asan_test.cc revision 1e172b4bdec57329bf904f063a29f99cddf2d85f 
1//===-- asan_test.cc ------------*- C++ -*-===//
2//
3//                     The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9//
10// This file is a part of AddressSanitizer, an address sanity checker.
11//
12//===----------------------------------------------------------------------===//
13#include <stdio.h>
14#include <signal.h>
15#include <stdlib.h>
16#include <string.h>
17#include <pthread.h>
18#include <stdint.h>
19#include <setjmp.h>
20#include <assert.h>
21
22#if defined(__i386__) or defined(__x86_64__)
23#include <emmintrin.h>
24#endif
25
26#include "asan_test_config.h"
27#include "asan_test_utils.h"
28
29#ifndef __APPLE__
30#include <malloc.h>
31#endif  // __APPLE__
32
33#ifdef __APPLE__
34static bool APPLE = true;
35#else
36static bool APPLE = false;
37#endif
38
39#if ASAN_HAS_EXCEPTIONS
40# define ASAN_THROW(x) throw (x)
41#else
42# define ASAN_THROW(x)
43#endif
44
45#include <sys/mman.h>
46
47typedef uint8_t   U1;
48typedef uint16_t  U2;
49typedef uint32_t  U4;
50typedef uint64_t  U8;
51
52static const char *progname;
53static const int kPageSize = 4096;
54
55// Simple stand-alone pseudorandom number generator.
56// Current algorithm is ANSI C linear congruential PRNG.
57static inline uint32_t my_rand(uint32_t* state) {
58  return (*state = *state * 1103515245 + 12345) >> 16;
59}
60
61static uint32_t global_seed = 0;
62
63class ObjdumpOfMyself {
64 public:
65  explicit ObjdumpOfMyself(const string &binary) {
66    is_correct = true;
67    string objdump_name = APPLE ? "gobjdump" : "objdump";
68    string prog = objdump_name + " -d " + binary;
69    // TODO(glider): popen() succeeds even if the file does not exist.
70    FILE *pipe = popen(prog.c_str(), "r");
71    string objdump;
72    if (pipe) {
73      const int kBuffSize = 4096;
74      char buff[kBuffSize+1];
75      int read_bytes;
76      while ((read_bytes = fread(buff, 1, kBuffSize, pipe)) > 0) {
77        buff[read_bytes] = 0;
78        objdump.append(buff);
79      }
80      pclose(pipe);
81    } else {
82      is_correct = false;
83    }
84    // cut the objdump into functions
85    string fn, next_fn;
86    size_t next_start;
87    for (size_t start = fn_start(objdump, 0, &fn);
88         start != string::npos;
89         start = next_start, fn = next_fn) {
90      next_start = fn_start(objdump, start, &next_fn);
91      // fprintf(stderr, "start: %d next_start = %d fn: %s\n",
92      //        (int)start, (int)next_start, fn.c_str());
93      // Mac OS adds the "_" prefix to function names.
94      if (fn.find(APPLE ? "_Disasm" : "Disasm") == string::npos) {
95        continue;
96      }
97      string fn_body = objdump.substr(start, next_start - start);
98      // fprintf(stderr, "%s:\n%s", fn.c_str(), fn_body.c_str());
99      functions_[fn] = fn_body;
100    }
101  }
102
103  string &GetFuncDisasm(const string &fn) {
104    return functions_[fn];
105  }
106
107  int CountInsnInFunc(const string &fn, const vector<string> &insns) {
108    // Mac OS adds the "_" prefix to function names.
109    string fn_ref = APPLE ? "_" + fn : fn;
110    const string &disasm = GetFuncDisasm(fn_ref);
111    if (disasm.empty()) return -1;
112    size_t counter = 0;
113    for (size_t i = 0; i < insns.size(); i++) {
114      size_t pos = 0;
115      while ((pos = disasm.find(insns[i], pos)) != string::npos) {
116        counter++;
117        pos++;
118      }
119    }
120    return counter;
121  }
122
123  bool IsCorrect() { return is_correct; }
124
125 private:
126  size_t fn_start(const string &objdump, size_t start_pos, string *fn) {
127    size_t pos = objdump.find(">:\n", start_pos);
128    if (pos == string::npos)
129      return string::npos;
130    size_t beg = pos;
131    while (beg > 0 && objdump[beg - 1] != '<')
132      beg--;
133    *fn = objdump.substr(beg, pos - beg);
134    return pos + 3;
135  }
136
137  map<string, string> functions_;
138  bool is_correct;
139};
140
141static ObjdumpOfMyself *objdump_of_myself() {
142  static ObjdumpOfMyself *o = new ObjdumpOfMyself(progname);
143  return o;
144}
145
146const size_t kLargeMalloc = 1 << 24;
147
148template<class T>
149__attribute__((noinline))
150void asan_write(T *a) {
151  *a = 0;
152}
153
154__attribute__((noinline))
155void asan_write_sized_aligned(uint8_t *p, size_t size) {
156  EXPECT_EQ(0, ((uintptr_t)p % size));
157  if      (size == 1) asan_write((uint8_t*)p);
158  else if (size == 2) asan_write((uint16_t*)p);
159  else if (size == 4) asan_write((uint32_t*)p);
160  else if (size == 8) asan_write((uint64_t*)p);
161}
162
163__attribute__((noinline)) void *malloc_fff(size_t size) {
164  void *res = malloc/**/(size); break_optimization(0); return res;}
165__attribute__((noinline)) void *malloc_eee(size_t size) {
166  void *res = malloc_fff(size); break_optimization(0); return res;}
167__attribute__((noinline)) void *malloc_ddd(size_t size) {
168  void *res = malloc_eee(size); break_optimization(0); return res;}
169__attribute__((noinline)) void *malloc_ccc(size_t size) {
170  void *res = malloc_ddd(size); break_optimization(0); return res;}
171__attribute__((noinline)) void *malloc_bbb(size_t size) {
172  void *res = malloc_ccc(size); break_optimization(0); return res;}
173__attribute__((noinline)) void *malloc_aaa(size_t size) {
174  void *res = malloc_bbb(size); break_optimization(0); return res;}
175
176#ifndef __APPLE__
177__attribute__((noinline)) void *memalign_fff(size_t alignment, size_t size) {
178  void *res = memalign/**/(alignment, size); break_optimization(0); return res;}
179__attribute__((noinline)) void *memalign_eee(size_t alignment, size_t size) {
180  void *res = memalign_fff(alignment, size); break_optimization(0); return res;}
181__attribute__((noinline)) void *memalign_ddd(size_t alignment, size_t size) {
182  void *res = memalign_eee(alignment, size); break_optimization(0); return res;}
183__attribute__((noinline)) void *memalign_ccc(size_t alignment, size_t size) {
184  void *res = memalign_ddd(alignment, size); break_optimization(0); return res;}
185__attribute__((noinline)) void *memalign_bbb(size_t alignment, size_t size) {
186  void *res = memalign_ccc(alignment, size); break_optimization(0); return res;}
187__attribute__((noinline)) void *memalign_aaa(size_t alignment, size_t size) {
188  void *res = memalign_bbb(alignment, size); break_optimization(0); return res;}
189#endif  // __APPLE__
190
191
192__attribute__((noinline))
193  void free_ccc(void *p) { free(p); break_optimization(0);}
194__attribute__((noinline))
195  void free_bbb(void *p) { free_ccc(p); break_optimization(0);}
196__attribute__((noinline))
197  void free_aaa(void *p) { free_bbb(p); break_optimization(0);}
198
199template<class T>
200__attribute__((noinline))
201void oob_test(int size, int off) {
202  char *p = (char*)malloc_aaa(size);
203  // fprintf(stderr, "writing %d byte(s) into [%p,%p) with offset %d\n",
204  //        sizeof(T), p, p + size, off);
205  asan_write((T*)(p + off));
206  free_aaa(p);
207}
208
209
210template<class T>
211__attribute__((noinline))
212void uaf_test(int size, int off) {
213  char *p = (char *)malloc_aaa(size);
214  free_aaa(p);
215  for (int i = 1; i < 100; i++)
216    free_aaa(malloc_aaa(i));
217  fprintf(stderr, "writing %ld byte(s) at %p with offset %d\n",
218          (long)sizeof(T), p, off);
219  asan_write((T*)(p + off));
220}
221
222TEST(AddressSanitizer, ADDRESS_SANITIZER_MacroTest) {
223  EXPECT_EQ(1, ADDRESS_SANITIZER);
224}
225
226TEST(AddressSanitizer, SimpleDeathTest) {
227  EXPECT_DEATH(exit(1), "");
228}
229
230TEST(AddressSanitizer, VariousMallocsTest) {
231  // fprintf(stderr, "malloc:\n");
232  int *a = (int*)malloc(100 * sizeof(int));
233  a[50] = 0;
234  free(a);
235
236  // fprintf(stderr, "realloc:\n");
237  int *r = (int*)malloc(10);
238  r = (int*)realloc(r, 2000 * sizeof(int));
239  r[1000] = 0;
240  free(r);
241
242  // fprintf(stderr, "operator new []\n");
243  int *b = new int[100];
244  b[50] = 0;
245  delete [] b;
246
247  // fprintf(stderr, "operator new\n");
248  int *c = new int;
249  *c = 0;
250  delete c;
251
252#ifndef __APPLE__
253  // cfree
254  cfree(Ident(malloc(1)));
255
256  // fprintf(stderr, "posix_memalign\n");
257  int *pm;
258  int pm_res = posix_memalign((void**)&pm, kPageSize, kPageSize);
259  EXPECT_EQ(0, pm_res);
260  free(pm);
261
262  int *ma = (int*)memalign(kPageSize, kPageSize);
263  EXPECT_EQ(0, (uintptr_t)ma % kPageSize);
264  ma[123] = 0;
265  free(ma);
266#endif  // __APPLE__
267}
268
269TEST(AddressSanitizer, CallocTest) {
270  int *a = (int*)calloc(100, sizeof(int));
271  EXPECT_EQ(0, a[10]);
272  free(a);
273}
274
275TEST(AddressSanitizer, VallocTest) {
276  void *a = valloc(100);
277  EXPECT_EQ(0, (uintptr_t)a % kPageSize);
278  free(a);
279}
280
281#ifndef __APPLE__
282TEST(AddressSanitizer, PvallocTest) {
283  char *a = (char*)pvalloc(kPageSize + 100);
284  EXPECT_EQ(0, (uintptr_t)a % kPageSize);
285  a[kPageSize + 101] = 1;  // we should not report an error here.
