[compiler-rt] ASan debugging API for report info extraction and locating addresses

[kubamracek]

Summary

This patch is part of an effort to implement a more generic debugging API, as proposed in http://lists.cs.uiuc.edu/pipermail/llvmdev/2014-July/074656.html, with first part reviewed at http://reviews.llvm.org/D4466.

Now adding two new APIs:

• __asan_get_report_data which returns a 0 if no asan report happened yet, or 1 if yes and also returns the PC, BP, SP, address, access type (read/write), access size and bug description (e.g. "heap-use-after-free")

• __asan_locate_address which takes a pointer and tries to locate it, i.e. say whether it is a heap pointer, a global or a stack, or whether it's a pointer into the shadow memory. If global or stack, tries to also return the variable name, address and size. If heap, tries to return the chunk address and size.

Generally these should serve as an alternative to "asan_describe_address", which only returns all the data in text form. Having an API to get these data could allow having debugging scripts/extensions that could show additional information about a variable/expression/pointer. The idea behind having asan_get_report_data is that we could have a special lldb stop reason that could show much more information than just "EXC_BAD_ACCESS".

[kcc]

include/sanitizer/asan_interface.h

69

I don't like the interface.
You may eventually need to get other kinds of data, so you will have to change this function.
Instead, I suggest to add a set of functions like __asan_get_report_foo each of which returns just one part of report if such is known.

78

Do you need this to be a enum?
Can this be just a 'const char *' containing the description, e.g.
'stack', "heap".
BTW, this is missign at least one kind of memory: fake-stack.

lib/asan/asan_debugging.cc

46

here and below, please avoid copy-paste at all costs.
You've copied this code from DescribeAddressIfStack -- don't do it.
Instead, refactor the code so that you can call it from other places.
If possible, please send the refactoring as separate patches.

lib/asan/asan_report.cc

34

wrap these into a struct.

struct ReportData {

uptr foo;
uptr bar;

};

static ReportData report_data;

947

why did you move this here?

[glider]

include/sanitizer/asan_interface.h

69

As an alternative you can make __asan_get_report_data return the ReportData struct suggested by Kostya below.
Keep in mind you'll have to keep your LLDB scripts in sync with that struct's layout which might be less convenient than having __asan_get_report_foo for every foo.
On the other hand __asan_get_report_data is more convenient to call from the user code that includes asan_interface.h

test/asan/TestCases/debug_locate.cc

9

Please fix the includes order.

[kubamracek]

Updated the patch to address review comments. Sent a separate refactor patch, http://reviews.llvm.org/D4545, this patch depends on it.

[kubamracek]

lib/asan/asan_report.cc

947

Because ScopedInErrorReport's constructor does things where I'd like the report data to already be available. Namely, it calls __asan_on_error, which seems like the only sensible place for a breakpoint *before* the actual report is printed (I'm using it in the debug_report.cc test case).

[samsonov]

lib/asan/asan_report.cc

35

I believe this wouldn't compile on Windows :-/

248

static is not necessary

[kubamracek]

lib/asan/asan_report.cc

35

I don't have a Windows box nearby, would it be because of the member initialization or because of assignment of zero into a bool?

[kubamracek]

Update addressing review comments.

[kubamracek]

ping

[glider]

Sorry for the delay, will review tomorrow (MSK time)

[glider]

Looks mostly good.

lib/asan/asan_debugging.cc

51

Single-line comments must start with a capital letter and end with a period. Please fix here and below.

lib/asan/asan_interface_internal.h

94

Please add a comment for this family of functions.

lib/asan/asan_report.cc

35

IIUC for a non-empty ReportData the value of |already_happened| is always true. I suggest to extract it into a separate flag variable to avoid copying this meaningless value when passing ReportData around.

test/asan/TestCases/debug_report.cc

7

Please mind the order of includes.

17

nit: too much vertical whitespace in this function.

[glider]

lib/asan/asan_report.cc

994

BTW why this function returns int, not bool?

[glider]

Please disregard my question about bool.

[kcc]

1. I still see some copy-paste
2. Your patches are uploaded w/o context. Please make them with full context.

[kubamracek]

Addressing the review comments. Tried to minimize any code duplication. Added full context.

[samsonov]

lib/asan/asan_globals.cc

93–94

Can you make this function do one of the following:
(1) print the address description (what it does now) if "print" input parameter is true
(2) set __asan_global output parameter to the structure describing the global.
Then you won't need GetInfoForAddressRelativeToGlobal at all.

116

See above: passing a pack of fake parameters is ugly. Instead you can call this function in two modes:

DescrineOrGetInfoForGlobal(addr, size, /*print*/true, /*global*/nullptr);

or

Global g;
DescribeOrGetInfoForGlobal(addr, 1, /*print*/false, &g);

lib/asan/asan_report.cc

306–307

Can you use the identical strings in the output and in shadow_type variable? That is, make shadow_type equal to "shadow gap", or "high shadow", or "low shadow".

311

Consider using internal_strncpy here.

