Revert to C-style callbacks for iteration over allocator chunks. Also clean up LSan code, fix some comments and replace void* with uptr to bring down the number of reinterpret_casts.

[kcc]

LGTM, please don't forget to run lint

lib/asan/asan_allocator2.cc

void UnlockAllocator() {
   __asan::allocator.ForceUnlock();
 }
 
 void GetAllocatorGlobalRange(uptr *begin, uptr *end) {
   *begin = (uptr)&__asan::allocator;
   *end = *begin + sizeof(__asan::allocator);
 }
 
-void *PointsIntoChunk(void* p) {
+uptr PointsIntoChunk(void* p) {
   uptr addr = reinterpret_cast<uptr>(p);
   __asan::AsanChunk *m = __asan::GetAsanChunkByAddrFastLocked(addr);
   if (!m) return 0;
   uptr chunk = m->Beg();
   if ((m->chunk_state == __asan::CHUNK_ALLOCATED) && m->AddrIsInside(addr))
-    return reinterpret_cast<void *>(chunk);
+    return chunk;
   return 0;
 }
 
-void *GetUserBegin(void *p) {
+uptr GetUserBegin(uptr chunk) {
   __asan::AsanChunk *m =
-      __asan::GetAsanChunkByAddrFastLocked(reinterpret_cast<uptr>(p));
+      __asan::GetAsanChunkByAddrFastLocked(chunk);
   CHECK(m);
-  return reinterpret_cast<void *>(m->Beg());
+  return m->Beg();
 }
 
-LsanMetadata::LsanMetadata(void *chunk) {
-  uptr addr = reinterpret_cast<uptr>(chunk);
-  metadata_ = reinterpret_cast<void *>(addr - __asan::kChunkHeaderSize);
+LsanMetadata::LsanMetadata(uptr chunk) {
+  metadata_ = reinterpret_cast<void *>(chunk - __asan::kChunkHeaderSize);
 }
 
 bool LsanMetadata::allocated() const {
   __asan::AsanChunk *m = reinterpret_cast<__asan::AsanChunk *>(metadata_);
   return m->chunk_state == __asan::CHUNK_ALLOCATED;
 }
 
 ChunkTag LsanMetadata::tag() const {
uptr LsanMetadata::requested_size() const {
   return m->UsedSize();
 }
 
 u32 LsanMetadata::stack_trace_id() const {
   __asan::AsanChunk *m = reinterpret_cast<__asan::AsanChunk *>(metadata_);
   return m->alloc_context_id;
 }
 
-template <typename Callable> void ForEachChunk(Callable const &callback) {
-  __asan::allocator.ForEachChunk(callback);
+void ForEachChunk(ForEachChunkCallback callback, void *arg) {
+  __asan::allocator.ForEachChunk(callback, arg);
 }
-#if CAN_SANITIZE_LEAKS
-template void ForEachChunk<ProcessPlatformSpecificAllocationsCb>(
-    ProcessPlatformSpecificAllocationsCb const &callback);
-template void ForEachChunk<PrintLeakedCb>(PrintLeakedCb const &callback);
-template void ForEachChunk<CollectLeaksCb>(CollectLeaksCb const &callback);
-template void ForEachChunk<MarkIndirectlyLeakedCb>(
-    MarkIndirectlyLeakedCb const &callback);
-template void ForEachChunk<CollectIgnoredCb>(
-    CollectIgnoredCb const &callback);
-#endif  // CAN_SANITIZE_LEAKS
 
 IgnoreObjectResult IgnoreObjectLocked(const void *p) {
   uptr addr = reinterpret_cast<uptr>(p);
   __asan::AsanChunk *m = __asan::GetAsanChunkByAddr(addr);
   if (!m) return kIgnoreObjectInvalid;
   if ((m->chunk_state == __asan::CHUNK_ALLOCATED) && m->AddrIsInside(addr)) {
     if (m->lsan_tag == kIgnored)
       return kIgnoreObjectAlreadyIgnored;

lib/lsan/lsan_allocator.cc

void InitializeAllocator() {
   allocator.Init();
 }
 
 void AllocatorThreadFinish() {
   allocator.SwallowCache(&cache);
 }
 
 static ChunkMetadata *Metadata(void *p) {
-  return (ChunkMetadata *)allocator.GetMetaData(p);
+  return reinterpret_cast<ChunkMetadata *>(allocator.GetMetaData(p));
 }
 
 static void RegisterAllocation(const StackTrace &stack, void *p, uptr size) {
   if (!p) return;
   ChunkMetadata *m = Metadata(p);
   CHECK(m);
   m->tag = DisabledInThisThread() ? kIgnored : kDirectlyLeaked;
   m->stack_trace_id = StackDepotPut(stack.trace, stack.size);
   m->requested_size = size;
-  atomic_store((atomic_uint8_t*)m, 1, memory_order_relaxed);
+  atomic_store(reinterpret_cast<atomic_uint8_t *>(m), 1, memory_order_relaxed);
 }
 