286  free(a);
287
288  a = (char*)pvalloc(0);  // pvalloc(0) should allocate at least one page.
289  EXPECT_EQ(0, (uintptr_t)a % kPageSize);
290  a[101] = 1;  // we should not report an error here.
291  free(a);
292}
293#endif  // __APPLE__
294
295void NoOpSignalHandler(int unused) {
296  fprintf(stderr, "NoOpSignalHandler (should not happen). Aborting\n");
297  abort();
298}
299
300void NoOpSigaction(int, siginfo_t *siginfo, void *context) {
301  fprintf(stderr, "NoOpSigaction (should not happen). Aborting\n");
302  abort();
303}
304
305TEST(AddressSanitizer, SignalTest) {
306  signal(SIGSEGV, NoOpSignalHandler);
307  signal(SIGILL, NoOpSignalHandler);
308  // If asan did not intercept sigaction NoOpSigaction will fire.
309  char *x = Ident((char*)malloc(5));
310  EXPECT_DEATH(x[6]++, "is located 1 bytes to the right");
311  free(Ident(x));
312}
313
314TEST(AddressSanitizer, SigactionTest) {
315  {
316    struct sigaction sigact;
317    memset(&sigact, 0, sizeof(sigact));
318    sigact.sa_sigaction = NoOpSigaction;;
319    sigact.sa_flags = SA_SIGINFO;
320    sigaction(SIGSEGV, &sigact, 0);
321  }
322
323  {
324    struct sigaction sigact;
325    memset(&sigact, 0, sizeof(sigact));
326    sigact.sa_sigaction = NoOpSigaction;;
327    sigact.sa_flags = SA_SIGINFO;
328    sigaction(SIGILL, &sigact, 0);
329  }
330
331  // If asan did not intercept sigaction NoOpSigaction will fire.
332  char *x = Ident((char*)malloc(5));
333  EXPECT_DEATH(x[6]++, "is located 1 bytes to the right");
334  free(Ident(x));
335}
336
337void *TSDWorker(void *test_key) {
338  if (test_key) {
339    pthread_setspecific(*(pthread_key_t*)test_key, (void*)0xfeedface);
340  }
341  return NULL;
342}
343
344void TSDDestructor(void *tsd) {
345  // Spawning a thread will check that the current thread id is not -1.
346  pthread_t th;
347  pthread_create(&th, NULL, TSDWorker, NULL);
348  pthread_join(th, NULL);
349}
350
351// This tests triggers the thread-specific data destruction fiasco which occurs
352// if we don't manage the TSD destructors ourselves. We create a new pthread
353// key with a non-NULL destructor which is likely to be put after the destructor
354// of AsanThread in the list of destructors.
355// In this case the TSD for AsanThread will be destroyed before TSDDestructor
356// is called for the child thread, and a CHECK will fail when we call
357// pthread_create() to spawn the grandchild.
358TEST(AddressSanitizer, DISABLED_TSDTest) {
359  pthread_t th;
360  pthread_key_t test_key;
361  pthread_key_create(&test_key, TSDDestructor);
362  pthread_create(&th, NULL, TSDWorker, &test_key);
363  pthread_join(th, NULL);
364  pthread_key_delete(test_key);
365}
366
367template<class T>
368void OOBTest() {
369  char expected_str[100];
370  for (int size = sizeof(T); size < 20; size += 5) {
371    for (int i = -5; i < 0; i++) {
372      const char *str =
373          "is located.*%d byte.*to the left";
374      sprintf(expected_str, str, abs(i));
375      EXPECT_DEATH(oob_test<T>(size, i), expected_str);
376    }
377
378    for (int i = 0; i < size - sizeof(T) + 1; i++)
379      oob_test<T>(size, i);
380
381    for (int i = size - sizeof(T) + 1; i <= size + 3 * sizeof(T); i++) {
382      const char *str =
383          "is located.*%d byte.*to the right";
384      int off = i >= size ? (i - size) : 0;
385      // we don't catch unaligned partially OOB accesses.
386      if (i % sizeof(T)) continue;
387      sprintf(expected_str, str, off);
388      EXPECT_DEATH(oob_test<T>(size, i), expected_str);
389    }
390  }
391
392  EXPECT_DEATH(oob_test<T>(kLargeMalloc, -1),
393          "is located.*1 byte.*to the left");
394  EXPECT_DEATH(oob_test<T>(kLargeMalloc, kLargeMalloc),
395          "is located.*0 byte.*to the right");
396}
397
398// TODO(glider): the following tests are EXTREMELY slow on Darwin:
399//   AddressSanitizer.OOB_char (125503 ms)
400//   AddressSanitizer.OOB_int (126890 ms)
401//   AddressSanitizer.OOBRightTest (315605 ms)
402//   AddressSanitizer.SimpleStackTest (366559 ms)
403
404TEST(AddressSanitizer, OOB_char) {
405  OOBTest<U1>();
406}
407
408TEST(AddressSanitizer, OOB_int) {
409  OOBTest<U4>();
410}
411
412TEST(AddressSanitizer, OOBRightTest) {
413  for (size_t access_size = 1; access_size <= 8; access_size *= 2) {
414    for (size_t alloc_size = 1; alloc_size <= 8; alloc_size++) {
415      for (size_t offset = 0; offset <= 8; offset += access_size) {
416        void *p = malloc(alloc_size);
417        // allocated: [p, p + alloc_size)
418        // accessed:  [p + offset, p + offset + access_size)
419        uint8_t *addr = (uint8_t*)p + offset;
420        if (offset + access_size <= alloc_size) {
421          asan_write_sized_aligned(addr, access_size);
422        } else {
423          int outside_bytes = offset > alloc_size ? (offset - alloc_size) : 0;
424          const char *str =
425              "is located.%d *byte.*to the right";
426          char expected_str[100];
427          sprintf(expected_str, str, outside_bytes);
428          EXPECT_DEATH(asan_write_sized_aligned(addr, access_size),
429                       expected_str);
430        }
431        free(p);
432      }
433    }
434  }
435}
436
437TEST(AddressSanitizer, UAF_char) {
438  const char *uaf_string = "AddressSanitizer.*heap-use-after-free";
439  EXPECT_DEATH(uaf_test<U1>(1, 0), uaf_string);
440  EXPECT_DEATH(uaf_test<U1>(10, 0), uaf_string);
441  EXPECT_DEATH(uaf_test<U1>(10, 10), uaf_string);
442  EXPECT_DEATH(uaf_test<U1>(kLargeMalloc, 0), uaf_string);
443  EXPECT_DEATH(uaf_test<U1>(kLargeMalloc, kLargeMalloc / 2), uaf_string);
444}
445
446#if ASAN_HAS_BLACKLIST
447TEST(AddressSanitizer, IgnoreTest) {
448  int *x = Ident(new int);
449  delete Ident(x);
450  *x = 0;
451}
452#endif  // ASAN_HAS_BLACKLIST
453
454struct StructWithBitField {
455  int bf1:1;
456  int bf2:1;
457  int bf3:1;
458  int bf4:29;
459};
460
461TEST(AddressSanitizer, BitFieldPositiveTest) {
462  StructWithBitField *x = new StructWithBitField;
463  delete Ident(x);
464  EXPECT_DEATH(x->bf1 = 0, "use-after-free");
465  EXPECT_DEATH(x->bf2 = 0, "use-after-free");
466  EXPECT_DEATH(x->bf3 = 0, "use-after-free");
467  EXPECT_DEATH(x->bf4 = 0, "use-after-free");
468};
469
470struct StructWithBitFields_8_24 {
471  int a:8;
472  int b:24;
473};
474
475TEST(AddressSanitizer, BitFieldNegativeTest) {
476  StructWithBitFields_8_24 *x = Ident(new StructWithBitFields_8_24);
477  x->a = 0;
478  x->b = 0;
479  delete Ident(x);
480}
481
482TEST(AddressSanitizer, OutOfMemoryTest) {
483  size_t size = __WORDSIZE == 64 ? (size_t)(1ULL << 48) : (0xf0000000);
484  EXPECT_EQ(0, realloc(0, size));
485  EXPECT_EQ(0, realloc(0, ~Ident(0)));
486  EXPECT_EQ(0, malloc(size));
487  EXPECT_EQ(0, malloc(~Ident(0)));
488  EXPECT_EQ(0, calloc(1, size));
489  EXPECT_EQ(0, calloc(1, ~Ident(0)));
490}
491
492#if ASAN_NEEDS_SEGV
493TEST(AddressSanitizer, WildAddressTest) {
494  char *c = (char*)0x123;
495  EXPECT_DEATH(*c = 0, "AddressSanitizer crashed on unknown address");
496}
497#endif
498
499static void MallocStress(size_t n) {
500  uint32_t seed = my_rand(&global_seed);
501  for (size_t iter = 0; iter < 10; iter++) {
502    vector<void *> vec;
503    for (size_t i = 0; i < n; i++) {
504      if ((i % 3) == 0) {
505        if (vec.empty()) continue;
506        size_t idx = my_rand(&seed) % vec.size();
507        void *ptr = vec[idx];
508        vec[idx] = vec.back();
509        vec.pop_back();
510        free_aaa(ptr);
511      } else {
512        size_t size = my_rand(&seed) % 1000 + 1;
513#ifndef __APPLE__
514        size_t alignment = 1 << (my_rand(&seed) % 7 + 3);
515        char *ptr = (char*)memalign_aaa(alignment, size);
516#else
517        char *ptr = (char*) malloc_aaa(size);
518#endif
519        vec.push_back(ptr);
520        ptr[0] = 0;
521        ptr[size-1] = 0;
522        ptr[size/2] = 0;
523      }
524    }
525    for (size_t i = 0; i < vec.size(); i++)
526      free_aaa(vec[i]);
527  }
528}
529
530TEST(AddressSanitizer, MallocStressTest) {
531  MallocStress(200000);
532}
533
534static void TestLargeMalloc(size_t size) {
535  char buff[1024];
536  sprintf(buff, "is located 1 bytes to the left of %lu-byte", (long)size);
537  EXPECT_DEATH(Ident((char*)malloc(size))[-1] = 0, buff);
538}
539
540TEST(AddressSanitizer, LargeMallocTest) {
541  for (int i = 113; i < (1 << 28); i = i * 2 + 13) {
542    TestLargeMalloc(i);
543  }
544}
545
546TEST(AddressSanitizer, HugeMallocTest) {
547#ifdef __APPLE__
548  // It was empirically found out that 1215 megabytes is the maximum amount of
549  // memory available to the process under AddressSanitizer on Darwin.
