Bug Summary

File:projects/compiler-rt/lib/lsan/lsan_common.cc
Warning:line 516, column 3
Called C++ object pointer is null

Annotated Source Code

1//=-- lsan_common.cc ------------------------------------------------------===//
2//
3// The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9//
10// This file is a part of LeakSanitizer.
11// Implementation of common leak checking functionality.
12//
13//===----------------------------------------------------------------------===//
14
15#include "lsan_common.h"
16
17#include "sanitizer_common/sanitizer_common.h"
18#include "sanitizer_common/sanitizer_flags.h"
19#include "sanitizer_common/sanitizer_flag_parser.h"
20#include "sanitizer_common/sanitizer_placement_new.h"
21#include "sanitizer_common/sanitizer_procmaps.h"
22#include "sanitizer_common/sanitizer_stackdepot.h"
23#include "sanitizer_common/sanitizer_stacktrace.h"
24#include "sanitizer_common/sanitizer_suppressions.h"
25#include "sanitizer_common/sanitizer_report_decorator.h"
26#include "sanitizer_common/sanitizer_tls_get_addr.h"
27
28#if CAN_SANITIZE_LEAKS1
29namespace __lsan {
30
31// This mutex is used to prevent races between DoLeakCheck and IgnoreObject, and
32// also to protect the global list of root regions.
33BlockingMutex global_mutex(LINKER_INITIALIZED);
34
35__attribute__((tls_model("initial-exec")))
36THREADLOCAL__thread int disable_counter;
37bool DisabledInThisThread() { return disable_counter > 0; }
38void DisableInThisThread() { disable_counter++; }
39void EnableInThisThread() {
40 if (!disable_counter && common_flags()->detect_leaks) {
41 Report("Unmatched call to __lsan_enable().\n");
42 Die();
43 }
44 disable_counter--;
45}
46
47Flags lsan_flags;
48
49void Flags::SetDefaults() {
50#define LSAN_FLAG(Type, Name, DefaultValue, Description) Name = DefaultValue;
51#include "lsan_flags.inc"
52#undef LSAN_FLAG
53}
54
55void RegisterLsanFlags(FlagParser *parser, Flags *f) {
56#define LSAN_FLAG(Type, Name, DefaultValue, Description) \
57 RegisterFlag(parser, #Name, Description, &f->Name);
58#include "lsan_flags.inc"
59#undef LSAN_FLAG
60}
61
62#define LOG_POINTERS(...)do { if (flags()->log_pointers) Report(...); } while (0); \
63 do { \
64 if (flags()->log_pointers) Report(__VA_ARGS__); \
65 } while (0);
66
67#define LOG_THREADS(...)do { if (flags()->log_threads) Report(...); } while (0); \
68 do { \
69 if (flags()->log_threads) Report(__VA_ARGS__); \
70 } while (0);
71
72ALIGNED(64)__attribute__((aligned(64))) static char suppression_placeholder[sizeof(SuppressionContext)];
73static SuppressionContext *suppression_ctx = nullptr;
74static const char kSuppressionLeak[] = "leak";
75static const char *kSuppressionTypes[] = { kSuppressionLeak };
76
77void InitializeSuppressions() {
78 CHECK_EQ(nullptr, suppression_ctx)do { __sanitizer::u64 v1 = (u64)((nullptr)); __sanitizer::u64
v2 = (u64)((suppression_ctx)); if (__builtin_expect(!!(!(v1 ==
v2)), 0)) __sanitizer::CheckFailed("/tmp/buildd/llvm-toolchain-snapshot-4.0~svn290870/projects/compiler-rt/lib/lsan/lsan_common.cc"
, 78, "(" "(nullptr)" ") " "==" " (" "(suppression_ctx)" ")",
v1, v2); } while (false)
;
79 suppression_ctx = new (suppression_placeholder) // NOLINT
80 SuppressionContext(kSuppressionTypes, ARRAY_SIZE(kSuppressionTypes)(sizeof(kSuppressionTypes)/sizeof((kSuppressionTypes)[0])));
81 suppression_ctx->ParseFromFile(flags()->suppressions);
82 if (&__lsan_default_suppressions)
83 suppression_ctx->Parse(__lsan_default_suppressions());
84}
85
86static SuppressionContext *GetSuppressionContext() {
87 CHECK(suppression_ctx)do { __sanitizer::u64 v1 = (u64)((suppression_ctx)); __sanitizer
::u64 v2 = (u64)(0); if (__builtin_expect(!!(!(v1 != v2)), 0)
) __sanitizer::CheckFailed("/tmp/buildd/llvm-toolchain-snapshot-4.0~svn290870/projects/compiler-rt/lib/lsan/lsan_common.cc"
, 87, "(" "(suppression_ctx)" ") " "!=" " (" "0" ")", v1, v2)
; } while (false)
;
88 return suppression_ctx;
89}
90
91struct RootRegion {
92 const void *begin;
93 uptr size;
94};
95
96InternalMmapVector<RootRegion> *root_regions;
97
98void InitializeRootRegions() {
99 CHECK(!root_regions)do { __sanitizer::u64 v1 = (u64)((!root_regions)); __sanitizer
::u64 v2 = (u64)(0); if (__builtin_expect(!!(!(v1 != v2)), 0)
) __sanitizer::CheckFailed("/tmp/buildd/llvm-toolchain-snapshot-4.0~svn290870/projects/compiler-rt/lib/lsan/lsan_common.cc"
, 99, "(" "(!root_regions)" ") " "!=" " (" "0" ")", v1, v2); }
while (false)
;
100 ALIGNED(64)__attribute__((aligned(64))) static char placeholder[sizeof(InternalMmapVector<RootRegion>)];
101 root_regions = new(placeholder) InternalMmapVector<RootRegion>(1);
102}
103
104void InitCommonLsan() {
105 InitializeRootRegions();
106 if (common_flags()->detect_leaks) {
107 // Initialization which can fail or print warnings should only be done if
108 // LSan is actually enabled.
