llvm-capstone/libcxx/include/deque

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

2995 lines
106 KiB
Plaintext
Raw Normal View History

2010-05-11 19:42:16 +00:00
// -*- C++ -*-
//===----------------------------------------------------------------------===//
2010-05-11 19:42:16 +00:00
//
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
// See https://llvm.org/LICENSE.txt for license information.
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
2010-05-11 19:42:16 +00:00
//
//===----------------------------------------------------------------------===//
#ifndef _LIBCPP_DEQUE
#define _LIBCPP_DEQUE
/*
deque synopsis
namespace std
{
template <class T, class Allocator = allocator<T> >
class deque
{
public:
// types:
typedef T value_type;
typedef Allocator allocator_type;
typedef typename allocator_type::reference reference;
typedef typename allocator_type::const_reference const_reference;
typedef implementation-defined iterator;
typedef implementation-defined const_iterator;
typedef typename allocator_type::size_type size_type;
typedef typename allocator_type::difference_type difference_type;
typedef typename allocator_type::pointer pointer;
typedef typename allocator_type::const_pointer const_pointer;
typedef std::reverse_iterator<iterator> reverse_iterator;
typedef std::reverse_iterator<const_iterator> const_reverse_iterator;
// construct/copy/destroy:
deque() noexcept(is_nothrow_default_constructible<allocator_type>::value);
2010-05-11 19:42:16 +00:00
explicit deque(const allocator_type& a);
explicit deque(size_type n);
explicit deque(size_type n, const allocator_type& a); // C++14
2010-05-11 19:42:16 +00:00
deque(size_type n, const value_type& v);
deque(size_type n, const value_type& v, const allocator_type& a);
template <class InputIterator>
deque(InputIterator f, InputIterator l);
template <class InputIterator>
deque(InputIterator f, InputIterator l, const allocator_type& a);
template<container-compatible-range<T> R>
deque(from_range_t, R&& rg, const Allocator& = Allocator()); // C++23
2010-05-11 19:42:16 +00:00
deque(const deque& c);
deque(deque&& c)
noexcept(is_nothrow_move_constructible<allocator_type>::value);
2010-05-11 19:42:16 +00:00
deque(initializer_list<value_type> il, const Allocator& a = allocator_type());
deque(const deque& c, const allocator_type& a);
deque(deque&& c, const allocator_type& a);
~deque();
deque& operator=(const deque& c);
deque& operator=(deque&& c)
noexcept(
allocator_type::propagate_on_container_move_assignment::value &&
is_nothrow_move_assignable<allocator_type>::value);
2010-05-11 19:42:16 +00:00
deque& operator=(initializer_list<value_type> il);
template <class InputIterator>
void assign(InputIterator f, InputIterator l);
template<container-compatible-range<T> R>
void assign_range(R&& rg); // C++23
2010-05-11 19:42:16 +00:00
void assign(size_type n, const value_type& v);
void assign(initializer_list<value_type> il);
2011-06-02 16:10:22 +00:00
allocator_type get_allocator() const noexcept;
2010-05-11 19:42:16 +00:00
// iterators:
2011-06-02 16:10:22 +00:00
iterator begin() noexcept;
const_iterator begin() const noexcept;
iterator end() noexcept;
const_iterator end() const noexcept;
2010-05-11 19:42:16 +00:00
2011-06-02 16:10:22 +00:00
reverse_iterator rbegin() noexcept;
const_reverse_iterator rbegin() const noexcept;
reverse_iterator rend() noexcept;
const_reverse_iterator rend() const noexcept;
2010-05-11 19:42:16 +00:00
