rsleevi@chromium.org | de3a6cf | 2012-04-06 12:53:02 +0900 | [diff] [blame] | 1 | // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
glider@chromium.org | 0f9756f | 2009-12-17 21:37:58 +0900 | [diff] [blame] | 2 | // Use of this source code is governed by a BSD-style license that can be |
| 3 | // found in the LICENSE file. |
glider@chromium.org | 71a6e93 | 2011-10-05 22:22:50 +0900 | [diff] [blame] | 4 | // |
| 5 | // This file contains intentional memory errors, some of which may lead to |
| 6 | // crashes if the test is ran without special memory testing tools. We use these |
| 7 | // errors to verify the sanity of the tools. |
glider@chromium.org | 0f9756f | 2009-12-17 21:37:58 +0900 | [diff] [blame] | 8 | |
timurrrr@chromium.org | b1d5c02 | 2011-05-11 03:03:34 +0900 | [diff] [blame] | 9 | #include "base/atomicops.h" |
sebmarchand@chromium.org | d117d7a | 2014-06-14 17:29:37 +0900 | [diff] [blame] | 10 | #include "base/debug/asan_invalid_access.h" |
| 11 | #include "base/debug/profiler.h" |
avi@chromium.org | a043a86 | 2013-07-18 17:12:40 +0900 | [diff] [blame] | 12 | #include "base/message_loop/message_loop.h" |
timurrrr@chromium.org | f39c3ff | 2010-05-14 17:24:42 +0900 | [diff] [blame] | 13 | #include "base/third_party/dynamic_annotations/dynamic_annotations.h" |
brettw@chromium.org | 5b5f5e0 | 2011-01-01 10:01:06 +0900 | [diff] [blame] | 14 | #include "base/threading/thread.h" |
glider@chromium.org | 0f9756f | 2009-12-17 21:37:58 +0900 | [diff] [blame] | 15 | #include "testing/gtest/include/gtest/gtest.h" |
| 16 | |
brettw@chromium.org | 6139182 | 2011-01-01 05:02:16 +0900 | [diff] [blame] | 17 | namespace base { |
| 18 | |
glider@chromium.org | 0f9756f | 2009-12-17 21:37:58 +0900 | [diff] [blame] | 19 | namespace { |
| 20 | |
timurrrr@chromium.org | b1d5c02 | 2011-05-11 03:03:34 +0900 | [diff] [blame] | 21 | const base::subtle::Atomic32 kMagicValue = 42; |
glider@chromium.org | 0f9756f | 2009-12-17 21:37:58 +0900 | [diff] [blame] | 22 | |
glider@chromium.org | 71a6e93 | 2011-10-05 22:22:50 +0900 | [diff] [blame] | 23 | // Helper for memory accesses that can potentially corrupt memory or cause a |
| 24 | // crash during a native run. |
chrisha@google.com | 87839ab | 2014-03-28 00:08:04 +0900 | [diff] [blame] | 25 | #if defined(ADDRESS_SANITIZER) || defined(SYZYASAN) |
glider@chromium.org | a3b3c43 | 2012-10-24 23:11:02 +0900 | [diff] [blame] | 26 | #if defined(OS_IOS) |
| 27 | // EXPECT_DEATH is not supported on IOS. |
| 28 | #define HARMFUL_ACCESS(action,error_regexp) do { action; } while (0) |
sebmarchand@chromium.org | d117d7a | 2014-06-14 17:29:37 +0900 | [diff] [blame] | 29 | #elif defined(SYZYASAN) |
| 30 | // We won't get a meaningful error message because we're not running under the |
| 31 | // SyzyASan logger, but we can at least make sure that the error has been |
| 32 | // generated in the SyzyASan runtime. |
| 33 | #define HARMFUL_ACCESS(action,unused) \ |
| 34 | if (debug::IsBinaryInstrumented()) { EXPECT_DEATH(action, \ |