109 InitializeSuppressions();
110 InitializePlatformSpecificModules();
111 }
112}
113
114class Decorator: public __sanitizer::SanitizerCommonDecorator {
115 public:
116 Decorator() : SanitizerCommonDecorator() { }
117 const char *Error() { return Red(); }
118 const char *Leak() { return Blue(); }
119 const char *End() { return Default(); }
120};
121
122static inline bool CanBeAHeapPointer(uptr p) {
123 // Since our heap is located in mmap-ed memory, we can assume a sensible lower
124 // bound on heap addresses.
125 const uptr kMinAddress = 4 * 4096;
126 if (p < kMinAddress) return false;
127#if defined(__x86_64__1)
128 // Accept only canonical form user-space addresses.
129 return ((p >> 47) == 0);
130#elif defined(__mips64)
131 return ((p >> 40) == 0);
132#elif defined(__aarch64__)
133 unsigned runtimeVMA =
134 (MostSignificantSetBitIndex(GET_CURRENT_FRAME()(uptr)__builtin_frame_address(0)) + 1);
135 return ((p >> runtimeVMA) == 0);
136#else
137 return true;
138#endif
139}
140
141// Scans the memory range, looking for byte patterns that point into allocator
142// chunks. Marks those chunks with |tag| and adds them to |frontier|.
143// There are two usage modes for this function: finding reachable chunks
144// (|tag| = kReachable) and finding indirectly leaked chunks
145// (|tag| = kIndirectlyLeaked). In the second case, there's no flood fill,
146// so |frontier| = 0.
147void ScanRangeForPointers(uptr begin, uptr end,
148 Frontier *frontier,
149 const char *region_type, ChunkTag tag) {
150 CHECK(tag == kReachable || tag == kIndirectlyLeaked)do { __sanitizer::u64 v1 = (u64)((tag == kReachable || tag ==
kIndirectlyLeaked)); __sanitizer::u64 v2 = (u64)(0); if (__builtin_expect
(!!(!(v1 != v2)), 0)) __sanitizer::CheckFailed("/tmp/buildd/llvm-toolchain-snapshot-4.0~svn290870/projects/compiler-rt/lib/lsan/lsan_common.cc"
, 150, "(" "(tag == kReachable || tag == kIndirectlyLeaked)" ") "
"!=" " (" "0" ")", v1, v2); } while (false)
;
151 const uptr alignment = flags()->pointer_alignment();
152 LOG_POINTERS("Scanning %s range %p-%p.\n", region_type, begin, end)do { if (flags()->log_pointers) Report("Scanning %s range %p-%p.\n"
, region_type, begin, end); } while (0);
;
153 uptr pp = begin;
154 if (pp % alignment)
155 pp = pp + alignment - pp % alignment;
156 for (; pp + sizeof(void *) <= end; pp += alignment) { // NOLINT
157 void *p = *reinterpret_cast<void **>(pp);
158 if (!CanBeAHeapPointer(reinterpret_cast<uptr>(p))) continue;
159 uptr chunk = PointsIntoChunk(p);
160 if (!chunk) continue;
161 // Pointers to self don't count. This matters when tag == kIndirectlyLeaked.
162 if (chunk == begin) continue;
163 LsanMetadata m(chunk);
164 if (m.tag() == kReachable || m.tag() == kIgnored) continue;
165
166 // Do this check relatively late so we can log only the interesting cases.
167 if (!flags()->use_poisoned && WordIsPoisoned(pp)) {
168 LOG_POINTERS(do { if (flags()->log_pointers) Report("%p is poisoned: ignoring %p pointing into chunk %p-%p of size "
"%zu.\n", pp, p, chunk, chunk + m.requested_size(), m.requested_size
()); } while (0);
169 "%p is poisoned: ignoring %p pointing into chunk %p-%p of size "do { if (flags()->log_pointers) Report("%p is poisoned: ignoring %p pointing into chunk %p-%p of size "
"%zu.\n", pp, p, chunk, chunk + m.requested_size(), m.requested_size
()); } while (0);
170 "%zu.\n",do { if (flags()->log_pointers) Report("%p is poisoned: ignoring %p pointing into chunk %p-%p of size "
"%zu.\n", pp, p, chunk, chunk + m.requested_size(), m.requested_size
()); } while (0);
171 pp, p, chunk, chunk + m.requested_size(), m.requested_size())do { if (flags()->log_pointers) Report("%p is poisoned: ignoring %p pointing into chunk %p-%p of size "
"%zu.\n", pp, p, chunk, chunk + m.requested_size(), m.requested_size
()); } while (0);
;
172 continue;
173 }
174
175 m.set_tag(tag);
176 LOG_POINTERS("%p: found %p pointing into chunk %p-%p of size %zu.\n", pp, p,do { if (flags()->log_pointers) Report("%p: found %p pointing into chunk %p-%p of size %zu.\n"
, pp, p, chunk, chunk + m.requested_size(), m.requested_size(
)); } while (0);
177 chunk, chunk + m.requested_size(), m.requested_size())do { if (flags()->log_pointers) Report("%p: found %p pointing into chunk %p-%p of size %zu.\n"
, pp, p, chunk, chunk + m.requested_size(), m.requested_size(
)); } while (0);
;
178 if (frontier)
179 frontier->push_back(chunk);
180 }
181}
182
183void ForEachExtraStackRangeCb(uptr begin, uptr end, void* arg) {
184 Frontier *frontier = reinterpret_cast<Frontier *>(arg);
185 ScanRangeForPointers(begin, end, frontier, "FAKE STACK", kReachable);
186}
187
188// Scans thread data (stacks and TLS) for heap pointers.
