Remove tcmalloc when not being used. Restore shim on Windows.

base/security_unittest.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <fcntl.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <sys/stat.h>
 #include <sys/types.h>
 
 #include <algorithm>
 #include <limits>
 
 #include "base/files/file_util.h"
 #include "base/logging.h"
 #include "base/memory/scoped_ptr.h"
 #include "build/build_config.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 #if defined(OS_POSIX)
 #include <sys/mman.h>
 #include <unistd.h>
 #endif
 
+#if defined(OS_WIN)
+#include <new.h>
+#endif
+
 using std::nothrow;
 using std::numeric_limits;
 
 namespace {
 
+#if defined(OS_WIN)
+int OnNoMemory(size_t) {
+  _exit(1);
+}
+
+void exhaustMemory() {

[scottmg, 2015/01/12 16:51:01]

nit; exhaustMemory -> ExhaustMemory

[Will Harris, 2015/01/12 19:03:44]

Done.

+  for (;;) {
+    // This is a permitted size but exhausts memory pretty quickly.
+    void* buf = malloc(0x7FFFE000);
+    if (!buf)
+      break;
+  }
+}
+#endif
+
 // This function acts as a compiler optimization barrier. We use it to
 // prevent the compiler from making an expression a compile-time constant.
 // We also use it so that the compiler doesn't discard certain return values
 // as something we don't need (see the comment with calloc below).
 template <typename Type>
 Type HideValueFromCompiler(volatile Type value) {
 #if defined(__GNUC__)
   // In a GCC compatible compiler (GCC or Clang), make this compiler barrier
   // more robust than merely using "volatile".
   __asm__ volatile ("" : "+r" (value));
 #endif  // __GNUC__
   return value;
 }
 
+// Tcmalloc and Windows allocator shim support setting malloc limits.
 // - NO_TCMALLOC (should be defined if compiled with use_allocator!="tcmalloc")
 // - ADDRESS_SANITIZER and SYZYASAN because they have their own memory allocator
 // - IOS does not use tcmalloc
 // - OS_MACOSX does not use tcmalloc
-#if !defined(NO_TCMALLOC) && !defined(ADDRESS_SANITIZER) && \
-    !defined(OS_IOS) && !defined(OS_MACOSX) && !defined(SYZYASAN)
-  #define TCMALLOC_TEST(function) function
+// - Windows allocator shim defines ALLOCATOR_SHIM
+#if (!defined(NO_TCMALLOC) || defined(ALLOCATOR_SHIM)) &&                     \
+    !defined(ADDRESS_SANITIZER) && !defined(OS_IOS) && !defined(OS_MACOSX) && \
+    !defined(SYZYASAN)
+#define MALLOC_OVERFLOW_TEST(function) function
 #else
-  #define TCMALLOC_TEST(function) DISABLED_##function
+#define MALLOC_OVERFLOW_TEST(function) DISABLED_##function
 #endif
 
 // TODO(jln): switch to std::numeric_limits<int>::max() when we switch to
 // C++11.
 const size_t kTooBigAllocSize = INT_MAX;
 
 // Detect runtime TCMalloc bypasses.
 bool IsTcMallocBypassed() {
 #if defined(OS_LINUX)
   // This should detect a TCMalloc bypass from Valgrind.
   char* g_slice = getenv("G_SLICE");
   if (g_slice && !strcmp(g_slice, "always-malloc"))
     return true;
-#elif defined(OS_WIN)
-  // This should detect a TCMalloc bypass from setting
-  // the CHROME_ALLOCATOR environment variable.
-  char* allocator = getenv("CHROME_ALLOCATOR");
-  if (allocator && strcmp(allocator, "tcmalloc"))
-    return true;
 #endif
   return false;
 }
 
 bool CallocDiesOnOOM() {
 // The sanitizers' calloc dies on OOM instead of returning NULL.
 // The wrapper function in base/process_util_linux.cc that is used when we
 // compile without TCMalloc will just die on OOM instead of returning NULL.
 #if defined(ADDRESS_SANITIZER) || \
     defined(MEMORY_SANITIZER) || \
     defined(THREAD_SANITIZER) || \
     (defined(OS_LINUX) && defined(NO_TCMALLOC))
   return true;
 #else
   return false;
 #endif
 }
 