| 35 | "AsanRuntime::OnError"); } |
glider@chromium.org | a3b3c43 | 2012-10-24 23:11:02 +0900 | [diff] [blame] | 36 | #else |
glider@chromium.org | 71a6e93 | 2011-10-05 22:22:50 +0900 | [diff] [blame] | 37 | #define HARMFUL_ACCESS(action,error_regexp) EXPECT_DEATH(action,error_regexp) |
sebmarchand@chromium.org | d117d7a | 2014-06-14 17:29:37 +0900 | [diff] [blame] | 38 | #endif // !OS_IOS && !SYZYASAN |
glider@chromium.org | 71a6e93 | 2011-10-05 22:22:50 +0900 | [diff] [blame] | 39 | #else |
| 40 | #define HARMFUL_ACCESS(action,error_regexp) \ |
| 41 | do { if (RunningOnValgrind()) { action; } } while (0) |
| 42 | #endif |
| 43 | |
earthdok@chromium.org | 5a5e465 | 2014-01-16 14:31:41 +0900 | [diff] [blame] | 44 | void DoReadUninitializedValue(char *ptr) { |
eugenis@google.com | 7634fc5 | 2012-05-16 17:42:08 +0900 | [diff] [blame] | 45 | // Comparison with 64 is to prevent clang from optimizing away the |
thakis@chromium.org | 987f833 | 2011-09-19 01:39:12 +0900 | [diff] [blame] | 46 | // jump -- valgrind only catches jumps and conditional moves, but clang uses |
| 47 | // the borrow flag if the condition is just `*ptr == '\0'`. |
eugenis@google.com | 7634fc5 | 2012-05-16 17:42:08 +0900 | [diff] [blame] | 48 | if (*ptr == 64) { |
earthdok@chromium.org | 5a5e465 | 2014-01-16 14:31:41 +0900 | [diff] [blame] | 49 | VLOG(1) << "Uninit condition is true"; |
timurrrr@chromium.org | 4631544 | 2010-09-23 18:12:37 +0900 | [diff] [blame] | 50 | } else { |
earthdok@chromium.org | 5a5e465 | 2014-01-16 14:31:41 +0900 | [diff] [blame] | 51 | VLOG(1) << "Uninit condition is false"; |
timurrrr@chromium.org | 4631544 | 2010-09-23 18:12:37 +0900 | [diff] [blame] | 52 | } |
| 53 | } |
| 54 | |
earthdok@chromium.org | 5a5e465 | 2014-01-16 14:31:41 +0900 | [diff] [blame] | 55 | void ReadUninitializedValue(char *ptr) { |
| 56 | #if defined(MEMORY_SANITIZER) |
| 57 | EXPECT_DEATH(DoReadUninitializedValue(ptr), |
| 58 | "use-of-uninitialized-value"); |
| 59 | #else |
| 60 | DoReadUninitializedValue(ptr); |
| 61 | #endif |
| 62 | } |
| 63 | |
timurrrr@chromium.org | 4597f34 | 2010-03-26 21:54:44 +0900 | [diff] [blame] | 64 | void ReadValueOutOfArrayBoundsLeft(char *ptr) { |
pkasting@chromium.org | 4baea27 | 2010-10-19 08:57:49 +0900 | [diff] [blame] | 65 | char c = ptr[-2]; |
| 66 | VLOG(1) << "Reading a byte out of bounds: " << c; |
timurrrr@chromium.org | 4597f34 | 2010-03-26 21:54:44 +0900 | [diff] [blame] | 67 | } |
| 68 | |
| 69 | void ReadValueOutOfArrayBoundsRight(char *ptr, size_t size) { |
pkasting@chromium.org | 4baea27 | 2010-10-19 08:57:49 +0900 | [diff] [blame] | 70 | char c = ptr[size + 1]; |
| 71 | VLOG(1) << "Reading a byte out of bounds: " << c; |
timurrrr@chromium.org | 4597f34 | 2010-03-26 21:54:44 +0900 | [diff] [blame] | 72 | } |
| 73 | |
| 74 | // This is harmless if you run it under Valgrind thanks to redzones. |
| 75 | void WriteValueOutOfArrayBoundsLeft(char *ptr) { |
