tsan_interceptors_mac.cpp 20 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521
  1. //===-- tsan_interceptors_mac.cpp -----------------------------------------===//
  2. //
  3. // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
  4. // See https://llvm.org/LICENSE.txt for license information.
  5. // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
  6. //
  7. //===----------------------------------------------------------------------===//
  8. //
  9. // This file is a part of ThreadSanitizer (TSan), a race detector.
  10. //
  11. // Mac-specific interceptors.
  12. //===----------------------------------------------------------------------===//
  13. #include "sanitizer_common/sanitizer_platform.h"
  14. #if SANITIZER_MAC
  15. #include "interception/interception.h"
  16. #include "tsan_interceptors.h"
  17. #include "tsan_interface.h"
  18. #include "tsan_interface_ann.h"
  19. #include "sanitizer_common/sanitizer_addrhashmap.h"
  20. #include <errno.h>
  21. #include <libkern/OSAtomic.h>
  22. #include <objc/objc-sync.h>
  23. #include <os/lock.h>
  24. #include <sys/ucontext.h>
  25. #if defined(__has_include) && __has_include(<xpc/xpc.h>)
  26. #include <xpc/xpc.h>
  27. #endif // #if defined(__has_include) && __has_include(<xpc/xpc.h>)
  28. typedef long long_t;
  29. extern "C" {
  30. int getcontext(ucontext_t *ucp) __attribute__((returns_twice));
  31. int setcontext(const ucontext_t *ucp);
  32. }
  33. namespace __tsan {
  34. // The non-barrier versions of OSAtomic* functions are semantically mo_relaxed,
  35. // but the two variants (e.g. OSAtomicAdd32 and OSAtomicAdd32Barrier) are
  36. // actually aliases of each other, and we cannot have different interceptors for
  37. // them, because they're actually the same function. Thus, we have to stay
  38. // conservative and treat the non-barrier versions as mo_acq_rel.
  39. static constexpr morder kMacOrderBarrier = mo_acq_rel;
  40. static constexpr morder kMacOrderNonBarrier = mo_acq_rel;
  41. static constexpr morder kMacFailureOrder = mo_relaxed;
  42. #define OSATOMIC_INTERCEPTOR(return_t, t, tsan_t, f, tsan_atomic_f, mo) \
  43. TSAN_INTERCEPTOR(return_t, f, t x, volatile t *ptr) { \
  44. SCOPED_TSAN_INTERCEPTOR(f, x, ptr); \
  45. return tsan_atomic_f((volatile tsan_t *)ptr, x, mo); \
  46. }
  47. #define OSATOMIC_INTERCEPTOR_PLUS_X(return_t, t, tsan_t, f, tsan_atomic_f, mo) \
  48. TSAN_INTERCEPTOR(return_t, f, t x, volatile t *ptr) { \
  49. SCOPED_TSAN_INTERCEPTOR(f, x, ptr); \
  50. return tsan_atomic_f((volatile tsan_t *)ptr, x, mo) + x; \
  51. }
  52. #define OSATOMIC_INTERCEPTOR_PLUS_1(return_t, t, tsan_t, f, tsan_atomic_f, mo) \
  53. TSAN_INTERCEPTOR(return_t, f, volatile t *ptr) { \
  54. SCOPED_TSAN_INTERCEPTOR(f, ptr); \
  55. return tsan_atomic_f((volatile tsan_t *)ptr, 1, mo) + 1; \
  56. }
  57. #define OSATOMIC_INTERCEPTOR_MINUS_1(return_t, t, tsan_t, f, tsan_atomic_f, \
  58. mo) \
