[lsan] On Fuchsia, don't use atexit hook for leak checks

[mcgrathr]

Summary

Fuchsia's system libraries are instrumented and use the lsan
allocator for internal purposes. So leak checking needs to run
after all atexit hooks and after the system libraries' internal
exit-time hooks. The <zircon/sanitizer.h> hook API calls the
__sanitizer_process_exit_hook function at exactly the right time.

[vitalybuka]

compiler-rt/lib/asan/asan_rtl.cpp

502–503

can you please extract this into lsan.h/lsan_posix.cc as

AtExitCheckLeaks() {
   if (common_flags()->detect_leaks && common_flags()->leak_check_at_exit) {
      if (flags()->halt_on_error)
        Atexit(__lsan::DoLeakCheck);
      else
        Atexit(__lsan::DoRecoverableLeakCheckVoid);
    }
}

and make empty one in in lsan_fuchsia.cc

compiler-rt/lib/lsan/lsan_fuchsia.cpp

131

why do you need to move this?
if you move this please also move ExitHook to avoid it in common header

[mcgrathr]

refactored per review

compiler-rt/lib/asan/asan_rtl.cpp

502–503

Separate ones were needed for asan and lsan, so I did that.

compiler-rt/lib/lsan/lsan_fuchsia.cpp

131

ASan also calls __lsan::ExitHook on Fuchsia. The two definitions of the libc hook (__sanitizer_process_exit_hook) were different for ASan vs LSan because LSan doesn't have the halt_on_error flag. AFAICT that's still necessary because the expected behavior is not to change the exit status when halt_on_error=false. So though the mechanism is different from other platforms, I still need ASan-specific plumbing so it can test the ASan-specific flag, and separate standalone-LSan plumbing where there is no such flag to test.

I've changed this so lsan_common_fuchsia.cpp still defines this locally, but uses another __lsan:: function that is defined differently in asan_fuchsia.cpp (to check the flag) and lsan_fuchsia.cpp (to always change the exit code for leaks).

[mcgrathr]

ping

[vitalybuka]

compiler-rt/lib/asan/asan_posix.cpp

146–151

I guess lsan only version is enough
Just add Atexit(__lsan::DoRecoverableLeakCheckVoid) into that one.

If you do that can you add !halt_on_error test case to see if it works?

compiler-rt/lib/lsan/lsan.h

42

Maybe
AtExitCheckLeaks -> InstallAtExitLeakCheck

[mcgrathr]

rebased

[mcgrathr]

add windows stub

[mcgrathr]

fix typo in windows stub

[phosek]

Tested on Windows and it seems to be working now.

[Arfrever]

compiler-rt/lib/lsan/lsan_common_fuchsia.cpp

54

Typo: s/asan_fuchsiap.cpp/asan_fuchsia.cpp/

[nikic]

I've reverted this change as it breaks the clang build with linker errors. D88173 did not address them either.

/home/nikic/llvm-project/compiler-rt/lib/asan/asan_rtl.cpp:503: error: undefined reference to '__asan::InstallAtExitCheckLeaks()'

This is with GCC 10.0, gold 1.16 and the following configuration:

cmake -GNinja -Bbuild llvm \
    -DLLVM_ENABLE_PROJECTS="clang;compiler-rt" \
    -DLLVM_TARGETS_TO_BUILD="all" \
    -DCMAKE_BUILD_TYPE=Release \
    -DLLVM_ENABLE_ASSERTIONS=true \
    -DLLVM_CCACHE_BUILD=true \
    -DLLVM_USE_LINKER=gold \
    -DLLVM_APPEND_VC_REV=false \
    -DCLANG_ENABLE_ARCMT=false \
    -DCLANG_ENABLE_STATIC_ANALYZER=false \
    -DLLVM_BINUTILS_INCDIR=/usr/include \
    -DLLVM_ENABLE_SPHINX=true \
    -DSPHINX_WARNINGS_AS_ERRORS=false

compiler-rt/lib/asan/asan_fuchsia.cpp

 //===-- asan_fuchsia.cpp -------------------------------------------------===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===---------------------------------------------------------------------===//
 //
 // This file is a part of AddressSanitizer, an address sanity checker.
 //
 // Fuchsia-specific details.
 //===---------------------------------------------------------------------===//
 
 #include "sanitizer_common/sanitizer_fuchsia.h"
 #if SANITIZER_FUCHSIA
 
-#include "asan_interceptors.h"
-#include "asan_internal.h"
-#include "asan_stack.h"
-#include "asan_thread.h"
-
 #include <limits.h>
 #include <zircon/sanitizer.h>
 #include <zircon/syscalls.h>
 #include <zircon/threads.h>
 
