[libc++] Avoid UB in the no-exceptions mode in a few places

[ldionne]

Summary

A few places in the library seem to behave unexpectedly when the library
is compiled or used with exceptions disabled. For example, not throwing
an exception when a pointer is NULL can lead us to dereference the pointer
later on, which is UB. This patch fixes such occurences.

It's hard to tell whether there are other places where the no-exceptions
mode misbehaves like this, because the replacement for throwing an
exception does not always seem to be abort()ing, but at least this
patch will improve the situation somewhat.

See http://lists.llvm.org/pipermail/libcxx-dev/2019-January/000172.html

[ldionne]

Here's the justification for changes in this patch.

libcxx/include/unordered_map

1606 ↗

(On Diff #185328)

Justification: If we don't abort(), we dereference __i below, which is a past-the-end iterator.

1616 ↗

(On Diff #185328)

Ditto.

libcxx/src/hash.cpp

179 ↗

(On Diff #185328)

I guess nothing good happens if we keep going after n has overflown, but TBH I haven't done a deep analysis of this one.

libcxx/src/ios.cpp

271 ↗

(On Diff #185328)

Actually, looking at this again, it seems like we probably don't want to abort here, since the stream will report the error with the error flags. So I should not change this one -- @mclow.lists does that seem right to you?

312 ↗

(On Diff #185328)

Justification: If we don't abort() when new_callbacks is null, we assign new_callbacks to __fn_ on line 343 and we then access __fn[__event_size] on line 350, which is UB.

317 ↗

(On Diff #185328)

Ditto.

324 ↗

(On Diff #185328)

Ditto.

331 ↗

(On Diff #185328)

Ditto.

350 ↗

(On Diff #185328)

UB here if new_callbacks is null and we don't abort().

libcxx/src/locale.cpp

472 ↗

(On Diff #185328)

Justification: If we don't abort(), we will access facets_ at an out-of-bounds index id. The check has_facet(id) roughly checks whether id is in bound for facets_.

539 ↗

(On Diff #185328)

Justification: If we don't abort(), we create the std::string member name_ inside __imp from the name parameter (which is null). It's UB to construct a std::string from a null char const*.

552 ↗

(On Diff #185328)

Ditto.

[dexonsmith]

libcxx/src/ios.cpp

271 ↗

(On Diff #185328)

::abort seems more consistent to me. The user has set the exception bit, so I wouldn't expect them to have control flow to handle errors otherwise. Moreover, the direct user could be templated/inlined header code which doesn't know that -fno-exceptions has been passed for this project/TU.

More generally, I think a strict library policy of turning throws into aborts will lead to behaviour that's predictable for users.

[mclow.lists]

I think all of these are no-brainers except the one calling __throw_failure.

libcxx/src/ios.cpp

271 ↗

(On Diff #185328)

If we do this, we should be consistent about it.
Do we want to say "Compiling with exceptions disabled makes iostreams act as if state & __exceptions_ is always false?

And then what do we do if the user explicitly sets the __exceptions_ flag? Abort there?

[jfb]

I'm wondering if, as a follow-up, the XFAIL tests that validate the behavior for exceptions should instead:

• Not XFAIL
• Install a SIGABORT handler, and call exit(0) or something
• Instead of catch, call exit(1) because we expected the abort handler to be called.

That type of testing will find any missing fixes from this patch (and prevent regressions).

[ldionne]

In D57761#1385562, @jfb wrote:

I'm wondering if, as a follow-up, the XFAIL tests that validate the behavior for exceptions should instead:

• Not XFAIL
• Install a SIGABORT handler, and call exit(0) or something
• Instead of catch, call exit(1) because we expected the abort handler to be called.

That type of testing will find any missing fixes from this patch (and prevent regressions).

Yes, I agree we should test the no-exceptions behaviour just like we test the behaviour with exceptions enabled. There's a question of whether this should be part of test/std or test/libcxx, however, since the Standard currently doesn't mention implementations without exceptions (I think).

libcxx/src/ios.cpp

271 ↗

(On Diff #185328)

Moreover, the direct user could be templated/inlined header code which doesn't know that -fno-exceptions has been passed for this project/TU.