  59. TSAN_INTERCEPTOR(return_t, f, volatile t *ptr) { \
  60. SCOPED_TSAN_INTERCEPTOR(f, ptr); \
  61. return tsan_atomic_f((volatile tsan_t *)ptr, 1, mo) - 1; \
  62. }
  63. #define OSATOMIC_INTERCEPTORS_ARITHMETIC(f, tsan_atomic_f, m) \
  64. m(int32_t, int32_t, a32, f##32, __tsan_atomic32_##tsan_atomic_f, \
  65. kMacOrderNonBarrier) \
  66. m(int32_t, int32_t, a32, f##32##Barrier, __tsan_atomic32_##tsan_atomic_f, \
  67. kMacOrderBarrier) \
  68. m(int64_t, int64_t, a64, f##64, __tsan_atomic64_##tsan_atomic_f, \
  69. kMacOrderNonBarrier) \
  70. m(int64_t, int64_t, a64, f##64##Barrier, __tsan_atomic64_##tsan_atomic_f, \
  71. kMacOrderBarrier)
  72. #define OSATOMIC_INTERCEPTORS_BITWISE(f, tsan_atomic_f, m, m_orig) \
  73. m(int32_t, uint32_t, a32, f##32, __tsan_atomic32_##tsan_atomic_f, \
  74. kMacOrderNonBarrier) \
  75. m(int32_t, uint32_t, a32, f##32##Barrier, __tsan_atomic32_##tsan_atomic_f, \
  76. kMacOrderBarrier) \
  77. m_orig(int32_t, uint32_t, a32, f##32##Orig, __tsan_atomic32_##tsan_atomic_f, \
  78. kMacOrderNonBarrier) \
  79. m_orig(int32_t, uint32_t, a32, f##32##OrigBarrier, \
  80. __tsan_atomic32_##tsan_atomic_f, kMacOrderBarrier)
  81. OSATOMIC_INTERCEPTORS_ARITHMETIC(OSAtomicAdd, fetch_add,
  82. OSATOMIC_INTERCEPTOR_PLUS_X)
  83. OSATOMIC_INTERCEPTORS_ARITHMETIC(OSAtomicIncrement, fetch_add,
  84. OSATOMIC_INTERCEPTOR_PLUS_1)
  85. OSATOMIC_INTERCEPTORS_ARITHMETIC(OSAtomicDecrement, fetch_sub,
  86. OSATOMIC_INTERCEPTOR_MINUS_1)
  87. OSATOMIC_INTERCEPTORS_BITWISE(OSAtomicOr, fetch_or, OSATOMIC_INTERCEPTOR_PLUS_X,
  88. OSATOMIC_INTERCEPTOR)
  89. OSATOMIC_INTERCEPTORS_BITWISE(OSAtomicAnd, fetch_and,
  90. OSATOMIC_INTERCEPTOR_PLUS_X, OSATOMIC_INTERCEPTOR)
  91. OSATOMIC_INTERCEPTORS_BITWISE(OSAtomicXor, fetch_xor,
  92. OSATOMIC_INTERCEPTOR_PLUS_X, OSATOMIC_INTERCEPTOR)
  93. #define OSATOMIC_INTERCEPTORS_CAS(f, tsan_atomic_f, tsan_t, t) \
  94. TSAN_INTERCEPTOR(bool, f, t old_value, t new_value, t volatile *ptr) { \
  95. SCOPED_TSAN_INTERCEPTOR(f, old_value, new_value, ptr); \
  96. return tsan_atomic_f##_compare_exchange_strong( \
  97. (volatile tsan_t *)ptr, (tsan_t *)&old_value, (tsan_t)new_value, \
  98. kMacOrderNonBarrier, kMacFailureOrder); \
  99. } \
  100. \
  101. TSAN_INTERCEPTOR(bool, f##Barrier, t old_value, t new_value, \
  102. t volatile *ptr) { \
  103. SCOPED_TSAN_INTERCEPTOR(f##Barrier, old_value, new_value, ptr); \
  104. return tsan_atomic_f##_compare_exchange_strong( \
  105. (volatile tsan_t *)ptr, (tsan_t *)&old_value, (tsan_t)new_value, \
  106. kMacOrderBarrier, kMacFailureOrder); \
  107. }
  108. OSATOMIC_INTERCEPTORS_CAS(OSAtomicCompareAndSwapInt, __tsan_atomic32, a32, int)
  109. OSATOMIC_INTERCEPTORS_CAS(OSAtomicCompareAndSwapLong, __tsan_atomic64, a64,
  110. long_t)
  111. OSATOMIC_INTERCEPTORS_CAS(OSAtomicCompareAndSwapPtr, __tsan_atomic64, a64,
  112. void *)
  113. OSATOMIC_INTERCEPTORS_CAS(OSAtomicCompareAndSwap32, __tsan_atomic32, a32,
  114. int32_t)