timurrrr@chromium.org | b1d5c02 | 2011-05-11 03:03:34 +0900 | [diff] [blame] | 76 | ptr[-1] = kMagicValue; |
timurrrr@chromium.org | 4597f34 | 2010-03-26 21:54:44 +0900 | [diff] [blame] | 77 | } |
| 78 | |
| 79 | // This is harmless if you run it under Valgrind thanks to redzones. |
| 80 | void WriteValueOutOfArrayBoundsRight(char *ptr, size_t size) { |
timurrrr@chromium.org | b1d5c02 | 2011-05-11 03:03:34 +0900 | [diff] [blame] | 81 | ptr[size] = kMagicValue; |
timurrrr@chromium.org | 4597f34 | 2010-03-26 21:54:44 +0900 | [diff] [blame] | 82 | } |
| 83 | |
| 84 | void MakeSomeErrors(char *ptr, size_t size) { |
timurrrr@chromium.org | 4631544 | 2010-09-23 18:12:37 +0900 | [diff] [blame] | 85 | ReadUninitializedValue(ptr); |
mithro@mithis.com | 62c7227 | 2013-12-18 14:31:33 +0900 | [diff] [blame] | 86 | |
glider@chromium.org | 71a6e93 | 2011-10-05 22:22:50 +0900 | [diff] [blame] | 87 | HARMFUL_ACCESS(ReadValueOutOfArrayBoundsLeft(ptr), |
mithro@mithis.com | 62c7227 | 2013-12-18 14:31:33 +0900 | [diff] [blame] | 88 | "2 bytes to the left"); |
glider@chromium.org | 71a6e93 | 2011-10-05 22:22:50 +0900 | [diff] [blame] | 89 | HARMFUL_ACCESS(ReadValueOutOfArrayBoundsRight(ptr, size), |
mithro@mithis.com | 62c7227 | 2013-12-18 14:31:33 +0900 | [diff] [blame] | 90 | "1 bytes to the right"); |
glider@chromium.org | 71a6e93 | 2011-10-05 22:22:50 +0900 | [diff] [blame] | 91 | HARMFUL_ACCESS(WriteValueOutOfArrayBoundsLeft(ptr), |
mithro@mithis.com | 62c7227 | 2013-12-18 14:31:33 +0900 | [diff] [blame] | 92 | "1 bytes to the left"); |
glider@chromium.org | 71a6e93 | 2011-10-05 22:22:50 +0900 | [diff] [blame] | 93 | HARMFUL_ACCESS(WriteValueOutOfArrayBoundsRight(ptr, size), |
mithro@mithis.com | 62c7227 | 2013-12-18 14:31:33 +0900 | [diff] [blame] | 94 | "0 bytes to the right"); |
timurrrr@chromium.org | 4597f34 | 2010-03-26 21:54:44 +0900 | [diff] [blame] | 95 | } |
| 96 | |
glider@chromium.org | b311fbc | 2010-10-14 17:25:54 +0900 | [diff] [blame] | 97 | } // namespace |
| 98 | |
| 99 | // A memory leak detector should report an error in this test. |
| 100 | TEST(ToolsSanityTest, MemoryLeak) { |
thakis@chromium.org | 1a3c5d1 | 2011-11-01 20:08:09 +0900 | [diff] [blame] | 101 | // Without the |volatile|, clang optimizes away the next two lines. |
| 102 | int* volatile leak = new int[256]; // Leak some memory intentionally. |
glider@chromium.org | b311fbc | 2010-10-14 17:25:54 +0900 | [diff] [blame] | 103 | leak[4] = 1; // Make sure the allocated memory is used. |
| 104 | } |
| 105 | |
chrisha@chromium.org | 3f23a1a | 2014-03-29 02:35:10 +0900 | [diff] [blame] | 106 | #if (defined(ADDRESS_SANITIZER) && defined(OS_IOS)) || defined(SYZYASAN) |
glider@chromium.org | a3b3c43 | 2012-10-24 23:11:02 +0900 | [diff] [blame] | 107 | // Because iOS doesn't support death tests, each of the following tests will |
chrisha@chromium.org | 3f23a1a | 2014-03-29 02:35:10 +0900 | [diff] [blame] | 108 | // crash the whole program under Asan. On Windows Asan is based on SyzyAsan; the |