994

Why have you moved ScopedInErrorReport here?

1055

Any specific reason to not expose report_data structure layout in the interface header? This pack of functions doesn't look nice.

[kubamracek]

Any specific reason to not expose report_data structure layout in the interface header? This pack of functions doesn't look nice.

It's to make it easier to use from LLDB. When we add a new function, it's easier to check whether that symbol exists than to version this struct. See the original suggestion at http://reviews.llvm.org/D4527?id=11470#inline-37585

Why have you moved ScopedInErrorReport here?

Because ScopedInErrorReport's constructor does things where I'd like the report data to already be available. Namely, it calls __asan_on_error, which seems like the only sensible place for a breakpoint *before* the actual report is printed (I'm using it in the debug_report.cc test case). I know we have to be careful about this, but it seems to me this move should be safe (the code in between doesn't do any locks, etc.). Or is there any subtle issue due to this move?

I agree with the other comments, will submit a new patch.

Kuba

[kubamracek]

Addressing comments from review.

[samsonov]

lib/asan/asan_debugging.cc

38

internal_strncpy?

121

Consider introducing a struct for address description instead of passing quadruple (name, name_size, region_address, region_size) around. It would be much easier to modify it later. You can also add region_kind ("global", "stack" etc.) string there.

lib/asan/asan_globals.cc

93–94

This function can be static.

106

I believe output_global should always be nonnull in this case. Remove the if() and optionally add a CHECK.

lib/asan/asan_interface_internal.h

97

Don't duplicate the comments here.

lib/asan/asan_report.cc

279

This clearly belongs to asan_globals.cc

314

I guess that if print() is false, output_type should be nonnull.

986

Can you use aggregate assignment here?

report_data = { ... };

[kubamracek]

Updated patch.

Consider introducing a struct for address description instead of
passing quadruple (name, name_size, region_address, region_size)
around. It would be much easier to modify it later. You can also add
region_kind ("global", "stack" etc.) string there.

Introduced AddressDescription. However, I still kept the external interface not to use this struct, again for LLDB convenience reasons.

[samsonov]

Getting closer.

lib/asan/asan_debugging.cc

35

Why not internal_strncpy(descr->name, vars[i].name_pos, Min(descr->name_size - 1, vars[i].name_len)) ?

40

s/break/return

48

See another comment about passing AddressDescription into DescribeAddressIfShadow()

55

This should be filled by GtInfoForAddressIfGlobal

69

Consider factoring out filling heap address description into a separate routine. AsanLocateAddress would then be really straightforward.

lib/asan/asan_globals.cc

105

put CHECK() under if()

126

You can (and probably should) fill descr->region_type here.

lib/asan/asan_report.h

44

Why not pass AddressDescription here as well?

[kubamracek]

Getting closer.

Thanks for the patience :)

Why not internal_strncpy(descr->name, vars[i].name_pos, Min(descr->name_size - 1, vars[i].name_len)) ?

Because that would not write \0 after the string (we're copying just a part of the string pointed to by vars[i].name_pos). So I would have to memset the whole buffer to zero before. Should I do that, instead of the strncat? (The strncat is also used in asan_report.cc:436).

[samsonov]

In D4527#31, @kubabrecka wrote:

Getting closer.

Thanks for the patience :)

Why not internal_strncpy(descr->name, vars[i].name_pos, Min(descr->name_size - 1, vars[i].name_len)) ?

Because that would not write \0 after the string (we're copying just a part of the string pointed to by vars[i].name_pos). So I would have to memset the whole buffer to zero before. Should I do that, instead of the strncat? (The strncat is also used in asan_report.cc:436).

Right, let's keep strncat here then.

[kubamracek]

In D4527#33, @samsonov wrote:

Why not internal_strncpy(descr->name, vars[i].name_pos, Min(descr->name_size - 1, vars[i].name_len)) ?

Because that would not write \0 after the string (we're copying just a part of the string pointed to by vars[i].name_pos). So I would have to memset the whole buffer to zero before. Should I do that, instead of the strncat? (The strncat is also used in asan_report.cc:436).

Right, let's keep strncat here then.

Ok. So, are you fine with how the patch looks like now?

[samsonov]

lib/asan/asan_debugging.cc

43

what if you haven't found a stack variable? Should you still set descr->region_kind in this case?

58

Minor nit: comments seems to be redundant in this function. Also, you can reduce the amount of vertical whitespace here.

73

Rename this function to GetInfoForStackVar to make this consistent with GetInfoForAddressIfGlobal and GetInfoForHeapAddress.

lib/asan/asan_report.cc

306–307

Get rid of this variable - just put this string inside a single Printf call.

310

else if

311

else if

985

Note that report_happened might be set to true even though report_data is not yet initialized. Have you considered setting this flag inside "ScopedInErrorReport constructor? Yes, you will have no report data for other kinds of error reports, but it still seems like the right place for it.

You can also pass ReportData into ScopedInErrorReport constructor, to make sure you initialize global "report_data" exactly once, under a lock.