 static void RegisterDeallocation(void *p) {
   if (!p) return;
   ChunkMetadata *m = Metadata(p);
   CHECK(m);
-  atomic_store((atomic_uint8_t*)m, 0, memory_order_relaxed);
+  atomic_store(reinterpret_cast<atomic_uint8_t *>(m), 0, memory_order_relaxed);
 }
 
 void *Allocate(const StackTrace &stack, uptr size, uptr alignment,
                bool cleared) {
   if (size == 0)
     size = 1;
   if (size > kMaxAllowedMallocSize) {
     Report("WARNING: LeakSanitizer failed to allocate %zu bytes\n", size);
void UnlockAllocator() {
   allocator.ForceUnlock();
 }
 
 void GetAllocatorGlobalRange(uptr *begin, uptr *end) {
   *begin = (uptr)&allocator;
   *end = *begin + sizeof(allocator);
 }
 
-void *PointsIntoChunk(void* p) {
-  void *chunk = allocator.GetBlockBeginFastLocked(p);
+uptr PointsIntoChunk(void* p) {
+  uptr addr = reinterpret_cast<uptr>(p);
+  uptr chunk = reinterpret_cast<uptr>(allocator.GetBlockBeginFastLocked(p));
   if (!chunk) return 0;
   // LargeMmapAllocator considers pointers to the meta-region of a chunk to be
   // valid, but we don't want that.
-  if (p < chunk) return 0;
-  ChunkMetadata *m = Metadata(chunk);
+  if (addr < chunk) return 0;
+  ChunkMetadata *m = Metadata(reinterpret_cast<void *>(chunk));
   CHECK(m);
-  if (m->allocated && (uptr)p < (uptr)chunk + m->requested_size)
+  if (m->allocated && addr < chunk + m->requested_size)
     return chunk;
   return 0;
 }
 
-void *GetUserBegin(void *p) {
-  return p;
+uptr GetUserBegin(uptr chunk) {
+  return chunk;
 }
 
-LsanMetadata::LsanMetadata(void *chunk) {
-  metadata_ = Metadata(chunk);
+LsanMetadata::LsanMetadata(uptr chunk) {
+  metadata_ = Metadata(reinterpret_cast<void *>(chunk));
   CHECK(metadata_);
 }
 
 bool LsanMetadata::allocated() const {
   return reinterpret_cast<ChunkMetadata *>(metadata_)->allocated;
 }
 
 ChunkTag LsanMetadata::tag() const {
   return reinterpret_cast<ChunkMetadata *>(metadata_)->tag;
 }
 
 void LsanMetadata::set_tag(ChunkTag value) {
   reinterpret_cast<ChunkMetadata *>(metadata_)->tag = value;
 }
 
 uptr LsanMetadata::requested_size() const {
   return reinterpret_cast<ChunkMetadata *>(metadata_)->requested_size;
 }
 
 u32 LsanMetadata::stack_trace_id() const {
   return reinterpret_cast<ChunkMetadata *>(metadata_)->stack_trace_id;
 }
 
-template<typename Callable>
-void ForEachChunk(Callable const &callback) {
-  allocator.ForEachChunk(callback);
+void ForEachChunk(ForEachChunkCallback callback, void *arg) {
+  allocator.ForEachChunk(callback, arg);
 }
 
-template void ForEachChunk<ProcessPlatformSpecificAllocationsCb>(
-    ProcessPlatformSpecificAllocationsCb const &callback);
-template void ForEachChunk<PrintLeakedCb>(PrintLeakedCb const &callback);
-template void ForEachChunk<CollectLeaksCb>(CollectLeaksCb const &callback);
-template void ForEachChunk<MarkIndirectlyLeakedCb>(
-    MarkIndirectlyLeakedCb const &callback);
-template void ForEachChunk<CollectIgnoredCb>(
-    CollectIgnoredCb const &callback);
-
 IgnoreObjectResult IgnoreObjectLocked(const void *p) {
   void *chunk = allocator.GetBlockBegin(p);
   if (!chunk || p < chunk) return kIgnoreObjectInvalid;
   ChunkMetadata *m = Metadata(chunk);
   CHECK(m);
   if (m->allocated && (uptr)p < (uptr)chunk + m->requested_size) {
     if (m->tag == kIgnored)
       return kIgnoreObjectAlreadyIgnored;
     m->tag = kIgnored;
     return kIgnoreObjectSuccess;
   } else {
     return kIgnoreObjectInvalid;
   }
 }
 }  // namespace __lsan

lib/lsan/lsan_common.h

 // This file is a part of LeakSanitizer.
 // Private LSan header.
 //
 //===----------------------------------------------------------------------===//
 