+#include "asan_interceptors.h"
+#include "asan_internal.h"
+#include "asan_stack.h"
+#include "asan_thread.h"
+#include "lsan/lsan_common.h"
+
 namespace __asan {
 
 // The system already set up the shadow memory for us.
 // __sanitizer::GetMaxUserVirtualAddress has already been called by
 // AsanInitInternal->InitializeHighMemEnd (asan_rtl.cpp).
 // Just do some additional sanity checks here.
 void InitializeShadowMemory() {
-  if (Verbosity()) PrintAddressSpaceLayout();
+  if (Verbosity())
+    PrintAddressSpaceLayout();
 
   // Make sure SHADOW_OFFSET doesn't use __asan_shadow_memory_dynamic_address.
   __asan_shadow_memory_dynamic_address = kDefaultShadowSentinel;
   DCHECK(kLowShadowBeg != kDefaultShadowSentinel);
   __asan_shadow_memory_dynamic_address = kLowShadowBeg;
 
   CHECK_EQ(kShadowGapEnd, kHighShadowBeg - 1);
   CHECK_EQ(kHighMemEnd, __sanitizer::ShadowBounds.memory_limit - 1);

 
 // This is called before each thread creation is attempted.  So, in
 // its first call, the calling thread is the initial and sole thread.
 static void *BeforeThreadCreateHook(uptr user_id, bool detached,
                                     const char *name, uptr stack_bottom,
                                     uptr stack_size) {
   EnsureMainThreadIDIsCorrect();
   // Strict init-order checking is thread-hostile.
-  if (flags()->strict_init_order) StopInitOrderChecking();
+  if (flags()->strict_init_order)
+    StopInitOrderChecking();
 
   GET_STACK_TRACE_THREAD;
   u32 parent_tid = GetCurrentTidOrInvalid();
 
   return CreateAsanThread(&stack, parent_tid, user_id, detached, name,
                           stack_bottom, stack_size);
 }
 
static_assert(!SANITIZER_SUPPORTS_INIT_FOR_DLOPEN,
                 "Expected SANITIZER_SUPPORTS_INIT_FOR_DLOPEN to be false");
   return false;
 }
 
 void FlushUnneededASanShadowMemory(uptr p, uptr size) {
   __sanitizer_fill_shadow(p, size, 0, 0);
 }
 
+// On Fuchsia, leak detection is done by a special hook after atexit hooks.
+// So this doesn't install any atexit hook like on other platforms.
+void InstallAtExitCheckLeaks() {}
+
 }  // namespace __asan
 
+namespace __lsan {
+
+bool UseExitcodeOnLeak() { return __asan::flags()->halt_on_error; }
+
+}  // namespace __lsan
+
 // These are declared (in extern "C") by <zircon/sanitizer.h>.
 // The system runtime will call our definitions directly.
 
 void *__sanitizer_before_thread_create_hook(thrd_t thread, bool detached,
                                             const char *name, void *stack_base,
                                             size_t stack_size) {
   return __asan::BeforeThreadCreateHook(
       reinterpret_cast<uptr>(thread), detached, name,

compiler-rt/lib/asan/asan_internal.h

 
 void *AsanDlSymNext(const char *sym);
 
 // Returns `true` iff most of ASan init process should be skipped due to the
 // ASan library being loaded via `dlopen()`. Platforms may perform any
 // `dlopen()` specific initialization inside this function.
 bool HandleDlopenInit();
 
+void InstallAtExitCheckLeaks();
+
 // Add convenient macro for interface functions that may be represented as
 // weak hooks.
 #define ASAN_MALLOC_HOOK(ptr, size)                                   \
   do {                                                                \
     if (&__sanitizer_malloc_hook) __sanitizer_malloc_hook(ptr, size); \
     RunMallocHooks(ptr, size);                                        \
   } while (false)
 #define ASAN_FREE_HOOK(ptr)                                 \

compiler-rt/lib/asan/asan_posix.cpp

void PlatformTSDDtor(void *tsd) {
   if (context->destructor_iterations > 1) {
     context->destructor_iterations--;
     CHECK_EQ(0, pthread_setspecific(tsd_key, tsd));
     return;
   }
   AsanThread::TSDDtor(tsd);
 }
 #endif
+
+#if CAN_SANITIZE_LEAKS
+void InstallAtExitCheckLeaks() {
+  if (common_flags()->detect_leaks && common_flags()->leak_check_at_exit) {
+    if (flags()->halt_on_error)
+      Atexit(__lsan::DoLeakCheck);
+    else
+      Atexit(__lsan::DoRecoverableLeakCheckVoid);
+  }
+}
+#endif
+
 }  // namespace __asan
 