189static void ProcessThreads(SuspendedThreadsList const &suspended_threads,
190 Frontier *frontier) {
191 InternalScopedBuffer<uptr> registers(SuspendedThreadsList::RegisterCount());
192 uptr registers_begin = reinterpret_cast<uptr>(registers.data());
193 uptr registers_end = registers_begin + registers.size();
194 for (uptr i = 0; i < suspended_threads.thread_count(); i++) {
195 uptr os_id = static_cast<uptr>(suspended_threads.GetThreadID(i));
196 LOG_THREADS("Processing thread %d.\n", os_id)do { if (flags()->log_threads) Report("Processing thread %d.\n"
, os_id); } while (0);
;
197 uptr stack_begin, stack_end, tls_begin, tls_end, cache_begin, cache_end;
198 DTLS *dtls;
199 bool thread_found = GetThreadRangesLocked(os_id, &stack_begin, &stack_end,
200 &tls_begin, &tls_end,
201 &cache_begin, &cache_end, &dtls);
202 if (!thread_found) {
203 // If a thread can't be found in the thread registry, it's probably in the
204 // process of destruction. Log this event and move on.
205 LOG_THREADS("Thread %d not found in registry.\n", os_id)do { if (flags()->log_threads) Report("Thread %d not found in registry.\n"
, os_id); } while (0);
;
206 continue;
207 }
208 uptr sp;
209 bool have_registers =
210 (suspended_threads.GetRegistersAndSP(i, registers.data(), &sp) == 0);
211 if (!have_registers) {
212 Report("Unable to get registers from thread %d.\n");
213 // If unable to get SP, consider the entire stack to be reachable.
214 sp = stack_begin;
215 }
216
217 if (flags()->use_registers && have_registers)
218 ScanRangeForPointers(registers_begin, registers_end, frontier,
219 "REGISTERS", kReachable);
220
221 if (flags()->use_stacks) {
222 LOG_THREADS("Stack at %p-%p (SP = %p).\n", stack_begin, stack_end, sp)do { if (flags()->log_threads) Report("Stack at %p-%p (SP = %p).\n"
, stack_begin, stack_end, sp); } while (0);
;
223 if (sp < stack_begin || sp >= stack_end) {
224 // SP is outside the recorded stack range (e.g. the thread is running a
225 // signal handler on alternate stack, or swapcontext was used).
226 // Again, consider the entire stack range to be reachable.
227 LOG_THREADS("WARNING: stack pointer not in stack range.\n")do { if (flags()->log_threads) Report("WARNING: stack pointer not in stack range.\n"
); } while (0);
;
228 uptr page_size = GetPageSizeCached();
229 int skipped = 0;
230 while (stack_begin < stack_end &&
231 !IsAccessibleMemoryRange(stack_begin, 1)) {
232 skipped++;
233 stack_begin += page_size;
234 }
235 LOG_THREADS("Skipped %d guard page(s) to obtain stack %p-%p.\n",do { if (flags()->log_threads) Report("Skipped %d guard page(s) to obtain stack %p-%p.\n"
, skipped, stack_begin, stack_end); } while (0);
236 skipped, stack_begin, stack_end)do { if (flags()->log_threads) Report("Skipped %d guard page(s) to obtain stack %p-%p.\n"
, skipped, stack_begin, stack_end); } while (0);
;
237 } else {
238 // Shrink the stack range to ignore out-of-scope values.
239 stack_begin = sp;
240 }
241 ScanRangeForPointers(stack_begin, stack_end, frontier, "STACK",
242 kReachable);
243 ForEachExtraStackRange(os_id, ForEachExtraStackRangeCb, frontier);
244 }
245
246 if (flags()->use_tls) {
247 LOG_THREADS("TLS at %p-%p.\n", tls_begin, tls_end)do { if (flags()->log_threads) Report("TLS at %p-%p.\n", tls_begin
, tls_end); } while (0);
;
248 if (cache_begin == cache_end) {
249 ScanRangeForPointers(tls_begin, tls_end, frontier, "TLS", kReachable);
250 } else {
251 // Because LSan should not be loaded with dlopen(), we can assume
252 // that allocator cache will be part of static TLS image.