  115. OSATOMIC_INTERCEPTORS_CAS(OSAtomicCompareAndSwap64, __tsan_atomic64, a64,
  116. int64_t)
  117. #define OSATOMIC_INTERCEPTOR_BITOP(f, op, clear, mo) \
  118. TSAN_INTERCEPTOR(bool, f, uint32_t n, volatile void *ptr) { \
  119. SCOPED_TSAN_INTERCEPTOR(f, n, ptr); \
  120. volatile char *byte_ptr = ((volatile char *)ptr) + (n >> 3); \
  121. char bit = 0x80u >> (n & 7); \
  122. char mask = clear ? ~bit : bit; \
  123. char orig_byte = op((volatile a8 *)byte_ptr, mask, mo); \
  124. return orig_byte & bit; \
  125. }
  126. #define OSATOMIC_INTERCEPTORS_BITOP(f, op, clear) \
  127. OSATOMIC_INTERCEPTOR_BITOP(f, op, clear, kMacOrderNonBarrier) \
  128. OSATOMIC_INTERCEPTOR_BITOP(f##Barrier, op, clear, kMacOrderBarrier)
  129. OSATOMIC_INTERCEPTORS_BITOP(OSAtomicTestAndSet, __tsan_atomic8_fetch_or, false)
  130. OSATOMIC_INTERCEPTORS_BITOP(OSAtomicTestAndClear, __tsan_atomic8_fetch_and,
  131. true)
  132. TSAN_INTERCEPTOR(void, OSAtomicEnqueue, OSQueueHead *list, void *item,
  133. size_t offset) {
  134. SCOPED_TSAN_INTERCEPTOR(OSAtomicEnqueue, list, item, offset);
  135. __tsan_release(item);
  136. REAL(OSAtomicEnqueue)(list, item, offset);
  137. }
  138. TSAN_INTERCEPTOR(void *, OSAtomicDequeue, OSQueueHead *list, size_t offset) {
  139. SCOPED_TSAN_INTERCEPTOR(OSAtomicDequeue, list, offset);
  140. void *item = REAL(OSAtomicDequeue)(list, offset);
  141. if (item) __tsan_acquire(item);
  142. return item;
  143. }
  144. // OSAtomicFifoEnqueue and OSAtomicFifoDequeue are only on OS X.
  145. #if !SANITIZER_IOS
  146. TSAN_INTERCEPTOR(void, OSAtomicFifoEnqueue, OSFifoQueueHead *list, void *item,
  147. size_t offset) {
  148. SCOPED_TSAN_INTERCEPTOR(OSAtomicFifoEnqueue, list, item, offset);
  149. __tsan_release(item);
  150. REAL(OSAtomicFifoEnqueue)(list, item, offset);
  151. }
  152. TSAN_INTERCEPTOR(void *, OSAtomicFifoDequeue, OSFifoQueueHead *list,
  153. size_t offset) {
  154. SCOPED_TSAN_INTERCEPTOR(OSAtomicFifoDequeue, list, offset);
  155. void *item = REAL(OSAtomicFifoDequeue)(list, offset);
  156. if (item) __tsan_acquire(item);
  157. return item;
  158. }
  159. #endif
  160. TSAN_INTERCEPTOR(void, OSSpinLockLock, volatile OSSpinLock *lock) {
  161. CHECK(!cur_thread()->is_dead);
  162. if (!cur_thread()->is_inited) {
  163. return REAL(OSSpinLockLock)(lock);
  164. }
  165. SCOPED_TSAN_INTERCEPTOR(OSSpinLockLock, lock);
  166. REAL(OSSpinLockLock)(lock);
  167. Acquire(thr, pc, (uptr)lock);
  168. }
  169. TSAN_INTERCEPTOR(bool, OSSpinLockTry, volatile OSSpinLock *lock) {
  170. CHECK(!cur_thread()->is_dead);
  171. if (!cur_thread()->is_inited) {
  172. return REAL(OSSpinLockTry)(lock);
  173. }
  174. SCOPED_TSAN_INTERCEPTOR(OSSpinLockTry, lock);
  175. bool result = REAL(OSSpinLockTry)(lock);
  176. if (result)
  177. Acquire(thr, pc, (uptr)lock);
  178. return result;
  179. }
  180. TSAN_INTERCEPTOR(void, OSSpinLockUnlock, volatile OSSpinLock *lock) {
  181. CHECK(!cur_thread()->is_dead);