 #ifndef LSAN_COMMON_H
 #define LSAN_COMMON_H
 
+#include "sanitizer_common/sanitizer_allocator.h"
 #include "sanitizer_common/sanitizer_common.h"
 #include "sanitizer_common/sanitizer_internal_defs.h"
 #include "sanitizer_common/sanitizer_platform.h"
 #include "sanitizer_common/sanitizer_symbolizer.h"
 
 #if SANITIZER_LINUX && defined(__x86_64__)
 #define CAN_SANITIZE_LEAKS 1
 #else

 void InitializePlatformSpecificModules();
 void ProcessGlobalRegions(Frontier *frontier);
 void ProcessPlatformSpecificAllocations(Frontier *frontier);
 
 void ScanRangeForPointers(uptr begin, uptr end,
                           Frontier *frontier,
                           const char *region_type, ChunkTag tag);
 
-// Callables for iterating over chunks. Those classes are used as template
-// parameters in ForEachChunk, so we must expose them here to allow for explicit
-// template instantiation.
-
-// Identifies unreachable chunks which must be treated as reachable. Marks them
-// as reachable and adds them to the frontier.
-class ProcessPlatformSpecificAllocationsCb {
- public:
-  explicit ProcessPlatformSpecificAllocationsCb(
-      Frontier *frontier)
-      : frontier_(frontier) {}
-  void operator()(void *p) const;
- private:
-  Frontier *frontier_;
-};
-
-// Prints addresses of unreachable chunks.
-class PrintLeakedCb {
- public:
-  void operator()(void *p) const;
-};
-
-// Aggregates unreachable chunks into a LeakReport.
-class CollectLeaksCb {
- public:
-  explicit CollectLeaksCb(LeakReport *leak_report)
-      : leak_report_(leak_report) {}
-  void operator()(void *p) const;
- private:
-  LeakReport *leak_report_;
-};
-
-// Scans each leaked chunk for pointers to other leaked chunks, and marks each
-// of them as indirectly leaked.
-class MarkIndirectlyLeakedCb {
- public:
-  void operator()(void *p) const;
-};
-
-// Finds all chunk marked as kIgnored and adds their addresses to frontier.
-class CollectIgnoredCb {
- public:
-  explicit CollectIgnoredCb(Frontier *frontier)
-      : frontier_(frontier) {}
-  void operator()(void *p) const;
- private:
-  Frontier *frontier_;
-};
-
 enum IgnoreObjectResult {
   kIgnoreObjectSuccess,
   kIgnoreObjectAlreadyIgnored,
   kIgnoreObjectInvalid
 };
 
 // Functions called from the parent tool.
 void InitCommonLsan();
 void DoLeakCheck();
 bool DisabledInThisThread();
 
 // The following must be implemented in the parent tool.
 
-template<typename Callable> void ForEachChunk(Callable const &callback);
-// The address range occupied by the global allocator object.
+void ForEachChunk(ForEachChunkCallback callback, void *arg);
+// Returns the address range occupied by the global allocator object.
 void GetAllocatorGlobalRange(uptr *begin, uptr *end);
 // Wrappers for allocator's ForceLock()/ForceUnlock().
 void LockAllocator();
 void UnlockAllocator();
 // Wrappers for ThreadRegistry access.
 void LockThreadRegistry();
 void UnlockThreadRegistry();
 bool GetThreadRangesLocked(uptr os_id, uptr *stack_begin, uptr *stack_end,
                            uptr *tls_begin, uptr *tls_end,
                            uptr *cache_begin, uptr *cache_end);
-// If p points into a chunk that has been allocated to the user, return its
-// user-visible address. Otherwise, return 0.
-void *PointsIntoChunk(void *p);
-// Return address of user-visible chunk contained in this allocator chunk.
-void *GetUserBegin(void *p);
+// If p points into a chunk that has been allocated to the user, returns its
+// user-visible address. Otherwise, returns 0.
+uptr PointsIntoChunk(void *p);
+// Returns address of user-visible chunk contained in this allocator chunk.
+uptr GetUserBegin(uptr chunk);
 // Helper for __lsan_ignore_object().
 IgnoreObjectResult IgnoreObjectLocked(const void *p);
 // Wrapper for chunk metadata operations.
 class LsanMetadata {
  public:
-  // Constructor accepts pointer to user-visible chunk.
-  explicit LsanMetadata(void *chunk);
+  // Constructor accepts address of user-visible chunk.
+  explicit LsanMetadata(uptr chunk);
   bool allocated() const;
   ChunkTag tag() const;
   void set_tag(ChunkTag value);
   uptr requested_size() const;
   u32 stack_trace_id() const;
  private:
   void *metadata_;
 };
 