253 CHECK_LE(tls_begin, cache_begin)do { __sanitizer::u64 v1 = (u64)((tls_begin)); __sanitizer::u64
v2 = (u64)((cache_begin)); if (__builtin_expect(!!(!(v1 <=
v2)), 0)) __sanitizer::CheckFailed("/tmp/buildd/llvm-toolchain-snapshot-4.0~svn290870/projects/compiler-rt/lib/lsan/lsan_common.cc"
, 253, "(" "(tls_begin)" ") " "<=" " (" "(cache_begin)" ")"
, v1, v2); } while (false)
;
254 CHECK_GE(tls_end, cache_end)do { __sanitizer::u64 v1 = (u64)((tls_end)); __sanitizer::u64
v2 = (u64)((cache_end)); if (__builtin_expect(!!(!(v1 >= v2
)), 0)) __sanitizer::CheckFailed("/tmp/buildd/llvm-toolchain-snapshot-4.0~svn290870/projects/compiler-rt/lib/lsan/lsan_common.cc"
, 254, "(" "(tls_end)" ") " ">=" " (" "(cache_end)" ")", v1
, v2); } while (false)
;
255 if (tls_begin < cache_begin)
256 ScanRangeForPointers(tls_begin, cache_begin, frontier, "TLS",
257 kReachable);
258 if (tls_end > cache_end)
259 ScanRangeForPointers(cache_end, tls_end, frontier, "TLS", kReachable);
260 }
261 if (dtls) {
262 for (uptr j = 0; j < dtls->dtv_size; ++j) {
263 uptr dtls_beg = dtls->dtv[j].beg;
264 uptr dtls_end = dtls_beg + dtls->dtv[j].size;
265 if (dtls_beg < dtls_end) {
266 LOG_THREADS("DTLS %zu at %p-%p.\n", j, dtls_beg, dtls_end)do { if (flags()->log_threads) Report("DTLS %zu at %p-%p.\n"
, j, dtls_beg, dtls_end); } while (0);
;
267 ScanRangeForPointers(dtls_beg, dtls_end, frontier, "DTLS",
268 kReachable);
269 }
270 }
271 }
272 }
273 }
274}
275
276static void ProcessRootRegion(Frontier *frontier, uptr root_begin,
277 uptr root_end) {
278 MemoryMappingLayout proc_maps(/*cache_enabled*/true);
279 uptr begin, end, prot;
280 while (proc_maps.Next(&begin, &end,
281 /*offset*/ nullptr, /*filename*/ nullptr,
282 /*filename_size*/ 0, &prot)) {
283 uptr intersection_begin = Max(root_begin, begin);
284 uptr intersection_end = Min(end, root_end);
285 if (intersection_begin >= intersection_end) continue;
286 bool is_readable = prot & MemoryMappingLayout::kProtectionRead;
287 LOG_POINTERS("Root region %p-%p intersects with mapped region %p-%p (%s)\n",do { if (flags()->log_pointers) Report("Root region %p-%p intersects with mapped region %p-%p (%s)\n"
, root_begin, root_end, begin, end, is_readable ? "readable" :
"unreadable"); } while (0);
288 root_begin, root_end, begin, end,do { if (flags()->log_pointers) Report("Root region %p-%p intersects with mapped region %p-%p (%s)\n"
, root_begin, root_end, begin, end, is_readable ? "readable" :
"unreadable"); } while (0);
289 is_readable ? "readable" : "unreadable")do { if (flags()->log_pointers) Report("Root region %p-%p intersects with mapped region %p-%p (%s)\n"
, root_begin, root_end, begin, end, is_readable ? "readable" :
"unreadable"); } while (0);
;
290 if (is_readable)
291 ScanRangeForPointers(intersection_begin, intersection_end, frontier,
292 "ROOT", kReachable);
293 }
294}
295
296// Scans root regions for heap pointers.
297static void ProcessRootRegions(Frontier *frontier) {
298 if (!flags()->use_root_regions) return;
299 CHECK(root_regions)do { __sanitizer::u64 v1 = (u64)((root_regions)); __sanitizer
::u64 v2 = (u64)(0); if (__builtin_expect(!!(!(v1 != v2)), 0)
) __sanitizer::CheckFailed("/tmp/buildd/llvm-toolchain-snapshot-4.0~svn290870/projects/compiler-rt/lib/lsan/lsan_common.cc"
, 299, "(" "(root_regions)" ") " "!=" " (" "0" ")", v1, v2); }
while (false)
;
300 for (uptr i = 0; i < root_regions->size(); i++) {
301 RootRegion region = (*root_regions)[i];
302 uptr begin_addr = reinterpret_cast<uptr>(region.begin);
303 ProcessRootRegion(frontier, begin_addr, begin_addr + region.size);
304 }
305}
306
307static void FloodFillTag(Frontier *frontier, ChunkTag tag) {
308 while (frontier->size()) {
309 uptr next_chunk = frontier->back();
310 frontier->pop_back();
311 LsanMetadata m(next_chunk);
312 ScanRangeForPointers(next_chunk, next_chunk + m.requested_size(), frontier,
313 "HEAP", tag);
314 }
315}
316
317// ForEachChunk callback. If the chunk is marked as leaked, marks all chunks
318// which are reachable from it as indirectly leaked.
319static void MarkIndirectlyLeakedCb(uptr chunk, void *arg) {
320 chunk = GetUserBegin(chunk);
321 LsanMetadata m(chunk);
322 if (m.allocated() && m.tag() != kReachable) {
323 ScanRangeForPointers(chunk, chunk + m.requested_size(),
324 /* frontier */ nullptr, "HEAP", kIndirectlyLeaked);
325 }
326}
327
328// ForEachChunk callback. If chunk is marked as ignored, adds its address to
329// frontier.
330static void CollectIgnoredCb(uptr chunk, void *arg) {
331 CHECK(arg)do { __sanitizer::u64 v1 = (u64)((arg)); __sanitizer::u64 v2 =
(u64)(0); if (__builtin_expect(!!(!(v1 != v2)), 0)) __sanitizer
::CheckFailed("/tmp/buildd/llvm-toolchain-snapshot-4.0~svn290870/projects/compiler-rt/lib/lsan/lsan_common.cc"
, 331, "(" "(arg)" ") " "!=" " (" "0" ")", v1, v2); } while (
false)
;
332 chunk = GetUserBegin(chunk);
333 LsanMetadata m(chunk);
334 if (m.allocated() && m.tag() == kIgnored) {
335 LOG_POINTERS("Ignored: chunk %p-%p of size %zu.\n",do { if (flags()->log_pointers) Report("Ignored: chunk %p-%p of size %zu.\n"
, chunk, chunk + m.requested_size(), m.requested_size()); } while
(0);
336 chunk, chunk + m.requested_size(), m.requested_size())do { if (flags()->log_pointers) Report("Ignored: chunk %p-%p of size %zu.\n"
, chunk, chunk + m.requested_size(), m.requested_size()); } while
(0);
;
337 reinterpret_cast<Frontier *>(arg)->push_back(chunk);
338 }
339}
340
341// Sets the appropriate tag on each chunk.
342static void ClassifyAllChunks(SuspendedThreadsList const &suspended_threads) {
343 // Holds the flood fill frontier.
344 Frontier frontier(1);
345
346 ForEachChunk(CollectIgnoredCb, &frontier);
347 ProcessGlobalRegions(&frontier);
348 ProcessThreads(suspended_threads, &frontier);
349 ProcessRootRegions(&frontier);
350 FloodFillTag(&frontier, kReachable);
351
352 // The check here is relatively expensive, so we do this in a separate flood
353 // fill. That way we can skip the check for chunks that are reachable
354 // otherwise.