| 109 | // error report mechanism is different than with Asan so these tests will fail. |
glider@chromium.org | a3b3c43 | 2012-10-24 23:11:02 +0900 | [diff] [blame] | 110 | #define MAYBE_AccessesToNewMemory DISABLED_AccessesToNewMemory |
| 111 | #define MAYBE_AccessesToMallocMemory DISABLED_AccessesToMallocMemory |
glider@chromium.org | 738e89d | 2014-05-14 20:50:37 +0900 | [diff] [blame] | 112 | #else |
| 113 | #define MAYBE_AccessesToNewMemory AccessesToNewMemory |
| 114 | #define MAYBE_AccessesToMallocMemory AccessesToMallocMemory |
tzik@chromium.org | f65e67e | 2014-07-18 11:40:40 +0900 | [diff] [blame] | 115 | #endif // (defined(ADDRESS_SANITIZER) && defined(OS_IOS)) || defined(SYZYASAN) |
glider@chromium.org | e43d006 | 2014-05-15 01:04:30 +0900 | [diff] [blame] | 116 | |
| 117 | // The following tests pass with Clang r170392, but not r172454, which |
| 118 | // makes AddressSanitizer detect errors in them. We disable these tests under |
| 119 | // AddressSanitizer until we fully switch to Clang r172454. After that the |
| 120 | // tests should be put back under the (defined(OS_IOS) || defined(OS_WIN)) |
| 121 | // clause above. |
| 122 | // See also http://crbug.com/172614. |
| 123 | #if defined(ADDRESS_SANITIZER) || defined(SYZYASAN) |
glider@chromium.org | 738e89d | 2014-05-14 20:50:37 +0900 | [diff] [blame] | 124 | #define MAYBE_SingleElementDeletedWithBraces \ |
| 125 | DISABLED_SingleElementDeletedWithBraces |
glider@chromium.org | e43d006 | 2014-05-15 01:04:30 +0900 | [diff] [blame] | 126 | #define MAYBE_ArrayDeletedWithoutBraces DISABLED_ArrayDeletedWithoutBraces |
tzik@chromium.org | f65e67e | 2014-07-18 11:40:40 +0900 | [diff] [blame] | 127 | #else |
| 128 | #define MAYBE_ArrayDeletedWithoutBraces ArrayDeletedWithoutBraces |
| 129 | #define MAYBE_SingleElementDeletedWithBraces SingleElementDeletedWithBraces |
| 130 | #endif // defined(ADDRESS_SANITIZER) || defined(SYZYASAN) |
| 131 | |
glider@chromium.org | a3b3c43 | 2012-10-24 23:11:02 +0900 | [diff] [blame] | 132 | TEST(ToolsSanityTest, MAYBE_AccessesToNewMemory) { |
timurrrr@chromium.org | 4597f34 | 2010-03-26 21:54:44 +0900 | [diff] [blame] | 133 | char *foo = new char[10]; |
| 134 | MakeSomeErrors(foo, 10); |
| 135 | delete [] foo; |
glider@chromium.org | 71a6e93 | 2011-10-05 22:22:50 +0900 | [diff] [blame] | 136 | // Use after delete. |
| 137 | HARMFUL_ACCESS(foo[5] = 0, "heap-use-after-free"); |
timurrrr@chromium.org | 4597f34 | 2010-03-26 21:54:44 +0900 | [diff] [blame] | 138 | } |
| 139 | |
glider@chromium.org | a3b3c43 | 2012-10-24 23:11:02 +0900 | [diff] [blame] | 140 | TEST(ToolsSanityTest, MAYBE_AccessesToMallocMemory) { |
timurrrr@chromium.org | 4597f34 | 2010-03-26 21:54:44 +0900 | [diff] [blame] | 141 | char *foo = reinterpret_cast<char*>(malloc(10)); |
| 142 | MakeSomeErrors(foo, 10); |
| 143 | free(foo); |
glider@chromium.org | 71a6e93 | 2011-10-05 22:22:50 +0900 | [diff] [blame] | 144 | // Use after free. |
| 145 | HARMFUL_ACCESS(foo[5] = 0, "heap-use-after-free"); |