We don't have a story for mixing code built with -fno-exceptions with code built with -fexceptions. For starters, it's an ODR violation to do that because the functions in the headers will have different definitions. One would technically have to enable per-TU ABI insulation with _LIBCPP_HIDE_FROM_ABI_PER_TU to make this work, but I would _strongly_ recommend against recommending that as a solution.

More generally, I think a strict library policy of turning throws into aborts will lead to behaviour that's predictable for users.

I agree.

Do we want to say "Compiling with exceptions disabled makes iostreams act as if state & __exceptions_ is always false?
And then what do we do if the user explicitly sets the __exceptions_ flag? Abort there?

That's certainly not what I want. I think I'm with Duncan when he says that a simple and strict policy of turning throws into aborts is the right thing to do. Cleverness is the enemy here.

In that case, it seems like I should keep this change.

[jfb]

In D57761#1385562, @jfb wrote:

I'm wondering if, as a follow-up, the XFAIL tests that validate the behavior for exceptions should instead:

• Not XFAIL
• Install a SIGABORT handler, and call exit(0) or something
• Instead of catch, call exit(1) because we expected the abort handler to be called.

That type of testing will find any missing fixes from this patch (and prevent regressions).

To clarify my logic based on a private chat with @mclow.lists: Louis is changing code that's clearly doing the wrong thing, yet no tests are being changed. Louis' change is correct, therefore the tests were inadequate.

I don't think this patch really needs to fix the tests, but I think the tests need a bit of love for this odd use case.

[ldionne]

In D57761#1385646, @jfb wrote:

I don't think this patch really needs to fix the tests, but I think the tests need a bit of love for this odd use case.

Not so odd, really. For example, it's reasonable to test that a user won't get UB if they fetch a key that does not exist in a map and exceptions are disabled. If we don't, we can basically declare our support for -fno-exceptions to be inexistent.

[mclow.lists]

In D57761#1385680, @ldionne wrote:

In D57761#1385646, @jfb wrote:

I don't think this patch really needs to fix the tests, but I think the tests need a bit of love for this odd use case.

Not so odd, really. For example, it's reasonable to test that a user won't get UB if they fetch a key that does not exist in a map and exceptions are disabled. If we don't, we can basically declare our support for -fno-exceptions to be inexistent.

(As I said to JF in IRC) It's reasonable to test that in test/libcxx, not lib/std.

[dexonsmith]

libcxx/src/ios.cpp

271 ↗

(On Diff #185328)

Moreover, the direct user could be templated/inlined header code which doesn't know that -fno-exceptions has been passed for this project/TU.

We don't have a story for mixing code built with -fno-exceptions with code built with -fexceptions. For starters, it's an ODR violation to do that because the functions in the headers will have different definitions. One would technically have to enable per-TU ABI insulation with _LIBCPP_HIDE_FROM_ABI_PER_TU to make this work, but I would _strongly_ recommend against recommending that as a solution.

FWIW, I wasn't necessarily suggesting mixing code between -fexceptions and -fno-exceptions. Consider:

• A header-only library A has code that uses iostream somehow.
• A project B builds with -fno-exceptions and uses library A.
• A project C builds with -fexceptions and uses library A.
• Project B and project C are completely unrelated, except that they share a dependency.

I don't think library A should need to detect whether exceptions are enabled to do the right thing for both project B and project C. The simple abort-on-throw rule will simplify life for library A.

[ldionne]

Added tests for the abort() behavior and fixed UB I had missed in map::at().

[ldionne]

@mclow.lists @jfb I added tests per your request. Please LMK if this is satisfactory.

[jfb]

The tests are exactly what I had in mind, great! LGTM.

libcxx/test/libcxx/containers/associative/map/at.abort.pass.cpp

30 ↗

(On Diff #186318)

*chef's kiss*

[mclow.lists]

This looks fine to me - thanks!

libcxx/trunk/include/ios

class _LIBCPP_EXCEPTION_ABI ios_base::failure
     : public system_error
 {
 public:
     explicit failure(const string& __msg, const error_code& __ec = io_errc::stream);
     explicit failure(const char* __msg, const error_code& __ec = io_errc::stream);
     virtual ~failure() throw();
 };
 
