[SyzyAsan] More careful handling when freeing corrupt blocks.

syzygy/agent/asan/heap_managers/block_heap_manager.h

 // Copyright 2014 Google Inc. All Rights Reserved.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
 //
 //     http://www.apache.org/licenses/LICENSE-2.0
 //
 // Unless required by applicable law or agreed to in writing, software
 // distributed under the License is distributed on an "AS IS" BASIS,
@@ skipping 276 matching lines @@
   bool FreePristineBlock(BlockInfo* block_info);
 
   // Free an unguarded allocation.
   // @param heap_id A hint about the heap that might contain this allocation.
   // @param alloc The allocation to be freed.
   // @returns true if the allocation has been successfully freed, false
   //     otherwise.
   bool FreeUnguardedAlloc(HeapId heap_id, void* alloc);
 
   // Clears the metadata of a corrupt block. After calling this function the
-  // block can safely be passed to FreeBlock.
+  // block can safely be passed to FreeBlock, but only if heap_id is non-zero.
   // @param block_info The information about this block.
   void ClearCorruptBlockMetadata(BlockInfo* block_info);
 
   // Reports a heap error via the heap error callback. This is for originating
   // errors that are detected while performing operations on a heap metadata.
   // Read/write errors are detected outside of the manager, and query the heap
   // for information about the error itself.
   // @param address The address that was being accessed/manipulating when the
   //     error was detected.
   // @param kind The type of error encountered.
@@ skipping 47 matching lines @@
   // also by tests to override the callback.
   // @param deferred_free_callback The callback.
   void EnableDeferredFreeThreadWithCallback(
       DeferredFreeThread::Callback deferred_free_callback);
 
   // Returns the ID of the deferred free thread. Must not be called if the
   // thread is not running.
   // @returns the thread ID.
   base::PlatformThreadId GetDeferredFreeThreadId();
 
+  // Helper function for finding the heap ID associated with a corrupt block.
+  // This is best effort, and can return 0 when no heap can be found with
+  // certainty.
+  HeapId GetCorruptBlockHeapId(const BlockInfo* block_info);
+
   // The shadow memory that is notified by all activity in this heap manager.
   Shadow* shadow_;
 
   // The stack cache used to store the stack traces.
   StackCaptureCache* stack_cache_;
 
   // The memory notifier to use.
   MemoryNotifierInterface* memory_notifier_;
 
   // Protects concurrent access to the heap manager internals.
@@ skipping 70 matching lines @@
   std::unique_ptr<DeferredFreeThread> deferred_free_thread_;
 
   DISALLOW_COPY_AND_ASSIGN(BlockHeapManager);
 };
 
 }  // namespace heap_managers
 }  // namespace asan
 }  // namespace agent
 
 #endif  // SYZYGY_AGENT_ASAN_HEAP_MANAGERS_BLOCK_HEAP_MANAGER_H_