[kubamracek]

Addressing review comments.

[kubamracek]

Uploading patch with more context.

[samsonov]

I've got only a handful of comments left.

Kostya, are you OK with the change?

lib/asan/asan_debugging.cc

49

Do you need to at least set descr->name to empty string?

lib/asan/asan_report.cc

596

Just make nullptr default value for report.

explicit ScopedInErrorReport(ReportData *report = nullptr) {...}

test/asan/TestCases/debug_locate.cc

32

You can just use asserts instead of CHECK-lines here. It doesn't look like this test needs FileCheck.

assert(0 == strcmp(type, "global"));

[kubamracek]

Addressing review comments.

[samsonov]

LGTM (but please let Kostya sign this off).

[kcc]

Almost LGTM, sorry for delay

lib/asan/asan_debugging.cc

30

If the stack corruption is really bad we may return false here. This should be handled.

[kubamracek]

Handle the case when ParseFrameDescription returns false.

[kcc]

LGTM, thanks!

[kubamracek]

Landed in r218481, thanks for review!

[kubamracek]

Reverted in r218501 due to test failure on the sanitizer-x86_64-linux buildbot. Committed again in r218538 with a fix, intptr_t -> uintptr_t, and an extra free(heap_ptr) to fix the LeakSanitizer report. Both changes are in the test file only (debug_locate.cc).

include/sanitizer/asan_interface.h

#endif
 
   // If at least on byte in [beg, beg+size) is poisoned, return the address
   // of the first such byte. Otherwise return 0.
   void *__asan_region_is_poisoned(void *beg, size_t size);
 
   // Print the description of addr (useful when debugging in gdb).
   void __asan_describe_address(void *addr);
 
+  // Useful for calling from a debugger to get information about an ASan error.
+  // Returns 1 if an error has been (or is being) reported, otherwise returns 0.
+  int __asan_report_present();
+
+  // Useful for calling from a debugger to get information about an ASan error.
+  // If an error has been (or is being) reported, the following functions return
+  // the pc, bp, sp, address, access type (0 = read, 1 = write), access size and
+  // bug description (e.g. "heap-use-after-free"). Otherwise they return 0.
+  void *__asan_get_report_pc();
+  void *__asan_get_report_bp();
+  void *__asan_get_report_sp();
+  void *__asan_get_report_address();
+  int __asan_get_report_access_type();
+  size_t __asan_get_report_access_size();
+  const char *__asan_get_report_description();
+
+  // Useful for calling from the debugger to get information about a pointer.
+  // Returns the category of the given pointer as a constant string.
+  // Possible return values are "global", "stack", "stack-fake", "heap",
+  // "heap-invalid", "shadow-low", "shadow-gap", "shadow-high", "unknown".
+  // If global or stack, tries to also return the variable name, address and
+  // size. If heap, tries to return the chunk address and size. 'name' should
+  // point to an allocated buffer of size 'name_size'.
+  const char *__asan_locate_address(void *addr, char *name, size_t name_size,
+                                    void **region_address, size_t *region_size);
+
   // Useful for calling from the debugger to get the allocation stack trace
   // and thread ID for a heap address. Stores up to 'size' frames into 'trace',
   // returns the number of stored frames or 0 on error.
   size_t __asan_get_alloc_stack(void *addr, void **trace, size_t size,
                                 int *thread_id);
 
   // Useful for calling from the debugger to get the free stack trace
   // and thread ID for a heap address. Stores up to 'size' frames into 'trace',

lib/asan/asan_debugging.cc

 // This file contains various functions that are generally useful to call when
 // using a debugger (LLDB, GDB).
 //===----------------------------------------------------------------------===//
 
 #include "asan_allocator.h"
 #include "asan_flags.h"
 #include "asan_internal.h"
 #include "asan_mapping.h"
+#include "asan_report.h"
 #include "asan_thread.h"
 