+_LIBCPP_NORETURN inline _LIBCPP_INLINE_VISIBILITY
+void __throw_failure(char const* __msg) {
+#ifndef _LIBCPP_NO_EXCEPTIONS
+    throw ios_base::failure(__msg);
+#else
+    ((void)__msg);
+    _VSTD::abort();
+#endif
+}
+
 class _LIBCPP_TYPE_VIS ios_base::Init
 {
 public:
     Init();
     ~Init();
 };
 
 // fmtflags

libcxx/trunk/include/map

 #endif  // _LIBCPP_CXX03_LANG
 
 template <class _Key, class _Tp, class _Compare, class _Allocator>
 _Tp&
 map<_Key, _Tp, _Compare, _Allocator>::at(const key_type& __k)
 {
     __parent_pointer __parent;
     __node_base_pointer& __child = __tree_.__find_equal(__parent, __k);
-#ifndef _LIBCPP_NO_EXCEPTIONS
     if (__child == nullptr)
-        throw out_of_range("map::at:  key not found");
-#endif  // _LIBCPP_NO_EXCEPTIONS
+        __throw_out_of_range("map::at:  key not found");
     return static_cast<__node_pointer>(__child)->__value_.__get_value().second;
 }
 
 template <class _Key, class _Tp, class _Compare, class _Allocator>
 const _Tp&
 map<_Key, _Tp, _Compare, _Allocator>::at(const key_type& __k) const
 {
     __parent_pointer __parent;
     __node_base_pointer __child = __tree_.__find_equal(__parent, __k);
-#ifndef _LIBCPP_NO_EXCEPTIONS
     if (__child == nullptr)
-        throw out_of_range("map::at:  key not found");
-#endif  // _LIBCPP_NO_EXCEPTIONS
+        __throw_out_of_range("map::at:  key not found");
     return static_cast<__node_pointer>(__child)->__value_.__get_value().second;
 }
 
 
 template <class _Key, class _Tp, class _Compare, class _Allocator>
 inline _LIBCPP_INLINE_VISIBILITY
 bool
 operator==(const map<_Key, _Tp, _Compare, _Allocator>& __x,

libcxx/trunk/include/unordered_map

 
 #endif  // _LIBCPP_CXX03_MODE
 
 template <class _Key, class _Tp, class _Hash, class _Pred, class _Alloc>
 _Tp&
 unordered_map<_Key, _Tp, _Hash, _Pred, _Alloc>::at(const key_type& __k)
 {
     iterator __i = find(__k);
-#ifndef _LIBCPP_NO_EXCEPTIONS
     if (__i == end())
-        throw out_of_range("unordered_map::at: key not found");
-#endif  // _LIBCPP_NO_EXCEPTIONS
+        __throw_out_of_range("unordered_map::at: key not found");
     return __i->second;
 }
 
 template <class _Key, class _Tp, class _Hash, class _Pred, class _Alloc>
 const _Tp&
 unordered_map<_Key, _Tp, _Hash, _Pred, _Alloc>::at(const key_type& __k) const
 {
     const_iterator __i = find(__k);
-#ifndef _LIBCPP_NO_EXCEPTIONS
     if (__i == end())
-        throw out_of_range("unordered_map::at: key not found");
-#endif  // _LIBCPP_NO_EXCEPTIONS
+        __throw_out_of_range("unordered_map::at: key not found");
     return __i->second;
 }
 
 template <class _Key, class _Tp, class _Hash, class _Pred, class _Alloc>
 inline _LIBCPP_INLINE_VISIBILITY
 void
 swap(unordered_map<_Key, _Tp, _Hash, _Pred, _Alloc>& __x,
      unordered_map<_Key, _Tp, _Hash, _Pred, _Alloc>& __y)

libcxx/trunk/src/hash.cpp

 // are fewer potential primes to search, and fewer potential primes to divide
 // against.
 