timurrrr@chromium.org | 4597f34 | 2010-03-26 21:54:44 +0900 | [diff] [blame] | 146 | } |
| 147 | |
hans | e03e7f7 | 2015-05-20 02:03:14 +0900 | [diff] [blame] | 148 | static int* allocateArray() { |
| 149 | // Clang warns about the mismatched new[]/delete if they occur in the same |
| 150 | // function. |
| 151 | return new int[10]; |
| 152 | } |
| 153 | |
glider@chromium.org | a3b3c43 | 2012-10-24 23:11:02 +0900 | [diff] [blame] | 154 | TEST(ToolsSanityTest, MAYBE_ArrayDeletedWithoutBraces) { |
chrisha@google.com | 87839ab | 2014-03-28 00:08:04 +0900 | [diff] [blame] | 155 | #if !defined(ADDRESS_SANITIZER) && !defined(SYZYASAN) |
glider@chromium.org | 71a6e93 | 2011-10-05 22:22:50 +0900 | [diff] [blame] | 156 | // This test may corrupt memory if not run under Valgrind or compiled with |
| 157 | // AddressSanitizer. |
timurrrr@chromium.org | 4597f34 | 2010-03-26 21:54:44 +0900 | [diff] [blame] | 158 | if (!RunningOnValgrind()) |
| 159 | return; |
glider@chromium.org | 71a6e93 | 2011-10-05 22:22:50 +0900 | [diff] [blame] | 160 | #endif |
timurrrr@chromium.org | 4597f34 | 2010-03-26 21:54:44 +0900 | [diff] [blame] | 161 | |
thakis@chromium.org | c3846f8 | 2011-09-19 01:30:12 +0900 | [diff] [blame] | 162 | // Without the |volatile|, clang optimizes away the next two lines. |
hans | e03e7f7 | 2015-05-20 02:03:14 +0900 | [diff] [blame] | 163 | int* volatile foo = allocateArray(); |
glider@chromium.org | e43d006 | 2014-05-15 01:04:30 +0900 | [diff] [blame] | 164 | delete foo; |
timurrrr@chromium.org | 4597f34 | 2010-03-26 21:54:44 +0900 | [diff] [blame] | 165 | } |
| 166 | |
hans | e03e7f7 | 2015-05-20 02:03:14 +0900 | [diff] [blame] | 167 | static int* allocateScalar() { |
| 168 | // Clang warns about the mismatched new/delete[] if they occur in the same |
| 169 | // function. |
| 170 | return new int; |
| 171 | } |
| 172 | |
glider@chromium.org | a3b3c43 | 2012-10-24 23:11:02 +0900 | [diff] [blame] | 173 | TEST(ToolsSanityTest, MAYBE_SingleElementDeletedWithBraces) { |
| 174 | #if !defined(ADDRESS_SANITIZER) |
glider@chromium.org | 71a6e93 | 2011-10-05 22:22:50 +0900 | [diff] [blame] | 175 | // This test may corrupt memory if not run under Valgrind or compiled with |
| 176 | // AddressSanitizer. |
timurrrr@chromium.org | 4597f34 | 2010-03-26 21:54:44 +0900 | [diff] [blame] | 177 | if (!RunningOnValgrind()) |
| 178 | return; |
glider@chromium.org | 71a6e93 | 2011-10-05 22:22:50 +0900 | [diff] [blame] | 179 | #endif |
timurrrr@chromium.org | 4597f34 | 2010-03-26 21:54:44 +0900 | [diff] [blame] | 180 | |
thakis@chromium.org | c3846f8 | 2011-09-19 01:30:12 +0900 | [diff] [blame] | 181 | // Without the |volatile|, clang optimizes away the next two lines. |
hans | e03e7f7 | 2015-05-20 02:03:14 +0900 | [diff] [blame] | 182 | int* volatile foo = allocateScalar(); |
pph34r@gmail.com | 8027129 | 2011-10-01 03:52:04 +0900 | [diff] [blame] | 183 | (void) foo; |
glider@chromium.org | e43d006 | 2014-05-15 01:04:30 +0900 | [diff] [blame] | 184 | delete [] foo; |