 namespace __asan {
 
+void GetInfoForStackVar(uptr addr, AddressDescription *descr, AsanThread *t) {
+  descr->name[0] = 0;
+  descr->region_address = 0;
+  descr->region_size = 0;
+  descr->region_kind = "stack";
+
+  uptr offset = 0;
+  uptr frame_pc = 0;
+  const char *frame_descr = t->GetFrameNameByAddr(addr, &offset, &frame_pc);
+  InternalMmapVector<StackVarDescr> vars(16);
+  if (!ParseFrameDescription(frame_descr, &vars)) {
+    return;
+  }
+
+  for (uptr i = 0; i < vars.size(); i++) {
+    if (offset <= vars[i].beg + vars[i].size) {
+      internal_strncat(descr->name, vars[i].name_pos,
+                       Min(descr->name_size, vars[i].name_len));
+      descr->region_address = addr - (offset - vars[i].beg);
+      descr->region_size = vars[i].size;
+      return;
+    }
+  }
+}
+
+void GetInfoForHeapAddress(uptr addr, AddressDescription *descr) {
+  AsanChunkView chunk = FindHeapChunkByAddress(addr);
+
+  descr->name[0] = 0;
+  descr->region_address = 0;
+  descr->region_size = 0;
+
+  if (!chunk.IsValid()) {
+    descr->region_kind = "heap-invalid";
+    return;
+  }
+
+  descr->region_address = chunk.Beg();
+  descr->region_size = chunk.UsedSize();
+  descr->region_kind = "heap";
+}
+
+void AsanLocateAddress(uptr addr, AddressDescription *descr) {
+  if (DescribeAddressIfShadow(addr, descr, /* print */ false)) {
+    return;
+  }
+  if (GetInfoForAddressIfGlobal(addr, descr)) {
+    return;
+  }
+  asanThreadRegistry().Lock();
+  AsanThread *thread = FindThreadByStackAddress(addr);
+  asanThreadRegistry().Unlock();
+  if (thread) {
+    GetInfoForStackVar(addr, descr, thread);
+    return;
+  }
+  GetInfoForHeapAddress(addr, descr);
+}
+
 uptr AsanGetStack(uptr addr, uptr *trace, uptr size, u32 *thread_id,
                   bool alloc_stack) {
   AsanChunkView chunk = FindHeapChunkByAddress(addr);
   if (!chunk.IsValid()) return 0;
 
   StackTrace stack;
   if (alloc_stack) {
     if (chunk.AllocTid() == kInvalidTid) return 0;
uptr AsanGetStack(uptr addr, uptr *trace, uptr size, u32 *thread_id,
   return 0;
 }
 
 }  // namespace __asan
 
 using namespace __asan;
 
 SANITIZER_INTERFACE_ATTRIBUTE
+const char *__asan_locate_address(uptr addr, char *name, uptr name_size,
+                                  uptr *region_address, uptr *region_size) {
+  AddressDescription descr = { name, name_size, 0, 0, 0 };
+  AsanLocateAddress(addr, &descr);
+  if (region_address) *region_address = descr.region_address;
+  if (region_size) *region_size = descr.region_size;
+  return descr.region_kind;
+}
+
+SANITIZER_INTERFACE_ATTRIBUTE
 uptr __asan_get_alloc_stack(uptr addr, uptr *trace, uptr size, u32 *thread_id) {
   return AsanGetStack(addr, trace, size, thread_id, /* alloc_stack */ true);
 }
 
 SANITIZER_INTERFACE_ATTRIBUTE
 uptr __asan_get_free_stack(uptr addr, uptr *trace, uptr size, u32 *thread_id) {
   return AsanGetStack(addr, trace, size, thread_id, /* alloc_stack */ false);
 }
 
 SANITIZER_INTERFACE_ATTRIBUTE
 void __asan_get_shadow_mapping(uptr *shadow_scale, uptr *shadow_offset) {
   if (shadow_scale)
     *shadow_scale = SHADOW_SCALE;
   if (shadow_offset)
     *shadow_offset = SHADOW_OFFSET;
 }

lib/asan/asan_globals.cc

if (g.size != aligned_size) {
     FastPoisonShadowPartialRightRedzone(
         g.beg + RoundDownTo(g.size, SHADOW_GRANULARITY),
         g.size % SHADOW_GRANULARITY,
         SHADOW_GRANULARITY,
         kAsanGlobalRedzoneMagic);
   }
 }
 
+const uptr kMinimalDistanceFromAnotherGlobal = 64;
+
+bool IsAddressNearGlobal(uptr addr, const __asan_global &g) {
+  if (addr <= g.beg - kMinimalDistanceFromAnotherGlobal) return false;
+  if (addr >= g.beg + g.size_with_redzone) return false;
+  return true;
+}
+
 static void ReportGlobal(const Global &g, const char *prefix) {
   Report("%s Global[%p]: beg=%p size=%zu/%zu name=%s module=%s dyn_init=%zu\n",
          prefix, &g, (void *)g.beg, g.size, g.size_with_redzone, g.name,
          g.module_name, g.has_dynamic_init);
   if (g.location) {
     Report("  location (%p): name=%s[%p], %d %d\n", g.location,
            g.location->filename, g.location->filename, g.location->line_no,
            g.location->column_no);
   }
 }
 
-bool DescribeAddressIfGlobal(uptr addr, uptr size) {
+static bool DescribeOrGetInfoIfGlobal(uptr addr, uptr size, bool print,
+                                      Global *output_global) {
   if (!flags()->report_globals) return false;
   BlockingMutexLock lock(&mu_for_globals);
   bool res = false;
   for (ListOfGlobals *l = list_of_all_globals; l; l = l->next) {
     const Global &g = *l->g;
+    if (print) {
       if (flags()->report_globals >= 2)
         ReportGlobal(g, "Search");
       res |= DescribeAddressRelativeToGlobal(addr, size, g);
+    } else {
+      if (IsAddressNearGlobal(addr, g)) {
+        CHECK(output_global);
+        *output_global = g;
+        return true;
+      }
+    }
   }
   return res;
 }
 