 template <size_t _Sz = sizeof(size_t)>
 inline _LIBCPP_INLINE_VISIBILITY
 typename enable_if<_Sz == 4, void>::type
 __check_for_overflow(size_t N)
 {
-#ifndef _LIBCPP_NO_EXCEPTIONS
     if (N > 0xFFFFFFFB)
-        throw overflow_error("__next_prime overflow");
-#else
-    (void)N;
-#endif
+        __throw_overflow_error("__next_prime overflow");
 }
 
 template <size_t _Sz = sizeof(size_t)>
 inline _LIBCPP_INLINE_VISIBILITY
 typename enable_if<_Sz == 8, void>::type
 __check_for_overflow(size_t N)
 {
-#ifndef _LIBCPP_NO_EXCEPTIONS
     if (N > 0xFFFFFFFFFFFFFFC5ull)
-        throw overflow_error("__next_prime overflow");
-#else
-    (void)N;
-#endif
+        __throw_overflow_error("__next_prime overflow");
 }
 
 size_t
 __next_prime(size_t n)
 {
     const size_t L = 210;
     const size_t N = sizeof(small_primes) / sizeof(small_primes[0]);
     // If n is small enough, search in small_primes

libcxx/trunk/src/ios.cpp

 
 void
 ios_base::clear(iostate state)
 {
     if (__rdbuf_)
         __rdstate_ = state;
     else
         __rdstate_ = state | badbit;
-#ifndef _LIBCPP_NO_EXCEPTIONS
+
     if (((state | (__rdbuf_ ? goodbit : badbit)) & __exceptions_) != 0)
-        throw failure("ios_base::clear");
-#endif  // _LIBCPP_NO_EXCEPTIONS
+        __throw_failure("ios_base::clear");
 }
 
 // init
 
 void
 ios_base::init(void* sb)
 {
     __rdbuf_ = sb;
ios_base::copyfmt(const ios_base& rhs)
     unique_ptr<event_callback, void (*)(void*)> new_callbacks(0, free);
     unique_ptr<int, void (*)(void*)> new_ints(0, free);
     unique_ptr<long, void (*)(void*)> new_longs(0, free);
     unique_ptr<void*, void (*)(void*)> new_pointers(0, free);
     if (__event_cap_ < rhs.__event_size_)
     {
         size_t newesize = sizeof(event_callback) * rhs.__event_size_;
         new_callbacks.reset(static_cast<event_callback*>(malloc(newesize)));
-#ifndef _LIBCPP_NO_EXCEPTIONS
         if (!new_callbacks)
-            throw bad_alloc();
-#endif  // _LIBCPP_NO_EXCEPTIONS
+            __throw_bad_alloc();
 
         size_t newisize = sizeof(int) * rhs.__event_size_;
         new_ints.reset(static_cast<int *>(malloc(newisize)));
-#ifndef _LIBCPP_NO_EXCEPTIONS
         if (!new_ints)
-            throw bad_alloc();
-#endif  // _LIBCPP_NO_EXCEPTIONS
+            __throw_bad_alloc();
     }
     if (__iarray_cap_ < rhs.__iarray_size_)
     {
         size_t newsize = sizeof(long) * rhs.__iarray_size_;
         new_longs.reset(static_cast<long*>(malloc(newsize)));
-#ifndef _LIBCPP_NO_EXCEPTIONS
         if (!new_longs)
-            throw bad_alloc();
-#endif  // _LIBCPP_NO_EXCEPTIONS
+            __throw_bad_alloc();
     }
     if (__parray_cap_ < rhs.__parray_size_)
     {
         size_t newsize = sizeof(void*) * rhs.__parray_size_;
         new_pointers.reset(static_cast<void**>(malloc(newsize)));
-#ifndef _LIBCPP_NO_EXCEPTIONS
         if (!new_pointers)
-            throw bad_alloc();
-#endif  // _LIBCPP_NO_EXCEPTIONS
+            __throw_bad_alloc();
     }
     // Got everything we need.  Copy everything but __rdstate_, __rdbuf_ and __exceptions_
     __fmtflags_ = rhs.__fmtflags_;
     __precision_ = rhs.__precision_;
     __width_ = rhs.__width_;
     locale& lhs_loc = *reinterpret_cast<locale*>(&__loc_);
     const locale& rhs_loc = *reinterpret_cast<const locale*>(&rhs.__loc_);
     lhs_loc = rhs_loc;

libcxx/trunk/src/locale.cpp

locale::__imp::install(facet* f, long id)
     if (facets_[static_cast<size_t>(id)])
         facets_[static_cast<size_t>(id)]->__release_shared();
     facets_[static_cast<size_t>(id)] = hold.release();
 }
 
 const locale::facet*
 locale::__imp::use_facet(long id) const
 {
-#ifndef _LIBCPP_NO_EXCEPTIONS
     if (!has_facet(id))
-        throw bad_cast();
-#endif  // _LIBCPP_NO_EXCEPTIONS
+        __throw_bad_cast();
     return facets_[static_cast<size_t>(id)];
 }
 