 #endif  // SANITIZER_POSIX

compiler-rt/lib/asan/asan_rtl.cpp

#endif
 
   // Create main thread.
   AsanThread *main_thread = CreateMainThread();
   CHECK_EQ(0, main_thread->tid());
   force_interface_symbols();  // no-op.
   SanitizerInitializeUnwinder();
 
   if (CAN_SANITIZE_LEAKS) {
     __lsan::InitCommonLsan();
-    if (common_flags()->detect_leaks && common_flags()->leak_check_at_exit) {
-      if (flags()->halt_on_error)
-        Atexit(__lsan::DoLeakCheck);
-      else
-        Atexit(__lsan::DoRecoverableLeakCheckVoid);
-    }
+    InstallAtExitCheckLeaks();
   }
 
 #if CAN_SANITIZE_UB
   __ubsan::InitAsPlugin();
 #endif
 
   InitializeSuppressions();
 

compiler-rt/lib/asan/asan_win.cpp

-//===-- asan_win.cpp ------------------------------------------------------===//
+//===-- asan_win.cpp
+//------------------------------------------------------===//>
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 //
 // This file is a part of AddressSanitizer, an address sanity checker.
 //
 // Windows-specific details.
 //===----------------------------------------------------------------------===//
 
 #include "sanitizer_common/sanitizer_platform.h"
 #if SANITIZER_WINDOWS
 #define WIN32_LEAN_AND_MEAN
-#include <windows.h>
-
 #include <stdlib.h>
+#include <windows.h>
 
 #include "asan_interceptors.h"
 #include "asan_internal.h"
 #include "asan_mapping.h"
 #include "asan_report.h"
 #include "asan_stack.h"
 #include "asan_thread.h"
 #include "sanitizer_common/sanitizer_libc.h"
uptr __asan_get_shadow_memory_dynamic_address() {
   return __asan_shadow_memory_dynamic_address;
 }
 }  // extern "C"
 
 // ---------------------- Windows-specific interceptors ---------------- {{{
 static LPTOP_LEVEL_EXCEPTION_FILTER default_seh_handler;
 static LPTOP_LEVEL_EXCEPTION_FILTER user_seh_handler;
 
-extern "C" SANITIZER_INTERFACE_ATTRIBUTE
-long __asan_unhandled_exception_filter(EXCEPTION_POINTERS *info) {
+extern "C" SANITIZER_INTERFACE_ATTRIBUTE long __asan_unhandled_exception_filter(
+    EXCEPTION_POINTERS *info) {
   EXCEPTION_RECORD *exception_record = info->ExceptionRecord;
   CONTEXT *context = info->ContextRecord;
 
   // FIXME: Handle EXCEPTION_STACK_OVERFLOW here.
 
   SignalContext sig(exception_record, context);
   ReportDeadlySignal(sig);
   UNREACHABLE("returned from reporting deadly signal");
if (!::__interception::OverrideFunction("RaiseException",
                                           (uptr)WRAP(RaiseException),
                                           (uptr *)&REAL(RaiseException))) {
     CHECK(::__interception::OverrideFunction("RtlRaiseException",
                                              (uptr)WRAP(RtlRaiseException),
                                              (uptr *)&REAL(RtlRaiseException)));
   }
 }
 
+InstallAtExitCheckLeaks() {}
+
 void AsanApplyToGlobals(globals_op_fptr op, const void *needle) {
   UNIMPLEMENTED();
 }
 
 void FlushUnneededASanShadowMemory(uptr p, uptr size) {
   // Since asan's mapping is compacting, the shadow chunk may be
   // not page-aligned, so we only flush the page-aligned portion.
   ReleaseMemoryPagesToOS(MemToShadow(p), MemToShadow(p + size));

compiler-rt/lib/lsan/lsan.h

 
 #define GET_STACK_TRACE_THREAD GET_STACK_TRACE(kStackTraceMax, true)
 
 namespace __lsan {
 
 void InitializeInterceptors();
 void ReplaceSystemMalloc();
 void LsanOnDeadlySignal(int signo, void *siginfo, void *context);
+void InstallAtExitCheckLeaks();
 
 #define ENSURE_LSAN_INITED do {   \
   CHECK(!lsan_init_is_running);   \
   if (!lsan_inited)               \
     __lsan_init();                \
 } while (0)
 