timurrrr@chromium.org | 4597f34 | 2010-03-26 21:54:44 +0900 | [diff] [blame] | 185 | } |
| 186 | |
chrisha@google.com | 87839ab | 2014-03-28 00:08:04 +0900 | [diff] [blame] | 187 | #if defined(ADDRESS_SANITIZER) || defined(SYZYASAN) |
sebmarchand@chromium.org | d117d7a | 2014-06-14 17:29:37 +0900 | [diff] [blame] | 188 | |
glider@chromium.org | 4b5cd88 | 2011-11-08 18:28:49 +0900 | [diff] [blame] | 189 | TEST(ToolsSanityTest, DISABLED_AddressSanitizerNullDerefCrashTest) { |
glider@chromium.org | 2fa52d0 | 2011-10-13 02:18:24 +0900 | [diff] [blame] | 190 | // Intentionally crash to make sure AddressSanitizer is running. |
| 191 | // This test should not be ran on bots. |
| 192 | int* volatile zero = NULL; |
| 193 | *zero = 0; |
| 194 | } |
glider@chromium.org | 4b5cd88 | 2011-11-08 18:28:49 +0900 | [diff] [blame] | 195 | |
| 196 | TEST(ToolsSanityTest, DISABLED_AddressSanitizerLocalOOBCrashTest) { |
| 197 | // Intentionally crash to make sure AddressSanitizer is instrumenting |
| 198 | // the local variables. |
| 199 | // This test should not be ran on bots. |
| 200 | int array[5]; |
| 201 | // Work around the OOB warning reported by Clang. |
| 202 | int* volatile access = &array[5]; |
| 203 | *access = 43; |
| 204 | } |
| 205 | |
| 206 | namespace { |
| 207 | int g_asan_test_global_array[10]; |
| 208 | } // namespace |
| 209 | |
| 210 | TEST(ToolsSanityTest, DISABLED_AddressSanitizerGlobalOOBCrashTest) { |
| 211 | // Intentionally crash to make sure AddressSanitizer is instrumenting |
| 212 | // the global variables. |
| 213 | // This test should not be ran on bots. |
| 214 | |
| 215 | // Work around the OOB warning reported by Clang. |
| 216 | int* volatile access = g_asan_test_global_array - 1; |
| 217 | *access = 43; |
| 218 | } |
| 219 | |
sebmarchand@chromium.org | d117d7a | 2014-06-14 17:29:37 +0900 | [diff] [blame] | 220 | TEST(ToolsSanityTest, AsanHeapOverflow) { |
| 221 | HARMFUL_ACCESS(debug::AsanHeapOverflow() ,"to the right"); |
| 222 | } |
| 223 | |
| 224 | TEST(ToolsSanityTest, AsanHeapUnderflow) { |
| 225 | HARMFUL_ACCESS(debug::AsanHeapUnderflow(), "to the left"); |
| 226 | } |
| 227 | |
| 228 | TEST(ToolsSanityTest, AsanHeapUseAfterFree) { |
| 229 | HARMFUL_ACCESS(debug::AsanHeapUseAfterFree(), "heap-use-after-free"); |
| 230 | } |
| 231 | |
| 232 | #if defined(SYZYASAN) |
| 233 | TEST(ToolsSanityTest, AsanCorruptHeapBlock) { |
| 234 | HARMFUL_ACCESS(debug::AsanCorruptHeapBlock(), ""); |
| 235 | } |
| 236 | |
| 237 | TEST(ToolsSanityTest, AsanCorruptHeap) { |
| 238 | // This test will kill the process by raising an exception, there's no |
| 239 | // particular string to look for in the stack trace. |
| 240 | EXPECT_DEATH(debug::AsanCorruptHeap(), ""); |
| 241 | } |
| 242 | #endif // SYZYASAN |
| 243 | |
| 244 | #endif // ADDRESS_SANITIZER || SYZYASAN |
timurrrr@chromium.org | b1d5c02 | 2011-05-11 03:03:34 +0900 | [diff] [blame] | 245 | |
| 246 | namespace { |
| 247 | |
| 248 | // We use caps here just to ensure that the method name doesn't interfere with |
