENT_THREAD : public PlatformThread::Delegate { … };

class ReleaseStoreThread : public PlatformThread::Delegate { … };

class AcquireLoadThread : public PlatformThread::Delegate { … };

void RunInParallel(PlatformThread::Delegate *d1, PlatformThread::Delegate *d2) { … }

#if defined(THREAD_SANITIZER)
void DataRace() {
  bool *shared = new bool(false);
  TOOLS_SANITY_TEST_CONCURRENT_THREAD thread1(shared), thread2(shared);
  RunInParallel(&thread1, &thread2);
  EXPECT_TRUE(*shared);
  delete shared;
  // We're in a death test - crash.
  CHECK(0);
}
#endif

}  // namespace

#if defined(THREAD_SANITIZER)
// A data race detector should report an error in this test.
TEST(ToolsSanityTest, DataRace) {
  // The suppression regexp must match that in base/debug/tsan_suppressions.cc.
  EXPECT_DEATH(DataRace(), "1 race:base/tools_sanity_unittest.cc");
}
#endif

TEST(ToolsSanityTest, AnnotateBenignRace) { … }

TEST(ToolsSanityTest, AtomicsAreIgnored) { … }

#if BUILDFLAG(CFI_ENFORCEMENT_TRAP)
#if BUILDFLAG(IS_WIN)
#define CFI_ERROR_MSG …
#elif BUILDFLAG(IS_ANDROID)
// TODO(pcc): Produce proper stack dumps on Android and test for the correct
// si_code here.
#define CFI_ERROR_MSG …
#else
#define CFI_ERROR_MSG …
#endif
#elif BUILDFLAG(CFI_ENFORCEMENT_DIAGNOSTIC)
#define CFI_ERROR_MSG …
#endif  // BUILDFLAG(CFI_ENFORCEMENT_TRAP || CFI_ENFORCEMENT_DIAGNOSTIC)

#if defined(CFI_ERROR_MSG)
class A {
 public:
  A(): n_(0) {}
  virtual void f() { n_++; }
 protected:
  int n_;
};

class B: public A {
 public:
  void f() override { n_--; }
};

class C: public B {
 public:
  void f() override { n_ += 2; }
};

NOINLINE void KillVptrAndCall(A *obj) {
  *reinterpret_cast<void **>(obj) = 0;
  obj->f();
}

TEST(ToolsSanityTest, BadVirtualCallNull) {
  A a;
  B b;
  EXPECT_DEATH({ KillVptrAndCall(&a); KillVptrAndCall(&b); }, CFI_ERROR_MSG);
}

NOINLINE void OverwriteVptrAndCall(B *obj, A *vptr) {
  *reinterpret_cast<void **>(obj) = *reinterpret_cast<void **>(vptr);
  obj->f();
}

TEST(ToolsSanityTest, BadVirtualCallWrongType) {
  A a;
  B b;
  C c;
  EXPECT_DEATH({ OverwriteVptrAndCall(&b, &a); OverwriteVptrAndCall(&b, &c); },
               CFI_ERROR_MSG);
}

// TODO(pcc): remove CFI_CAST_CHECK, see https://crbug.com/626794.
#if BUILDFLAG(CFI_CAST_CHECK)
TEST(ToolsSanityTest, BadDerivedCast) {
  A a;
  EXPECT_DEATH((void)(B*)&a, CFI_ERROR_MSG);
}

TEST(ToolsSanityTest, BadUnrelatedCast) {
  class A {
    virtual void f() {}
  };

  class B {
    virtual void f() {}
  };

  A a;
  EXPECT_DEATH((void)(B*)&a, CFI_ERROR_MSG);
}
#endif  // BUILDFLAG(CFI_CAST_CHECK)

#endif  // CFI_ERROR_MSG

#undef CFI_ERROR_MSG
#undef HARMFUL_ACCESS
#undef HARMFUL_ACCESS_IS_NOOP

}  // namespace base
chromium/base/tools_sanity_unittest.cc
