1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
|
// Copyright (c) 2012 The Chromium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include <stdio.h>
#include "base/allocator/allocator_shim.h"
#include "testing/gtest/include/gtest/gtest.h"
// TCMalloc header files
#include "common.h" // For TCMalloc constants like page size, etc.
using base::allocator::TCMallocDoMallocForTest;
using base::allocator::TCMallocDoFreeForTest;
using base::allocator::ExcludeSpaceForMarkForTest;
TEST(TCMallocFreeCheck, BadPointerInFirstPageOfTheLargeObject) {
char* p = reinterpret_cast<char*>(
TCMallocDoMallocForTest(ExcludeSpaceForMarkForTest(kMaxSize + 1)));
for (int offset = 1; offset < kPageSize ; offset <<= 1) {
ASSERT_DEATH(TCMallocDoFreeForTest(p + offset),
"Pointer is not pointing to the start of a span");
}
}
TEST(TCMallocFreeCheck, BadPageAlignedPointerInsideLargeObject) {
char* p = reinterpret_cast<char*>(
TCMallocDoMallocForTest(ExcludeSpaceForMarkForTest(kMaxSize + 1)));
for (int offset = kPageSize; offset < kMaxSize; offset += kPageSize) {
// Only the first and last page of a span are in heap map. So for others
// tcmalloc will give a general error of invalid pointer.
ASSERT_DEATH(TCMallocDoFreeForTest(p + offset),
"Attempt to free invalid pointer");
}
ASSERT_DEATH(TCMallocDoFreeForTest(p + kMaxSize),
"Pointer is not pointing to the start of a span");
}
TEST(TCMallocFreeCheck, DoubleFreeLargeObject) {
char* p = reinterpret_cast<char*>(
TCMallocDoMallocForTest(ExcludeSpaceForMarkForTest(kMaxSize + 1)));
ASSERT_DEATH(TCMallocDoFreeForTest(p); TCMallocDoFreeForTest(p),
"Object was not in-use");
}
#ifdef NDEBUG
TEST(TCMallocFreeCheck, DoubleFreeSmallObject) {
for (size_t size = 1;
size <= ExcludeSpaceForMarkForTest(kMaxSize);
size <<= 1) {
char* p = reinterpret_cast<char*>(TCMallocDoMallocForTest(size));
ASSERT_DEATH(TCMallocDoFreeForTest(p); TCMallocDoFreeForTest(p),
"Circular loop in list detected");
}
}
#else
TEST(TCMallocFreeCheck, DoubleFreeSmallObject) {
size_t size = 1;
// When the object is small, tcmalloc validation can not distinguish normal
// memory corruption or double free, because there's not enough space in
// freed objects to keep the mark.
for (; size <= ExcludeSpaceForMarkForTest(kMinClassSize); size <<= 1) {
char* p = reinterpret_cast<char*>(TCMallocDoMallocForTest(size));
ASSERT_DEATH(TCMallocDoFreeForTest(p); TCMallocDoFreeForTest(p),
"Memory corrupted");
}
for (; size <= ExcludeSpaceForMarkForTest(kMaxSize); size <<= 1) {
char* p = reinterpret_cast<char*>(TCMallocDoMallocForTest(size));
ASSERT_DEATH(TCMallocDoFreeForTest(p); TCMallocDoFreeForTest(p),
"Attempt to double free");
}
}
#endif
int main(int argc, char **argv) {
testing::InitGoogleTest(&argc, argv);
return RUN_ALL_TESTS();
}
|