550  // (the libSystem malloc() allows allocating up to 2300 megabytes without
551  // ASan).
552  size_t n_megs = __WORDSIZE == 32 ? 1200 : 4100;
553#else
554  size_t n_megs = __WORDSIZE == 32 ? 2600 : 4100;
555#endif
556  TestLargeMalloc(n_megs << 20);
557}
558
559TEST(AddressSanitizer, ThreadedMallocStressTest) {
560  const int kNumThreads = 4;
561  pthread_t t[kNumThreads];
562  for (int i = 0; i < kNumThreads; i++) {
563    pthread_create(&t[i], 0, (void* (*)(void *x))MallocStress, (void*)100000);
564  }
565  for (int i = 0; i < kNumThreads; i++) {
566    pthread_join(t[i], 0);
567  }
568}
569
570void *ManyThreadsWorker(void *a) {
571  for (int iter = 0; iter < 100; iter++) {
572    for (size_t size = 100; size < 2000; size *= 2) {
573      free(Ident(malloc(size)));
574    }
575  }
576  return 0;
577}
578
579TEST(AddressSanitizer, ManyThreadsTest) {
580  const size_t kNumThreads = __WORDSIZE == 32 ? 150 : 1000;
581  pthread_t t[kNumThreads];
582  for (size_t i = 0; i < kNumThreads; i++) {
583    pthread_create(&t[i], 0, (void* (*)(void *x))ManyThreadsWorker, (void*)i);
584  }
585  for (size_t i = 0; i < kNumThreads; i++) {
586    pthread_join(t[i], 0);
587  }
588}
589
590TEST(AddressSanitizer, ReallocTest) {
591  const int kMinElem = 5;
592  int *ptr = (int*)malloc(sizeof(int) * kMinElem);
593  ptr[3] = 3;
594  for (int i = 0; i < 10000; i++) {
595    ptr = (int*)realloc(ptr,
596        (my_rand(&global_seed) % 1000 + kMinElem) * sizeof(int));
597    EXPECT_EQ(3, ptr[3]);
598  }
599}
600
601void WrongFree() {
602  int *x = (int*)malloc(100 * sizeof(int));
603  // Use the allocated memory, otherwise Clang will optimize it out.
604  Ident(x);
605  free(x + 1);
606}
607
608TEST(AddressSanitizer, WrongFreeTest) {
609  EXPECT_DEATH(WrongFree(), "attempting free.*not malloc");
610}
611
612void DoubleFree() {
613  int *x = (int*)malloc(100 * sizeof(int));
614  fprintf(stderr, "DoubleFree: x=%p\n", x);
615  free(x);
616  free(x);
617  fprintf(stderr, "should have failed in the second free(%p)\n", x);
618  abort();
619}
620
621TEST(AddressSanitizer, DoubleFreeTest) {
622  EXPECT_DEATH(DoubleFree(), "attempting double-free");
623}
624
625template<int kSize>
626__attribute__((noinline))
627void SizedStackTest() {
628  char a[kSize];
629  char  *A = Ident((char*)&a);
630  for (size_t i = 0; i < kSize; i++)
631    A[i] = i;
632  EXPECT_DEATH(A[-1] = 0, "");
633  EXPECT_DEATH(A[-20] = 0, "");
634  EXPECT_DEATH(A[-31] = 0, "");
635  EXPECT_DEATH(A[kSize] = 0, "");
636  EXPECT_DEATH(A[kSize + 1] = 0, "");
637  EXPECT_DEATH(A[kSize + 10] = 0, "");
638  EXPECT_DEATH(A[kSize + 31] = 0, "");
639}
640
641TEST(AddressSanitizer, SimpleStackTest) {
642  SizedStackTest<1>();
643  SizedStackTest<2>();
644  SizedStackTest<3>();
645  SizedStackTest<4>();
646  SizedStackTest<5>();
647  SizedStackTest<6>();
648  SizedStackTest<7>();
649  SizedStackTest<16>();
650  SizedStackTest<25>();
651  SizedStackTest<34>();
652  SizedStackTest<43>();
653  SizedStackTest<51>();
654  SizedStackTest<62>();
655  SizedStackTest<64>();
656  SizedStackTest<128>();
657}
658
659TEST(AddressSanitizer, ManyStackObjectsTest) {
660  char XXX[10];
661  char YYY[20];
662  char ZZZ[30];
663  Ident(XXX);
664  Ident(YYY);
665  EXPECT_DEATH(Ident(ZZZ)[-1] = 0, ASAN_PCRE_DOTALL "XXX.*YYY.*ZZZ");
666}
667
668__attribute__((noinline))
669static void Frame0(int frame, char *a, char *b, char *c) {
670  char d[4] = {0};
671  char *D = Ident(d);
672  switch (frame) {
673    case 3: a[5]++; break;
674    case 2: b[5]++; break;
675    case 1: c[5]++; break;
676    case 0: D[5]++; break;
677  }
678}
679__attribute__((noinline)) static void Frame1(int frame, char *a, char *b) {
680  char c[4] = {0}; Frame0(frame, a, b, c);
681  break_optimization(0);
682}
683__attribute__((noinline)) static void Frame2(int frame, char *a) {
684  char b[4] = {0}; Frame1(frame, a, b);
685  break_optimization(0);
686}
687__attribute__((noinline)) static void Frame3(int frame) {
688  char a[4] = {0}; Frame2(frame, a);
689  break_optimization(0);
690}
691
692TEST(AddressSanitizer, GuiltyStackFrame0Test) {
693  EXPECT_DEATH(Frame3(0), "located .*in frame <.*Frame0");
694}
695TEST(AddressSanitizer, GuiltyStackFrame1Test) {
696  EXPECT_DEATH(Frame3(1), "located .*in frame <.*Frame1");
697}
698TEST(AddressSanitizer, GuiltyStackFrame2Test) {
699  EXPECT_DEATH(Frame3(2), "located .*in frame <.*Frame2");
700}
701TEST(AddressSanitizer, GuiltyStackFrame3Test) {
702  EXPECT_DEATH(Frame3(3), "located .*in frame <.*Frame3");
703}
704
705__attribute__((noinline))
706void LongJmpFunc1(jmp_buf buf) {
707  // create three red zones for these two stack objects.
708  int a;
709  int b;
710
711  int *A = Ident(&a);
712  int *B = Ident(&b);
713  *A = *B;
714  longjmp(buf, 1);
715}
716
717__attribute__((noinline))
718void UnderscopeLongJmpFunc1(jmp_buf buf) {
719  // create three red zones for these two stack objects.
720  int a;
721  int b;
722
723  int *A = Ident(&a);
724  int *B = Ident(&b);
725  *A = *B;
726  _longjmp(buf, 1);
727}
728
729__attribute__((noinline))
730void SigLongJmpFunc1(sigjmp_buf buf) {
731  // create three red zones for these two stack objects.
732  int a;
733  int b;
734
735  int *A = Ident(&a);
736  int *B = Ident(&b);
737  *A = *B;
738  siglongjmp(buf, 1);
739}
740
741
742__attribute__((noinline))
743void TouchStackFunc() {
744  int a[100];  // long array will intersect with redzones from LongJmpFunc1.
745  int *A = Ident(a);
746  for (int i = 0; i < 100; i++)
747    A[i] = i*i;
748}
749
750// Test that we handle longjmp and do not report fals positives on stack.
751TEST(AddressSanitizer, LongJmpTest) {
752  static jmp_buf buf;
753  if (!setjmp(buf)) {
754    LongJmpFunc1(buf);
755  } else {
756    TouchStackFunc();
757  }
758}
759
760TEST(AddressSanitizer, UnderscopeLongJmpTest) {
761  static jmp_buf buf;
762  if (!_setjmp(buf)) {
763    UnderscopeLongJmpFunc1(buf);
764  } else {
765    TouchStackFunc();
766  }
767}
768
769TEST(AddressSanitizer, SigLongJmpTest) {
770  static sigjmp_buf buf;
771  if (!sigsetjmp(buf, 1)) {
772    SigLongJmpFunc1(buf);
773  } else {
774    TouchStackFunc();
775  }
776}
777
778#ifdef __EXCEPTIONS
779__attribute__((noinline))
780void ThrowFunc() {
781  // create three red zones for these two stack objects.
