[MSan] Print current stack on CHECK violation

[alekseyshl]

Summary

Print current stack on CHECK violation to aid debugging and
match other sanitizers functionality.

[eugenis]

Could you reliably trigger a check failure, with a wild free for example?
I'm thinking a test would be nice.

This has potential for deadlocks. Slow unwinder may malloc AFAIK, which is not good if the CHECK failure is itself in malloc. On the other hand, fast unwinder would require frame pointers in internal msan and sanitizer_common functions, which we try to avoid.

I'm tempted to land this anyway and see if the deadlocks actually happen in practice or they are purely theoretical.

[alekseyshl]

• Add a test.

[alekseyshl]

Yes, that's how I tested it, with unaligned pointer (added the same test).

MSan does make an effort to block interceptors during unwind (see SymbolizerScope), so if the problem arises, we'll fix it.

lib/msan/msan.h

if (__msan_get_track_origins() > 1 && msan_inited) {                    \
     if (!SANITIZER_CAN_FAST_UNWIND)                                       \
       GetStackTrace(&stack, Min(1, flags()->store_context_size), pc, bp,  \
                     nullptr, false);                                      \
     else                                                                  \
       GetStackTrace(&stack, flags()->store_context_size, pc, bp, nullptr, \
                     common_flags()->fast_unwind_on_malloc);               \
   }
 
+#define GET_STORE_STACK_TRACE \
+  GET_STORE_STACK_TRACE_PC_BP(StackTrace::GetCurrentPc(), GET_CURRENT_FRAME())
+
 #define GET_FATAL_STACK_TRACE_PC_BP(pc, bp)              \
   BufferedStackTrace stack;                              \
   if (msan_inited)                                       \
   GetStackTrace(&stack, kStackTraceMax, pc, bp, nullptr, \
                 common_flags()->fast_unwind_on_fatal)
 
-#define GET_STORE_STACK_TRACE \
-  GET_STORE_STACK_TRACE_PC_BP(StackTrace::GetCurrentPc(), GET_CURRENT_FRAME())
+#define GET_FATAL_STACK_TRACE_HERE \
+  GET_FATAL_STACK_TRACE_PC_BP(StackTrace::GetCurrentPc(), GET_CURRENT_FRAME())
+
+#define PRINT_CURRENT_STACK_CHECK() \
+  {                                 \
+    GET_FATAL_STACK_TRACE_HERE;     \
+    stack.Print();                  \
+  }
 
 class ScopedThreadLocalStateBackup {
  public:
   ScopedThreadLocalStateBackup() { Backup(); }
   ~ScopedThreadLocalStateBackup() { Restore(); }
   void Backup();
   void Restore();
  private:

lib/msan/msan.cc

static void OnStackUnwind(const SignalContext &sig, const void *,
   GetStackTrace(stack, kStackTraceMax, sig.pc, sig.bp, sig.context,
                 common_flags()->fast_unwind_on_fatal);
 }
 
 static void MsanOnDeadlySignal(int signo, void *siginfo, void *context) {
   HandleDeadlySignal(siginfo, context, GetTid(), &OnStackUnwind, nullptr);
 }
 
+static void MsanCheckFailed(const char *file, int line, const char *cond,
+                            u64 v1, u64 v2) {
+  Report("MemorySanitizer CHECK failed: %s:%d \"%s\" (0x%zx, 0x%zx)\n", file,
+         line, cond, (uptr)v1, (uptr)v2);
+  PRINT_CURRENT_STACK_CHECK();
+  Die();
+}
+
 void __msan_init() {
   CHECK(!msan_init_is_running);
   if (msan_inited) return;
   msan_init_is_running = 1;
   SanitizerToolName = "MemorySanitizer";
 
   AvoidCVE_2016_2143();
   InitTlsSize();
 
   CacheBinaryName();
   InitializeFlags();
 
+  // Install tool-specific callbacks in sanitizer_common.
+  SetCheckFailedCallback(MsanCheckFailed);
+
   __sanitizer_set_report_path(common_flags()->log_path);
 
   InitializeInterceptors();
   InstallDeadlySignalHandlers(MsanOnDeadlySignal);
   InstallAtExitHandler(); // Needs __cxa_atexit interceptor.
 
   DisableCoreDumperIfNecessary();
   if (StackSizeIsUnlimited()) {

test/msan/check-handler.cc

+// RUN: %clangxx_msan -O0 -g %s -o %t && not %run %t 2>&1 | FileCheck %s
+
+// Verify that CHECK handler prints a stack on CHECK fail.
+
+#include <stdlib.h>
+
+int main(void) {
+  // Allocate chunk from the secondary allocator to trigger CHECK(IsALigned())
+  // in its free() path.
+  void *p = malloc(8 << 20);
+  free(reinterpret_cast<char*>(p) + 1);
+  // CHECK: MemorySanitizer: bad pointer
+  // CHECK: MemorySanitizer CHECK failed
+  // CHECK: #0
+  return 0;
+}