  182. if (!cur_thread()->is_inited) {
  183. return REAL(OSSpinLockUnlock)(lock);
  184. }
  185. SCOPED_TSAN_INTERCEPTOR(OSSpinLockUnlock, lock);
  186. Release(thr, pc, (uptr)lock);
  187. REAL(OSSpinLockUnlock)(lock);
  188. }
  189. TSAN_INTERCEPTOR(void, os_lock_lock, void *lock) {
  190. CHECK(!cur_thread()->is_dead);
  191. if (!cur_thread()->is_inited) {
  192. return REAL(os_lock_lock)(lock);
  193. }
  194. SCOPED_TSAN_INTERCEPTOR(os_lock_lock, lock);
  195. REAL(os_lock_lock)(lock);
  196. Acquire(thr, pc, (uptr)lock);
  197. }
  198. TSAN_INTERCEPTOR(bool, os_lock_trylock, void *lock) {
  199. CHECK(!cur_thread()->is_dead);
  200. if (!cur_thread()->is_inited) {
  201. return REAL(os_lock_trylock)(lock);
  202. }
  203. SCOPED_TSAN_INTERCEPTOR(os_lock_trylock, lock);
  204. bool result = REAL(os_lock_trylock)(lock);
  205. if (result)
  206. Acquire(thr, pc, (uptr)lock);
  207. return result;
  208. }
  209. TSAN_INTERCEPTOR(void, os_lock_unlock, void *lock) {
  210. CHECK(!cur_thread()->is_dead);
  211. if (!cur_thread()->is_inited) {
  212. return REAL(os_lock_unlock)(lock);
  213. }
  214. SCOPED_TSAN_INTERCEPTOR(os_lock_unlock, lock);
  215. Release(thr, pc, (uptr)lock);
  216. REAL(os_lock_unlock)(lock);
  217. }
  218. TSAN_INTERCEPTOR(void, os_unfair_lock_lock, os_unfair_lock_t lock) {
  219. if (!cur_thread()->is_inited || cur_thread()->is_dead) {
  220. return REAL(os_unfair_lock_lock)(lock);
  221. }
  222. SCOPED_TSAN_INTERCEPTOR(os_unfair_lock_lock, lock);
  223. REAL(os_unfair_lock_lock)(lock);
  224. Acquire(thr, pc, (uptr)lock);
  225. }
  226. TSAN_INTERCEPTOR(void, os_unfair_lock_lock_with_options, os_unfair_lock_t lock,
  227. u32 options) {
  228. if (!cur_thread()->is_inited || cur_thread()->is_dead) {
  229. return REAL(os_unfair_lock_lock_with_options)(lock, options);
  230. }
  231. SCOPED_TSAN_INTERCEPTOR(os_unfair_lock_lock_with_options, lock, options);
  232. REAL(os_unfair_lock_lock_with_options)(lock, options);
  233. Acquire(thr, pc, (uptr)lock);
  234. }
  235. TSAN_INTERCEPTOR(bool, os_unfair_lock_trylock, os_unfair_lock_t lock) {
  236. if (!cur_thread()->is_inited || cur_thread()->is_dead) {
  237. return REAL(os_unfair_lock_trylock)(lock);
  238. }
  239. SCOPED_TSAN_INTERCEPTOR(os_unfair_lock_trylock, lock);
  240. bool result = REAL(os_unfair_lock_trylock)(lock);
  241. if (result)
  242. Acquire(thr, pc, (uptr)lock);
  243. return result;
  244. }
  245. TSAN_INTERCEPTOR(void, os_unfair_lock_unlock, os_unfair_lock_t lock) {
  246. if (!cur_thread()->is_inited || cur_thread()->is_dead) {
  247. return REAL(os_unfair_lock_unlock)(lock);
  248. }
  249. SCOPED_TSAN_INTERCEPTOR(os_unfair_lock_unlock, lock);
  250. Release(thr, pc, (uptr)lock);
  251. REAL(os_unfair_lock_unlock)(lock);
  252. }
  253. #if defined(__has_include) && __has_include(<xpc/xpc.h>)
  254. TSAN_INTERCEPTOR(void, xpc_connection_set_event_handler,
  255. xpc_connection_t connection, xpc_handler_t handler) {