782  int a;
783  int b;
784
785  int *A = Ident(&a);
786  int *B = Ident(&b);
787  *A = *B;
788  ASAN_THROW(1);
789}
790
791TEST(AddressSanitizer, CxxExceptionTest) {
792  if (ASAN_UAR) return;
793  // TODO(kcc): this test crashes on 32-bit for some reason...
794  if (__WORDSIZE == 32) return;
795  try {
796    ThrowFunc();
797  } catch(...) {}
798  TouchStackFunc();
799}
800#endif
801
802void *ThreadStackReuseFunc1(void *unused) {
803  // create three red zones for these two stack objects.
804  int a;
805  int b;
806
807  int *A = Ident(&a);
808  int *B = Ident(&b);
809  *A = *B;
810  pthread_exit(0);
811  return 0;
812}
813
814void *ThreadStackReuseFunc2(void *unused) {
815  TouchStackFunc();
816  return 0;
817}
818
819TEST(AddressSanitizer, ThreadStackReuseTest) {
820  pthread_t t;
821  pthread_create(&t, 0, ThreadStackReuseFunc1, 0);
822  pthread_join(t, 0);
823  pthread_create(&t, 0, ThreadStackReuseFunc2, 0);
824  pthread_join(t, 0);
825}
826
827#if defined(__i386__) or defined(__x86_64__)
828TEST(AddressSanitizer, Store128Test) {
829  char *a = Ident((char*)malloc(Ident(12)));
830  char *p = a;
831  if (((uintptr_t)a % 16) != 0)
832    p = a + 8;
833  assert(((uintptr_t)p % 16) == 0);
834  __m128i value_wide = _mm_set1_epi16(0x1234);
835  EXPECT_DEATH(_mm_store_si128((__m128i*)p, value_wide),
836               "WRITE of size 16");
837  EXPECT_DEATH(_mm_store_si128((__m128i*)p, value_wide),
838               "located 0 bytes to the right of 12-byte");
839  free(a);
840}
841#endif
842
843static string RightOOBErrorMessage(int oob_distance) {
844  assert(oob_distance >= 0);
845  char expected_str[100];
846  sprintf(expected_str, "located %d bytes to the right", oob_distance);
847  return string(expected_str);
848}
849
850static string LeftOOBErrorMessage(int oob_distance) {
851  assert(oob_distance > 0);
852  char expected_str[100];
853  sprintf(expected_str, "located %d bytes to the left", oob_distance);
854  return string(expected_str);
855}
856
857template<class T>
858void MemSetOOBTestTemplate(size_t length) {
859  if (length == 0) return;
860  size_t size = Ident(sizeof(T) * length);
861  T *array = Ident((T*)malloc(size));
862  int element = Ident(42);
863  int zero = Ident(0);
864  // memset interval inside array
865  memset(array, element, size);
866  memset(array, element, size - 1);
867  memset(array + length - 1, element, sizeof(T));
868  memset(array, element, 1);
869
870  // memset 0 bytes
871  memset(array - 10, element, zero);
872  memset(array - 1, element, zero);
873  memset(array, element, zero);
874  memset(array + length, 0, zero);
875  memset(array + length + 1, 0, zero);
876
877  // try to memset bytes to the right of array
878  EXPECT_DEATH(memset(array, 0, size + 1),
879               RightOOBErrorMessage(0));
880  EXPECT_DEATH(memset((char*)(array + length) - 1, element, 6),
881               RightOOBErrorMessage(4));
882  EXPECT_DEATH(memset(array + 1, element, size + sizeof(T)),
883               RightOOBErrorMessage(2 * sizeof(T) - 1));
884  // whole interval is to the right
885  EXPECT_DEATH(memset(array + length + 1, 0, 10),
886               RightOOBErrorMessage(sizeof(T)));
887
888  // try to memset bytes to the left of array
889  EXPECT_DEATH(memset((char*)array - 1, element, size),
890               LeftOOBErrorMessage(1));
891  EXPECT_DEATH(memset((char*)array - 5, 0, 6),
892               LeftOOBErrorMessage(5));
893  EXPECT_DEATH(memset(array - 5, element, size + 5 * sizeof(T)),
894               LeftOOBErrorMessage(5 * sizeof(T)));
895  // whole interval is to the left
896  EXPECT_DEATH(memset(array - 2, 0, sizeof(T)),
897               LeftOOBErrorMessage(2 * sizeof(T)));
898
899  // try to memset bytes both to the left & to the right
900  EXPECT_DEATH(memset((char*)array - 2, element, size + 4),
901               LeftOOBErrorMessage(2));
902
903  free(array);
904}
905
906TEST(AddressSanitizer, MemSetOOBTest) {
907  MemSetOOBTestTemplate<char>(100);
908  MemSetOOBTestTemplate<int>(5);
909  MemSetOOBTestTemplate<double>(256);
910  // We can test arrays of structres/classes here, but what for?
911}
912
913// Same test for memcpy and memmove functions
914template <class T, class M>
915void MemTransferOOBTestTemplate(size_t length) {
916  if (length == 0) return;
917  size_t size = Ident(sizeof(T) * length);
918  T *src = Ident((T*)malloc(size));
919  T *dest = Ident((T*)malloc(size));
920  int zero = Ident(0);
921
922  // valid transfer of bytes between arrays
923  M::transfer(dest, src, size);
924  M::transfer(dest + 1, src, size - sizeof(T));
925  M::transfer(dest, src + length - 1, sizeof(T));
926  M::transfer(dest, src, 1);
927
928  // transfer zero bytes
929  M::transfer(dest - 1, src, 0);
930  M::transfer(dest + length, src, zero);
931  M::transfer(dest, src - 1, zero);
932  M::transfer(dest, src, zero);
933
934  // try to change mem to the right of dest
935  EXPECT_DEATH(M::transfer(dest + 1, src, size),
936               RightOOBErrorMessage(sizeof(T) - 1));
937  EXPECT_DEATH(M::transfer((char*)(dest + length) - 1, src, 5),
938               RightOOBErrorMessage(3));
939
940  // try to change mem to the left of dest
941  EXPECT_DEATH(M::transfer(dest - 2, src, size),
942               LeftOOBErrorMessage(2 * sizeof(T)));
943  EXPECT_DEATH(M::transfer((char*)dest - 3, src, 4),
944               LeftOOBErrorMessage(3));
945
946  // try to access mem to the right of src
947  EXPECT_DEATH(M::transfer(dest, src + 2, size),
948               RightOOBErrorMessage(2 * sizeof(T) - 1));
949  EXPECT_DEATH(M::transfer(dest, (char*)(src + length) - 3, 6),
950               RightOOBErrorMessage(2));
951
952  // try to access mem to the left of src
953  EXPECT_DEATH(M::transfer(dest, src - 1, size),
954               LeftOOBErrorMessage(sizeof(T)));
955  EXPECT_DEATH(M::transfer(dest, (char*)src - 6, 7),
956               LeftOOBErrorMessage(6));
957
958  // Generally we don't need to test cases where both accessing src and writing
959  // to dest address to poisoned memory.
960
961  T *big_src = Ident((T*)malloc(size * 2));
962  T *big_dest = Ident((T*)malloc(size * 2));
963  // try to change mem to both sides of dest
964  EXPECT_DEATH(M::transfer(dest - 1, big_src, size * 2),
965               LeftOOBErrorMessage(sizeof(T)));
966  // try to access mem to both sides of src
967  EXPECT_DEATH(M::transfer(big_dest, src - 2, size * 2),
968               LeftOOBErrorMessage(2 * sizeof(T)));
969
970  free(src);
971  free(dest);
972  free(big_src);
973  free(big_dest);
974}
975
976class MemCpyWrapper {
977 public:
978  static void* transfer(void *to, const void *from, size_t size) {
979    return memcpy(to, from, size);
980  }
981};
982TEST(AddressSanitizer, MemCpyOOBTest) {
983  MemTransferOOBTestTemplate<char, MemCpyWrapper>(100);
984  MemTransferOOBTestTemplate<int, MemCpyWrapper>(1024);
985}
986
987class MemMoveWrapper {
988 public:
989  static void* transfer(void *to, const void *from, size_t size) {
990    return memmove(to, from, size);
991  }
992};
993TEST(AddressSanitizer, MemMoveOOBTest) {
994  MemTransferOOBTestTemplate<char, MemMoveWrapper>(100);
995  MemTransferOOBTestTemplate<int, MemMoveWrapper>(1024);
996}
997
998// Tests for string functions
999
1000// Used for string functions tests
1001static char global_string[] = "global";
1002static size_t global_string_length = 6;
1003
1004// Input to a test is a zero-terminated string str with given length
1005// Accesses to the bytes to the left and to the right of str
1006// are presumed to produce OOB errors
1007void StrLenOOBTestTemplate(char *str, size_t length, bool is_global) {
1008  // Normal strlen calls
1009  EXPECT_EQ(strlen(str), length);
1010  if (length > 0) {
1011    EXPECT_EQ(strlen(str + 1), length - 1);
1012    EXPECT_EQ(strlen(str + length), 0);
1013  }
1014  // Arg of strlen is not malloced, OOB access
1015  if (!is_global) {
1016    // We don't insert RedZones to the left of global variables
1017    EXPECT_DEATH(Ident(strlen(str - 1)), LeftOOBErrorMessage(1));
1018    EXPECT_DEATH(Ident(strlen(str - 5)), LeftOOBErrorMessage(5));
1019  }
1020  EXPECT_DEATH(Ident(strlen(str + length + 1)), RightOOBErrorMessage(0));
1021  // Overwrite terminator
1022  str[length] = 'a';
1023  // String is not zero-terminated, strlen will lead to OOB access
1024  EXPECT_DEATH(Ident(strlen(str)), RightOOBErrorMessage(0));
1025  EXPECT_DEATH(Ident(strlen(str + length)), RightOOBErrorMessage(0));
1026  // Restore terminator
1027  str[length] = 0;
1028}
1029TEST(AddressSanitizer, StrLenOOBTest) {
1030  // Check heap-allocated string
1031  size_t length = Ident(10);
1032  char *heap_string = Ident((char*)malloc(length + 1));
1033  char stack_string[10 + 1];
1034  for (int i = 0; i < length; i++) {
1035    heap_string[i] = 'a';
1036    stack_string[i] = 'b';
1037  }
1038  heap_string[length] = 0;
1039  stack_string[length] = 0;
1040  StrLenOOBTestTemplate(heap_string, length, false);
1041  // TODO(samsonov): Fix expected messages in StrLenOOBTestTemplate to
1042  //      make test for stack_string work. Or move it to output tests.