 }  // namespace __lsan
 
 #endif  // LSAN_COMMON_H

lib/lsan/lsan_common.cc

 #include "sanitizer_common/sanitizer_flags.h"
 #include "sanitizer_common/sanitizer_stackdepot.h"
 #include "sanitizer_common/sanitizer_stacktrace.h"
 #include "sanitizer_common/sanitizer_stoptheworld.h"
 
 #if CAN_SANITIZE_LEAKS
 namespace __lsan {
 
-// This mutex is used to prevent races between DoLeakCheck and SuppressObject.
+// This mutex is used to prevent races between DoLeakCheck and IgnoreObject.
 BlockingMutex global_mutex(LINKER_INITIALIZED);
 
 THREADLOCAL int disable_counter;
 bool DisabledInThisThread() { return disable_counter > 0; }
 
 Flags lsan_flags;
 
 static void InitializeFlags() {

 #ifdef __x86_64__
   // Accept only canonical form user-space addresses.
   return ((p >> 47) == 0);
 #else
   return true;
 #endif
 }
 
-// Scan the memory range, looking for byte patterns that point into allocator
-// chunks. Mark those chunks with tag and add them to the frontier.
+// Scans the memory range, looking for byte patterns that point into allocator
+// chunks. Marks those chunks with |tag| and adds them to |frontier|.
 // There are two usage modes for this function: finding reachable or ignored 
-// chunks (tag = kReachable or kIgnored) and finding indirectly leaked chunks
-// (tag = kIndirectlyLeaked). In the second case, there's no flood fill,
-// so frontier = 0.
+// chunks (|tag| = kReachable or kIgnored) and finding indirectly leaked chunks
+// (|tag| = kIndirectlyLeaked). In the second case, there's no flood fill,
+// so |frontier| = 0.
 void ScanRangeForPointers(uptr begin, uptr end,
                           Frontier *frontier,
                           const char *region_type, ChunkTag tag) {
   const uptr alignment = flags()->pointer_alignment();
   if (flags()->log_pointers)
     Report("Scanning %s range %p-%p.\n", region_type, begin, end);
   uptr pp = begin;
   if (pp % alignment)
     pp = pp + alignment - pp % alignment;
   for (; pp + sizeof(void *) <= end; pp += alignment) {
     void *p = *reinterpret_cast<void**>(pp);
     if (!CanBeAHeapPointer(reinterpret_cast<uptr>(p))) continue;
-    void *chunk = PointsIntoChunk(p);
+    uptr chunk = PointsIntoChunk(p);
     if (!chunk) continue;
     LsanMetadata m(chunk);
     // Reachable beats ignored beats leaked.
     if (m.tag() == kReachable) continue;
     if (m.tag() == kIgnored && tag != kReachable) continue;
     m.set_tag(tag);
     if (flags()->log_pointers)
       Report("%p: found %p pointing into chunk %p-%p of size %zu.\n", pp, p,
-             chunk, reinterpret_cast<uptr>(chunk) + m.requested_size(),
-             m.requested_size());
+             chunk, chunk + m.requested_size(), m.requested_size());
     if (frontier)
-      frontier->push_back(reinterpret_cast<uptr>(chunk));
+      frontier->push_back(chunk);
   }
 }
 
-// Scan thread data (stacks and TLS) for heap pointers.
+// Scans thread data (stacks and TLS) for heap pointers.
 static void ProcessThreads(SuspendedThreadsList const &suspended_threads,
                            Frontier *frontier) {
   InternalScopedBuffer<uptr> registers(SuspendedThreadsList::RegisterCount());
   uptr registers_begin = reinterpret_cast<uptr>(registers.data());
   uptr registers_end = registers_begin + registers.size();
   for (uptr i = 0; i < suspended_threads.thread_count(); i++) {
     uptr os_id = static_cast<uptr>(suspended_threads.GetThreadID(i));
     if (flags()->log_threads) Report("Processing thread %d.\n", os_id);
for (uptr i = 0; i < suspended_threads.thread_count(); i++) {
     }
   }
 }
 
 static void FloodFillTag(Frontier *frontier, ChunkTag tag) {
   while (frontier->size()) {
     uptr next_chunk = frontier->back();
     frontier->pop_back();
-    LsanMetadata m(reinterpret_cast<void *>(next_chunk));
+    LsanMetadata m(next_chunk);
     ScanRangeForPointers(next_chunk, next_chunk + m.requested_size(), frontier,
                          "HEAP", tag);
   }
 }
 
