[compiler-rt] Demangling for DlAddrSymbolizer

[kubamracek]

Summary

On OS X, dladdr() provides mangled names only, so we need need to demangle in DlAddrSymbolizer::SymbolizePC.

[zaks.anna]

lib/sanitizer_common/sanitizer_symbolizer_posix_libcdep.cc

42

Maybe we should provide an option that allows us to turn off demangling? It would make it easier to isolate cases where we get a second failure while reporting. Clients who don't need this (ex: running under the debugger) could turn this off.

What do you think?

[kubamracek]

lib/sanitizer_common/sanitizer_symbolizer_posix_libcdep.cc

42

Can demangling really cause such a bad failure? I was under the impression that either __cxa_demangle could be missing (because we're not linked against libcxx) or it could return NULL, and we handle both these cases here. (Which reminds me that the extra check for NULL-ness above in sanitizer_symbolizer_mac.cc is not necessary, because DemangleCXXABI can never return NULL).

However, if you suspect that it could actually cause a crash, having an option to turn it on/off sounds like a good idea.

FYI, if you use ASAN_OPTIONS=symbolize=0, stack traces will not be symbolicated at all, and no demangling will occur either.

[zaks.anna]

I've just noticed this FIXME in the comment:
" __cxa_demangle aggressively insists on allocating memory."

Allocating memory while in a bad state could result in unpredictable behavior.

[samsonov]

FYI I'm ok with this patch. Allocating memory during report printing is bad, will roundtrip through our allocator, and can cause different side-effects. However, we can't do much better here. InternalSymbolizer we're using internally allocates a *lot* of memory, and we were able to get away with it for quite a while for now.

[kubamracek]

Landed in r232910. Later I'll try to take another look into memory allocations during report printing.

lib/sanitizer_common/sanitizer_symbolizer_internal.h

 // InternalAlloc) and null-terminataed buffer is returned. They return a pointer
 // to the next characted after the found delimiter.
 const char *ExtractToken(const char *str, const char *delims, char **result);
 const char *ExtractInt(const char *str, const char *delims, int *result);
 const char *ExtractUptr(const char *str, const char *delims, uptr *result);
 const char *ExtractTokenUpToDelimiter(const char *str, const char *delimiter,
                                       char **result);
 
+const char *DemangleCXXABI(const char *name);
+
 // SymbolizerTool is an interface that is implemented by individual "tools"
 // that can perform symbolication (external llvm-symbolizer, libbacktrace,
 // Windows DbgHelp symbolizer, etc.).
 class SymbolizerTool {
  public:
   // The main |Symbolizer| class implements a "fallback chain" of symbolizer
   // tools. In a request to symbolize an address, if one tool returns false,
   // the next tool in the chain will be tried.

lib/sanitizer_common/sanitizer_symbolizer_mac.cc

 #include <sys/wait.h>
 #include <unistd.h>
 #include <util.h>
 
 bool DlAddrSymbolizer::SymbolizePC(uptr addr, SymbolizedStack *stack) {
   Dl_info info;
   int result = dladdr((const void *)addr, &info);
   if (!result) return false;
+  if (const char *demangled = DemangleCXXABI(info.dli_sname)) {
+    stack->info.function = internal_strdup(demangled);
+  } else {
     stack->info.function = internal_strdup(info.dli_sname);
+  }
   return true;
 }
 
 bool DlAddrSymbolizer::SymbolizeData(uptr addr, DataInfo *info) {
   return false;
 }
 
 class AtosSymbolizerProcess : public SymbolizerProcess {

lib/sanitizer_common/sanitizer_symbolizer_posix_libcdep.cc

namespace __cxxabiv1 {
   extern "C" SANITIZER_WEAK_ATTRIBUTE
   char *__cxa_demangle(const char *mangled, char *buffer,
                                   size_t *length, int *status);
 }
 
 namespace __sanitizer {
 
 // Attempts to demangle the name via __cxa_demangle from __cxxabiv1.
-static const char *DemangleCXXABI(const char *name) {
+const char *DemangleCXXABI(const char *name) {
   // FIXME: __cxa_demangle aggressively insists on allocating memory.
   // There's not much we can do about that, short of providing our
   // own demangler (libc++abi's implementation could be adapted so that
   // it does not allocate). For now, we just call it anyway, and we leak
   // the returned value.
   if (__cxxabiv1::__cxa_demangle)
     if (const char *demangled_name =
           __cxxabiv1::__cxa_demangle(name, 0, 0, 0))
       return demangled_name;

test/asan/TestCases/Darwin/dladdr-demangling.cc

+// In a non-forking sandbox, we fallback to dladdr(). Test that we provide
+// properly demangled C++ names in that case.
+
+// RUN: %clangxx_asan -O0 %s -o %t 
+// RUN: not %run %t 2>&1 | FileCheck %s
+// RUN: ASAN_OPTIONS=verbosity=2 not %run sandbox-exec -p '(version 1)(allow default)(deny process-fork)' %t 2>&1 | FileCheck %s --check-prefix=CHECK --check-prefix=CHECK-DLADDR
+
+#include <stdlib.h>
+
+class MyClass {
+ public:
+  int my_function(int n) {
+    char *x = (char*)malloc(n * sizeof(char));
+    free(x);
+    return x[5];
+    // CHECK: {{.*ERROR: AddressSanitizer: heap-use-after-free on address}}
+    // CHECK: {{READ of size 1 at 0x.* thread T0}}
+    // CHECK-DLADDR: Using dladdr symbolizer as fallback
+    // CHECK-DLADDR: failed to fork external symbolizer
+    // CHECK: {{    #0 0x.* in MyClass::my_function\(int\)}}
+    // CHECK: {{freed by thread T0 here:}}
+    // CHECK: {{    #0 0x.* in wrap_free}}
+    // CHECK: {{    #1 0x.* in MyClass::my_function\(int\)}}
+    // CHECK: {{previously allocated by thread T0 here:}}
+    // CHECK: {{    #0 0x.* in wrap_malloc}}
+    // CHECK: {{    #1 0x.* in MyClass::my_function\(int\)}}
+  }
+};
+
+int main() {
+  MyClass o;
+  return o.my_function(10);
+}