1043  // StrLenOOBTestTemplate(stack_string, length, false);
1044  StrLenOOBTestTemplate(global_string, global_string_length, true);
1045  free(heap_string);
1046}
1047
1048#ifndef __APPLE__
1049TEST(AddressSanitizer, StrNLenOOBTest) {
1050  size_t size = Ident(123);
1051  char *str = Ident((char*)malloc(size));
1052  memset(str, 'z', size);
1053  // Normal strnlen calls.
1054  Ident(strnlen(str - 1, 0));
1055  Ident(strnlen(str, size));
1056  Ident(strnlen(str + size - 1, 1));
1057  str[size - 1] = '\0';
1058  Ident(strnlen(str, 2 * size));
1059  // Argument points to not allocated memory.
1060  EXPECT_DEATH(Ident(strnlen(str - 1, 1)), LeftOOBErrorMessage(1));
1061  EXPECT_DEATH(Ident(strnlen(str + size, 1)), RightOOBErrorMessage(0));
1062  // Overwrite the terminating '\0' and hit unallocated memory.
1063  str[size - 1] = 'z';
1064  EXPECT_DEATH(Ident(strnlen(str, size + 1)), RightOOBErrorMessage(0));
1065  free(str);
1066}
1067#endif
1068
1069TEST(AddressSanitizer, StrDupOOBTest) {
1070  size_t size = Ident(42);
1071  char *str = Ident((char*)malloc(size));
1072  char *new_str;
1073  memset(str, 'z', size);
1074  // Normal strdup calls.
1075  str[size - 1] = '\0';
1076  new_str = strdup(str);
1077  free(new_str);
1078  new_str = strdup(str + size - 1);
1079  free(new_str);
1080  // Argument points to not allocated memory.
1081  EXPECT_DEATH(Ident(strdup(str - 1)), LeftOOBErrorMessage(1));
1082  EXPECT_DEATH(Ident(strdup(str + size)), RightOOBErrorMessage(0));
1083  // Overwrite the terminating '\0' and hit unallocated memory.
1084  str[size - 1] = 'z';
1085  EXPECT_DEATH(Ident(strdup(str)), RightOOBErrorMessage(0));
1086  free(str);
1087}
1088
1089TEST(AddressSanitizer, StrCpyOOBTest) {
1090  size_t to_size = Ident(30);
1091  size_t from_size = Ident(6);  // less than to_size
1092  char *to = Ident((char*)malloc(to_size));
1093  char *from = Ident((char*)malloc(from_size));
1094  // Normal strcpy calls.
1095  strcpy(from, "hello");
1096  strcpy(to, from);
1097  strcpy(to + to_size - from_size, from);
1098  // Length of "from" is too small.
1099  EXPECT_DEATH(Ident(strcpy(from, "hello2")), RightOOBErrorMessage(0));
1100  // "to" or "from" points to not allocated memory.
1101  EXPECT_DEATH(Ident(strcpy(to - 1, from)), LeftOOBErrorMessage(1));
1102  EXPECT_DEATH(Ident(strcpy(to, from - 1)), LeftOOBErrorMessage(1));
1103  EXPECT_DEATH(Ident(strcpy(to, from + from_size)), RightOOBErrorMessage(0));
1104  EXPECT_DEATH(Ident(strcpy(to + to_size, from)), RightOOBErrorMessage(0));
1105  // Overwrite the terminating '\0' character and hit unallocated memory.
1106  from[from_size - 1] = '!';
1107  EXPECT_DEATH(Ident(strcpy(to, from)), RightOOBErrorMessage(0));
1108  free(to);
1109  free(from);
1110}
1111
1112TEST(AddressSanitizer, StrNCpyOOBTest) {
1113  size_t to_size = Ident(20);
1114  size_t from_size = Ident(6);  // less than to_size
1115  char *to = Ident((char*)malloc(to_size));
1116  // From is a zero-terminated string "hello\0" of length 6
1117  char *from = Ident((char*)malloc(from_size));
1118  strcpy(from, "hello");
1119  // copy 0 bytes
1120  strncpy(to, from, 0);
1121  strncpy(to - 1, from - 1, 0);
1122  // normal strncpy calls
1123  strncpy(to, from, from_size);
1124  strncpy(to, from, to_size);
1125  strncpy(to, from + from_size - 1, to_size);
1126  strncpy(to + to_size - 1, from, 1);
1127  // One of {to, from} points to not allocated memory
1128  EXPECT_DEATH(Ident(strncpy(to, from - 1, from_size)),
1129               LeftOOBErrorMessage(1));
1130  EXPECT_DEATH(Ident(strncpy(to - 1, from, from_size)),
1131               LeftOOBErrorMessage(1));
1132  EXPECT_DEATH(Ident(strncpy(to, from + from_size, 1)),
1133               RightOOBErrorMessage(0));
1134  EXPECT_DEATH(Ident(strncpy(to + to_size, from, 1)),
1135               RightOOBErrorMessage(0));
1136  // Length of "to" is too small
1137  EXPECT_DEATH(Ident(strncpy(to + to_size - from_size + 1, from, from_size)),
1138               RightOOBErrorMessage(0));
1139  EXPECT_DEATH(Ident(strncpy(to + 1, from, to_size)),
1140               RightOOBErrorMessage(0));
1141  // Overwrite terminator in from
1142  from[from_size - 1] = '!';
1143  // normal strncpy call
1144  strncpy(to, from, from_size);
1145  // Length of "from" is too small
1146  EXPECT_DEATH(Ident(strncpy(to, from, to_size)),
1147               RightOOBErrorMessage(0));
1148  free(to);
1149  free(from);
1150}
1151
1152typedef char*(*PointerToStrChr)(const char*, int);
1153void RunStrChrTest(PointerToStrChr StrChr) {
1154  size_t size = Ident(100);
1155  char *str = Ident((char*)malloc(size));
1156  memset(str, 'z', size);
1157  str[10] = 'q';
1158  str[11] = '\0';
1159  EXPECT_EQ(str, StrChr(str, 'z'));
1160  EXPECT_EQ(str + 10, StrChr(str, 'q'));
1161  EXPECT_EQ(NULL, StrChr(str, 'a'));
1162  // StrChr argument points to not allocated memory.
1163  EXPECT_DEATH(Ident(StrChr(str - 1, 'z')), LeftOOBErrorMessage(1));
1164  EXPECT_DEATH(Ident(StrChr(str + size, 'z')), RightOOBErrorMessage(0));
1165  // Overwrite the terminator and hit not allocated memory.
1166  str[11] = 'z';
1167  EXPECT_DEATH(Ident(StrChr(str, 'a')), RightOOBErrorMessage(0));
1168  free(str);
1169}
1170TEST(AddressSanitizer, StrChrAndIndexOOBTest) {
1171  RunStrChrTest(&strchr);
1172  RunStrChrTest(&index);
1173}
1174
1175TEST(AddressSanitizer, StrCmpAndFriendsLogicTest) {
1176  // strcmp
1177  EXPECT_EQ(0, strcmp("", ""));
1178  EXPECT_EQ(0, strcmp("abcd", "abcd"));
1179  EXPECT_EQ(-1, strcmp("ab", "ac"));
1180  EXPECT_EQ(-1, strcmp("abc", "abcd"));
1181  EXPECT_EQ(1, strcmp("acc", "abc"));
1182  EXPECT_EQ(1, strcmp("abcd", "abc"));
1183
1184  // strncmp
1185  EXPECT_EQ(0, strncmp("a", "b", 0));
1186  EXPECT_EQ(0, strncmp("abcd", "abcd", 10));
1187  EXPECT_EQ(0, strncmp("abcd", "abcef", 3));
1188  EXPECT_EQ(-1, strncmp("abcde", "abcfa", 4));
1189  EXPECT_EQ(-1, strncmp("a", "b", 5));
1190  EXPECT_EQ(-1, strncmp("bc", "bcde", 4));
1191  EXPECT_EQ(1, strncmp("xyz", "xyy", 10));
1192  EXPECT_EQ(1, strncmp("baa", "aaa", 1));
1193  EXPECT_EQ(1, strncmp("zyx", "", 2));
1194}
1195
1196static inline char* MallocAndMemsetString(size_t size) {
1197  char *s = Ident((char*)malloc(size));
1198  memset(s, 'z', size);
1199  return s;
1200}
1201
1202TEST(AddressSanitizer, StrCmpOOBTest) {
1203  size_t size = Ident(100);
1204  char *s1 = MallocAndMemsetString(size);
1205  char *s2 = MallocAndMemsetString(size);
1206  s1[size - 1] = '\0';
1207  s2[size - 1] = '\0';
1208  // Normal strcmp calls
1209  Ident(strcmp(s1, s2));
1210  Ident(strcmp(s1, s2 + size - 1));
1211  Ident(strcmp(s1 + size - 1, s2 + size - 1));
1212  s1[size - 1] = 'z';
1213  s2[size - 1] = 'x';
1214  Ident(strcmp(s1, s2));
1215  // One of arguments points to not allocated memory.