2011-06-02 16:10:22 +00:00
const_iterator cbegin() const noexcept;
const_iterator cend() const noexcept;
const_reverse_iterator crbegin() const noexcept;
const_reverse_iterator crend() const noexcept;
2010-05-11 19:42:16 +00:00
// capacity:
2011-06-02 16:10:22 +00:00
size_type size() const noexcept;
size_type max_size() const noexcept;
2010-05-11 19:42:16 +00:00
void resize(size_type n);
void resize(size_type n, const value_type& v);
void shrink_to_fit();
2011-06-02 16:10:22 +00:00
bool empty() const noexcept;
2010-05-11 19:42:16 +00:00
// element access:
reference operator[](size_type i);
const_reference operator[](size_type i) const;
reference at(size_type i);
const_reference at(size_type i) const;
reference front();
const_reference front() const;
reference back();
const_reference back() const;
// modifiers:
void push_front(const value_type& v);
void push_front(value_type&& v);
template<container-compatible-range<T> R>
void prepend_range(R&& rg); // C++23
2010-05-11 19:42:16 +00:00
void push_back(const value_type& v);
void push_back(value_type&& v);
template<container-compatible-range<T> R>
void append_range(R&& rg); // C++23
template <class... Args> reference emplace_front(Args&&... args); // reference in C++17
template <class... Args> reference emplace_back(Args&&... args); // reference in C++17
2010-05-11 19:42:16 +00:00
template <class... Args> iterator emplace(const_iterator p, Args&&... args);
iterator insert(const_iterator p, const value_type& v);
iterator insert(const_iterator p, value_type&& v);
iterator insert(const_iterator p, size_type n, const value_type& v);
template <class InputIterator>
iterator insert(const_iterator p, InputIterator f, InputIterator l);
template<container-compatible-range<T> R>
iterator insert_range(const_iterator position, R&& rg); // C++23
2010-05-11 19:42:16 +00:00
iterator insert(const_iterator p, initializer_list<value_type> il);
void pop_front();
void pop_back();
iterator erase(const_iterator p);
iterator erase(const_iterator f, const_iterator l);
void swap(deque& c)
noexcept(allocator_traits<allocator_type>::is_always_equal::value); // C++17
2011-06-02 16:10:22 +00:00
void clear() noexcept;
2010-05-11 19:42:16 +00:00
};
template <class InputIterator, class Allocator = allocator<typename iterator_traits<InputIterator>::value_type>>
deque(InputIterator, InputIterator, Allocator = Allocator())
-> deque<typename iterator_traits<InputIterator>::value_type, Allocator>; // C++17
template<ranges::input_range R, class Allocator = allocator<ranges::range_value_t<R>>>
deque(from_range_t, R&&, Allocator = Allocator())
-> deque<ranges::range_value_t<R>, Allocator>; // C++23
2010-05-11 19:42:16 +00:00
template <class T, class Allocator>
bool operator==(const deque<T,Allocator>& x, const deque<T,Allocator>& y);
template <class T, class Allocator>
bool operator< (const deque<T,Allocator>& x, const deque<T,Allocator>& y); // removed in C++20
2010-05-11 19:42:16 +00:00
template <class T, class Allocator>
bool operator!=(const deque<T,Allocator>& x, const deque<T,Allocator>& y); // removed in C++20
2010-05-11 19:42:16 +00:00
template <class T, class Allocator>
bool operator> (const deque<T,Allocator>& x, const deque<T,Allocator>& y); // removed in C++20
2010-05-11 19:42:16 +00:00
template <class T, class Allocator>
bool operator>=(const deque<T,Allocator>& x, const deque<T,Allocator>& y); // removed in C++20
2010-05-11 19:42:16 +00:00
template <class T, class Allocator>
