base/tools_sanity_unittest.cc

   1 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4 //
   5 // This file contains intentional memory errors, some of which may lead to
   6 // crashes if the test is ran without special memory testing tools. We use these
   7 // errors to verify the sanity of the tools.
   8
   9 #include "base/atomicops.h"
  10 #include "base/message_loop.h"
  11 #include "base/third_party/dynamic_annotations/dynamic_annotations.h"
  12 #include "base/threading/thread.h"
  13 #include "testing/gtest/include/gtest/gtest.h"
  14
  15 namespace base {
  16
  17 namespace {
  18
  19 const base::subtle::Atomic32 kMagicValue = 42;
  20
  21 // Helper for memory accesses that can potentially corrupt memory or cause a
  22 // crash during a native run.
  23 #ifdef ADDRESS_SANITIZER
  24 #define HARMFUL_ACCESS(action,error_regexp) EXPECT_DEATH(action,error_regexp)
  25 #else
  26 #define HARMFUL_ACCESS(action,error_regexp) \
  27 do { if (RunningOnValgrind()) { action; } } while (0)
  28 #endif
  29
  30 void ReadUninitializedValue(char *ptr) {
  31   // The || in the conditional is to prevent clang from optimizing away the
  32   // jump -- valgrind only catches jumps and conditional moves, but clang uses
  33   // the borrow flag if the condition is just `*ptr == '\0'`.
  34   if (*ptr == '\0' || *ptr == 64) {
  35     (*ptr)++;
  36   } else {
  37     (*ptr)--;
  38   }
  39 }
  40
  41 void ReadValueOutOfArrayBoundsLeft(char *ptr) {
  42   char c = ptr[-2];
  43   VLOG(1) << "Reading a byte out of bounds: " << c;
  44 }
  45
  46 void ReadValueOutOfArrayBoundsRight(char *ptr, size_t size) {
  47   char c = ptr[size + 1];
  48   VLOG(1) << "Reading a byte out of bounds: " << c;
  49 }
  50
  51 // This is harmless if you run it under Valgrind thanks to redzones.
  52 void WriteValueOutOfArrayBoundsLeft(char *ptr) {
  53   ptr[-1] = kMagicValue;
  54 }
  55
  56 // This is harmless if you run it under Valgrind thanks to redzones.
  57 void WriteValueOutOfArrayBoundsRight(char *ptr, size_t size) {
  58   ptr[size] = kMagicValue;
  59 }
  60
  61 void MakeSomeErrors(char *ptr, size_t size) {
  62   ReadUninitializedValue(ptr);
  63   HARMFUL_ACCESS(ReadValueOutOfArrayBoundsLeft(ptr),
  64                  "heap-buffer-overflow.*2 bytes to the left");
  65   HARMFUL_ACCESS(ReadValueOutOfArrayBoundsRight(ptr, size),
  66                  "heap-buffer-overflow.*1 bytes to the right");
  67   HARMFUL_ACCESS(WriteValueOutOfArrayBoundsLeft(ptr),
  68                  "heap-buffer-overflow.*1 bytes to the left");
  69   HARMFUL_ACCESS(WriteValueOutOfArrayBoundsRight(ptr, size),
  70                  "heap-buffer-overflow.*0 bytes to the right");
  71 }
  72
  73 }  // namespace
  74
  75 // A memory leak detector should report an error in this test.
  76 TEST(ToolsSanityTest, MemoryLeak) {
  77   // Without the |volatile|, clang optimizes away the next two lines.
  78   int* volatile leak = new int[256];  // Leak some memory intentionally.
  79   leak[4] = 1;  // Make sure the allocated memory is used.
  80 }
  81
  82 TEST(ToolsSanityTest, AccessesToNewMemory) {
  83   char *foo = new char[10];
  84   MakeSomeErrors(foo, 10);
  85   delete [] foo;
  86   // Use after delete.
  87   HARMFUL_ACCESS(foo[5] = 0, "heap-use-after-free");
  88 }
  89
  90 TEST(ToolsSanityTest, AccessesToMallocMemory) {
  91   char *foo = reinterpret_cast<char*>(malloc(10));
  92   MakeSomeErrors(foo, 10);
  93   free(foo);
  94   // Use after free.
  95   HARMFUL_ACCESS(foo[5] = 0, "heap-use-after-free");
  96 }
  97
  98 TEST(ToolsSanityTest, ArrayDeletedWithoutBraces) {
  99 #ifndef ADDRESS_SANITIZER
 100   // This test may corrupt memory if not run under Valgrind or compiled with
 101   // AddressSanitizer.
 102   if (!RunningOnValgrind())
 103     return;
 104 #endif
 105
 106   // Without the |volatile|, clang optimizes away the next two lines.
 107   int* volatile foo = new int[10];
 108   delete foo;
 109 }
 110
 111 TEST(ToolsSanityTest, SingleElementDeletedWithBraces) {
 112 #ifndef ADDRESS_SANITIZER
 113   // This test may corrupt memory if not run under Valgrind or compiled with
 114   // AddressSanitizer.
 115   if (!RunningOnValgrind())
 116     return;
 117 #endif
 118
 119   // Without the |volatile|, clang optimizes away the next two lines.