-// Mark leaked chunks which are reachable from other leaked chunks.
-void MarkIndirectlyLeakedCb::operator()(void *p) const {
-  p = GetUserBegin(p);
-  LsanMetadata m(p);
+// ForEachChunk callback. If the chunk is marked as leaked, marks all chunks
+// which are reachable from it as indirectly leaked.
+static void MarkIndirectlyLeakedCb(uptr chunk, void *arg) {
+  chunk = GetUserBegin(chunk);
+  LsanMetadata m(chunk);
   if (m.allocated() && m.tag() != kReachable) {
-    ScanRangeForPointers(reinterpret_cast<uptr>(p),
-                         reinterpret_cast<uptr>(p) + m.requested_size(),
+    ScanRangeForPointers(chunk, chunk + m.requested_size(),
                          /* frontier */ 0, "HEAP", kIndirectlyLeaked);
   }
 }
 
-void CollectIgnoredCb::operator()(void *p) const {
-  p = GetUserBegin(p);
-  LsanMetadata m(p);
+// ForEachChunk callback. If chunk is marked as ignored, adds its address to
+// frontier.
+static void CollectIgnoredCb(uptr chunk, void *arg) {
+  CHECK(arg);
+  chunk = GetUserBegin(chunk);
+  LsanMetadata m(chunk);
   if (m.allocated() && m.tag() == kIgnored)
-    frontier_->push_back(reinterpret_cast<uptr>(p));
+    reinterpret_cast<Frontier *>(arg)->push_back(chunk);
 }
 
-// Set the appropriate tag on each chunk.
+// Sets the appropriate tag on each chunk.
 static void ClassifyAllChunks(SuspendedThreadsList const &suspended_threads) {
   // Holds the flood fill frontier.
   Frontier frontier(GetPageSizeCached());
 
   if (flags()->use_globals)
     ProcessGlobalRegions(&frontier);
   ProcessThreads(suspended_threads, &frontier);
   FloodFillTag(&frontier, kReachable);
   // The check here is relatively expensive, so we do this in a separate flood
   // fill. That way we can skip the check for chunks that are reachable
   // otherwise.
   ProcessPlatformSpecificAllocations(&frontier);
   FloodFillTag(&frontier, kReachable);
 
   if (flags()->log_pointers)
     Report("Scanning ignored chunks.\n");
   CHECK_EQ(0, frontier.size());
-  ForEachChunk(CollectIgnoredCb(&frontier));
+  ForEachChunk(CollectIgnoredCb, &frontier);
   FloodFillTag(&frontier, kIgnored);
 
   // Iterate over leaked chunks and mark those that are reachable from other
   // leaked chunks.
   if (flags()->log_pointers)
     Report("Scanning leaked chunks.\n");
-  ForEachChunk(MarkIndirectlyLeakedCb());
+  ForEachChunk(MarkIndirectlyLeakedCb, 0 /* arg */);
 }
 
 static void PrintStackTraceById(u32 stack_trace_id) {
   CHECK(stack_trace_id);
   uptr size = 0;
   const uptr *trace = StackDepotGet(stack_trace_id, &size);
   StackTrace::PrintStack(trace, size, common_flags()->symbolize,
                          common_flags()->strip_path_prefix, 0);
 }
 
-void CollectLeaksCb::operator()(void *p) const {
-  p = GetUserBegin(p);
-  LsanMetadata m(p);
+// ForEachChunk callback. Aggregates unreachable chunks into a LeakReport.
+static void CollectLeaksCb(uptr chunk, void *arg) {
+  CHECK(arg);
+  LeakReport *leak_report = reinterpret_cast<LeakReport *>(arg);
+  chunk = GetUserBegin(chunk);
+  LsanMetadata m(chunk);
   if (!m.allocated()) return;
   if (m.tag() == kDirectlyLeaked || m.tag() == kIndirectlyLeaked) {
     uptr resolution = flags()->resolution;
     if (resolution > 0) {
       uptr size = 0;
       const uptr *trace = StackDepotGet(m.stack_trace_id(), &size);
       size = Min(size, resolution);
-      leak_report_->Add(StackDepotPut(trace, size), m.requested_size(),
-                        m.tag());
+      leak_report->Add(StackDepotPut(trace, size), m.requested_size(), m.tag());
     } else {
-      leak_report_->Add(m.stack_trace_id(), m.requested_size(), m.tag());
+      leak_report->Add(m.stack_trace_id(), m.requested_size(), m.tag());
     }
   }
 }
 