| 249 | // the wildcarded suppressions. |
| 250 | class TOOLS_SANITY_TEST_CONCURRENT_THREAD : public PlatformThread::Delegate { |
| 251 | public: |
| 252 | explicit TOOLS_SANITY_TEST_CONCURRENT_THREAD(bool *value) : value_(value) {} |
dcheng | 7dc8df5 | 2014-10-21 19:54:51 +0900 | [diff] [blame] | 253 | ~TOOLS_SANITY_TEST_CONCURRENT_THREAD() override {} |
| 254 | void ThreadMain() override { |
timurrrr@chromium.org | b1d5c02 | 2011-05-11 03:03:34 +0900 | [diff] [blame] | 255 | *value_ = true; |
| 256 | |
| 257 | // Sleep for a few milliseconds so the two threads are more likely to live |
| 258 | // simultaneously. Otherwise we may miss the report due to mutex |
| 259 | // lock/unlock's inside thread creation code in pure-happens-before mode... |
tedvessenes@gmail.com | aaa6303 | 2012-01-01 07:53:51 +0900 | [diff] [blame] | 260 | PlatformThread::Sleep(TimeDelta::FromMilliseconds(100)); |
timurrrr@chromium.org | b1d5c02 | 2011-05-11 03:03:34 +0900 | [diff] [blame] | 261 | } |
| 262 | private: |
| 263 | bool *value_; |
| 264 | }; |
| 265 | |
| 266 | class ReleaseStoreThread : public PlatformThread::Delegate { |
| 267 | public: |
| 268 | explicit ReleaseStoreThread(base::subtle::Atomic32 *value) : value_(value) {} |
dcheng | 7dc8df5 | 2014-10-21 19:54:51 +0900 | [diff] [blame] | 269 | ~ReleaseStoreThread() override {} |
| 270 | void ThreadMain() override { |
timurrrr@chromium.org | b1d5c02 | 2011-05-11 03:03:34 +0900 | [diff] [blame] | 271 | base::subtle::Release_Store(value_, kMagicValue); |
| 272 | |
| 273 | // Sleep for a few milliseconds so the two threads are more likely to live |
| 274 | // simultaneously. Otherwise we may miss the report due to mutex |
| 275 | // lock/unlock's inside thread creation code in pure-happens-before mode... |
tedvessenes@gmail.com | aaa6303 | 2012-01-01 07:53:51 +0900 | [diff] [blame] | 276 | PlatformThread::Sleep(TimeDelta::FromMilliseconds(100)); |
timurrrr@chromium.org | b1d5c02 | 2011-05-11 03:03:34 +0900 | [diff] [blame] | 277 | } |
| 278 | private: |
| 279 | base::subtle::Atomic32 *value_; |
| 280 | }; |
| 281 | |
| 282 | class AcquireLoadThread : public PlatformThread::Delegate { |
| 283 | public: |
| 284 | explicit AcquireLoadThread(base::subtle::Atomic32 *value) : value_(value) {} |
dcheng | 7dc8df5 | 2014-10-21 19:54:51 +0900 | [diff] [blame] | 285 | ~AcquireLoadThread() override {} |
| 286 | void ThreadMain() override { |
timurrrr@chromium.org | b1d5c02 | 2011-05-11 03:03:34 +0900 | [diff] [blame] | 287 | // Wait for the other thread to make Release_Store |
tedvessenes@gmail.com | aaa6303 | 2012-01-01 07:53:51 +0900 | [diff] [blame] | 288 | PlatformThread::Sleep(TimeDelta::FromMilliseconds(100)); |
timurrrr@chromium.org | b1d5c02 | 2011-05-11 03:03:34 +0900 | [diff] [blame] | 289 | base::subtle::Acquire_Load(value_); |
| 290 | } |
| 291 | private: |
| 292 | base::subtle::Atomic32 *value_; |
| 293 | }; |
| 294 | |
| 295 | void RunInParallel(PlatformThread::Delegate *d1, PlatformThread::Delegate *d2) { |
