[compiler-rt] [Sanitizers][Darwin] Add atos-canary test (PR #209338)

[via llvm-commits]

llvmorg-github-actions[bot] wrote:


<!--LLVM PR SUMMARY COMMENT-->

@llvm/pr-subscribers-compiler-rt-sanitizer

Author: Mariusz Borsa (wrotki)

<details>
<summary>Changes</summary>

We've observed tests using atos symbolizer ocasionally failing for
several test runs on x86_64 machines, then stabilizing again. We were unable to reproduce
this with local builds, so it's unclear what the root cause is.

To help investigate similar failures in the future, we're adding a test
exercising atos itself. Should atos start to fail again, this test
should fail too, and provide way more info helping debugging than other
tests do

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@<!-- -->anthropic.com>


---
Full diff: https://github.com/llvm/llvm-project/pull/209338.diff


1 Files Affected:

- (added) compiler-rt/test/asan/TestCases/Darwin/atos-canary-symbolize.cpp (+73) 


``````````diff
diff --git a/compiler-rt/test/asan/TestCases/Darwin/atos-canary-symbolize.cpp b/compiler-rt/test/asan/TestCases/Darwin/atos-canary-symbolize.cpp
new file mode 100644
index 0000000000000..86be771a22ec4
--- /dev/null
+++ b/compiler-rt/test/asan/TestCases/Darwin/atos-canary-symbolize.cpp
@@ -0,0 +1,73 @@
+// compiler-rt/test/asan/TestCases/Darwin/atos-canary-symbolize.cpp
+//
+
+// REQUIRES: system-darwin
+// Path returned by `which atos` is only valid on the host (attach mode needs it).
+// UNSUPPORTED: darwin-remote, i386-darwin
+
+// RUN: %clangxx_asan -O0 -g -fno-omit-frame-pointer %s -o %t
+
+// --- Diagnostics preamble (never gates; the FileCheck at the end is the gate).
+//     compiler-rt runs under lit's INTERNAL shell by default (llvm #106636), which
+//     has no `( subshell )` and no `$(...)` command substitution -- so each probe is
+//     a flat `;`-separated sequence ending in `true`, and the atos path comes from
+//     `%{readfile:...}` (lit inlines it) rather than `$(cat ...)`. ---
+// RUN: echo '==== atos identity (runtime picks FIRST on PATH) ====' ; xcrun --find atos 2>&1 ; which -a atos 2>&1 ; true
+// RUN: which atos | tr -d '\n' > %t.atos_path
+// RUN: echo '==== atos version / codesign ====' ; atos -V 2>&1 ; codesign -dv --verbose=4 %{readfile:%t.atos_path} 2>&1 ; codesign -v --verbose=2 %{readfile:%t.atos_path} 2>&1 ; true
+// RUN: echo '==== SIP / DevToolsSecurity / task_for_pid policy (attach-mode gate) ====' ; csrutil status 2>&1 ; DevToolsSecurity -status 2>&1 ; sysctl kern.tfp.policy 2>&1 ; true
+// RUN: echo '==== active developer dir / SDK ====' ; xcode-select -p 2>&1 ; xcrun --show-sdk-path 2>&1 ; true
+// RUN: echo '==== network-dSYM hook (a set DBGShellCommands => hang risk) ====' ; defaults read com.apple.DebugSymbols 2>&1 ; env | grep -iE 'DBGShellCommands|dsymForUUID' 2>&1 ; true
+// RUN: echo '==== built test binary codesign (mode 1c: hardened w/o get-task-allow) ====' ; codesign -dv --verbose=4 %t 2>&1 ; codesign -d --entitlements :- %t 2>&1 | grep -iE 'get-task-allow|runtime|flags' 2>&1 ; true
+
+// --- (A) ATTACH mode: exactly how the runtime uses atos (atos -i -p <pid> over a
+//         pipe). This is the REAL gate. `not %run` because asan exits non-zero. ---
+// RUN: %env_asan_opts=verbosity=2 ASAN_SYMBOLIZER_PATH=%{readfile:%t.atos_path} not %run %t > %t.attach.log 2>&1 || true
+// RUN: echo '==== ATTACH-mode asan report (verbosity=2) ====' ; cat %t.attach.log || true
+
+// --- (B) OFFLINE cross-check: run atos by hand against the same binary. Lets us
+//         tell "atos itself is dead" (offline also fails) from "attach/task_for_pid
+//         is blocked" (offline works). Never gates. ---
+// RUN: echo '==== OFFLINE atos probe (no attach / no task_for_pid) ====' ; atos -o %t -arch %arch -l 0 0x1 </dev/null 2>&1 ; true
+
+// --- best-effort syslog tail: task_for_pid / atos / CoreSymbolication denials.
+//     `log show` can be slow on locked-down nodes; it is `|| true` so it can't
+//     fail the test, but if it ever stalls the lit timeout, drop this line. ---
+// RUN: echo '==== syslog (last 2m: atos / taskgated / task_for_pid) ====' ; log show --last 2m --style compact --predicate 'process == "atos" OR process == "taskgated" OR eventMessage CONTAINS "task_for_pid" OR eventMessage CONTAINS "Sanitizer"' 2>&1 ; true
+
+// --- PASS/FAIL GATE: the attach-mode report MUST be fully symbolized. FileCheck
+//     runs on the SAME captured log so the failing output sits right next to the
+//     diagnostics above it in the lit log. ---
+// RUN: FileCheck %s --input-file=%t.attach.log
+
+// The runtime must have picked our atos and reported using it (verbosity=2).
+// (ASAN_SYMBOLIZER_PATH => "at user-specified path"; a bare PATH search =>
+//  "found at". Accept either so the canary is robust to how it resolved.)
+// CHECK: {{Using atos (found at|at user-specified path):}}
+
+// The crash header must appear (proves the process ran and asan fired).
+// CHECK: AddressSanitizer: heap-use-after-free
+
+// THE GATE: frame #0 must symbolize to boom() at its store line, frame #1 to
+// main() at the boom() call. When atos is broken these stay as bare 0x...
+// addresses with no `in boom` / no filename => FileCheck fails => canary RED.
+// CHECK: #0 0x{{.*}} in boom{{.*}}atos-canary-symbolize.cpp:[[@LINE+11]]
+// CHECK: #1 0x{{.*}} in main{{.*}}atos-canary-symbolize.cpp:[[@LINE+16]]
+
+// --- Negative guards: make the RED reason unambiguous in the FileCheck diff.
+//     (The positive frame checks already catch it; these name the failure mode.) ---
+// CHECK-NOT: Can't read from symbolizer at fd
+// CHECK-NOT: atos failed to symbolize address
+
+#include <cstdlib>
+
+__attribute__((noinline)) void boom(int *p) {
+  *p = 42; // <-- frame #0 store; the CHECK #0 [[@LINE]] anchor resolves here
+}
+
+int main() {
+  int *p = new int[4];
+  delete[] p;
+  boom(p); // <-- frame #1 call site; the CHECK #1 [[@LINE]] anchor resolves here
+  return 0;
+}
\ No newline at end of file

``````````

</details>


https://github.com/llvm/llvm-project/pull/209338