-static void CollectLeaks(LeakReport *leak_report) {
-  ForEachChunk(CollectLeaksCb(leak_report));
-}
-
-void PrintLeakedCb::operator()(void *p) const {
-  p = GetUserBegin(p);
-  LsanMetadata m(p);
+// ForEachChunkCallback. Prints addresses of unreachable chunks.
+static void PrintLeakedCb(uptr chunk, void *arg) {
+  chunk = GetUserBegin(chunk);
+  LsanMetadata m(chunk);
   if (!m.allocated()) return;
   if (m.tag() == kDirectlyLeaked || m.tag() == kIndirectlyLeaked) {
     Printf("%s leaked %zu byte object at %p.\n",
            m.tag() == kDirectlyLeaked ? "Directly" : "Indirectly",
-           m.requested_size(), p);
+           m.requested_size(), chunk);
   }
 }
 
 static void PrintLeaked() {
   Printf("\n");
   Printf("Reporting individual objects:\n");
-  ForEachChunk(PrintLeakedCb());
+  ForEachChunk(PrintLeakedCb, 0 /* arg */);
 }
 
 struct DoLeakCheckParam {
   bool success;
   LeakReport leak_report;
 };
 
 static void DoLeakCheckCallback(const SuspendedThreadsList &suspended_threads,
                                 void *arg) {
   DoLeakCheckParam *param = reinterpret_cast<DoLeakCheckParam *>(arg);
   CHECK(param);
   CHECK(!param->success);
   CHECK(param->leak_report.IsEmpty());
   ClassifyAllChunks(suspended_threads);
-  CollectLeaks(&param->leak_report);
+  ForEachChunk(CollectLeaksCb, &param->leak_report);
   if (!param->leak_report.IsEmpty() && flags()->report_objects)
     PrintLeaked();
   param->success = true;
 }
 
 void DoLeakCheck() {
   BlockingMutexLock l(&global_mutex);
   static bool already_done;

lib/lsan/lsan_common_linux.cc

void InitializePlatformSpecificModules() {
   else if (num_matches > 1)
     Report("LeakSanitizer: Multiple modules match \"%s\". "
            "TLS will not be handled correctly.\n", kLinkerName);
   linker = 0;
 }
 
 static int ProcessGlobalRegionsCallback(struct dl_phdr_info *info, size_t size,
                                         void *data) {
-  Frontier *frontier =
-      reinterpret_cast<Frontier *>(data);
+  Frontier *frontier = reinterpret_cast<Frontier *>(data);
   for (uptr j = 0; j < info->dlpi_phnum; j++) {
     const ElfW(Phdr) *phdr = &(info->dlpi_phdr[j]);
     // We're looking for .data and .bss sections, which reside in writeable,
     // loadable segments.
     if (!(phdr->p_flags & PF_W) || (phdr->p_type != PT_LOAD) ||
         (phdr->p_memsz == 0))
       continue;
     uptr begin = info->dlpi_addr + phdr->p_vaddr;
if (begin <= allocator_begin && allocator_begin < end) {
                              kReachable);
     } else {
       ScanRangeForPointers(begin, end, frontier, "GLOBAL", kReachable);
     }
   }
   return 0;
 }
 
-// Scan global variables for heap pointers.
+// Scans global variables for heap pointers.
 void ProcessGlobalRegions(Frontier *frontier) {
   // FIXME: dl_iterate_phdr acquires a linker lock, so we run a risk of
   // deadlocking by running this under StopTheWorld. However, the lock is
   // reentrant, so we should be able to fix this by acquiring the lock before
   // suspending threads.
   dl_iterate_phdr(ProcessGlobalRegionsCallback, frontier);
 }
 
 static uptr GetCallerPC(u32 stack_id) {
   CHECK(stack_id);
   uptr size = 0;
   const uptr *trace = StackDepotGet(stack_id, &size);
   // The top frame is our malloc/calloc/etc. The next frame is the caller.
   if (size >= 2)
     return trace[1];
   return 0;
 }
 
-void ProcessPlatformSpecificAllocationsCb::operator()(void *p) const {
-  p = GetUserBegin(p);
-  LsanMetadata m(p);
+// ForEachChunk callback. Identifies unreachable chunks which must be treated as
+// reachable. Marks them as reachable and adds them to the frontier.
+static void ProcessPlatformSpecificAllocationsCb(uptr chunk, void *arg) {
+  CHECK(arg);
+  chunk = GetUserBegin(chunk);
+  LsanMetadata m(chunk);
   if (m.allocated() && m.tag() != kReachable) {
     if (linker->containsAddress(GetCallerPC(m.stack_trace_id()))) {
       m.set_tag(kReachable);
-      frontier_->push_back(reinterpret_cast<uptr>(p));
+      reinterpret_cast<Frontier *>(arg)->push_back(chunk);
     }
   }
 }
 
-// Handle dynamically allocated TLS blocks by treating all chunks allocated from
-// ld-linux.so as reachable.
+// Handles dynamically allocated TLS blocks by treating all chunks allocated
+// from ld-linux.so as reachable.
 void ProcessPlatformSpecificAllocations(Frontier *frontier) {
   if (!flags()->use_tls) return;
   if (!linker) return;
-  ForEachChunk(ProcessPlatformSpecificAllocationsCb(frontier));
+  ForEachChunk(ProcessPlatformSpecificAllocationsCb, frontier);
 }
 