355 LOG_POINTERS("Processing platform-specific allocations.\n")do { if (flags()->log_pointers) Report("Processing platform-specific allocations.\n"
); } while (0);
;
356 CHECK_EQ(0, frontier.size())do { __sanitizer::u64 v1 = (u64)((0)); __sanitizer::u64 v2 = (
u64)((frontier.size())); if (__builtin_expect(!!(!(v1 == v2))
, 0)) __sanitizer::CheckFailed("/tmp/buildd/llvm-toolchain-snapshot-4.0~svn290870/projects/compiler-rt/lib/lsan/lsan_common.cc"
, 356, "(" "(0)" ") " "==" " (" "(frontier.size())" ")", v1, v2
); } while (false)
;
357 ProcessPlatformSpecificAllocations(&frontier);
358 FloodFillTag(&frontier, kReachable);
359
360 // Iterate over leaked chunks and mark those that are reachable from other
361 // leaked chunks.
362 LOG_POINTERS("Scanning leaked chunks.\n")do { if (flags()->log_pointers) Report("Scanning leaked chunks.\n"
); } while (0);
;
363 ForEachChunk(MarkIndirectlyLeakedCb, nullptr);
364}
365
366// ForEachChunk callback. Resets the tags to pre-leak-check state.
367static void ResetTagsCb(uptr chunk, void *arg) {
368 (void)arg;
369 chunk = GetUserBegin(chunk);
370 LsanMetadata m(chunk);
371 if (m.allocated() && m.tag() != kIgnored)
372 m.set_tag(kDirectlyLeaked);
373}
374
375static void PrintStackTraceById(u32 stack_trace_id) {
376 CHECK(stack_trace_id)do { __sanitizer::u64 v1 = (u64)((stack_trace_id)); __sanitizer
::u64 v2 = (u64)(0); if (__builtin_expect(!!(!(v1 != v2)), 0)
) __sanitizer::CheckFailed("/tmp/buildd/llvm-toolchain-snapshot-4.0~svn290870/projects/compiler-rt/lib/lsan/lsan_common.cc"
, 376, "(" "(stack_trace_id)" ") " "!=" " (" "0" ")", v1, v2)
; } while (false)
;
377 StackDepotGet(stack_trace_id).Print();
378}
379
380// ForEachChunk callback. Aggregates information about unreachable chunks into
381// a LeakReport.
382static void CollectLeaksCb(uptr chunk, void *arg) {
383 CHECK(arg)do { __sanitizer::u64 v1 = (u64)((arg)); __sanitizer::u64 v2 =
(u64)(0); if (__builtin_expect(!!(!(v1 != v2)), 0)) __sanitizer
::CheckFailed("/tmp/buildd/llvm-toolchain-snapshot-4.0~svn290870/projects/compiler-rt/lib/lsan/lsan_common.cc"
, 383, "(" "(arg)" ") " "!=" " (" "0" ")", v1, v2); } while (
false)
;
384 LeakReport *leak_report = reinterpret_cast<LeakReport *>(arg);
385 chunk = GetUserBegin(chunk);
386 LsanMetadata m(chunk);
387 if (!m.allocated()) return;
388 if (m.tag() == kDirectlyLeaked || m.tag() == kIndirectlyLeaked) {
389 u32 resolution = flags()->resolution;
390 u32 stack_trace_id = 0;
391 if (resolution > 0) {
392 StackTrace stack = StackDepotGet(m.stack_trace_id());
393 stack.size = Min(stack.size, resolution);
394 stack_trace_id = StackDepotPut(stack);
395 } else {
396 stack_trace_id = m.stack_trace_id();
397 }
398 leak_report->AddLeakedChunk(chunk, stack_trace_id, m.requested_size(),
399 m.tag());
400 }
401}
402
403static void PrintMatchedSuppressions() {
404 InternalMmapVector<Suppression *> matched(1);
405 GetSuppressionContext()->GetMatched(&matched);
406 if (!matched.size())
407 return;
408 const char *line = "-----------------------------------------------------";
409 Printf("%s\n", line);
410 Printf("Suppressions used:\n");
411 Printf(" count bytes template\n");
412 for (uptr i = 0; i < matched.size(); i++)
413 Printf("%7zu %10zu %s\n", static_cast<uptr>(atomic_load_relaxed(
414 &matched[i]->hit_count)), matched[i]->weight, matched[i]->templ);
415 Printf("%s\n\n", line);
416}
417
418struct CheckForLeaksParam {
419 bool success;
420 LeakReport leak_report;
421};
422
423static void CheckForLeaksCallback(const SuspendedThreadsList &suspended_threads,
424 void *arg) {
425 CheckForLeaksParam *param = reinterpret_cast<CheckForLeaksParam *>(arg);
426 CHECK(param)do { __sanitizer::u64 v1 = (u64)((param)); __sanitizer::u64 v2
= (u64)(0); if (__builtin_expect(!!(!(v1 != v2)), 0)) __sanitizer
::CheckFailed("/tmp/buildd/llvm-toolchain-snapshot-4.0~svn290870/projects/compiler-rt/lib/lsan/lsan_common.cc"
, 426, "(" "(param)" ") " "!=" " (" "0" ")", v1, v2); } while
(false)
;
427 CHECK(!param->success)do { __sanitizer::u64 v1 = (u64)((!param->success)); __sanitizer
::u64 v2 = (u64)(0); if (__builtin_expect(!!(!(v1 != v2)), 0)
) __sanitizer::CheckFailed("/tmp/buildd/llvm-toolchain-snapshot-4.0~svn290870/projects/compiler-rt/lib/lsan/lsan_common.cc"
, 427, "(" "(!param->success)" ") " "!=" " (" "0" ")", v1,
v2); } while (false)
;
428 ClassifyAllChunks(suspended_threads);
429 ForEachChunk(CollectLeaksCb, &param->leak_report);
430 // Clean up for subsequent leak checks. This assumes we did not overwrite any
431 // kIgnored tags.