  256. SCOPED_TSAN_INTERCEPTOR(xpc_connection_set_event_handler, connection,
  257. handler);
  258. Release(thr, pc, (uptr)connection);
  259. xpc_handler_t new_handler = ^(xpc_object_t object) {
  260. {
  261. SCOPED_INTERCEPTOR_RAW(xpc_connection_set_event_handler);
  262. Acquire(thr, pc, (uptr)connection);
  263. }
  264. handler(object);
  265. };
  266. REAL(xpc_connection_set_event_handler)(connection, new_handler);
  267. }
  268. TSAN_INTERCEPTOR(void, xpc_connection_send_barrier, xpc_connection_t connection,
  269. dispatch_block_t barrier) {
  270. SCOPED_TSAN_INTERCEPTOR(xpc_connection_send_barrier, connection, barrier);
  271. Release(thr, pc, (uptr)connection);
  272. dispatch_block_t new_barrier = ^() {
  273. {
  274. SCOPED_INTERCEPTOR_RAW(xpc_connection_send_barrier);
  275. Acquire(thr, pc, (uptr)connection);
  276. }
  277. barrier();
  278. };
  279. REAL(xpc_connection_send_barrier)(connection, new_barrier);
  280. }
  281. TSAN_INTERCEPTOR(void, xpc_connection_send_message_with_reply,
  282. xpc_connection_t connection, xpc_object_t message,
  283. dispatch_queue_t replyq, xpc_handler_t handler) {
  284. SCOPED_TSAN_INTERCEPTOR(xpc_connection_send_message_with_reply, connection,
  285. message, replyq, handler);
  286. Release(thr, pc, (uptr)connection);
  287. xpc_handler_t new_handler = ^(xpc_object_t object) {
  288. {
  289. SCOPED_INTERCEPTOR_RAW(xpc_connection_send_message_with_reply);
  290. Acquire(thr, pc, (uptr)connection);
  291. }
  292. handler(object);
  293. };
  294. REAL(xpc_connection_send_message_with_reply)
  295. (connection, message, replyq, new_handler);
  296. }
  297. TSAN_INTERCEPTOR(void, xpc_connection_cancel, xpc_connection_t connection) {
  298. SCOPED_TSAN_INTERCEPTOR(xpc_connection_cancel, connection);
  299. Release(thr, pc, (uptr)connection);
  300. REAL(xpc_connection_cancel)(connection);
  301. }
  302. #endif // #if defined(__has_include) && __has_include(<xpc/xpc.h>)
  303. // Determines whether the Obj-C object pointer is a tagged pointer. Tagged
  304. // pointers encode the object data directly in their pointer bits and do not
  305. // have an associated memory allocation. The Obj-C runtime uses tagged pointers
  306. // to transparently optimize small objects.
  307. static bool IsTaggedObjCPointer(id obj) {
  308. const uptr kPossibleTaggedBits = 0x8000000000000001ull;
  309. return ((uptr)obj & kPossibleTaggedBits) != 0;
  310. }
  311. // Returns an address which can be used to inform TSan about synchronization
  312. // points (MutexLock/Unlock). The TSan infrastructure expects this to be a valid
  313. // address in the process space. We do a small allocation here to obtain a
  314. // stable address (the array backing the hash map can change). The memory is
  315. // never free'd (leaked) and allocation and locking are slow, but this code only
  316. // runs for @synchronized with tagged pointers, which is very rare.