+bool DescribeAddressIfGlobal(uptr addr, uptr size) {
+  return DescribeOrGetInfoIfGlobal(addr, size, /* print */ true,
+                                   /* output_global */ nullptr);
+}
+
+bool GetInfoForAddressIfGlobal(uptr addr, AddressDescription *descr) {
+  Global g = {};
+  if (DescribeOrGetInfoIfGlobal(addr, /* size */ 1, /* print */ false, &g)) {
+    internal_strncpy(descr->name, g.name, descr->name_size);
+    descr->region_address = g.beg;
+    descr->region_size = g.size;
+    descr->region_kind = "global";
+    return true;
+  }
+  return false;
+}
+
 u32 FindRegistrationSite(const Global *g) {
   CHECK(global_registration_site_vector);
   for (uptr i = 0, n = global_registration_site_vector->size(); i < n; i++) {
     GlobalRegistrationSite &grs = (*global_registration_site_vector)[i];
     if (g >= grs.g_first && g <= grs.g_last)
       return grs.stack_id;
   }
   return 0;

lib/asan/asan_interface_internal.h

extern "C" {
 
   SANITIZER_INTERFACE_ATTRIBUTE
   uptr __asan_region_is_poisoned(uptr beg, uptr size);
 
   SANITIZER_INTERFACE_ATTRIBUTE
   void __asan_describe_address(uptr addr);
 
   SANITIZER_INTERFACE_ATTRIBUTE
+  int __asan_report_present();
+
+  SANITIZER_INTERFACE_ATTRIBUTE
+  uptr __asan_get_report_pc();
+  SANITIZER_INTERFACE_ATTRIBUTE
+  uptr __asan_get_report_bp();
+  SANITIZER_INTERFACE_ATTRIBUTE
+  uptr __asan_get_report_sp();
+  SANITIZER_INTERFACE_ATTRIBUTE
+  uptr __asan_get_report_address();
+  SANITIZER_INTERFACE_ATTRIBUTE
+  int __asan_get_report_access_type();
+  SANITIZER_INTERFACE_ATTRIBUTE
+  uptr __asan_get_report_access_size();
+  SANITIZER_INTERFACE_ATTRIBUTE
+  const char * __asan_get_report_description();
+
+  SANITIZER_INTERFACE_ATTRIBUTE
+  const char * __asan_locate_address(uptr addr, char *name, uptr name_size,
+                                     uptr *region_address, uptr *region_size);
+
+  SANITIZER_INTERFACE_ATTRIBUTE
   uptr __asan_get_alloc_stack(uptr addr, uptr *trace, uptr size,
                               u32 *thread_id);
 
   SANITIZER_INTERFACE_ATTRIBUTE
   uptr __asan_get_free_stack(uptr addr, uptr *trace, uptr size,
                              u32 *thread_id);
 
   SANITIZER_INTERFACE_ATTRIBUTE

lib/asan/asan_report.h

 
 struct StackVarDescr {
   uptr beg;
   uptr size;
   const char *name_pos;
   uptr name_len;
 };
 
+struct AddressDescription {
+  char *name;
+  uptr name_size;
+  uptr region_address;
+  uptr region_size;
+  const char *region_kind;
+};
+
 // The following functions prints address description depending
 // on the memory type (shadow/heap/stack/global).
 void DescribeHeapAddress(uptr addr, uptr access_size);
 bool DescribeAddressIfGlobal(uptr addr, uptr access_size);
 bool DescribeAddressRelativeToGlobal(uptr addr, uptr access_size,
                                      const __asan_global &g);
-bool DescribeAddressIfShadow(uptr addr);
+bool IsAddressNearGlobal(uptr addr, const __asan_global &g);
+bool GetInfoForAddressIfGlobal(uptr addr, AddressDescription *descr);
+bool DescribeAddressIfShadow(uptr addr, AddressDescription *descr = nullptr,
+                             bool print = true);
 bool ParseFrameDescription(const char *frame_descr,
                            InternalMmapVector<StackVarDescr> *vars);
 bool DescribeAddressIfStack(uptr addr, uptr access_size);
 // Determines memory type on its own.
 void DescribeAddress(uptr addr, uptr access_size);
 
 void DescribeThread(AsanThreadContext *context);
 

lib/asan/asan_report.cc

 namespace __asan {
 
 // -------------------- User-specified callbacks ----------------- {{{1
 static void (*error_report_callback)(const char*);
 static char *error_message_buffer = 0;
 static uptr error_message_buffer_pos = 0;
 static uptr error_message_buffer_size = 0;
 