432 ForEachChunk(ResetTagsCb, nullptr);
433 param->success = true;
434}
435
436static bool CheckForLeaks() {
437 if (&__lsan_is_turned_off && __lsan_is_turned_off())
438 return false;
439 EnsureMainThreadIDIsCorrect();
440 CheckForLeaksParam param;
441 param.success = false;
442 LockThreadRegistry();
443 LockAllocator();
444 DoStopTheWorld(CheckForLeaksCallback, &param);
445 UnlockAllocator();
446 UnlockThreadRegistry();
447
448 if (!param.success) {
449 Report("LeakSanitizer has encountered a fatal error.\n");
450 Report(
451 "HINT: For debugging, try setting environment variable "
452 "LSAN_OPTIONS=verbosity=1:log_threads=1\n");
453 Report(
454 "HINT: LeakSanitizer does not work under ptrace (strace, gdb, etc)\n");
455 Die();
456 }
457 param.leak_report.ApplySuppressions();
458 uptr unsuppressed_count = param.leak_report.UnsuppressedLeakCount();
459 if (unsuppressed_count > 0) {
460 Decorator d;
461 Printf("\n"
462 "================================================================="
463 "\n");
464 Printf("%s", d.Error());
465 Report("ERROR: LeakSanitizer: detected memory leaks\n");
466 Printf("%s", d.End());
467 param.leak_report.ReportTopLeaks(flags()->max_leaks);
468 }
469 if (common_flags()->print_suppressions)
470 PrintMatchedSuppressions();
471 if (unsuppressed_count > 0) {
472 param.leak_report.PrintSummary();
473 return true;
474 }
475 return false;
476}
477
478void DoLeakCheck() {
479 BlockingMutexLock l(&global_mutex);
480 static bool already_done;
481 if (already_done) return;
482 already_done = true;
483 bool have_leaks = CheckForLeaks();
484 if (!have_leaks) {
485 return;
486 }
487 if (common_flags()->exitcode) {
488 Die();
489 }
490}
491
492static int DoRecoverableLeakCheck() {
493 BlockingMutexLock l(&global_mutex);
494 bool have_leaks = CheckForLeaks();
495 return have_leaks ? 1 : 0;
496}
497
498static Suppression *GetSuppressionForAddr(uptr addr) {
499 Suppression *s = nullptr;
500
501 // Suppress by module name.
502 SuppressionContext *suppressions = GetSuppressionContext();
503 if (const char *module_name =
1
Taking false branch
504 Symbolizer::GetOrInit()->GetModuleNameForPc(addr))
505 if (suppressions->Match(module_name, kSuppressionLeak, &s))
506 return s;
507
508 // Suppress by file or function name.
509 SymbolizedStack *frames = Symbolizer::GetOrInit()->SymbolizePC(addr);
2
'frames' initialized here
510 for (SymbolizedStack *cur = frames; cur; cur = cur->next) {
3
Assuming pointer value is null
4
Loop condition is false. Execution continues on line 516
511 if (suppressions->Match(cur->info.function, kSuppressionLeak, &s) ||
512 suppressions->Match(cur->info.file, kSuppressionLeak, &s)) {
513 break;
514 }
515 }
516 frames->ClearAll();
5
Called C++ object pointer is null
517 return s;
518}
519
520static Suppression *GetSuppressionForStack(u32 stack_trace_id) {
521 StackTrace stack = StackDepotGet(stack_trace_id);
522 for (uptr i = 0; i < stack.size; i++) {
523 Suppression *s = GetSuppressionForAddr(
524 StackTrace::GetPreviousInstructionPc(stack.trace[i]));
525 if (s) return s;
526 }
527 return nullptr;
528}
529
530///// LeakReport implementation. /////
531
532// A hard limit on the number of distinct leaks, to avoid quadratic complexity
533// in LeakReport::AddLeakedChunk(). We don't expect to ever see this many leaks
534// in real-world applications.
535// FIXME: Get rid of this limit by changing the implementation of LeakReport to
536// use a hash table.
537const uptr kMaxLeaksConsidered = 5000;
538
539void LeakReport::AddLeakedChunk(uptr chunk, u32 stack_trace_id,
540 uptr leaked_size, ChunkTag tag) {
541 CHECK(tag == kDirectlyLeaked || tag == kIndirectlyLeaked)do { __sanitizer::u64 v1 = (u64)((tag == kDirectlyLeaked || tag
== kIndirectlyLeaked)); __sanitizer::u64 v2 = (u64)(0); if (
__builtin_expect(!!(!(v1 != v2)), 0)) __sanitizer::CheckFailed
("/tmp/buildd/llvm-toolchain-snapshot-4.0~svn290870/projects/compiler-rt/lib/lsan/lsan_common.cc"
, 541, "(" "(tag == kDirectlyLeaked || tag == kIndirectlyLeaked)"
") " "!=" " (" "0" ")", v1, v2); } while (false)
;
542 bool is_directly_leaked = (tag == kDirectlyLeaked);
543 uptr i;
544 for (i = 0; i < leaks_.size(); i++) {
545 if (leaks_[i].stack_trace_id == stack_trace_id &&
546 leaks_[i].is_directly_leaked == is_directly_leaked) {
547 leaks_[i].hit_count++;
548 leaks_[i].total_size += leaked_size;
549 break;
550 }
551 }
552 if (i == leaks_.size()) {
553 if (leaks_.size() == kMaxLeaksConsidered) return;
554 Leak leak = { next_id_++, /* hit_count */ 1, leaked_size, stack_trace_id,
555 is_directly_leaked, /* is_suppressed */ false };
556 leaks_.push_back(leak);
557 }
558 if (flags()->report_objects) {
559 LeakedObject obj = {leaks_[i].id, chunk, leaked_size};
560 leaked_objects_.push_back(obj);
561 }
562}
563
564static bool LeakComparator(const Leak &leak1, const Leak &leak2) {
565 if (leak1.is_directly_leaked == leak2.is_directly_leaked)
566 return leak1.total_size > leak2.total_size;
567 else
568 return leak1.is_directly_leaked;
569}
570
571void LeakReport::ReportTopLeaks(uptr num_leaks_to_report) {
572 CHECK(leaks_.size() <= kMaxLeaksConsidered)do { __sanitizer::u64 v1 = (u64)((leaks_.size() <= kMaxLeaksConsidered
)); __sanitizer::u64 v2 = (u64)(0); if (__builtin_expect(!!(!
