Add some function and URLs to induce ASan crashes.

base/tools_sanity_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 //
 // This file contains intentional memory errors, some of which may lead to
 // crashes if the test is ran without special memory testing tools. We use these
 // errors to verify the sanity of the tools.
 
 #include "base/atomicops.h"
+#include "base/debug/asan_invalid_access.h"
+#include "base/debug/profiler.h"
 #include "base/message_loop/message_loop.h"
 #include "base/third_party/dynamic_annotations/dynamic_annotations.h"
 #include "base/threading/thread.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace base {
 
 namespace {
 
 const base::subtle::Atomic32 kMagicValue = 42;
 
 // Helper for memory accesses that can potentially corrupt memory or cause a
 // crash during a native run.
 #if defined(ADDRESS_SANITIZER) || defined(SYZYASAN)
 #if defined(OS_IOS)
 // EXPECT_DEATH is not supported on IOS.
 #define HARMFUL_ACCESS(action,error_regexp) do { action; } while (0)
+#elif defined(SYZYASAN)
+#define HARMFUL_ACCESS(action,error_regexp) \
+if (debug::IsBinaryInstrumented()) { EXPECT_DEATH(action,error_regexp); }
 #else
 #define HARMFUL_ACCESS(action,error_regexp) EXPECT_DEATH(action,error_regexp)
-#endif  // !OS_IOS
+#endif  // !OS_IOS && !SYZYASAN
 #else
 #define HARMFUL_ACCESS(action,error_regexp) \
 do { if (RunningOnValgrind()) { action; } } while (0)
 #endif
 
 void DoReadUninitializedValue(char *ptr) {
   // Comparison with 64 is to prevent clang from optimizing away the
   // jump -- valgrind only catches jumps and conditional moves, but clang uses
   // the borrow flag if the condition is just `*ptr == '\0'`.
   if (*ptr == 64) {
@@ skipping 115 matching lines @@
     return;
 #endif
 
   // Without the |volatile|, clang optimizes away the next two lines.
   int* volatile foo = new int;
   (void) foo;
   delete [] foo;
 }
 
 #if defined(ADDRESS_SANITIZER) || defined(SYZYASAN)
+
 TEST(ToolsSanityTest, DISABLED_AddressSanitizerNullDerefCrashTest) {
   // Intentionally crash to make sure AddressSanitizer is running.
   // This test should not be ran on bots.
   int* volatile zero = NULL;
   *zero = 0;
 }
 
 TEST(ToolsSanityTest, DISABLED_AddressSanitizerLocalOOBCrashTest) {
   // Intentionally crash to make sure AddressSanitizer is instrumenting
   // the local variables.
@@ skipping 11 matching lines @@
 TEST(ToolsSanityTest, DISABLED_AddressSanitizerGlobalOOBCrashTest) {
   // Intentionally crash to make sure AddressSanitizer is instrumenting
   // the global variables.
   // This test should not be ran on bots.
 
   // Work around the OOB warning reported by Clang.
   int* volatile access = g_asan_test_global_array - 1;
   *access = 43;
 }
 
+TEST(ToolsSanityTest, AsanHeapOverflow) {
+#if defined(SYZYASAN)
+  // We won't get a meaningful error message because we're not running under the
+  // SyzyASan logger, but we can at least make sure that the error has been
+  // generated in the SyzyASan runtime.
+  HARMFUL_ACCESS(AsanHeapOverflow(), "AsanRuntime::OnError")

[Timur Iskhodzhanov, 2014/06/05 15:32:09]

can you put the OnError stuff into the HARMFUL_ACCESS macro instead?

[Sébastien Marchand, 2014/06/05 19:44:34]

Nop, mostly because of ToolsSanityTest.AsanCorruptHeap as in this case this
frame won't be in the stack trace...

[Timur Iskhodzhanov, 2014/06/06 11:36:56]

:(
Maybe we can handle only that test differently (especially since it's
SyzyASan-only) rather than all of the tests?

[Sébastien Marchand, 2014/06/09 14:47:39]

Done.

+#else
+  HARMFUL_ACCESS(AsanHeapOverflow(),"to the right");
 #endif
+}
+
+TEST(ToolsSanityTest, AsanHeapUnderflow) {
+#if defined(SYZYASAN)
+  // We won't get a meaningful error message because we're not running under the
+  // SyzyASan logger, but we can at least make sure that the error has been
+  // generated in the SyzyASan runtime.
+  HARMFUL_ACCESS(AsanHeapUnderflow(), "AsanRuntime::OnError");
+#else
+  HARMFUL_ACCESS(AsanHeapUnderflow(), "to the left");
+#endif
+}
+
+TEST(ToolsSanityTest, AsanHeapUseAfterFree) {
+#if defined(SYZYASAN)
+  // We won't get a meaningful error message because we're not running under the
+  // SyzyASan logger, but we can at least make sure that the error has been
+  // generated in the SyzyASan runtime.
+  HARMFUL_ACCESS(AsanHeapUseAfterFree(), "AsanRuntime::OnError");
+#else
+  HARMFUL_ACCESS(AsanHeapUseAfterFree(), "heap-use-after-free");
+#endif
+}
+
+#if defined(SYZYASAN)
+TEST(ToolsSanityTest, AsanCorruptHeapBlock) {
+  HARMFUL_ACCESS(AsanCorruptHeapBlock(), "AsanRuntime::OnError");
+}
+
+TEST(ToolsSanityTest, AsanCorruptHeap) {
+  // This test will kill the process by raising an exception, there's no
+  // particular string to look for in the stack trace.
+  HARMFUL_ACCESS(AsanCorruptHeap(), "");
+}
+#endif  // SYZYASAN
+
+#endif  // ADDRESS_SANITIZER || SYZYASAN
 
 namespace {
 
 // We use caps here just to ensure that the method name doesn't interfere with
 // the wildcarded suppressions.
 class TOOLS_SANITY_TEST_CONCURRENT_THREAD : public PlatformThread::Delegate {
  public:
   explicit TOOLS_SANITY_TEST_CONCURRENT_THREAD(bool *value) : value_(value) {}
   virtual ~TOOLS_SANITY_TEST_CONCURRENT_THREAD() {}
   virtual void ThreadMain() OVERRIDE {
@@ skipping 67 matching lines @@
 
 TEST(ToolsSanityTest, AtomicsAreIgnored) {
   base::subtle::Atomic32 shared = 0;
   ReleaseStoreThread thread1(&shared);
   AcquireLoadThread thread2(&shared);
   RunInParallel(&thread1, &thread2);
   EXPECT_EQ(kMagicValue, shared);
 }
 
 }  // namespace base