Runtime check of poisoning derived class members.

[nmusgrave]

Summary

Simple test case to verify that an instance of a derived class with virtual base is properly poisoned

[eugenis]

test/msan/dtor-derived-class.cc

12

missing space

31

Allocate this with new(), otherwise you get undefined behavior at exit.

34

This can be re-phrased as assert(__msan_test_shadow(...) != -1).
No printfs, no checks. Don't even need FIleCheck.

35

An object may contain padding that does not have to be initialized. It's better to check user-visible things, like B::x_ and D::y_;

49

Do you check that the local pointer to b is not poisoned? It's true, of course, why would it be?

[nmusgrave]

• modified test to be more concise, and check the local pointer to the destroyed object

[eugenis]

LGTM

test/msan/dtor-derived-class.cc

34

Please remove this check, and the same check for "b".

[nmusgrave]

• revised test to not examine padding- only explicit object members

test/msan/dtor-derived-class.cc

+
+// RUN: %clangxx_msan %s -fsanitize=memory -fsanitize-memory-use-after-dtor -o %t && MSAN_OPTIONS=poison_in_dtor=1 %run %t >%t.out 2>&1
+
+// RUN: %clangxx_msan %s -O1 -fsanitize=memory -fsanitize-memory-use-after-dtor -o %t && MSAN_OPTIONS=poison_in_dtor=1 %run %t >%t.out 2>&1
+
+// RUN: %clangxx_msan %s -O2 -fsanitize=memory -fsanitize-memory-use-after-dtor -o %t && MSAN_OPTIONS=poison_in_dtor=1  %run %t >%t.out 2>&1
+
+#include <stdio.h>
+#include <sanitizer/msan_interface.h>
+#include <assert.h>
+
+struct Base {
+  int x;
+  Base() {
+    x = 5;
+  }
+  virtual ~Base() { }
+};
+
+struct Derived:public Base {
+  int y;
+  Derived() {
+    y = 10;
+  }
+  ~Derived() { }
+};
+
+int main() {
+  Derived *d = new Derived();
+  d->~Derived();
+
+  // Verify that local pointer is unpoisoned, and the object itself is.
+  assert(__msan_test_shadow(&d, sizeof(d)) == -1);
+  assert(__msan_test_shadow(d, sizeof(*d)) != -1);
+  assert(__msan_test_shadow(&d->x, sizeof(d->x)) != -1);
+  assert(__msan_test_shadow(&d->y, sizeof(d->y)) != -1);
+
+  Base *b = new Derived();
+  b->~Base();
+
+  // Verify that local pointer is unpoisoned, and the object itself is.
+  assert(__msan_test_shadow(&b, sizeof(b)) == -1);
+  assert(__msan_test_shadow(b, sizeof(*b)) != -1);
+  assert(__msan_test_shadow(&b->x, sizeof(b->x)) != -1);
+
+  return 0;
+}