(v1 != v2)), 0)) __sanitizer::CheckFailed("/tmp/buildd/llvm-toolchain-snapshot-4.0~svn290870/projects/compiler-rt/lib/lsan/lsan_common.cc"
, 572, "(" "(leaks_.size() <= kMaxLeaksConsidered)" ") " "!="
" (" "0" ")", v1, v2); } while (false)
;
573 Printf("\n");
574 if (leaks_.size() == kMaxLeaksConsidered)
575 Printf("Too many leaks! Only the first %zu leaks encountered will be "
576 "reported.\n",
577 kMaxLeaksConsidered);
578
579 uptr unsuppressed_count = UnsuppressedLeakCount();
580 if (num_leaks_to_report > 0 && num_leaks_to_report < unsuppressed_count)
581 Printf("The %zu top leak(s):\n", num_leaks_to_report);
582 InternalSort(&leaks_, leaks_.size(), LeakComparator);
583 uptr leaks_reported = 0;
584 for (uptr i = 0; i < leaks_.size(); i++) {
585 if (leaks_[i].is_suppressed) continue;
586 PrintReportForLeak(i);
587 leaks_reported++;
588 if (leaks_reported == num_leaks_to_report) break;
589 }
590 if (leaks_reported < unsuppressed_count) {
591 uptr remaining = unsuppressed_count - leaks_reported;
592 Printf("Omitting %zu more leak(s).\n", remaining);
593 }
594}
595
596void LeakReport::PrintReportForLeak(uptr index) {
597 Decorator d;
598 Printf("%s", d.Leak());
599 Printf("%s leak of %zu byte(s) in %zu object(s) allocated from:\n",
600 leaks_[index].is_directly_leaked ? "Direct" : "Indirect",
601 leaks_[index].total_size, leaks_[index].hit_count);
602 Printf("%s", d.End());
603
604 PrintStackTraceById(leaks_[index].stack_trace_id);
605
606 if (flags()->report_objects) {
607 Printf("Objects leaked above:\n");
608 PrintLeakedObjectsForLeak(index);
609 Printf("\n");
610 }
611}
612
613void LeakReport::PrintLeakedObjectsForLeak(uptr index) {
614 u32 leak_id = leaks_[index].id;
615 for (uptr j = 0; j < leaked_objects_.size(); j++) {
616 if (leaked_objects_[j].leak_id == leak_id)
617 Printf("%p (%zu bytes)\n", leaked_objects_[j].addr,
618 leaked_objects_[j].size);
619 }
620}
621
622void LeakReport::PrintSummary() {
623 CHECK(leaks_.size() <= kMaxLeaksConsidered)do { __sanitizer::u64 v1 = (u64)((leaks_.size() <= kMaxLeaksConsidered
)); __sanitizer::u64 v2 = (u64)(0); if (__builtin_expect(!!(!
(v1 != v2)), 0)) __sanitizer::CheckFailed("/tmp/buildd/llvm-toolchain-snapshot-4.0~svn290870/projects/compiler-rt/lib/lsan/lsan_common.cc"
, 623, "(" "(leaks_.size() <= kMaxLeaksConsidered)" ") " "!="
" (" "0" ")", v1, v2); } while (false)
;
624 uptr bytes = 0, allocations = 0;
625 for (uptr i = 0; i < leaks_.size(); i++) {
626 if (leaks_[i].is_suppressed) continue;
627 bytes += leaks_[i].total_size;
628 allocations += leaks_[i].hit_count;
629 }
630 InternalScopedString summary(kMaxSummaryLength);
631 summary.append("%zu byte(s) leaked in %zu allocation(s).", bytes,
632 allocations);
633 ReportErrorSummary(summary.data());
634}
635
636void LeakReport::ApplySuppressions() {
637 for (uptr i = 0; i < leaks_.size(); i++) {
638 Suppression *s = GetSuppressionForStack(leaks_[i].stack_trace_id);
639 if (s) {
640 s->weight += leaks_[i].total_size;
641 atomic_store_relaxed(&s->hit_count, atomic_load_relaxed(&s->hit_count) +
642 leaks_[i].hit_count);
643 leaks_[i].is_suppressed = true;
644 }
645 }
646}
647
648uptr LeakReport::UnsuppressedLeakCount() {
649 uptr result = 0;
650 for (uptr i = 0; i < leaks_.size(); i++)
651 if (!leaks_[i].is_suppressed) result++;
652 return result;
653}
654
655} // namespace __lsan
656#else // CAN_SANITIZE_LEAKS
657namespace __lsan {
658void InitCommonLsan() { }
659void DoLeakCheck() { }
660void DisableInThisThread() { }
661void EnableInThisThread() { }
662}
663#endif // CAN_SANITIZE_LEAKS
664
665using namespace __lsan; // NOLINT
666
667extern "C" {
668SANITIZER_INTERFACE_ATTRIBUTE__attribute__((visibility("default")))
669void __lsan_ignore_object(const void *p) {
670#if CAN_SANITIZE_LEAKS1
671 if (!common_flags()->detect_leaks)
672 return;
673 // Cannot use PointsIntoChunk or LsanMetadata here, since the allocator is not
674 // locked.
