base/tools_sanity_unittest.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4 //
   5 // This file contains intentional memory errors, some of which may lead to
   6 // crashes if the test is ran without special memory testing tools. We use these
   7 // errors to verify the sanity of the tools.
   8
   9 #include "base/atomicops.h"
  10 #include "base/message_loop/message_loop.h"
  11 #include "base/third_party/dynamic_annotations/dynamic_annotations.h"
  12 #include "base/threading/thread.h"
  13 #include "testing/gtest/include/gtest/gtest.h"
  14
  15 namespace base {
  16
  17 namespace {
  18
  19 const base::subtle::Atomic32 kMagicValue = 42;
  20
  21 // Helper for memory accesses that can potentially corrupt memory or cause a
  22 // crash during a native run.
  23 #if defined(ADDRESS_SANITIZER) || defined(SYZYASAN)
  24 #if defined(OS_IOS)
  25 // EXPECT_DEATH is not supported on IOS.
  26 #define HARMFUL_ACCESS(action,error_regexp) do { action; } while (0)
  27 #else
  28 #define HARMFUL_ACCESS(action,error_regexp) EXPECT_DEATH(action,error_regexp)
  29 #endif  // !OS_IOS
  30 #else
  31 #define HARMFUL_ACCESS(action,error_regexp) \
  32 do { if (RunningOnValgrind()) { action; } } while (0)
  33 #endif
  34
  35 void DoReadUninitializedValue(char *ptr) {
  36   // Comparison with 64 is to prevent clang from optimizing away the
  37   // jump -- valgrind only catches jumps and conditional moves, but clang uses
  38   // the borrow flag if the condition is just `*ptr == '\0'`.
  39   if (*ptr == 64) {
  40     VLOG(1) << "Uninit condition is true";
  41   } else {
  42     VLOG(1) << "Uninit condition is false";
  43   }
  44 }
  45
  46 void ReadUninitializedValue(char *ptr) {
  47 #if defined(MEMORY_SANITIZER)
  48   EXPECT_DEATH(DoReadUninitializedValue(ptr),
  49                "use-of-uninitialized-value");
  50 #else
  51   DoReadUninitializedValue(ptr);
  52 #endif
  53 }
  54
  55 void ReadValueOutOfArrayBoundsLeft(char *ptr) {
  56   char c = ptr[-2];
  57   VLOG(1) << "Reading a byte out of bounds: " << c;
  58 }
  59
  60 void ReadValueOutOfArrayBoundsRight(char *ptr, size_t size) {
  61   char c = ptr[size + 1];
  62   VLOG(1) << "Reading a byte out of bounds: " << c;
  63 }
  64
  65 // This is harmless if you run it under Valgrind thanks to redzones.
  66 void WriteValueOutOfArrayBoundsLeft(char *ptr) {
  67   ptr[-1] = kMagicValue;
  68 }
  69
  70 // This is harmless if you run it under Valgrind thanks to redzones.
  71 void WriteValueOutOfArrayBoundsRight(char *ptr, size_t size) {
  72   ptr[size] = kMagicValue;
  73 }
  74
  75 void MakeSomeErrors(char *ptr, size_t size) {
  76   ReadUninitializedValue(ptr);
  77
  78   HARMFUL_ACCESS(ReadValueOutOfArrayBoundsLeft(ptr),
  79                  "2 bytes to the left");
  80   HARMFUL_ACCESS(ReadValueOutOfArrayBoundsRight(ptr, size),
  81                  "1 bytes to the right");
  82   HARMFUL_ACCESS(WriteValueOutOfArrayBoundsLeft(ptr),
  83                  "1 bytes to the left");
  84   HARMFUL_ACCESS(WriteValueOutOfArrayBoundsRight(ptr, size),
  85                  "0 bytes to the right");
  86 }
  87
  88 }  // namespace
  89
  90 // A memory leak detector should report an error in this test.
  91 TEST(ToolsSanityTest, MemoryLeak) {
  92   // Without the |volatile|, clang optimizes away the next two lines.
  93   int* volatile leak = new int[256];  // Leak some memory intentionally.
  94   leak[4] = 1;  // Make sure the allocated memory is used.