 }  // namespace __lsan
 #endif  // CAN_SANITIZE_LEAKS && SANITIZER_LINUX

lib/sanitizer_common/sanitizer_allocator.h

 };
 
 // Allocators call these callbacks on mmap/munmap.
 struct NoOpMapUnmapCallback {
   void OnMap(uptr p, uptr size) const { }
   void OnUnmap(uptr p, uptr size) const { }
 };
 
+// Callback type for iterating over chunks.
+typedef void (*ForEachChunkCallback)(uptr chunk, void *arg);
+
 // SizeClassAllocator64 -- allocator for 64-bit address space.
 //
 // Space: a portion of address space of kSpaceSize bytes starting at
 // a fixed address (kSpaceBeg). Both constants are powers of two and
 // kSpaceBeg is kSpaceSize-aligned.
 // At the beginning the entire space is mprotect-ed, then small parts of it
 // are mapped on demand.
 //
public:
   }
 
   void ForceUnlock() {
     for (int i = (int)kNumClasses - 1; i >= 0; i--) {
       GetRegionInfo(i)->mutex.Unlock();
     }
   }
 
-  // Iterate over existing chunks. May include chunks that are not currently
-  // allocated to the user (e.g. freed).
-  // The caller is expected to call ForceLock() before calling this function.
-  template<typename Callable>
-  void ForEachChunk(const Callable &callback) {
+  // Iterate over all existing chunks.
+  // The allocator must be locked when calling this function.
+  void ForEachChunk(ForEachChunkCallback callback, void *arg) {
     for (uptr class_id = 1; class_id < kNumClasses; class_id++) {
       RegionInfo *region = GetRegionInfo(class_id);
       uptr chunk_size = SizeClassMap::Size(class_id);
       uptr region_beg = kSpaceBeg + class_id * kRegionSize;
-      for (uptr p = region_beg;
-           p < region_beg + region->allocated_user;
-           p += chunk_size) {
-        // Too slow: CHECK_EQ((void *)p, GetBlockBegin((void *)p));
-        callback((void *)p);
+      for (uptr chunk = region_beg;
+           chunk < region_beg + region->allocated_user;
+           chunk += chunk_size) {
+        // Too slow: CHECK_EQ((void *)chunk, GetBlockBegin((void *)chunk));
+        callback(chunk, arg);
       }
     }
   }
 
   typedef SizeClassMap SizeClassMapT;
   static const uptr kNumClasses = SizeClassMap::kNumClasses;
   static const uptr kNumClassesRounded = SizeClassMap::kNumClassesRounded;
 
public:
   }
 
   void ForceUnlock() {
     for (int i = kNumClasses - 1; i >= 0; i--) {
       GetSizeClassInfo(i)->mutex.Unlock();
     }
   }
 
-  // Iterate over existing chunks. May include chunks that are not currently
-  // allocated to the user (e.g. freed).
-  // The caller is expected to call ForceLock() before calling this function.
-  template<typename Callable>
-  void ForEachChunk(const Callable &callback) {
+  // Iterate over all existing chunks.
+  // The allocator must be locked when calling this function.
+  void ForEachChunk(ForEachChunkCallback callback, void *arg) {
     for (uptr region = 0; region < kNumPossibleRegions; region++)
       if (possible_regions[region]) {
         uptr chunk_size = SizeClassMap::Size(possible_regions[region]);
         uptr max_chunks_in_region = kRegionSize / (chunk_size + kMetadataSize);
         uptr region_beg = region * kRegionSize;
-        for (uptr p = region_beg;
-             p < region_beg + max_chunks_in_region * chunk_size;
-             p += chunk_size) {
-          // Too slow: CHECK_EQ((void *)p, GetBlockBegin((void *)p));
-          callback((void *)p);
+        for (uptr chunk = region_beg;
+             chunk < region_beg + max_chunks_in_region * chunk_size;
+             chunk += chunk_size) {
+          // Too slow: CHECK_EQ((void *)chunk, GetBlockBegin((void *)chunk));
+          callback(chunk, arg);
         }
       }
   }
 
   void PrintStats() {
   }
 
   typedef SizeClassMap SizeClassMapT;
public:
   void ForceLock() {
     mutex_.Lock();
   }
 
   void ForceUnlock() {
     mutex_.Unlock();
   }
 
-  // Iterate over existing chunks. May include chunks that are not currently
-  // allocated to the user (e.g. freed).
-  // The caller is expected to call ForceLock() before calling this function.
-  template<typename Callable>
-  void ForEachChunk(const Callable &callback) {
+  // Iterate over all existing chunks.
+  // The allocator must be locked when calling this function.
+  void ForEachChunk(ForEachChunkCallback callback, void *arg) {
     for (uptr i = 0; i < n_chunks_; i++)
-      callback(GetUser(chunks_[i]));
+      callback(reinterpret_cast<uptr>(GetUser(chunks_[i])), arg);
   }
 
  private:
   static const int kMaxNumChunks = 1 << FIRST_32_SECOND_64(15, 18);
   struct Header {
     uptr map_beg;
     uptr map_size;
     uptr size;
void ForceLock() {
     secondary_.ForceLock();
   }
 
   void ForceUnlock() {
     secondary_.ForceUnlock();
     primary_.ForceUnlock();
   }
 