 // locale
 
 const locale&
 locale::__imp::make_classic()
 {

 {
     other.__locale_->__add_shared();
     __locale_->__release_shared();
     __locale_ = other.__locale_;
     return *this;
 }
 
 locale::locale(const char* name)
-#ifndef _LIBCPP_NO_EXCEPTIONS
     : __locale_(name ? new __imp(name)
-                     : throw runtime_error("locale constructed with null"))
-#else  // _LIBCPP_NO_EXCEPTIONS
-    : __locale_(new __imp(name))
-#endif
+                     : (__throw_runtime_error("locale constructed with null"), (__imp*)0))
 {
     __locale_->__add_shared();
 }
 
 locale::locale(const string& name)
     : __locale_(new __imp(name))
 {
     __locale_->__add_shared();
 }
 
 locale::locale(const locale& other, const char* name, category c)
-#ifndef _LIBCPP_NO_EXCEPTIONS
     : __locale_(name ? new __imp(*other.__locale_, name, c)
-                     : throw runtime_error("locale constructed with null"))
-#else  // _LIBCPP_NO_EXCEPTIONS
-    : __locale_(new __imp(*other.__locale_, name, c))
-#endif
+                     : (__throw_runtime_error("locale constructed with null"), (__imp*)0))
 {
     __locale_->__add_shared();
 }
 
 locale::locale(const locale& other, const string& name, category c)
     : __locale_(new __imp(*other.__locale_, name, c))
 {
     __locale_->__add_shared();

libcxx/trunk/test/libcxx/containers/associative/map/at.abort.pass.cpp

+//===----------------------------------------------------------------------===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+
+// <map>
+
+// class map
+
+// mapped_type& at(const key_type& k);
+
+// Make sure we abort() when exceptions are disabled and we fetch a key that
+// is not in the map.
+
+// REQUIRES: libcpp-no-exceptions
+
+#include <csignal>
+#include <cstdlib>
+#include <map>
+
+
+void exit_success(int) {
+    std::_Exit(EXIT_SUCCESS);
+}
+
+int main(int, char**) {
+    std::signal(SIGABRT, exit_success);
+    std::map<int, int> map;
+    map.at(1);
+    return EXIT_FAILURE;
+}

libcxx/trunk/test/libcxx/containers/associative/map/at.const.abort.pass.cpp

+//===----------------------------------------------------------------------===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+
+// <map>
+
+// class map
+
+// const mapped_type& at(const key_type& k) const;
+
+// Make sure we abort() when exceptions are disabled and we fetch a key that
+// is not in the map.
+
+// REQUIRES: libcpp-no-exceptions
+
+#include <csignal>
+#include <cstdlib>
+#include <map>
+
+
+void exit_success(int) {
+    std::_Exit(EXIT_SUCCESS);
+}
+
+int main(int, char**) {
+    std::signal(SIGABRT, exit_success);
+    std::map<int, int> const map;
+    map.at(1);
+    return EXIT_FAILURE;
+}

libcxx/trunk/test/libcxx/containers/unord/unord.map/at.abort.pass.cpp

+//===----------------------------------------------------------------------===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+
+// <unordered_map>
+
+// class unordered_map
+
+// mapped_type& at(const key_type& k);
+
+// Make sure we abort() when exceptions are disabled and we fetch a key that
+// is not in the map.
+
+// REQUIRES: libcpp-no-exceptions
+// UNSUPPORTED: c++98, c++03
+
+#include <csignal>
+#include <cstdlib>
+#include <unordered_map>
+
+
+int main(int, char**) {
+    std::signal(SIGABRT, [](int) { std::_Exit(EXIT_SUCCESS); });
+    std::unordered_map<int, int> map;
+    map.at(1);
+    return EXIT_FAILURE;
+}