+struct ReportData {
+  uptr pc;
+  uptr sp;
+  uptr bp;
+  uptr addr;
+  bool is_write;
+  uptr access_size;
+  const char *description;
+};
+
+static bool report_happened = false;
+static ReportData report_data = {};
+
 void AppendToErrorMessageBuffer(const char *buffer) {
   if (error_message_buffer) {
     uptr length = internal_strlen(buffer);
     CHECK_GE(error_message_buffer_size, error_message_buffer_pos);
     uptr remaining = error_message_buffer_size - error_message_buffer_pos;
     internal_strncpy(error_message_buffer + error_message_buffer_pos,
                      buffer, remaining);
     error_message_buffer[error_message_buffer_size - 1] = '\0';
static const char *MaybeDemangleGlobalName(const char *name) {
 
   return should_demangle ? Symbolizer::GetOrInit()->Demangle(name) : name;
 }
 
 // Check if the global is a zero-terminated ASCII string. If so, print it.
 static void PrintGlobalNameIfASCII(InternalScopedString *str,
                                    const __asan_global &g) {
   for (uptr p = g.beg; p < g.beg + g.size - 1; p++) {
     unsigned char c = *(unsigned char*)p;
     if (c == '\0' || !IsASCII(c)) return;
   }
   if (*(char*)(g.beg + g.size - 1) != '\0') return;
   str->append("  '%s' is ascii string '%s'\n", MaybeDemangleGlobalName(g.name),
               (char *)g.beg);
 }
 
 static const char *GlobalFilename(const __asan_global &g) {
static void PrintGlobalLocation(InternalScopedString *str,
   if (g.location->line_no)
     str->append(":%d", g.location->line_no);
   if (g.location->column_no)
     str->append(":%d", g.location->column_no);
 }
 
 bool DescribeAddressRelativeToGlobal(uptr addr, uptr size,
                                      const __asan_global &g) {
-  static const uptr kMinimalDistanceFromAnotherGlobal = 64;
-  if (addr <= g.beg - kMinimalDistanceFromAnotherGlobal) return false;
-  if (addr >= g.beg + g.size_with_redzone) return false;
+  if (!IsAddressNearGlobal(addr, g)) return false;
   InternalScopedString str(4096);
   Decorator d;
   str.append("%s", d.Location());
   if (addr < g.beg) {
     str.append("%p is located %zd bytes to the left", (void *)addr,
                g.beg - addr);
   } else if (addr + size > g.beg + g.size) {
     if (addr < g.beg + g.size)
       addr = g.beg + g.size;
     str.append("%p is located %zd bytes to the right", (void *)addr,
                addr - (g.beg + g.size));
   } else {
     // Can it happen?
     str.append("%p is located %zd bytes inside", (void *)addr, addr - g.beg);
   }
   str.append(" of global variable '%s' defined in '",
              MaybeDemangleGlobalName(g.name));
   PrintGlobalLocation(&str, g);
   str.append("' (0x%zx) of size %zu\n", g.beg, g.size);
   str.append("%s", d.EndLocation());
   PrintGlobalNameIfASCII(&str, g);
   Printf("%s", str.data());
   return true;
 }
 
-bool DescribeAddressIfShadow(uptr addr) {
+bool DescribeAddressIfShadow(uptr addr, AddressDescription *descr, bool print) {
   if (AddrIsInMem(addr))
     return false;
-  static const char kAddrInShadowReport[] =
-      "Address %p is located in the %s.\n";
-  if (AddrIsInShadowGap(addr)) {
-    Printf(kAddrInShadowReport, addr, "shadow gap area");
-    return true;
-  }
-  if (AddrIsInHighShadow(addr)) {
-    Printf(kAddrInShadowReport, addr, "high shadow area");
-    return true;
+  const char *area_type = nullptr;
+  if (AddrIsInShadowGap(addr)) area_type = "shadow gap";
+  else if (AddrIsInHighShadow(addr)) area_type = "high shadow";
+  else if (AddrIsInLowShadow(addr)) area_type = "low shadow";
+  if (area_type != nullptr) {
+    if (print) {
+      Printf("Address %p is located in the %s area.\n", addr, area_type);
+    } else {
+      CHECK(descr);
+      descr->region_kind = area_type;
     }
-  if (AddrIsInLowShadow(addr)) {
-    Printf(kAddrInShadowReport, addr, "low shadow area");
     return true;
   }
   CHECK(0 && "Address is not in memory and not in shadow?");
   return false;
 }
 
 // Return " (thread_name) " or an empty string if the name is empty.
 const char *ThreadNameWithParenthesis(AsanThreadContext *t, char buff[],