  317. static uptr GetOrCreateSyncAddress(uptr addr, ThreadState *thr, uptr pc) {
  318. typedef AddrHashMap<uptr, 5> Map;
  319. static Map Addresses;
  320. Map::Handle h(&Addresses, addr);
  321. if (h.created()) {
  322. ThreadIgnoreBegin(thr, pc);
  323. *h = (uptr) user_alloc(thr, pc, /*size=*/1);
  324. ThreadIgnoreEnd(thr);
  325. }
  326. return *h;
  327. }
  328. // Returns an address on which we can synchronize given an Obj-C object pointer.
  329. // For normal object pointers, this is just the address of the object in memory.
  330. // Tagged pointers are not backed by an actual memory allocation, so we need to
  331. // synthesize a valid address.
  332. static uptr SyncAddressForObjCObject(id obj, ThreadState *thr, uptr pc) {
  333. if (IsTaggedObjCPointer(obj))
  334. return GetOrCreateSyncAddress((uptr)obj, thr, pc);
  335. return (uptr)obj;
  336. }
  337. TSAN_INTERCEPTOR(int, objc_sync_enter, id obj) {
  338. SCOPED_TSAN_INTERCEPTOR(objc_sync_enter, obj);
  339. if (!obj) return REAL(objc_sync_enter)(obj);
  340. uptr addr = SyncAddressForObjCObject(obj, thr, pc);
  341. MutexPreLock(thr, pc, addr, MutexFlagWriteReentrant);
  342. int result = REAL(objc_sync_enter)(obj);
  343. CHECK_EQ(result, OBJC_SYNC_SUCCESS);
  344. MutexPostLock(thr, pc, addr, MutexFlagWriteReentrant);
  345. return result;
  346. }
  347. TSAN_INTERCEPTOR(int, objc_sync_exit, id obj) {
  348. SCOPED_TSAN_INTERCEPTOR(objc_sync_exit, obj);
  349. if (!obj) return REAL(objc_sync_exit)(obj);
  350. uptr addr = SyncAddressForObjCObject(obj, thr, pc);
  351. MutexUnlock(thr, pc, addr);
  352. int result = REAL(objc_sync_exit)(obj);
  353. if (result != OBJC_SYNC_SUCCESS) MutexInvalidAccess(thr, pc, addr);
  354. return result;
  355. }
  356. TSAN_INTERCEPTOR(int, swapcontext, ucontext_t *oucp, const ucontext_t *ucp) {
  357. {
  358. SCOPED_INTERCEPTOR_RAW(swapcontext, oucp, ucp);
  359. }
  360. // Because of swapcontext() semantics we have no option but to copy its
  361. // implementation here
  362. if (!oucp || !ucp) {
  363. errno = EINVAL;
  364. return -1;
  365. }
  366. ThreadState *thr = cur_thread();
  367. const int UCF_SWAPPED = 0x80000000;
  368. oucp->uc_onstack &= ~UCF_SWAPPED;
  369. thr->ignore_interceptors++;
  370. int ret = getcontext(oucp);
  371. if (!(oucp->uc_onstack & UCF_SWAPPED)) {
  372. thr->ignore_interceptors--;
  373. if (!ret) {
  374. oucp->uc_onstack |= UCF_SWAPPED;
  375. ret = setcontext(ucp);
  376. }
  377. }
  378. return ret;
  379. }
  380. // On macOS, libc++ is always linked dynamically, so intercepting works the
  381. // usual way.