1216  EXPECT_DEATH(Ident(strcmp)(s1 - 1, s2), LeftOOBErrorMessage(1));
1217  EXPECT_DEATH(Ident(strcmp)(s1, s2 - 1), LeftOOBErrorMessage(1));
1218  EXPECT_DEATH(Ident(strcmp)(s1 + size, s2), RightOOBErrorMessage(0));
1219  EXPECT_DEATH(Ident(strcmp)(s1, s2 + size), RightOOBErrorMessage(0));
1220  // Hit unallocated memory and die.
1221  s2[size - 1] = 'z';
1222  EXPECT_DEATH(Ident(strcmp)(s1, s1), RightOOBErrorMessage(0));
1223  EXPECT_DEATH(Ident(strcmp)(s1 + size - 1, s2), RightOOBErrorMessage(0));
1224  free(s1);
1225  free(s2);
1226}
1227
1228TEST(AddressSanitizer, StrNCmpOOBTest) {
1229  size_t size = Ident(100);
1230  char *s1 = MallocAndMemsetString(size);
1231  char *s2 = MallocAndMemsetString(size);
1232  s1[size - 1] = '\0';
1233  s2[size - 1] = '\0';
1234  // Normal strncmp calls
1235  Ident(strncmp(s1, s2, size + 2));
1236  s1[size - 1] = 'z';
1237  s2[size - 1] = 'x';
1238  Ident(strncmp(s1 + size - 2, s2 + size - 2, size));
1239  s2[size - 1] = 'z';
1240  Ident(strncmp(s1 - 1, s2 - 1, 0));
1241  Ident(strncmp(s1 + size - 1, s2 + size - 1, 1));
1242  // One of arguments points to not allocated memory.
1243  EXPECT_DEATH(Ident(strncmp)(s1 - 1, s2, 1), LeftOOBErrorMessage(1));
1244  EXPECT_DEATH(Ident(strncmp)(s1, s2 - 1, 1), LeftOOBErrorMessage(1));
1245  EXPECT_DEATH(Ident(strncmp)(s1 + size, s2, 1), RightOOBErrorMessage(0));
1246  EXPECT_DEATH(Ident(strncmp)(s1, s2 + size, 1), RightOOBErrorMessage(0));
1247  // Hit unallocated memory and die.
1248  EXPECT_DEATH(Ident(strncmp)(s1 + 1, s2 + 1, size), RightOOBErrorMessage(0));
1249  EXPECT_DEATH(Ident(strncmp)(s1 + size - 1, s2, 2), RightOOBErrorMessage(0));
1250  free(s1);
1251  free(s2);
1252}
1253
1254static const char *kOverlapErrorMessage = "strcpy-param-overlap";
1255
1256TEST(AddressSanitizer, StrArgsOverlapTest) {
1257  size_t size = Ident(100);
1258  char *str = Ident((char*)malloc(size));
1259
1260#if 0
1261  // Check "memcpy". Use Ident() to avoid inlining.
1262  memset(str, 'z', size);
1263  Ident(memcpy)(str + 1, str + 11, 10);
1264  Ident(memcpy)(str, str, 0);
1265  EXPECT_DEATH(Ident(memcpy)(str, str + 14, 15), kOverlapErrorMessage);
1266  EXPECT_DEATH(Ident(memcpy)(str + 14, str, 15), kOverlapErrorMessage);
1267  EXPECT_DEATH(Ident(memcpy)(str + 20, str + 20, 1), kOverlapErrorMessage);
1268#endif
1269
1270  // Check "strcpy".
1271  memset(str, 'z', size);
1272  str[9] = '\0';
1273  strcpy(str + 10, str);
1274  EXPECT_DEATH(strcpy(str + 9, str), kOverlapErrorMessage);
1275  EXPECT_DEATH(strcpy(str, str + 4), kOverlapErrorMessage);
1276  strcpy(str, str + 5);
1277
1278  // Check "strncpy".
1279  memset(str, 'z', size);
1280  strncpy(str, str + 10, 10);
1281  EXPECT_DEATH(strncpy(str, str + 9, 10), kOverlapErrorMessage);
1282  EXPECT_DEATH(strncpy(str + 9, str, 10), kOverlapErrorMessage);
1283  str[10] = '\0';
1284  strncpy(str + 11, str, 20);
1285  EXPECT_DEATH(strncpy(str + 10, str, 20), kOverlapErrorMessage);
1286
1287  free(str);
1288}
1289
1290// At the moment we instrument memcpy/memove/memset calls at compile time so we
1291// can't handle OOB error if these functions are called by pointer, see disabled
1292// MemIntrinsicCallByPointerTest below
1293typedef void*(*PointerToMemTransfer)(void*, const void*, size_t);
1294typedef void*(*PointerToMemSet)(void*, int, size_t);
1295
1296void CallMemSetByPointer(PointerToMemSet MemSet) {
1297  size_t size = Ident(100);
1298  char *array = Ident((char*)malloc(size));
1299  EXPECT_DEATH(MemSet(array, 0, 101), RightOOBErrorMessage(0));
1300  free(array);
1301}
1302
1303void CallMemTransferByPointer(PointerToMemTransfer MemTransfer) {
1304  size_t size = Ident(100);
1305  char *src = Ident((char*)malloc(size));
1306  char *dst = Ident((char*)malloc(size));
1307  EXPECT_DEATH(MemTransfer(dst, src, 101), RightOOBErrorMessage(0));
1308  free(src);
1309  free(dst);
1310}
1311
1312TEST(AddressSanitizer, DISABLED_MemIntrinsicCallByPointerTest) {
1313  CallMemSetByPointer(&memset);
1314  CallMemTransferByPointer(&memcpy);
1315  CallMemTransferByPointer(&memmove);
1316}
1317
1318// This test case fails
1319// Clang optimizes memcpy/memset calls which lead to unaligned access
1320TEST(AddressSanitizer, DISABLED_MemIntrinsicUnalignedAccessTest) {
1321  int size = Ident(4096);
1322  char *s = Ident((char*)malloc(size));
1323  EXPECT_DEATH(memset(s + size - 1, 0, 2), RightOOBErrorMessage(0));
1324  free(s);
1325}
1326
1327// TODO(samsonov): Add a test with malloc(0)
1328// TODO(samsonov): Add tests for str* and mem* functions.
1329
1330__attribute__((noinline))
1331static int LargeFunction(bool do_bad_access) {
1332  int *x = new int[100];
1333  x[0]++;
1334  x[1]++;
1335  x[2]++;
1336  x[3]++;
1337  x[4]++;
1338  x[5]++;
1339  x[6]++;
1340  x[7]++;
1341  x[8]++;
1342  x[9]++;
1343
1344  x[do_bad_access ? 100 : 0]++; int res = __LINE__;
1345
1346  x[10]++;
1347  x[11]++;
1348  x[12]++;
1349  x[13]++;
1350  x[14]++;
1351  x[15]++;
1352  x[16]++;
1353  x[17]++;
1354  x[18]++;
1355  x[19]++;
1356
1357  delete x;
1358  return res;
1359}
1360
1361// Test the we have correct debug info for the failing instruction.
1362// This test requires the in-process symbolizer to be enabled by default.
1363TEST(AddressSanitizer, DISABLED_LargeFunctionSymbolizeTest) {
1364  int failing_line = LargeFunction(false);
1365  char expected_warning[128];
1366  sprintf(expected_warning, "LargeFunction.*asan_test.cc:%d", failing_line);
1367  EXPECT_DEATH(LargeFunction(true), expected_warning);
1368}
1369
1370// Check that we unwind and symbolize correctly.