 }
 
 // -------------------- Different kinds of reports ----------------- {{{1
 
 // Use ScopedInErrorReport to run common actions just before and
 // immediately after printing error report.
 class ScopedInErrorReport {
  public:
-  ScopedInErrorReport() {
+  explicit ScopedInErrorReport(ReportData *report = nullptr) {
     static atomic_uint32_t num_calls;
     static u32 reporting_thread_tid;
     if (atomic_fetch_add(&num_calls, 1, memory_order_relaxed) != 0) {
       // Do not print more than one report, otherwise they will mix up.
       // Error reporting functions shouldn't return at this situation, as
       // they are defined as no-return.
       Report("AddressSanitizer: while reporting a bug found another one. "
                  "Ignoring.\n");
       u32 current_tid = GetCurrentTidOrInvalid();
       if (current_tid != reporting_thread_tid) {
         // ASan found two bugs in different threads simultaneously. Sleep
         // long enough to make sure that the thread which started to print
         // an error report will finish doing it.
         SleepForSeconds(Max(100, flags()->sleep_before_dying + 1));
       }
       // If we're still not dead for some reason, use raw _exit() instead of
       // Die() to bypass any additional checks.
       internal__exit(flags()->exitcode);
     }
+    if (report) report_data = *report;
+    report_happened = true;
     ASAN_ON_ERROR();
     // Make sure the registry and sanitizer report mutexes are locked while
     // we're printing an error report.
     // We can lock them only here to avoid self-deadlock in case of
     // recursive reports.
     asanThreadRegistry().Lock();
     CommonSanitizerReportMutex.Lock();
     reporting_thread_tid = GetCurrentTidOrInvalid();

 
 }  // namespace __asan
 
 // --------------------------- Interface --------------------- {{{1
 using namespace __asan;  // NOLINT
 
 void __asan_report_error(uptr pc, uptr bp, uptr sp, uptr addr, int is_write,
                          uptr access_size) {
-  ScopedInErrorReport in_report;
-
   // Determine the error type.
   const char *bug_descr = "unknown-crash";
   if (AddrIsInMem(addr)) {
     u8 *shadow_addr = (u8*)MemToShadow(addr);
     // If we are accessing 16 bytes, look at the second shadow byte.
     if (*shadow_addr == 0 && access_size > SHADOW_GRANULARITY)
       shadow_addr++;
     // If we are in the partial right redzone, look at the next shadow byte.
     if (*shadow_addr > 0 && *shadow_addr < 128)
       shadow_addr++;
     switch (*shadow_addr) {
       case kAsanHeapLeftRedzoneMagic:
       case kAsanHeapRightRedzoneMagic:
       case kAsanArrayCookieMagic:
         bug_descr = "heap-buffer-overflow";
         break;
       case kAsanHeapFreeMagic:
         bug_descr = "heap-use-after-free";
         break;
switch (*shadow_addr) {
       case kAsanStackUseAfterScopeMagic:
         bug_descr = "stack-use-after-scope";
         break;
       case kAsanGlobalRedzoneMagic:
         bug_descr = "global-buffer-overflow";
         break;
     }
   }
+
+  ReportData report = { pc, sp, bp, addr, (bool)is_write, access_size,
+                        bug_descr };
+  ScopedInErrorReport in_report(&report);
+
   Decorator d;
   Printf("%s", d.Warning());
   Report("ERROR: AddressSanitizer: %s on address "
              "%p at pc %p bp %p sp %p\n",
              bug_descr, (void*)addr, pc, bp, sp);
   Printf("%s", d.EndWarning());
 
   u32 curr_tid = GetCurrentTidOrInvalid();
   char tname[128];
   Printf("%s%s of size %zu at %p thread T%d%s%s\n",
          d.Access(),
          access_size ? (is_write ? "WRITE" : "READ") : "ACCESS",
          access_size, (void*)addr, curr_tid,
          ThreadNameWithParenthesis(curr_tid, tname, sizeof(tname)),

 
 void __asan_describe_address(uptr addr) {
   // Thread registry must be locked while we're describing an address.
   asanThreadRegistry().Lock();
   DescribeAddress(addr, 1);
   asanThreadRegistry().Unlock();
 }
 
+int __asan_report_present() {
+  return report_happened ? 1 : 0;
+}
+
+uptr __asan_get_report_pc() {
+  return report_data.pc;
+}
+
+uptr __asan_get_report_bp() {
+  return report_data.bp;
+}
+
+uptr __asan_get_report_sp() {
+  return report_data.sp;
+}
+
+uptr __asan_get_report_address() {
+  return report_data.addr;
+}
+
+int __asan_get_report_access_type() {
+  return report_data.is_write ? 1 : 0;
+}
+
+uptr __asan_get_report_access_size() {
+  return report_data.access_size;
+}
+
+const char *__asan_get_report_description() {
+  return report_data.description;
+}
+
 extern "C" {
 SANITIZER_INTERFACE_ATTRIBUTE
 void __sanitizer_ptr_sub(void *a, void *b) {
   CheckForInvalidPointerPair(a, b);
 }
 SANITIZER_INTERFACE_ATTRIBUTE
 void __sanitizer_ptr_cmp(void *a, void *b) {
   CheckForInvalidPointerPair(a, b);