  95 }
  96
  97 #if (defined(ADDRESS_SANITIZER) && defined(OS_IOS)) || defined(SYZYASAN)
  98 // Because iOS doesn't support death tests, each of the following tests will
  99 // crash the whole program under Asan. On Windows Asan is based on SyzyAsan; the
 100 // error report mechanism is different than with Asan so these tests will fail.
 101 #define MAYBE_AccessesToNewMemory DISABLED_AccessesToNewMemory
 102 #define MAYBE_AccessesToMallocMemory DISABLED_AccessesToMallocMemory
 103 #else
 104 #define MAYBE_AccessesToNewMemory AccessesToNewMemory
 105 #define MAYBE_AccessesToMallocMemory AccessesToMallocMemory
 106 #define MAYBE_ArrayDeletedWithoutBraces ArrayDeletedWithoutBraces
 107 #define MAYBE_SingleElementDeletedWithBraces SingleElementDeletedWithBraces
 108 #endif
 109
 110 // The following tests pass with Clang r170392, but not r172454, which
 111 // makes AddressSanitizer detect errors in them. We disable these tests under
 112 // AddressSanitizer until we fully switch to Clang r172454. After that the
 113 // tests should be put back under the (defined(OS_IOS) || defined(OS_WIN))
 114 // clause above.
 115 // See also http://crbug.com/172614.
 116 #if defined(ADDRESS_SANITIZER) || defined(SYZYASAN)
 117 #define MAYBE_SingleElementDeletedWithBraces \
 118     DISABLED_SingleElementDeletedWithBraces
 119 #define MAYBE_ArrayDeletedWithoutBraces DISABLED_ArrayDeletedWithoutBraces
 120 #endif
 121 TEST(ToolsSanityTest, MAYBE_AccessesToNewMemory) {
 122   char *foo = new char[10];
 123   MakeSomeErrors(foo, 10);
 124   delete [] foo;
 125   // Use after delete.
 126   HARMFUL_ACCESS(foo[5] = 0, "heap-use-after-free");
 127 }
 128
 129 TEST(ToolsSanityTest, MAYBE_AccessesToMallocMemory) {
 130   char *foo = reinterpret_cast<char*>(malloc(10));
 131   MakeSomeErrors(foo, 10);
 132   free(foo);
 133   // Use after free.
 134   HARMFUL_ACCESS(foo[5] = 0, "heap-use-after-free");
 135 }
 136
 137 TEST(ToolsSanityTest, MAYBE_ArrayDeletedWithoutBraces) {
 138 #if !defined(ADDRESS_SANITIZER) && !defined(SYZYASAN)
 139   // This test may corrupt memory if not run under Valgrind or compiled with
 140   // AddressSanitizer.
 141   if (!RunningOnValgrind())
 142     return;
 143 #endif
 144
 145   // Without the |volatile|, clang optimizes away the next two lines.
 146   int* volatile foo = new int[10];
 147   delete foo;
 148 }
 149
 150 TEST(ToolsSanityTest, MAYBE_SingleElementDeletedWithBraces) {
 151 #if !defined(ADDRESS_SANITIZER)
 152   // This test may corrupt memory if not run under Valgrind or compiled with
 153   // AddressSanitizer.
 154   if (!RunningOnValgrind())
 155     return;
 156 #endif
 157
 158   // Without the |volatile|, clang optimizes away the next two lines.
 159   int* volatile foo = new int;
 160   (void) foo;
 161   delete [] foo;
 162 }
 163
 164 #if defined(ADDRESS_SANITIZER) || defined(SYZYASAN)
 165 TEST(ToolsSanityTest, DISABLED_AddressSanitizerNullDerefCrashTest) {
 166   // Intentionally crash to make sure AddressSanitizer is running.
 167   // This test should not be ran on bots.
 168   int* volatile zero = NULL;
 169   *zero = 0;
 170 }
 171
 172 TEST(ToolsSanityTest, DISABLED_AddressSanitizerLocalOOBCrashTest) {
 173   // Intentionally crash to make sure AddressSanitizer is instrumenting
 174   // the local variables.
 175   // This test should not be ran on bots.
 176   int array[5];
 177   // Work around the OOB warning reported by Clang.
 178   int* volatile access = &array[5];
 179   *access = 43;
 180 }
 181
 182 namespace {
 183 int g_asan_test_global_array[10];
 184 }  // namespace
 185
 186 TEST(ToolsSanityTest, DISABLED_AddressSanitizerGlobalOOBCrashTest) {
 187   // Intentionally crash to make sure AddressSanitizer is instrumenting
 188   // the global variables.