-  // Iterate over existing chunks. May include chunks that are not currently
-  // allocated to the user (e.g. freed).
-  // The caller is expected to call ForceLock() before calling this function.
-  template<typename Callable>
-  void ForEachChunk(const Callable &callback) {
-    primary_.ForEachChunk(callback);
-    secondary_.ForEachChunk(callback);
+  // Iterate over all existing chunks.
+  // The allocator must be locked when calling this function.
+  void ForEachChunk(ForEachChunkCallback callback, void *arg) {
+    primary_.ForEachChunk(callback, arg);
+    secondary_.ForEachChunk(callback, arg);
   }
 
  private:
   PrimaryAllocator primary_;
   SecondaryAllocator secondary_;
   AllocatorGlobalStats stats_;
 };
 
 // Returns true if calloc(size, n) should return 0 due to overflow in size*n.
 bool CallocShouldReturnNullDueToOverflow(uptr size, uptr n);
 
 }  // namespace __sanitizer
 
 #endif  // SANITIZER_ALLOCATOR_H
 

lib/sanitizer_common/tests/sanitizer_allocator_test.cc

TEST(Allocator, ScopedBuffer) {
   InternalScopedBuffer<char> char_buf(kSize);
   EXPECT_EQ(sizeof(char) * kSize, char_buf.size());  // NOLINT
   internal_memset(char_buf.data(), 'c', kSize);
   for (int i = 0; i < kSize; i++) {
     EXPECT_EQ('c', char_buf[i]);
   }
 }
 
-class IterationTestCallback {
- public:
-  explicit IterationTestCallback(std::set<void *> *chunks)
-    : chunks_(chunks) {}
-  void operator()(void *chunk) const {
-    chunks_->insert(chunk);
-  }
- private:
-  std::set<void *> *chunks_;
+void IterationTestCallback(uptr chunk, void *arg) {
+  reinterpret_cast<std::set<uptr> *>(arg)->insert(chunk);
 };
 
 template <class Allocator>
 void TestSizeClassAllocatorIteration() {
   Allocator *a = new Allocator;
   a->Init();
   SizeClassAllocatorLocalCache<Allocator> cache;
   memset(&cache, 0, sizeof(cache));
for (uptr s = 0; s < ARRAY_SIZE(sizes); s++) {
     // fprintf(stderr, "size: %ld iter: %ld\n", size, n_iter);
     for (uptr j = 0; j < n_iter; j++) {
       uptr class_id0 = Allocator::SizeClassMapT::ClassID(size);
       void *x = cache.Allocate(a, class_id0);
       allocated.push_back(x);
     }
   }
 
-  std::set<void *> reported_chunks;
-  IterationTestCallback callback(&reported_chunks);
+  std::set<uptr> reported_chunks;
   a->ForceLock();
-  a->ForEachChunk(callback);
+  a->ForEachChunk(IterationTestCallback, &reported_chunks);
   a->ForceUnlock();
 
   for (uptr i = 0; i < allocated.size(); i++) {
     // Don't use EXPECT_NE. Reporting the first mismatch is enough.
     ASSERT_NE(reported_chunks.find(allocated[i]), reported_chunks.end());
   }
 
   a->TestOnlyUnmap();
TEST(SanitizerCommon, LargeMmapAllocatorIteration) {
 
   static const uptr kNumAllocs = 1000;
   char *allocated[kNumAllocs];
   static const uptr size = 40;
   // Allocate some.
   for (uptr i = 0; i < kNumAllocs; i++)
     allocated[i] = (char *)a.Allocate(&stats, size, 1);
 
-  std::set<void *> reported_chunks;
-  IterationTestCallback callback(&reported_chunks);
+  std::set<uptr> reported_chunks;
   a.ForceLock();
-  a.ForEachChunk(callback);
+  a.ForEachChunk(IterationTestCallback, &reported_chunks);
   a.ForceUnlock();
 
   for (uptr i = 0; i < kNumAllocs; i++) {
     // Don't use EXPECT_NE. Reporting the first mismatch is enough.
     ASSERT_NE(reported_chunks.find(allocated[i]), reported_chunks.end());
   }
   for (uptr i = 0; i < kNumAllocs; i++)
     a.Deallocate(&stats, allocated[i]);