 // Fake test that allow to know the state of TCMalloc by looking at bots.
-TEST(SecurityTest, TCMALLOC_TEST(IsTCMallocDynamicallyBypassed)) {
+TEST(SecurityTest, MALLOC_OVERFLOW_TEST(IsTCMallocDynamicallyBypassed)) {
   printf("Malloc is dynamically bypassed: %s\n",
          IsTcMallocBypassed() ? "yes." : "no.");
 }
 
 // The MemoryAllocationRestrictions* tests test that we can not allocate a
 // memory range that cannot be indexed via an int. This is used to mitigate
 // vulnerabilities in libraries that use int instead of size_t.  See
 // crbug.com/169327.
 
-TEST(SecurityTest, TCMALLOC_TEST(MemoryAllocationRestrictionsMalloc)) {
+TEST(SecurityTest, MALLOC_OVERFLOW_TEST(MemoryAllocationRestrictionsMalloc)) {
   if (!IsTcMallocBypassed()) {
     scoped_ptr<char, base::FreeDeleter> ptr(static_cast<char*>(
         HideValueFromCompiler(malloc(kTooBigAllocSize))));
     ASSERT_TRUE(!ptr);
   }
 }
 
-TEST(SecurityTest, TCMALLOC_TEST(MemoryAllocationRestrictionsCalloc)) {
+#if defined(GTEST_HAS_DEATH_TEST) && defined(OS_WIN)
+TEST(SecurityTest, MALLOC_OVERFLOW_TEST(MemoryAllocationMallocDeathTest)) {
+  if (!IsTcMallocBypassed()) {

[scottmg, 2015/01/12 16:51:01]

Remove the IsTcMallocBypassed's for OS_WIN? (and below)

(It seems odd that that returns false on Windows too -- wouldn't it always be
bypassed?)

[Will Harris, 2015/01/12 19:03:44]

Done.

+    _set_new_handler(&OnNoMemory);
+    _set_new_mode(1);
+    {
+      scoped_ptr<char, base::FreeDeleter> ptr;
+      EXPECT_DEATH(ptr.reset(static_cast<char*>(
+                       HideValueFromCompiler(malloc(kTooBigAllocSize)))),

[scottmg, 2015/01/12 16:51:01]

Maybe a similar test that uses realloc instead of malloc since that code path is
a bit strange.

[Will Harris, 2015/01/12 19:03:44]

Done.

+                   "");
+      ASSERT_TRUE(!ptr);
+    }
+    _set_new_handler(NULL);
+    _set_new_mode(0);
+  }
+}
+
+TEST(SecurityTest, MALLOC_OVERFLOW_TEST(MemoryAllocationExhaustDeathTest)) {
+  if (!IsTcMallocBypassed()) {
+    _set_new_handler(&OnNoMemory);
+    _set_new_mode(1);
+    {
+      ASSERT_DEATH(exhaustMemory(), "");
+    }
+    _set_new_handler(NULL);
+    _set_new_mode(0);
+  }
+}
+
+#endif
+
+TEST(SecurityTest, MALLOC_OVERFLOW_TEST(MemoryAllocationRestrictionsCalloc)) {
   if (!IsTcMallocBypassed()) {
     scoped_ptr<char, base::FreeDeleter> ptr(static_cast<char*>(
         HideValueFromCompiler(calloc(kTooBigAllocSize, 1))));
     ASSERT_TRUE(!ptr);
   }
 }
 
