How to test for double frees

squeek502 · April 28, 2024, 8:02pm

GeneralPurposeAllocator does have support for detecting double frees:

ziglang/zig/blob/25f1526fe6424cef156724977b75a5b80a3d5833/lib/std/heap/general_purpose_allocator.zig#L493-L503


      
          fn reportDoubleFree(ret_addr: usize, alloc_stack_trace: StackTrace, free_stack_trace: StackTrace) void {
              var addresses: [stack_n]usize = [1]usize{0} ** stack_n;
              var second_free_stack_trace = StackTrace{
                  .instruction_addresses = &addresses,
                  .index = 0,
              };
              std.debug.captureStackTrace(ret_addr, &second_free_stack_trace);
              log.err("Double free detected. Allocation: {} First free: {} Second free: {}", .{
                  alloc_stack_trace, free_stack_trace, second_free_stack_trace,
              });
          }

but it needs the GeneralPurposeAllocator.Config to have retain_metadata = true and never_unmap = true:

github.com

ziglang/zig/blob/25f1526fe6424cef156724977b75a5b80a3d5833/lib/std/heap/general_purpose_allocator.zig#L142-L152


      
          /// This is a temporary debugging trick you can use to turn segfaults into more helpful
          /// logged error messages with stack trace details. The downside is that every allocation
          /// will be leaked, unless used with retain_metadata!
          never_unmap: bool = false,
          
          /// This is a temporary debugging aid that retains metadata about allocations indefinitely.
          /// This allows a greater range of double frees to be reported. All metadata is freed when
          /// deinit is called. When used with never_unmap, deliberately leaked memory is also freed
          /// during deinit. Currently should be used with never_unmap to avoid segfaults.
          /// TODO https://github.com/ziglang/zig/issues/4298 will allow use without never_unmap
          retain_metadata: bool = false,

Test code:

const std = @import("std");

test "double free" {
    var gpa = std.heap.GeneralPurposeAllocator(.{
        .safety = true,
        .never_unmap = true,
        .retain_metadata = true,
    }){};
    defer std.debug.assert(gpa.deinit() == .ok);
    const allocator = gpa.allocator();

    const alloc = try allocator.alloc(u8, 8);
    allocator.free(alloc);
    allocator.free(alloc);
}

For me on Windows this is outputting:

[gpa] (err): Double free detected. Allocation:
 First free:
 Second free:
C:\Users\Ryan\Programming\Zig\tmp\doublefree.zig:10:19: 0x7510f5 in test.double free (test.exe.obj)
    allocator.free(alloc);
                  ^
C:\Users\Ryan\Programming\Zig\zig\lib\compiler\test_runner.zig:158:25: 0x75bc1a in mainTerminal (test.exe.obj)
        if (test_fn.func()) |_| {
                        ^
C:\Users\Ryan\Programming\Zig\zig\lib\compiler\test_runner.zig:35:28: 0x751998 in main (test.exe.obj)
        return mainTerminal();
                           ^
C:\Users\Ryan\Programming\Zig\zig\lib\std\start.zig:350:53: 0x751713 in WinStartup (test.exe.obj)
    std.os.windows.ntdll.RtlExitUserProcess(callMain());
                                                    ^
???:?:?: 0x7ff91a157343 in ??? (KERNEL32.DLL)
???:?:?: 0x7ff91c0e26b0 in ??? (ntdll.dll)

unsure if the first free stack trace being empty is a Windows-only bug or a general regression.

(note: it looks like I may have accidentally regressed retain_metadata in GeneralPurposeAllocator: Considerably improve worst case performance by squeek502 · Pull Request #17383 · ziglang/zig · GitHub; if there are two allocations of 8 bytes in the above test, it hits an assertion failure during gpa.deinit())