bool operator<=(const deque<T,Allocator>& x, const deque<T,Allocator>& y); // removed in C++20
template<class T, class Allocator>
synth-three-way-result<T> operator<=>(const deque<T, Allocator>& x,
const deque<T, Allocator>& y); // since C++20
2010-05-11 19:42:16 +00:00
// specialized algorithms:
template <class T, class Allocator>
2011-06-03 17:30:28 +00:00
void swap(deque<T,Allocator>& x, deque<T,Allocator>& y)
noexcept(noexcept(x.swap(y)));
2010-05-11 19:42:16 +00:00
template <class T, class Allocator, class U>
typename deque<T, Allocator>::size_type
erase(deque<T, Allocator>& c, const U& value); // C++20
template <class T, class Allocator, class Predicate>
typename deque<T, Allocator>::size_type
erase_if(deque<T, Allocator>& c, Predicate pred); // C++20
2010-05-11 19:42:16 +00:00
} // std
*/
#include <__algorithm/copy.h>
#include <__algorithm/copy_backward.h>
#include <__algorithm/copy_n.h>
#include <__algorithm/equal.h>
#include <__algorithm/fill_n.h>
#include <__algorithm/lexicographical_compare.h>
#include <__algorithm/lexicographical_compare_three_way.h>
#include <__algorithm/min.h>
#include <__algorithm/remove.h>
#include <__algorithm/remove_if.h>
#include <__algorithm/unwrap_iter.h>
#include <__assert> // all public C++ headers provide the assertion handler
2010-05-11 19:42:16 +00:00
#include <__config>
#include <__format/enable_insertable.h>
#include <__iterator/distance.h>
#include <__iterator/iterator_traits.h>
#include <__iterator/next.h>
#include <__iterator/prev.h>
#include <__iterator/reverse_iterator.h>
#include <__iterator/segmented_iterator.h>
#include <__memory/addressof.h>
#include <__memory/allocator_destructor.h>
#include <__memory/pointer_traits.h>
#include <__memory/temp_value.h>
#include <__memory/unique_ptr.h>
#include <__memory_resource/polymorphic_allocator.h>
#include <__ranges/access.h>
#include <__ranges/concepts.h>
#include <__ranges/container_compatible_range.h>
#include <__ranges/from_range.h>
#include <__ranges/size.h>
2010-05-11 19:42:16 +00:00
#include <__split_buffer>
#include <__type_traits/is_allocator.h>
#include <__type_traits/is_convertible.h>
#include <__type_traits/is_same.h>
#include <__type_traits/type_identity.h>
#include <__utility/forward.h>
#include <__utility/move.h>
#include <__utility/pair.h>
#include <__utility/swap.h>
#include <limits>
2010-05-11 19:42:16 +00:00
#include <stdexcept>
#include <version>
2010-05-11 19:42:16 +00:00
// standard-mandated includes
// [iterator.range]
#include <__iterator/access.h>
#include <__iterator/data.h>
#include <__iterator/empty.h>
#include <__iterator/reverse_access.h>
#include <__iterator/size.h>
// [deque.syn]
#include <compare>
#include <initializer_list>
#if !defined(_LIBCPP_HAS_NO_PRAGMA_SYSTEM_HEADER)
# pragma GCC system_header
#endif
_LIBCPP_PUSH_MACROS
#include <__undef_macros>
2010-05-11 19:42:16 +00:00
_LIBCPP_BEGIN_NAMESPACE_STD
template <class _Tp, class _Allocator = allocator<_Tp> > class _LIBCPP_TEMPLATE_VIS deque;
2010-05-11 19:42:16 +00:00
template <class _ValueType, class _DiffType>
struct __deque_block_size {
static const _DiffType value = sizeof(_ValueType) < 256 ? 4096 / sizeof(_ValueType) : 16;
};
2010-05-11 19:42:16 +00:00
template <class _ValueType, class _Pointer, class _Reference, class _MapPointer,
class _DiffType, _DiffType _BS =
#ifdef _LIBCPP_ABI_INCOMPLETE_TYPES_IN_DEQUE
// Keep template parameter to avoid changing all template declarations thoughout
// this file.