-TEST(SecurityTest, TCMALLOC_TEST(MemoryAllocationRestrictionsRealloc)) {
+TEST(SecurityTest, MALLOC_OVERFLOW_TEST(MemoryAllocationRestrictionsRealloc)) {
   if (!IsTcMallocBypassed()) {
     char* orig_ptr = static_cast<char*>(malloc(1));
     ASSERT_TRUE(orig_ptr);
     scoped_ptr<char, base::FreeDeleter> ptr(static_cast<char*>(
         HideValueFromCompiler(realloc(orig_ptr, kTooBigAllocSize))));
     ASSERT_TRUE(!ptr);
     // If realloc() did not succeed, we need to free orig_ptr.
     free(orig_ptr);
   }
 }
 
 typedef struct {
   char large_array[kTooBigAllocSize];
 } VeryLargeStruct;
 
-TEST(SecurityTest, TCMALLOC_TEST(MemoryAllocationRestrictionsNew)) {
+TEST(SecurityTest, MALLOC_OVERFLOW_TEST(MemoryAllocationRestrictionsNew)) {
   if (!IsTcMallocBypassed()) {
     scoped_ptr<VeryLargeStruct> ptr(
         HideValueFromCompiler(new (nothrow) VeryLargeStruct));
     ASSERT_TRUE(!ptr);
   }
 }
 
-TEST(SecurityTest, TCMALLOC_TEST(MemoryAllocationRestrictionsNewArray)) {
+#if defined(GTEST_HAS_DEATH_TEST) && defined(OS_WIN)
+TEST(SecurityTest, MALLOC_OVERFLOW_TEST(MemoryAllocationNewDeathTest)) {
+  if (!IsTcMallocBypassed()) {
+    _set_new_handler(&OnNoMemory);
+    {
+      scoped_ptr<VeryLargeStruct> ptr;
+      EXPECT_DEATH(
+          ptr.reset(HideValueFromCompiler(new (nothrow) VeryLargeStruct)), "");
+      ASSERT_TRUE(!ptr);
+    }
+    _set_new_handler(NULL);
+  }
+}
+#endif
+
+TEST(SecurityTest, MALLOC_OVERFLOW_TEST(MemoryAllocationRestrictionsNewArray)) {
   if (!IsTcMallocBypassed()) {
     scoped_ptr<char[]> ptr(
         HideValueFromCompiler(new (nothrow) char[kTooBigAllocSize]));
     ASSERT_TRUE(!ptr);
   }
 }
 
 // The tests bellow check for overflows in new[] and calloc().
 
 // There are platforms where these tests are known to fail. We would like to
@@ skipping 82 matching lines @@
 
 #if defined(OS_LINUX) && defined(__x86_64__)
 // Check if ptr1 and ptr2 are separated by less than size chars.
 bool ArePointersToSameArea(void* ptr1, void* ptr2, size_t size) {
   ptrdiff_t ptr_diff = reinterpret_cast<char*>(std::max(ptr1, ptr2)) -
                        reinterpret_cast<char*>(std::min(ptr1, ptr2));
   return static_cast<size_t>(ptr_diff) <= size;
 }
 
 // Check if TCMalloc uses an underlying random memory allocator.
-TEST(SecurityTest, TCMALLOC_TEST(RandomMemoryAllocations)) {
+TEST(SecurityTest, MALLOC_OVERFLOW_TEST(RandomMemoryAllocations)) {
   if (IsTcMallocBypassed())
     return;
   size_t kPageSize = 4096;  // We support x86_64 only.
   // Check that malloc() returns an address that is neither the kernel's
   // un-hinted mmap area, nor the current brk() area. The first malloc() may
   // not be at a random address because TCMalloc will first exhaust any memory
   // that it has allocated early on, before starting the sophisticated
   // allocators.
   void* default_mmap_heap_address =
       mmap(0, kPageSize, PROT_READ|PROT_WRITE,
@@ skipping 29 matching lines @@
   // kRandomMask, so we use it as an additional detection mechanism.
   const uintptr_t kRandomMask = 0x3fffffffffffULL;
   bool impossible_random_address =
       reinterpret_cast<uintptr_t>(ptr.get()) & ~kRandomMask;
   EXPECT_FALSE(impossible_random_address);
 }
 
 #endif  // defined(OS_LINUX) && defined(__x86_64__)
 
 }  // namespace