 189   // This test should not be ran on bots.
 190
 191   // Work around the OOB warning reported by Clang.
 192   int* volatile access = g_asan_test_global_array - 1;
 193   *access = 43;
 194 }
 195
 196 #endif
 197
 198 namespace {
 199
 200 // We use caps here just to ensure that the method name doesn't interfere with
 201 // the wildcarded suppressions.
 202 class TOOLS_SANITY_TEST_CONCURRENT_THREAD : public PlatformThread::Delegate {
 203  public:
 204   explicit TOOLS_SANITY_TEST_CONCURRENT_THREAD(bool *value) : value_(value) {}
 205   virtual ~TOOLS_SANITY_TEST_CONCURRENT_THREAD() {}
 206   virtual void ThreadMain() OVERRIDE {
 207     *value_ = true;
 208
 209     // Sleep for a few milliseconds so the two threads are more likely to live
 210     // simultaneously. Otherwise we may miss the report due to mutex
 211     // lock/unlock's inside thread creation code in pure-happens-before mode...
 212     PlatformThread::Sleep(TimeDelta::FromMilliseconds(100));
 213   }
 214  private:
 215   bool *value_;
 216 };
 217
 218 class ReleaseStoreThread : public PlatformThread::Delegate {
 219  public:
 220   explicit ReleaseStoreThread(base::subtle::Atomic32 *value) : value_(value) {}
 221   virtual ~ReleaseStoreThread() {}
 222   virtual void ThreadMain() OVERRIDE {
 223     base::subtle::Release_Store(value_, kMagicValue);
 224
 225     // Sleep for a few milliseconds so the two threads are more likely to live
 226     // simultaneously. Otherwise we may miss the report due to mutex
 227     // lock/unlock's inside thread creation code in pure-happens-before mode...
 228     PlatformThread::Sleep(TimeDelta::FromMilliseconds(100));
 229   }
 230  private:
 231   base::subtle::Atomic32 *value_;
 232 };
 233
 234 class AcquireLoadThread : public PlatformThread::Delegate {
 235  public:
 236   explicit AcquireLoadThread(base::subtle::Atomic32 *value) : value_(value) {}
 237   virtual ~AcquireLoadThread() {}
 238   virtual void ThreadMain() OVERRIDE {
 239     // Wait for the other thread to make Release_Store
 240     PlatformThread::Sleep(TimeDelta::FromMilliseconds(100));
 241     base::subtle::Acquire_Load(value_);
 242   }
 243  private:
 244   base::subtle::Atomic32 *value_;
 245 };
 246
 247 void RunInParallel(PlatformThread::Delegate *d1, PlatformThread::Delegate *d2) {
 248   PlatformThreadHandle a;
 249   PlatformThreadHandle b;
 250   PlatformThread::Create(0, d1, &a);
 251   PlatformThread::Create(0, d2, &b);
 252   PlatformThread::Join(a);
 253   PlatformThread::Join(b);
 254 }
 255
 256 }  // namespace
 257
 258 // A data race detector should report an error in this test.
 259 TEST(ToolsSanityTest, DataRace) {
 260   bool *shared = new bool(false);
 261   TOOLS_SANITY_TEST_CONCURRENT_THREAD thread1(shared), thread2(shared);
 262   RunInParallel(&thread1, &thread2);
 263   EXPECT_TRUE(*shared);
 264   delete shared;
 265 }
 266
 267 TEST(ToolsSanityTest, AnnotateBenignRace) {
 268   bool shared = false;
 269   ANNOTATE_BENIGN_RACE(&shared, "Intentional race - make sure doesn't show up");
 270   TOOLS_SANITY_TEST_CONCURRENT_THREAD thread1(&shared), thread2(&shared);
 271   RunInParallel(&thread1, &thread2);
 272   EXPECT_TRUE(shared);
 273 }
 274
 275 TEST(ToolsSanityTest, AtomicsAreIgnored) {
 276   base::subtle::Atomic32 shared = 0;
 277   ReleaseStoreThread thread1(&shared);
 278   AcquireLoadThread thread2(&shared);
 279   RunInParallel(&thread1, &thread2);
 280   EXPECT_EQ(kMagicValue, shared);
 281 }
 282
 283 }  // namespace base