test/asan/TestCases/debug_locate.cc

+// Checks the ASan memory address type debugging API, makes sure it returns
+// the correct memory type for heap, stack, global and shadow addresses and
+// that it correctly finds out which region (and name and size) the address
+// belongs to.
+// RUN: %clangxx_asan -O0 %s -o %t && %run %t 2>&1
+
+#include <assert.h>
+#include <sanitizer/asan_interface.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+int global_var;
+
+int main() {
+  int local_var;
+  char *heap_ptr = (char *)malloc(10);
+
+  char name[100];
+  void *region_address;
+  size_t region_size;
+  const char *type;
+
+  type = __asan_locate_address(&global_var, name, 100,
+                               &region_address, &region_size);
+  assert(0 == strcmp(name, "global_var"));
+  assert(0 == strcmp(type, "global"));
+  assert(region_address == &global_var);
+  assert(region_size == sizeof(global_var));
+
+  type = __asan_locate_address((char *)(&global_var)+1, name, 100,
+                               &region_address, &region_size);
+  assert(0 == strcmp(name, "global_var"));
+  assert(0 == strcmp(type, "global"));
+  assert(region_address == &global_var);
+  assert(region_size == sizeof(global_var));
+
+  type = __asan_locate_address(&local_var, name, 100,
+                               &region_address, &region_size);
+  assert(0 == strcmp(name, "local_var"));
+  assert(0 == strcmp(type, "stack"));
+  assert(region_address == &local_var);
+  assert(region_size == sizeof(local_var));
+
+  type = __asan_locate_address((char *)(&local_var)+1, name, 100,
+                               &region_address, &region_size);
+  assert(0 == strcmp(name, "local_var"));
+  assert(0 == strcmp(type, "stack"));
+  assert(region_address == &local_var);
+  assert(region_size == sizeof(local_var));
+
+  type = __asan_locate_address(heap_ptr, name, 100,
+                               &region_address, &region_size);
+  assert(0 == strcmp(type, "heap"));
+  assert(region_address == heap_ptr);
+  assert(10 == region_size);
+
+  type = __asan_locate_address(heap_ptr+1, name, 100,
+                               &region_address, &region_size);
+  assert(0 == strcmp(type, "heap"));
+  assert(region_address == heap_ptr);
+  assert(10 == region_size);
+
+  size_t shadow_scale;
+  size_t shadow_offset;
+  __asan_get_shadow_mapping(&shadow_scale, &shadow_offset);
+
+  intptr_t shadow_ptr = (((intptr_t)heap_ptr) >> shadow_scale) + shadow_offset;
+  type = __asan_locate_address((void *)shadow_ptr, NULL, 0, NULL, NULL);
+  assert((0 == strcmp(type, "high shadow")) || 0 == strcmp(type, "low shadow"));
+
+  intptr_t shadow_gap = (shadow_ptr >> shadow_scale) + shadow_offset;
+  type = __asan_locate_address((void *)shadow_gap, NULL, 0, NULL, NULL);
+  assert(0 == strcmp(type, "shadow gap"));
+
+  return 0;
+}

test/asan/TestCases/debug_report.cc

+// Checks that the ASan debugging API for getting report information
+// returns correct values.
+// RUN: %clangxx_asan -O0 %s -o %t && not %run %t 2>&1 | FileCheck %s
+
+#include <sanitizer/asan_interface.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+int main() {
+  char *heap_ptr = (char *)malloc(10);
+  free(heap_ptr);
+  int present = __asan_report_present();
+  fprintf(stderr, "%s\n", (present == 0) ? "no report" : "");
+  // CHECK: no report
+  heap_ptr[0] = 'A'; // BOOM
+  return 0;
+}
+
+void __asan_on_error() {
+  int present = __asan_report_present();
+  void *pc = __asan_get_report_pc();
+  void *bp = __asan_get_report_bp();
+  void *sp = __asan_get_report_sp();
+  void *addr = __asan_get_report_address();
+  int is_write = __asan_get_report_access_type();
+  size_t access_size = __asan_get_report_access_size();
+  const char *description = __asan_get_report_description();
+
+  fprintf(stderr, "%s\n", (present == 1) ? "report" : "");
+  // CHECK: report
+  fprintf(stderr, "pc: %p\n", pc);
+  // CHECK: pc: 0x[[PC:[0-9a-f]+]]
+  fprintf(stderr, "bp: %p\n", bp);
+  // CHECK: bp: 0x[[BP:[0-9a-f]+]]
+  fprintf(stderr, "sp: %p\n", sp);
+  // CHECK: sp: 0x[[SP:[0-9a-f]+]]
+  fprintf(stderr, "addr: %p\n", addr);
+  // CHECK: addr: 0x[[ADDR:[0-9a-f]+]]
+  fprintf(stderr, "type: %s\n", (is_write ? "write" : "read"));
+  // CHECK: type: write
+  fprintf(stderr, "access_size: %ld\n", access_size);
+  // CHECK: access_size: 1
+  fprintf(stderr, "description: %s\n", description);
+  // CHECK: description: heap-use-after-free
+}
+
+// CHECK: AddressSanitizer: heap-use-after-free on address {{0x0*}}[[ADDR]] at pc {{0x0*}}[[PC]] bp {{0x0*}}[[BP]] sp {{0x0*}}[[SP]]
+// CHECK: WRITE of size 1 at {{0x0*}}[[ADDR]] thread T0