675 BlockingMutexLock l(&global_mutex);
676 IgnoreObjectResult res = IgnoreObjectLocked(p);
677 if (res == kIgnoreObjectInvalid)
678 VReport(1, "__lsan_ignore_object(): no heap object found at %p", p)do { if ((uptr)Verbosity() >= (1)) Report("__lsan_ignore_object(): no heap object found at %p"
, p); } while (0)
;
679 if (res == kIgnoreObjectAlreadyIgnored)
680 VReport(1, "__lsan_ignore_object(): "do { if ((uptr)Verbosity() >= (1)) Report("__lsan_ignore_object(): "
"heap object at %p is already being ignored\n", p); } while (
0)
681 "heap object at %p is already being ignored\n", p)do { if ((uptr)Verbosity() >= (1)) Report("__lsan_ignore_object(): "
"heap object at %p is already being ignored\n", p); } while (
0)
;
682 if (res == kIgnoreObjectSuccess)
683 VReport(1, "__lsan_ignore_object(): ignoring heap object at %p\n", p)do { if ((uptr)Verbosity() >= (1)) Report("__lsan_ignore_object(): ignoring heap object at %p\n"
, p); } while (0)
;
684#endif // CAN_SANITIZE_LEAKS
685}
686
687SANITIZER_INTERFACE_ATTRIBUTE__attribute__((visibility("default")))
688void __lsan_register_root_region(const void *begin, uptr size) {
689#if CAN_SANITIZE_LEAKS1
690 BlockingMutexLock l(&global_mutex);
691 CHECK(root_regions)do { __sanitizer::u64 v1 = (u64)((root_regions)); __sanitizer
::u64 v2 = (u64)(0); if (__builtin_expect(!!(!(v1 != v2)), 0)
) __sanitizer::CheckFailed("/tmp/buildd/llvm-toolchain-snapshot-4.0~svn290870/projects/compiler-rt/lib/lsan/lsan_common.cc"
, 691, "(" "(root_regions)" ") " "!=" " (" "0" ")", v1, v2); }
while (false)
;
692 RootRegion region = {begin, size};
693 root_regions->push_back(region);
694 VReport(1, "Registered root region at %p of size %llu\n", begin, size)do { if ((uptr)Verbosity() >= (1)) Report("Registered root region at %p of size %llu\n"
, begin, size); } while (0)
;
695#endif // CAN_SANITIZE_LEAKS
696}
697
698SANITIZER_INTERFACE_ATTRIBUTE__attribute__((visibility("default")))
699void __lsan_unregister_root_region(const void *begin, uptr size) {
700#if CAN_SANITIZE_LEAKS1
701 BlockingMutexLock l(&global_mutex);
702 CHECK(root_regions)do { __sanitizer::u64 v1 = (u64)((root_regions)); __sanitizer
::u64 v2 = (u64)(0); if (__builtin_expect(!!(!(v1 != v2)), 0)
) __sanitizer::CheckFailed("/tmp/buildd/llvm-toolchain-snapshot-4.0~svn290870/projects/compiler-rt/lib/lsan/lsan_common.cc"
, 702, "(" "(root_regions)" ") " "!=" " (" "0" ")", v1, v2); }
while (false)
;
703 bool removed = false;
704 for (uptr i = 0; i < root_regions->size(); i++) {
705 RootRegion region = (*root_regions)[i];
706 if (region.begin == begin && region.size == size) {
707 removed = true;
708 uptr last_index = root_regions->size() - 1;
709 (*root_regions)[i] = (*root_regions)[last_index];
710 root_regions->pop_back();
711 VReport(1, "Unregistered root region at %p of size %llu\n", begin, size)do { if ((uptr)Verbosity() >= (1)) Report("Unregistered root region at %p of size %llu\n"
, begin, size); } while (0)
;
712 break;
713 }
714 }
715 if (!removed) {
716 Report(
717 "__lsan_unregister_root_region(): region at %p of size %llu has not "
718 "been registered.\n",
719 begin, size);
720 Die();
721 }
722#endif // CAN_SANITIZE_LEAKS
723}
724
725SANITIZER_INTERFACE_ATTRIBUTE__attribute__((visibility("default")))
726void __lsan_disable() {
727#if CAN_SANITIZE_LEAKS1
728 __lsan::DisableInThisThread();
729#endif
730}
731
732SANITIZER_INTERFACE_ATTRIBUTE__attribute__((visibility("default")))
733void __lsan_enable() {
734#if CAN_SANITIZE_LEAKS1
735 __lsan::EnableInThisThread();
736#endif
737}
738
739SANITIZER_INTERFACE_ATTRIBUTE__attribute__((visibility("default")))
740void __lsan_do_leak_check() {
741#if CAN_SANITIZE_LEAKS1
742 if (common_flags()->detect_leaks)
743 __lsan::DoLeakCheck();
744#endif // CAN_SANITIZE_LEAKS
745}
746
747SANITIZER_INTERFACE_ATTRIBUTE__attribute__((visibility("default")))
748int __lsan_do_recoverable_leak_check() {
749#if CAN_SANITIZE_LEAKS1
750 if (common_flags()->detect_leaks)
751 return __lsan::DoRecoverableLeakCheck();
752#endif // CAN_SANITIZE_LEAKS
753 return 0;
754}
755
756#if !SANITIZER_SUPPORTS_WEAK_HOOKS1
757SANITIZER_INTERFACE_ATTRIBUTE__attribute__((visibility("default"))) SANITIZER_WEAK_ATTRIBUTE__attribute__((weak))
758int __lsan_is_turned_off() {
759 return 0;
760}
761#endif
762} // extern "C"