| 296 | PlatformThreadHandle a; |
| 297 | PlatformThreadHandle b; |
| 298 | PlatformThread::Create(0, d1, &a); |
| 299 | PlatformThread::Create(0, d2, &b); |
| 300 | PlatformThread::Join(a); |
| 301 | PlatformThread::Join(b); |
| 302 | } |
| 303 | |
glider@chromium.org | c75e137 | 2014-06-26 22:10:50 +0900 | [diff] [blame] | 304 | #if defined(THREAD_SANITIZER) |
| 305 | void DataRace() { |
glider@chromium.org | 7bb5ece | 2013-03-23 20:28:17 +0900 | [diff] [blame] | 306 | bool *shared = new bool(false); |
| 307 | TOOLS_SANITY_TEST_CONCURRENT_THREAD thread1(shared), thread2(shared); |
timurrrr@chromium.org | b1d5c02 | 2011-05-11 03:03:34 +0900 | [diff] [blame] | 308 | RunInParallel(&thread1, &thread2); |
glider@chromium.org | 7bb5ece | 2013-03-23 20:28:17 +0900 | [diff] [blame] | 309 | EXPECT_TRUE(*shared); |
| 310 | delete shared; |
glider@chromium.org | c75e137 | 2014-06-26 22:10:50 +0900 | [diff] [blame] | 311 | // We're in a death test - crash. |
| 312 | CHECK(0); |
timurrrr@chromium.org | b1d5c02 | 2011-05-11 03:03:34 +0900 | [diff] [blame] | 313 | } |
glider@chromium.org | c75e137 | 2014-06-26 22:10:50 +0900 | [diff] [blame] | 314 | #endif |
| 315 | |
| 316 | } // namespace |
| 317 | |
| 318 | #if defined(THREAD_SANITIZER) |
| 319 | // A data race detector should report an error in this test. |
| 320 | TEST(ToolsSanityTest, DataRace) { |
| 321 | // The suppression regexp must match that in base/debug/tsan_suppressions.cc. |
| 322 | EXPECT_DEATH(DataRace(), "1 race:base/tools_sanity_unittest.cc"); |
| 323 | } |
| 324 | #endif |
timurrrr@chromium.org | b1d5c02 | 2011-05-11 03:03:34 +0900 | [diff] [blame] | 325 | |
| 326 | TEST(ToolsSanityTest, AnnotateBenignRace) { |
| 327 | bool shared = false; |
| 328 | ANNOTATE_BENIGN_RACE(&shared, "Intentional race - make sure doesn't show up"); |
| 329 | TOOLS_SANITY_TEST_CONCURRENT_THREAD thread1(&shared), thread2(&shared); |
| 330 | RunInParallel(&thread1, &thread2); |
| 331 | EXPECT_TRUE(shared); |
| 332 | } |
| 333 | |
| 334 | TEST(ToolsSanityTest, AtomicsAreIgnored) { |
| 335 | base::subtle::Atomic32 shared = 0; |
| 336 | ReleaseStoreThread thread1(&shared); |
| 337 | AcquireLoadThread thread2(&shared); |
| 338 | RunInParallel(&thread1, &thread2); |
| 339 | EXPECT_EQ(kMagicValue, shared); |
glider@chromium.org | 0f9756f | 2009-12-17 21:37:58 +0900 | [diff] [blame] | 340 | } |
brettw@chromium.org | 6139182 | 2011-01-01 05:02:16 +0900 | [diff] [blame] | 341 | |
pcc | 85bb755 | 2015-07-31 09:19:06 +0900 | [diff] [blame] | 342 | #if defined(CFI_ENFORCEMENT) |
| 343 | TEST(ToolsSanityTest, BadCast) { |
| 344 | class A { |
| 345 | virtual void f() {} |
| 346 | }; |
| 347 | |
| 348 | class B { |
| 349 | virtual void f() {} |
| 350 | }; |
| 351 | |
| 352 | A a; |
| 353 | EXPECT_DEATH((void)(B*)&a, "ILL_ILLOPN"); |
| 354 | } |
| 355 | #endif |
| 356 | |
brettw@chromium.org | 6139182 | 2011-01-01 05:02:16 +0900 | [diff] [blame] | 357 | } // namespace base |