Add support for more ASAN errors generation to chrome://crash/...

content/renderer/render_frame_impl.cc

Index: content/renderer/render_frame_impl.cc
diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
index a088661633d144135611d95f83b8200077448e13..1d28afd4303c4058b2e5891a979bd113149d7643 100644
--- a/content/renderer/render_frame_impl.cc
+++ b/content/renderer/render_frame_impl.cc
@@ -202,6 +202,28 @@ NOINLINE static void CrashIntentionally() {
   *zero = 0;
 }
 
+#if defined(SYZYASAN)
+#pragma warning(push)
+#pragma warning(disable: 4509)

[chrisha, 2014/04/22 16:28:01]

Comment as to what warning you are disabling?

[Sébastien Marchand, 2014/04/22 17:21:43]

Done.

+NOINLINE static void CorruptMemoryBlock() {
+  // NOTE(sebmarchand): We intentionally corrupt a memory block her in order to

[chrisha, 2014/04/22 16:28:01]

here* in order

[Sébastien Marchand, 2014/04/22 17:21:43]

Done.

+  //     trigger an Address Sanitizer (ASAN) error report.
+  static const int kArraySize = 5;
+  scoped_ptr<int[]> array(new int[kArraySize]);
+  // Encapsulate the invalid memory access into a try-catch statement to prevent
+  // the function from being instrumented. This way the underflow won't be

[chrisha, 2014/04/22 16:28:01]

this* function from being instrumented.

[Sébastien Marchand, 2014/04/22 17:21:43]

Done.

+  // detected but the corruption will (as the allocator will still be hooked).
+  __try {
+    int dummy = array[-1]--;
+    // Make sure the assignments to the dummy value aren't optimized away.
+    base::debug::Alias(&array);
+  } __except (EXCEPTION_EXECUTE_HANDLER) {
+    return;
+  }
+}
+#pragma warning(pop)
+#endif
+
 #if defined(ADDRESS_SANITIZER) || defined(SYZYASAN)
 NOINLINE static void MaybeTriggerAsanError(const GURL& url) {
   // NOTE(rogerm): We intentionally perform an invalid heap access here in
@@ -210,6 +232,9 @@ NOINLINE static void MaybeTriggerAsanError(const GURL& url) {
   static const char kHeapOverflow[] = "/heap-overflow";
   static const char kHeapUnderflow[] = "/heap-underflow";
   static const char kUseAfterFree[] = "/use-after-free";
+#if defined(SYZYASAN)
+  static const char kHeapCorruptedBlock[] = "/heap-corrupted-block";
+#endif
   static const int kArraySize = 5;
 
   if (!url.DomainIs(kCrashDomain, sizeof(kCrashDomain) - 1))
@@ -229,6 +254,10 @@ NOINLINE static void MaybeTriggerAsanError(const GURL& url) {
     int* dangling = array.get();
     array.reset();
     dummy = dangling[kArraySize / 2];
+#if defined(SYZYASAN)
+  } else if (crash_type == kHeapCorruptedBlock) {
+    CorruptMemoryBlock();
+#endif
   }
 
   // Make sure the assignments to the dummy value aren't optimized away.