libcxx/trunk/test/libcxx/containers/unord/unord.map/at.const.abort.pass.cpp

+//===----------------------------------------------------------------------===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+
+// <unordered_map>
+
+// class unordered_map
+
+// const mapped_type& at(const key_type& k) const;
+
+// Make sure we abort() when exceptions are disabled and we fetch a key that
+// is not in the map.
+
+// REQUIRES: libcpp-no-exceptions
+// UNSUPPORTED: c++98, c++03
+
+#include <csignal>
+#include <cstdlib>
+#include <unordered_map>
+
+
+int main(int, char**) {
+    std::signal(SIGABRT, [](int) { std::_Exit(EXIT_SUCCESS); });
+    std::unordered_map<int, int> const map;
+    map.at(1);
+    return EXIT_FAILURE;
+}

libcxx/trunk/test/libcxx/input.output/iostreams.base/ios/iostate.flags/clear.abort.pass.cpp

+//===----------------------------------------------------------------------===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+
+// <ios>
+
+// template <class charT, class traits> class basic_ios
+
+// void clear(iostate state);
+
+// Make sure that we abort() when exceptions are disabled and the exception
+// flag is set for the iostate we pass to clear().
+
+// REQUIRES: libcpp-no-exceptions
+
+#include <csignal>
+#include <cstdlib>
+#include <ios>
+#include <streambuf>
+
+
+void exit_success(int) {
+    std::_Exit(EXIT_SUCCESS);
+}
+
+struct testbuf : public std::streambuf {};
+
+int main(int, char**) {
+    std::signal(SIGABRT, exit_success);
+
+    testbuf buf;
+    std::ios ios(&buf);
+    ios.exceptions(std::ios::badbit);
+    ios.clear(std::ios::badbit);
+
+    return EXIT_FAILURE;
+}

libcxx/trunk/test/libcxx/localization/locales/locale.abort.pass.cpp

+//===----------------------------------------------------------------------===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+
+// <locale>
+
+// class locale;
+
+// explicit locale( const char* std_name );
+
+// REQUIRES: libcpp-no-exceptions
+
+// Make sure we abort() when we construct a locale with a null name and
+// exceptions are disabled.
+
+#include <csignal>
+#include <cstdlib>
+#include <locale>
+
+
+void exit_success(int) {
+    std::_Exit(EXIT_SUCCESS);
+}
+
+int main(int, char**) {
+    std::signal(SIGABRT, exit_success);
+    std::locale loc(NULL);
+    (void)loc;
+    return EXIT_FAILURE;
+}

libcxx/trunk/test/libcxx/localization/locales/locale.category.abort.pass.cpp

+//===----------------------------------------------------------------------===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+
+// <locale>
+
+// class locale;
+
+// locale(const locale& other, const char* std_name, category cat);
+
+// REQUIRES: libcpp-no-exceptions
+
+// Make sure we abort() when we construct a locale with a null name and
+// exceptions are disabled.
+
+#include <csignal>
+#include <cstdlib>
+#include <locale>
+
+
+void exit_success(int) {
+    std::_Exit(EXIT_SUCCESS);
+}
+
+int main(int, char**) {
+    std::signal(SIGABRT, exit_success);
+    std::locale loc(std::locale(), NULL, std::locale::ctype);
+    (void)loc;
+    return EXIT_FAILURE;
+}

libcxx/trunk/test/libcxx/localization/locales/use_facet.abort.pass.cpp

+//===----------------------------------------------------------------------===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+
+// <locale>
+
+// template <class Facet> const Facet& use_facet(const locale& loc);
+
+// REQUIRES: libcpp-no-exceptions
+
+// Make sure we abort() when we pass a facet not associated to the locale to
+// use_facet() and exceptions are disabled.
+
+#include <csignal>
+#include <cstdlib>
+#include <locale>
+
+
+struct my_facet : public std::locale::facet {
+    static std::locale::id id;
+};
+
+std::locale::id my_facet::id;
+
+void exit_success(int) {
+    std::_Exit(EXIT_SUCCESS);
+}
+
+int main(int, char**) {
+    std::signal(SIGABRT, exit_success);
+    std::use_facet<my_facet>(std::locale());
+    return EXIT_FAILURE;
+}