Fix memory leaks in address sanitizer darwin tests

[fjricci]

Summary

These leaks are detected by leak sanitizer for darwin.

[alekseyshl]

test/asan/TestCases/Darwin/malloc_set_zone_name-mprotect.cc

52 ↗

(On Diff #94966)

Who's holding (and leaking) the buffer?

[fjricci]

test/asan/TestCases/Darwin/malloc_set_zone_name-mprotect.cc

52 ↗

(On Diff #94966)

From looking at the only malloc_set_zone_name source I could find (https://opensource.apple.com/source/Libc/Libc-320.1.3/gen/malloc.c), it looks like libc itself is holding a copy, which it frees whenever the name is overwritten. For some reason, malloc_destroy_zone doesn't free that buffer (I assume it should).

[fjricci]

test/asan/TestCases/Darwin/malloc_set_zone_name-mprotect.cc

52 ↗

(On Diff #94966)

Another alternative which would probably work would be calling 'free(malloc_get_zone_name(zone))`, but that seemed hackier.

[alekseyshl]

test/asan/TestCases/Darwin/malloc_set_zone_name-mprotect.cc

52 ↗

(On Diff #94966)

Looking at the code, it's not a leak. The zone name buffer is allocated within the zone itself, so destroying the zone effectively deallocates the name too.

[kubamracek]

test/asan/TestCases/Darwin/malloc_set_zone_name-mprotect.cc

52 ↗

(On Diff #94966)

This leaks because we have an interceptor for malloc_destroy_zone, which doesn't really destroy the zone, nor does it free the name (see sanitizer_malloc_mac.inc). Could this be fixed in the interceptor instead?

[alekseyshl]

test/asan/TestCases/Darwin/malloc_set_zone_name-mprotect.cc

52 ↗

(On Diff #94966)

Right, what I meant to say, the actual malloc does not leak the name.

Fixing it in the interceptor sounds like a better idea.

[fjricci]

test/asan/TestCases/Darwin/malloc_set_zone_name-mprotect.cc

52 ↗

(On Diff #94966)

Changing the interceptor to free the name does fix the leak, I'll pull that out into a separate patch.

[kubamracek]

test/asan/TestCases/Darwin/malloc_set_zone_name-mprotect.cc

52 ↗

(On Diff #94966)

Great, thanks!

[fjricci]

Remove hack to clear malloc zone name

compiler-rt/trunk/lib/asan/tests/asan_mac_test_helpers.mm

 
 void TestNSURLDeallocation() {
   NSURL *base =
       [[NSURL alloc] initWithString:@"file://localhost/Users/glider/Library/"];
   volatile NSURL *u =
       [[NSURL alloc] initWithString:@"Saved Application State"
                      relativeToURL:base];
   [u release];
+  [base release];
 }

compiler-rt/trunk/test/asan/TestCases/Darwin/malloc_set_zone_name-mprotect.cc

int main() {
   for (int i = 0; i < kNumIter; i++) {
     mem[i + kNumIter] = (char*)malloc(8 * i);
   }
   // Access the allocated memory chunks and free them.
   for (int i = 0; i < kNumIter * 2; i++) {
     memset(mem[i], 'a', 8 * (i % kNumIter));
     free(mem[i]);
   }
+  malloc_destroy_zone(zone);
   return 0;
 }

compiler-rt/trunk/test/asan/TestCases/Darwin/scribble.cc

int main() {
 
   my_object->print_my_class_name();
   // CHECK-NOSCRIBBLE: class name: MyClass
   // CHECK-SCRIBBLE: isa = {{(0x)?}}{{5555555555555555|55555555}}
 
   fprintf(stderr, "okthxbai!\n");
   // CHECK-SCRIBBLE: okthxbai!
   // CHECK-NOSCRIBBLE: okthxbai!
+  free(my_class_isa);
 }

compiler-rt/trunk/test/asan/TestCases/Darwin/suppressions-darwin.cc

 int main() {
   char *a = (char *)malloc(6);
   strcpy(a, "hello");
   CFStringRef str =
       CFStringCreateWithBytes(kCFAllocatorDefault, (unsigned char *)a, 10,
                               kCFStringEncodingUTF8, FALSE); // BOOM
   fprintf(stderr, "Ignored.\n");
   free(a);
+  CFRelease(str);
 }
 
 // CHECK-CRASH: AddressSanitizer: heap-buffer-overflow
 // CHECK-CRASH-NOT: Ignored.
 // CHECK-IGNORE-NOT: AddressSanitizer: heap-buffer-overflow
 // CHECK-IGNORE: Ignored.

compiler-rt/trunk/test/asan/TestCases/Darwin/suppressions-sandbox.cc

 int main() {
   char *a = (char *)malloc(6);
   strcpy(a, "hello");
   CFStringRef str =
       CFStringCreateWithBytes(kCFAllocatorDefault, (unsigned char *)a, 10,
                               kCFStringEncodingUTF8, FALSE);  // BOOM
   fprintf(stderr, "Ignored.\n");
   free(a);
+  CFRelease(str);
 }
 
 // CHECK-CRASH: AddressSanitizer: heap-buffer-overflow
 // CHECK-CRASH-NOT: Ignored.
 // CHECK-IGNORE-NOT: AddressSanitizer: heap-buffer-overflow
 // CHECK-IGNORE: Ignored.