1371TEST(AddressSanitizer, DISABLED_MallocFreeUnwindAndSymbolizeTest) {
1372  int *a = (int*)malloc_aaa(sizeof(int));
1373  *a = 1;
1374  free_aaa(a);
1375  EXPECT_DEATH(*a = 1, "free_ccc.*free_bbb.*free_aaa.*"
1376               "malloc_fff.*malloc_eee.*malloc_ddd");
1377}
1378
1379void *ThreadedTestAlloc(void *a) {
1380  int **p = (int**)a;
1381  *p = new int;
1382  return 0;
1383}
1384
1385void *ThreadedTestFree(void *a) {
1386  int **p = (int**)a;
1387  delete *p;
1388  return 0;
1389}
1390
1391void *ThreadedTestUse(void *a) {
1392  int **p = (int**)a;
1393  **p = 1;
1394  return 0;
1395}
1396
1397void ThreadedTestSpawn() {
1398  pthread_t t;
1399  int *x;
1400  pthread_create(&t, 0, ThreadedTestAlloc, &x);
1401  pthread_join(t, 0);
1402  pthread_create(&t, 0, ThreadedTestFree, &x);
1403  pthread_join(t, 0);
1404  pthread_create(&t, 0, ThreadedTestUse, &x);
1405  pthread_join(t, 0);
1406}
1407
1408TEST(AddressSanitizer, ThreadedTest) {
1409  EXPECT_DEATH(ThreadedTestSpawn(),
1410               ASAN_PCRE_DOTALL
1411               "Thread T.*created"
1412               ".*Thread T.*created"
1413               ".*Thread T.*created");
1414}
1415
1416#if ASAN_NEEDS_SEGV
1417TEST(AddressSanitizer, ShadowGapTest) {
1418#if __WORDSIZE == 32
1419  char *addr = (char*)0x22000000;
1420#else
1421  char *addr = (char*)0x0000100000080000;
1422#endif
1423  EXPECT_DEATH(*addr = 1, "AddressSanitizer crashed on unknown");
1424}
1425#endif  // ASAN_NEEDS_SEGV
1426
1427extern "C" {
1428__attribute__((noinline))
1429static void UseThenFreeThenUse() {
1430  char *x = Ident((char*)malloc(8));
1431  *x = 1;
1432  free_aaa(x);
1433  *x = 2;
1434}
1435}
1436
1437TEST(AddressSanitizer, UseThenFreeThenUseTest) {
1438  EXPECT_DEATH(UseThenFreeThenUse(), "freed by thread");
1439}
1440
1441TEST(AddressSanitizer, StrDupTest) {
1442  free(strdup(Ident("123")));
1443}
1444
1445TEST(AddressSanitizer, ObjdumpTest) {
1446  ObjdumpOfMyself *o = objdump_of_myself();
1447  EXPECT_TRUE(o->IsCorrect());
1448}
1449
1450extern "C" {
1451__attribute__((noinline))
1452static void DisasmSimple() {
1453  Ident(0);
1454}
1455
1456__attribute__((noinline))
1457static void DisasmParamWrite(int *a) {
1458  *a = 1;
1459}
1460
1461__attribute__((noinline))
1462static void DisasmParamInc(int *a) {
1463  (*a)++;
1464}
1465
1466__attribute__((noinline))
1467static void DisasmParamReadIfWrite(int *a) {
1468  if (*a)
1469    *a = 1;
1470}
1471
1472__attribute__((noinline))
1473static int DisasmParamIfReadWrite(int *a, int cond) {
1474  int res = 0;
1475  if (cond)
1476    res = *a;
1477  *a = 0;
1478  return res;
1479}
1480
1481static int GLOBAL;
1482
1483__attribute__((noinline))
1484static void DisasmWriteGlob() {
1485  GLOBAL = 1;
1486}
1487}  // extern "C"
1488
1489TEST(AddressSanitizer, DisasmTest) {
1490  int a;
1491  DisasmSimple();
1492  DisasmParamWrite(&a);
1493  DisasmParamInc(&a);
1494  Ident(DisasmWriteGlob)();
1495  DisasmParamReadIfWrite(&a);
1496
1497  a = 7;
1498  EXPECT_EQ(7, DisasmParamIfReadWrite(&a, Ident(1)));
1499  EXPECT_EQ(0, a);
1500
1501  ObjdumpOfMyself *o = objdump_of_myself();
1502  vector<string> insns;
1503  insns.push_back("ud2");
1504  insns.push_back("__asan_report_");
1505  EXPECT_EQ(0, o->CountInsnInFunc("DisasmSimple", insns));
1506  EXPECT_EQ(1, o->CountInsnInFunc("DisasmParamWrite", insns));
1507  EXPECT_EQ(1, o->CountInsnInFunc("DisasmParamInc", insns));
1508  EXPECT_EQ(0, o->CountInsnInFunc("DisasmWriteGlob", insns));
1509
1510  // TODO(kcc): implement these (needs just one __asan_report).
1511  EXPECT_EQ(2, o->CountInsnInFunc("DisasmParamReadIfWrite", insns));
1512  EXPECT_EQ(2, o->CountInsnInFunc("DisasmParamIfReadWrite", insns));
1513}
1514
1515// Currently we create and poison redzone at right of global variables.
1516char glob5[5];
1517static char static110[110];
1518const char ConstGlob[7] = {1, 2, 3, 4, 5, 6, 7};
1519static const char StaticConstGlob[3] = {9, 8, 7};
1520extern int GlobalsTest(int x);
1521
1522TEST(AddressSanitizer, GlobalTest) {
1523  static char func_static15[15];
1524
1525  static char fs1[10];
1526  static char fs2[10];
1527  static char fs3[10];
1528
1529  glob5[Ident(0)] = 0;
1530  glob5[Ident(1)] = 0;
1531  glob5[Ident(2)] = 0;
1532  glob5[Ident(3)] = 0;
1533  glob5[Ident(4)] = 0;
1534
1535  EXPECT_DEATH(glob5[Ident(5)] = 0,
1536               "0 bytes to the right of global variable.*glob5.* size 5");
1537  EXPECT_DEATH(glob5[Ident(5+6)] = 0,
1538               "6 bytes to the right of global variable.*glob5.* size 5");
1539  Ident(static110);  // avoid optimizations
1540  static110[Ident(0)] = 0;
1541  static110[Ident(109)] = 0;
1542  EXPECT_DEATH(static110[Ident(110)] = 0,
1543               "0 bytes to the right of global variable");
1544  EXPECT_DEATH(static110[Ident(110+7)] = 0,
1545               "7 bytes to the right of global variable");
1546
1547  Ident(func_static15);  // avoid optimizations
1548  func_static15[Ident(0)] = 0;
1549  EXPECT_DEATH(func_static15[Ident(15)] = 0,
1550               "0 bytes to the right of global variable");
1551  EXPECT_DEATH(func_static15[Ident(15 + 9)] = 0,
1552               "9 bytes to the right of global variable");
1553
1554  Ident(fs1);
1555  Ident(fs2);
1556  Ident(fs3);
1557
1558  // We don't create left redzones, so this is not 100% guaranteed to fail.
1559  // But most likely will.
1560  EXPECT_DEATH(fs2[Ident(-1)] = 0, "is located.*of global variable");
1561
1562  EXPECT_DEATH(Ident(Ident(ConstGlob)[8]),
1563               "is located 1 bytes to the right of .*ConstGlob");
1564  EXPECT_DEATH(Ident(Ident(StaticConstGlob)[5]),
1565               "is located 2 bytes to the right of .*StaticConstGlob");
1566
1567  // call stuff from another file.
1568  GlobalsTest(0);
1569}
1570
1571TEST(AddressSanitizer, GlobalStringConstTest) {
1572  static const char *zoo = "FOOBAR123";
1573  const char *p = Ident(zoo);
1574  EXPECT_DEATH(Ident(p[15]), "is ascii string 'FOOBAR123'");
1575}
1576
1577int *ReturnsPointerToALocalObject() {
1578  int a = 0;
1579  return Ident(&a);
1580}
1581
1582TEST(AddressSanitizer, LocalReferenceReturnTest) {
1583  int *(*f)() = Ident(ReturnsPointerToALocalObject);
1584  // Call f several times, only the first time should be reported.
1585  f();
1586  f();
1587  f();
1588  f();
1589  if (ASAN_UAR) {
1590    EXPECT_DEATH(*f() = 1, "is located.*in frame .*ReturnsPointerToALocal");
1591  }
1592}
1593
1594template <int kSize>
1595__attribute__((noinline))
1596static void FuncWithStack() {
1597  char x[kSize];
1598  Ident(x)[0] = 0;
1599  Ident(x)[kSize-1] = 0;
1600}
1601
1602static void LotsOfStackReuse() {
1603  int LargeStack[10000];
1604  Ident(LargeStack)[0] = 0;
1605  for (int i = 0; i < 10000; i++) {
1606    FuncWithStack<128 * 1>();
1607    FuncWithStack<128 * 2>();
1608    FuncWithStack<128 * 4>();
1609    FuncWithStack<128 * 8>();
1610    FuncWithStack<128 * 16>();
1611    FuncWithStack<128 * 32>();
1612    FuncWithStack<128 * 64>();
1613    FuncWithStack<128 * 128>();
1614    FuncWithStack<128 * 256>();
1615    FuncWithStack<128 * 512>();
1616    Ident(LargeStack)[0] = 0;
1617  }
1618}
1619
1620TEST(AddressSanitizer, StressStackReuseTest) {
1621  LotsOfStackReuse();
1622}
1623
1624TEST(AddressSanitizer, ThreadedStressStackReuseTest) {
1625  const int kNumThreads = 20;
1626  pthread_t t[kNumThreads];
1627  for (int i = 0; i < kNumThreads; i++) {
1628    pthread_create(&t[i], 0, (void* (*)(void *x))LotsOfStackReuse, 0);
1629  }
1630  for (int i = 0; i < kNumThreads; i++) {
1631    pthread_join(t[i], 0);
1632  }
1633}
1634
1635#ifdef __EXCEPTIONS
1636__attribute__((noinline))
1637static void StackReuseAndException() {
1638  int large_stack[1000];
1639  Ident(large_stack);
1640  ASAN_THROW(1);
1641}
1642
1643// TODO(kcc): support exceptions with use-after-return.