  382. #define STDCXX_INTERCEPTOR TSAN_INTERCEPTOR
  383. namespace {
  384. struct fake_shared_weak_count {
  385. volatile a64 shared_owners;
  386. volatile a64 shared_weak_owners;
  387. virtual void _unused_0x0() = 0;
  388. virtual void _unused_0x8() = 0;
  389. virtual void on_zero_shared() = 0;
  390. virtual void _unused_0x18() = 0;
  391. virtual void on_zero_shared_weak() = 0;
  392. virtual ~fake_shared_weak_count() = 0; // suppress -Wnon-virtual-dtor
  393. };
  394. } // namespace
  395. // The following code adds libc++ interceptors for:
  396. // void __shared_weak_count::__release_shared() _NOEXCEPT;
  397. // bool __shared_count::__release_shared() _NOEXCEPT;
  398. // Shared and weak pointers in C++ maintain reference counts via atomics in
  399. // libc++.dylib, which are TSan-invisible, and this leads to false positives in
  400. // destructor code. These interceptors re-implements the whole functions so that
  401. // the mo_acq_rel semantics of the atomic decrement are visible.
  402. //
  403. // Unfortunately, the interceptors cannot simply Acquire/Release some sync
  404. // object and call the original function, because it would have a race between
  405. // the sync and the destruction of the object. Calling both under a lock will
  406. // not work because the destructor can invoke this interceptor again (and even
  407. // in a different thread, so recursive locks don't help).
  408. STDCXX_INTERCEPTOR(void, _ZNSt3__119__shared_weak_count16__release_sharedEv,
  409. fake_shared_weak_count *o) {
  410. if (!flags()->shared_ptr_interceptor)
  411. return REAL(_ZNSt3__119__shared_weak_count16__release_sharedEv)(o);
  412. SCOPED_TSAN_INTERCEPTOR(_ZNSt3__119__shared_weak_count16__release_sharedEv,
  413. o);
  414. if (__tsan_atomic64_fetch_add(&o->shared_owners, -1, mo_release) == 0) {
  415. Acquire(thr, pc, (uptr)&o->shared_owners);
  416. o->on_zero_shared();
  417. if (__tsan_atomic64_fetch_add(&o->shared_weak_owners, -1, mo_release) ==
  418. 0) {
  419. Acquire(thr, pc, (uptr)&o->shared_weak_owners);
  420. o->on_zero_shared_weak();
  421. }
  422. }
  423. }
  424. STDCXX_INTERCEPTOR(bool, _ZNSt3__114__shared_count16__release_sharedEv,
  425. fake_shared_weak_count *o) {
  426. if (!flags()->shared_ptr_interceptor)
  427. return REAL(_ZNSt3__114__shared_count16__release_sharedEv)(o);
  428. SCOPED_TSAN_INTERCEPTOR(_ZNSt3__114__shared_count16__release_sharedEv, o);
  429. if (__tsan_atomic64_fetch_add(&o->shared_owners, -1, mo_release) == 0) {
  430. Acquire(thr, pc, (uptr)&o->shared_owners);
  431. o->on_zero_shared();
  432. return true;
  433. }
  434. return false;
  435. }
  436. namespace {
  437. struct call_once_callback_args {
  438. void (*orig_func)(void *arg);
  439. void *orig_arg;
  440. void *flag;
  441. };
  442. void call_once_callback_wrapper(void *arg) {
  443. call_once_callback_args *new_args = (call_once_callback_args *)arg;
  444. new_args->orig_func(new_args->orig_arg);
  445. __tsan_release(new_args->flag);
  446. }
  447. } // namespace
  448. // This adds a libc++ interceptor for:
  449. // void __call_once(volatile unsigned long&, void*, void(*)(void*));
  450. // C++11 call_once is implemented via an internal function __call_once which is
  451. // inside libc++.dylib, and the atomic release store inside it is thus
  452. // TSan-invisible. To avoid false positives, this interceptor wraps the callback
  453. // function and performs an explicit Release after the user code has run.
  454. STDCXX_INTERCEPTOR(void, _ZNSt3__111__call_onceERVmPvPFvS2_E, void *flag,
  455. void *arg, void (*func)(void *arg)) {
  456. call_once_callback_args new_args = {func, arg, flag};
  457. REAL(_ZNSt3__111__call_onceERVmPvPFvS2_E)(flag, &new_args,
  458. call_once_callback_wrapper);
  459. }
  460. } // namespace __tsan
  461. #endif // SANITIZER_MAC