 120   int* volatile foo = new int;
 121   (void) foo;
 122   delete [] foo;
 123 }
 124
 125 #ifdef ADDRESS_SANITIZER
 126 TEST(ToolsSanityTest, DISABLED_AddressSanitizerNullDerefCrashTest) {
 127   // Intentionally crash to make sure AddressSanitizer is running.
 128   // This test should not be ran on bots.
 129   int* volatile zero = NULL;
 130   *zero = 0;
 131 }
 132
 133 TEST(ToolsSanityTest, DISABLED_AddressSanitizerLocalOOBCrashTest) {
 134   // Intentionally crash to make sure AddressSanitizer is instrumenting
 135   // the local variables.
 136   // This test should not be ran on bots.
 137   int array[5];
 138   // Work around the OOB warning reported by Clang.
 139   int* volatile access = &array[5];
 140   *access = 43;
 141 }
 142
 143 namespace {
 144 int g_asan_test_global_array[10];
 145 }  // namespace
 146
 147 TEST(ToolsSanityTest, DISABLED_AddressSanitizerGlobalOOBCrashTest) {
 148   // Intentionally crash to make sure AddressSanitizer is instrumenting
 149   // the global variables.
 150   // This test should not be ran on bots.
 151
 152   // Work around the OOB warning reported by Clang.
 153   int* volatile access = g_asan_test_global_array - 1;
 154   *access = 43;
 155 }
 156
 157 #endif
 158
 159 namespace {
 160
 161 // We use caps here just to ensure that the method name doesn't interfere with
 162 // the wildcarded suppressions.
 163 class TOOLS_SANITY_TEST_CONCURRENT_THREAD : public PlatformThread::Delegate {
 164  public:
 165   explicit TOOLS_SANITY_TEST_CONCURRENT_THREAD(bool *value) : value_(value) {}
 166   ~TOOLS_SANITY_TEST_CONCURRENT_THREAD() {}
 167   void ThreadMain() {
 168     *value_ = true;
 169
 170     // Sleep for a few milliseconds so the two threads are more likely to live
 171     // simultaneously. Otherwise we may miss the report due to mutex
 172     // lock/unlock's inside thread creation code in pure-happens-before mode...
 173     PlatformThread::Sleep(100);
 174   }
 175  private:
 176   bool *value_;
 177 };
 178
 179 class ReleaseStoreThread : public PlatformThread::Delegate {
 180  public:
 181   explicit ReleaseStoreThread(base::subtle::Atomic32 *value) : value_(value) {}
 182   ~ReleaseStoreThread() {}
 183   void ThreadMain() {
 184     base::subtle::Release_Store(value_, kMagicValue);
 185
 186     // Sleep for a few milliseconds so the two threads are more likely to live
 187     // simultaneously. Otherwise we may miss the report due to mutex
 188     // lock/unlock's inside thread creation code in pure-happens-before mode...
 189     PlatformThread::Sleep(100);
 190   }
 191  private:
 192   base::subtle::Atomic32 *value_;
 193 };
 194
 195 class AcquireLoadThread : public PlatformThread::Delegate {
 196  public:
 197   explicit AcquireLoadThread(base::subtle::Atomic32 *value) : value_(value) {}
 198   ~AcquireLoadThread() {}
 199   void ThreadMain() {
 200     // Wait for the other thread to make Release_Store
 201     PlatformThread::Sleep(100);
 202     base::subtle::Acquire_Load(value_);
 203   }
 204  private:
 205   base::subtle::Atomic32 *value_;
 206 };
 207
 208 void RunInParallel(PlatformThread::Delegate *d1, PlatformThread::Delegate *d2) {
 209   PlatformThreadHandle a;
 210   PlatformThreadHandle b;
 211   PlatformThread::Create(0, d1, &a);
 212   PlatformThread::Create(0, d2, &b);
 213   PlatformThread::Join(a);
 214   PlatformThread::Join(b);
 215 }
 216
 217 }  // namespace
 218
 219 // A data race detector should report an error in this test.
 220 TEST(ToolsSanityTest, DataRace) {
 221   bool shared = false;
 222   TOOLS_SANITY_TEST_CONCURRENT_THREAD thread1(&shared), thread2(&shared);
 223   RunInParallel(&thread1, &thread2);
 224   EXPECT_TRUE(shared);
 225 }
 226
 227 TEST(ToolsSanityTest, AnnotateBenignRace) {
 228   bool shared = false;
 229   ANNOTATE_BENIGN_RACE(&shared, "Intentional race - make sure doesn't show up");
 230   TOOLS_SANITY_TEST_CONCURRENT_THREAD thread1(&shared), thread2(&shared);
 231   RunInParallel(&thread1, &thread2);
 232   EXPECT_TRUE(shared);
 233 }
 234
 235 TEST(ToolsSanityTest, AtomicsAreIgnored) {
 236   base::subtle::Atomic32 shared = 0;
 237   ReleaseStoreThread thread1(&shared);
 238   AcquireLoadThread thread2(&shared);
 239   RunInParallel(&thread1, &thread2);
 240   EXPECT_EQ(kMagicValue, shared);
 241 }
 242
 243 }  // namespace base