 }  // namespace __lsan
 
 extern bool lsan_inited;
 extern bool lsan_init_is_running;
 
 extern "C" SANITIZER_INTERFACE_ATTRIBUTE void __lsan_init();

compiler-rt/lib/lsan/lsan.cpp

extern "C" void __lsan_init() {
   InitCommonLsan();
   InitializeAllocator();
   ReplaceSystemMalloc();
   InitTlsSize();
   InitializeInterceptors();
   InitializeThreadRegistry();
   InstallDeadlySignalHandlers(LsanOnDeadlySignal);
   InitializeMainThread();
-
-  if (common_flags()->detect_leaks && common_flags()->leak_check_at_exit)
-    Atexit(DoLeakCheck);
+  InstallAtExitCheckLeaks();
 
   InitializeCoverage(common_flags()->coverage, common_flags()->coverage_dir);
 
   lsan_inited = true;
   lsan_init_is_running = false;
 }
 
 extern "C" SANITIZER_INTERFACE_ATTRIBUTE
 void __sanitizer_print_stack_trace() {
   GET_STACK_TRACE_FATAL;
   stack.Print();
 }

compiler-rt/lib/lsan/lsan_common_fuchsia.cpp

 // Nothing to do here.
 void ProcessPlatformSpecificAllocations(Frontier *frontier) {}
 
 // On Fuchsia, we can intercept _Exit gracefully, and return a failing exit
 // code if required at that point.  Calling Die() here is undefined
 // behavior and causes rare race conditions.
 void HandleLeaks() {}
 
+// This is defined differently in asan_fuchsiap.cpp and lsan_fuchsia.cpp.
+bool UseExitcodeOnLeak();
+
 int ExitHook(int status) {
+  if (common_flags()->detect_leaks && common_flags()->leak_check_at_exit) {
+    if (UseExitcodeOnLeak())
+      DoLeakCheck();
+    else
+      DoRecoverableLeakCheckVoid();
+  }
   return status == 0 && HasReportedLeaks() ? common_flags()->exitcode : status;
 }
 
 void LockStuffAndStopTheWorld(StopTheWorldCallback callback,
                               CheckForLeaksParam *argument) {
   LockThreadRegistry();
   LockAllocator();
 

compiler-rt/lib/lsan/lsan_fuchsia.cpp

void GetAllThreadAllocatorCachesLocked(InternalMmapVector<uptr> *caches) {
   GetThreadRegistryLocked()->RunCallbackForEachThreadLocked(
       [](ThreadContextBase *tctx, void *arg) {
         auto ctx = static_cast<ThreadContext *>(tctx);
         static_cast<decltype(caches)>(arg)->push_back(ctx->cache_begin());
       },
       caches);
 }
 
+// On Fuchsia, leak detection is done by a special hook after atexit hooks.
+// So this doesn't install any atexit hook like on other platforms.
+void InstallAtExitCheckLeaks() {}
+
+// ASan defines this to check its `halt_on_error` flag.
+bool UseExitcodeOnLeak() { return true; }
+
 }  // namespace __lsan
 
 // These are declared (in extern "C") by <zircon/sanitizer.h>.
 // The system runtime will call our definitions directly.
 
 // This is called before each thread creation is attempted.  So, in
 // its first call, the calling thread is the initial and sole thread.
 void *__sanitizer_before_thread_create_hook(thrd_t thread, bool detached,
void __sanitizer_thread_start_hook(void *hook, thrd_t self) {
   ThreadStart(tid);
 }
 
 // Each thread runs this just before it exits,
 // with the pointer returned by BeforeThreadCreateHook (above).
 // All per-thread destructors have already been called.
 void __sanitizer_thread_exit_hook(void *hook, thrd_t self) { ThreadFinish(); }
 
 #endif  // SANITIZER_FUCHSIA

compiler-rt/lib/lsan/lsan_posix.cpp

stack->Unwind(StackTrace::GetNextInstructionPc(sig.pc), sig.bp, sig.context,
                 common_flags()->fast_unwind_on_fatal);
 }
 
 void LsanOnDeadlySignal(int signo, void *siginfo, void *context) {
   HandleDeadlySignal(siginfo, context, GetCurrentThread(), &OnStackUnwind,
                      nullptr);
 }
 
+void InstallAtExitCheckLeaks() {
+  if (common_flags()->detect_leaks && common_flags()->leak_check_at_exit)
+    Atexit(DoLeakCheck);
+}
+
 }  // namespace __lsan
 
 #endif  // SANITIZER_POSIX