1644TEST(AddressSanitizer, DISABLED_StressStackReuseAndExceptionsTest) {
1645  for (int i = 0; i < 10000; i++) {
1646    try {
1647    StackReuseAndException();
1648    } catch(...) {
1649    }
1650  }
1651}
1652#endif
1653
1654TEST(AddressSanitizer, MlockTest) {
1655  EXPECT_EQ(0, mlockall(MCL_CURRENT));
1656  EXPECT_EQ(0, mlock((void*)0x12345, 0x5678));
1657  EXPECT_EQ(0, munlockall());
1658  EXPECT_EQ(0, munlock((void*)0x987, 0x654));
1659}
1660
1661// ------------------ demo tests; run each one-by-one -------------
1662// e.g. --gtest_filter=*DemoOOBLeftHigh --gtest_also_run_disabled_tests
1663TEST(AddressSanitizer, DISABLED_DemoThreadedTest) {
1664  ThreadedTestSpawn();
1665}
1666
1667void *SimpleBugOnSTack(void *x = 0) {
1668  char a[20];
1669  Ident(a)[20] = 0;
1670  return 0;
1671}
1672
1673TEST(AddressSanitizer, DISABLED_DemoStackTest) {
1674  SimpleBugOnSTack();
1675}
1676
1677TEST(AddressSanitizer, DISABLED_DemoThreadStackTest) {
1678  pthread_t t;
1679  pthread_create(&t, 0, SimpleBugOnSTack, 0);
1680  pthread_join(t, 0);
1681}
1682
1683TEST(AddressSanitizer, DISABLED_DemoUAFLowIn) {
1684  uaf_test<U1>(10, 0);
1685}
1686TEST(AddressSanitizer, DISABLED_DemoUAFLowLeft) {
1687  uaf_test<U1>(10, -2);
1688}
1689TEST(AddressSanitizer, DISABLED_DemoUAFLowRight) {
1690  uaf_test<U1>(10, 10);
1691}
1692
1693TEST(AddressSanitizer, DISABLED_DemoUAFHigh) {
1694  uaf_test<U1>(kLargeMalloc, 0);
1695}
1696
1697TEST(AddressSanitizer, DISABLED_DemoOOBLeftLow) {
1698  oob_test<U1>(10, -1);
1699}
1700
1701TEST(AddressSanitizer, DISABLED_DemoOOBLeftHigh) {
1702  oob_test<U1>(kLargeMalloc, -1);
1703}
1704
1705TEST(AddressSanitizer, DISABLED_DemoOOBRightLow) {
1706  oob_test<U1>(10, 10);
1707}
1708
1709TEST(AddressSanitizer, DISABLED_DemoOOBRightHigh) {
1710  oob_test<U1>(kLargeMalloc, kLargeMalloc);
1711}
1712
1713TEST(AddressSanitizer, DISABLED_DemoOOM) {
1714  size_t size = __WORDSIZE == 64 ? (size_t)(1ULL << 40) : (0xf0000000);
1715  printf("%p\n", malloc(size));
1716}
1717
1718TEST(AddressSanitizer, DISABLED_DemoDoubleFreeTest) {
1719  DoubleFree();
1720}
1721
1722TEST(AddressSanitizer, DISABLED_DemoNullDerefTest) {
1723  int *a = 0;
1724  Ident(a)[10] = 0;
1725}
1726
1727TEST(AddressSanitizer, DISABLED_DemoFunctionStaticTest) {
1728  static char a[100];
1729  static char b[100];
1730  static char c[100];
1731  Ident(a);
1732  Ident(b);
1733  Ident(c);
1734  Ident(a)[5] = 0;
1735  Ident(b)[105] = 0;
1736  Ident(a)[5] = 0;
1737}
1738
1739TEST(AddressSanitizer, DISABLED_DemoTooMuchMemoryTest) {
1740  const size_t kAllocSize = (1 << 28) - 1024;
1741  size_t total_size = 0;
1742  while (true) {
1743    char *x = (char*)malloc(kAllocSize);
1744    memset(x, 0, kAllocSize);
1745    total_size += kAllocSize;
1746    fprintf(stderr, "total: %ldM\n", (long)total_size >> 20);
1747  }
1748}
1749
1750#ifdef __APPLE__
1751#include "asan_mac_test.h"
1752// TODO(glider): figure out whether we still need these tests. Is it correct
1753// to intercept CFAllocator?
1754TEST(AddressSanitizerMac, DISABLED_CFAllocatorDefaultDoubleFree) {
1755  EXPECT_DEATH(
1756      CFAllocatorDefaultDoubleFree(),
1757      "attempting double-free");
1758}
1759
1760TEST(AddressSanitizerMac, DISABLED_CFAllocatorSystemDefaultDoubleFree) {
1761  EXPECT_DEATH(
1762      CFAllocatorSystemDefaultDoubleFree(),
1763      "attempting double-free");
1764}
1765
1766TEST(AddressSanitizerMac, DISABLED_CFAllocatorMallocDoubleFree) {
1767  EXPECT_DEATH(CFAllocatorMallocDoubleFree(), "attempting double-free");
1768}
1769
1770TEST(AddressSanitizerMac, DISABLED_CFAllocatorMallocZoneDoubleFree) {
1771  EXPECT_DEATH(CFAllocatorMallocZoneDoubleFree(), "attempting double-free");
1772}
1773
1774TEST(AddressSanitizerMac, DISABLED_GCDDispatchAsync) {
1775  // Make sure the whole ASan report is printed, i.e. that we don't die
1776  // on a CHECK.
1777  EXPECT_DEATH(TestGCDDispatchAsync(), "Shadow byte and word");
1778}
1779
1780TEST(AddressSanitizerMac, DISABLED_GCDDispatchSync) {
1781  // Make sure the whole ASan report is printed, i.e. that we don't die
1782  // on a CHECK.
1783  EXPECT_DEATH(TestGCDDispatchSync(), "Shadow byte and word");
1784}
1785
1786
1787TEST(AddressSanitizerMac, DISABLED_GCDReuseWqthreadsAsync) {
1788  // Make sure the whole ASan report is printed, i.e. that we don't die
1789  // on a CHECK.
1790  EXPECT_DEATH(TestGCDReuseWqthreadsAsync(), "Shadow byte and word");
1791}
1792
1793TEST(AddressSanitizerMac, DISABLED_GCDReuseWqthreadsSync) {
1794  // Make sure the whole ASan report is printed, i.e. that we don't die
1795  // on a CHECK.
1796  EXPECT_DEATH(TestGCDReuseWqthreadsSync(), "Shadow byte and word");
1797}
1798
1799TEST(AddressSanitizerMac, DISABLED_GCDDispatchAfter) {
1800  // Make sure the whole ASan report is printed, i.e. that we don't die
1801  // on a CHECK.
1802  EXPECT_DEATH(TestGCDDispatchAfter(), "Shadow byte and word");
1803}
1804
1805TEST(AddressSanitizerMac, DISABLED_GCDSourceEvent) {
1806  // Make sure the whole ASan report is printed, i.e. that we don't die
1807  // on a CHECK.
1808  EXPECT_DEATH(TestGCDSourceEvent(), "Shadow byte and word");
1809}
1810
1811TEST(AddressSanitizerMac, DISABLED_GCDSourceCancel) {
1812  // Make sure the whole ASan report is printed, i.e. that we don't die
1813  // on a CHECK.
1814  EXPECT_DEATH(TestGCDSourceCancel(), "Shadow byte and word");
1815}
1816
1817TEST(AddressSanitizerMac, DISABLED_GCDGroupAsync) {
1818  // Make sure the whole ASan report is printed, i.e. that we don't die
1819  // on a CHECK.
1820  EXPECT_DEATH(TestGCDGroupAsync(), "Shadow byte and word");
1821}
1822
1823void *MallocIntrospectionLockWorker(void *_) {
1824  const int kNumPointers = 100;
1825  int i;
1826  void *pointers[kNumPointers];
1827  for (i = 0; i < kNumPointers; i++) {
1828    pointers[i] = malloc(i + 1);
1829  }
1830  for (i = 0; i < kNumPointers; i++) {
1831    free(pointers[i]);
1832  }
1833
1834  return NULL;
1835}
1836
1837void *MallocIntrospectionLockForker(void *_) {
1838  pid_t result = fork();
1839  if (result == -1) {
1840    perror("fork");
1841  }
1842  assert(result != -1);
1843  if (result == 0) {
1844    // Call malloc in the child process to make sure we won't deadlock.
1845    void *ptr = malloc(42);
1846    free(ptr);
1847    exit(0);
1848  } else {
1849    // Return in the parent process.
1850    return NULL;
1851  }
1852}
1853
1854TEST(AddressSanitizerMac, MallocIntrospectionLock) {
1855  // Incorrect implementation of force_lock and force_unlock in our malloc zone
1856  // will cause forked processes to deadlock.
1857  // TODO(glider): need to detect that none of the child processes deadlocked.
1858  const int kNumWorkers = 5, kNumIterations = 100;
1859  int i, iter;
1860  for (iter = 0; iter < kNumIterations; iter++) {
1861    pthread_t workers[kNumWorkers], forker;
1862    for (i = 0; i < kNumWorkers; i++) {
1863      pthread_create(&workers[i], 0, MallocIntrospectionLockWorker, 0);
1864    }
1865    pthread_create(&forker, 0, MallocIntrospectionLockForker, 0);
1866    for (i = 0; i < kNumWorkers; i++) {
1867      pthread_join(workers[i], 0);
1868    }
1869    pthread_join(forker, 0);
1870  }
1871}
1872
1873void *TSDAllocWorker(void *test_key) {
1874  if (test_key) {
1875    void *mem = malloc(10);
1876    pthread_setspecific(*(pthread_key_t*)test_key, mem);
1877  }
1878  return NULL;
1879}
1880
1881TEST(AddressSanitizerMac, DISABLED_TSDWorkqueueTest) {
1882  pthread_t th;
1883  pthread_key_t test_key;
1884  pthread_key_create(&test_key, CallFreeOnWorkqueue);
1885  pthread_create(&th, NULL, TSDAllocWorker, &test_key);
1886  pthread_join(th, NULL);
1887  pthread_key_delete(test_key);
1888}
1889#endif  // __APPLE__
1890
1891int main(int argc, char **argv) {
1892  progname = argv[0];
1893  testing::GTEST_FLAG(death_test_style) = "threadsafe";
1894  testing::InitGoogleTest(&argc, argv);
1895  return RUN_ALL_TESTS();
1896}
1897