0
#else
__deque_block_size<_ValueType, _DiffType>::value
#endif
>
class _LIBCPP_TEMPLATE_VIS __deque_iterator
2010-05-11 19:42:16 +00:00
{
typedef _MapPointer __map_iterator;
public:
typedef _Pointer pointer;
typedef _DiffType difference_type;
private:
__map_iterator __m_iter_;
pointer __ptr_;
static const difference_type __block_size;
2010-05-11 19:42:16 +00:00
public:
typedef _ValueType value_type;
typedef random_access_iterator_tag iterator_category;
typedef _Reference reference;
_LIBCPP_HIDE_FROM_ABI __deque_iterator() _NOEXCEPT
#if _LIBCPP_STD_VER >= 14
: __m_iter_(nullptr), __ptr_(nullptr)
#endif
{}
2010-05-11 19:42:16 +00:00
template <class _Pp, class _Rp, class _MP>
_LIBCPP_HIDE_FROM_ABI
__deque_iterator(const __deque_iterator<value_type, _Pp, _Rp, _MP, difference_type, _BS>& __it,
typename enable_if<is_convertible<_Pp, pointer>::value>::type* = 0) _NOEXCEPT
2010-05-11 19:42:16 +00:00
: __m_iter_(__it.__m_iter_), __ptr_(__it.__ptr_) {}
_LIBCPP_HIDE_FROM_ABI reference operator*() const {return *__ptr_;}
_LIBCPP_HIDE_FROM_ABI pointer operator->() const {return __ptr_;}
2010-05-11 19:42:16 +00:00
_LIBCPP_HIDE_FROM_ABI __deque_iterator& operator++()
2010-05-11 19:42:16 +00:00
{
if (++__ptr_ - *__m_iter_ == __block_size)
{
++__m_iter_;
__ptr_ = *__m_iter_;
}
return *this;
}
_LIBCPP_HIDE_FROM_ABI __deque_iterator operator++(int)
2010-05-11 19:42:16 +00:00
{
__deque_iterator __tmp = *this;
++(*this);
return __tmp;
}
_LIBCPP_HIDE_FROM_ABI __deque_iterator& operator--()
2010-05-11 19:42:16 +00:00
{
if (__ptr_ == *__m_iter_)
{
--__m_iter_;
__ptr_ = *__m_iter_ + __block_size;
}
--__ptr_;
return *this;
}
_LIBCPP_HIDE_FROM_ABI __deque_iterator operator--(int)
2010-05-11 19:42:16 +00:00
{
__deque_iterator __tmp = *this;
--(*this);
return __tmp;
}
_LIBCPP_HIDE_FROM_ABI __deque_iterator& operator+=(difference_type __n)
2010-05-11 19:42:16 +00:00
{
if (__n != 0)
{
__n += __ptr_ - *__m_iter_;
if (__n > 0)
{
__m_iter_ += __n / __block_size;
__ptr_ = *__m_iter_ + __n % __block_size;
}
else // (__n < 0)
{
difference_type __z = __block_size - 1 - __n;
__m_iter_ -= __z / __block_size;
__ptr_ = *__m_iter_ + (__block_size - 1 - __z % __block_size);
}
}
return *this;
}
_LIBCPP_HIDE_FROM_ABI __deque_iterator& operator-=(difference_type __n)
2010-05-11 19:42:16 +00:00
{
return *this += -__n;
}
_LIBCPP_HIDE_FROM_ABI __deque_iterator operator+(difference_type __n) const
2010-05-11 19:42:16 +00:00
{
__deque_iterator __t(*this);
__t += __n;
return __t;
}
_LIBCPP_HIDE_FROM_ABI __deque_iterator operator-(difference_type __n) const
2010-05-11 19:42:16 +00:00
{
__deque_iterator __t(*this);
__t -= __n;
return __t;
}
_LIBCPP_HIDE_FROM_ABI
2010-05-11 19:42:16 +00:00
friend __deque_iterator operator+(difference_type __n, const __deque_iterator& __it)
{return __it + __n;}
_LIBCPP_HIDE_FROM_ABI
2010-05-11 19:42:16 +00:00
friend difference_type operator-(const __deque_iterator& __x, const __deque_iterator& __y)
{
if (__x != __y)
return (__x.__m_iter_ - __y.__m_iter_) * __block_size
+ (__x.__ptr_ - *__x.__m_iter_)
- (__y.__ptr_ - *__y.__m_iter_);
return 0;
}
_LIBCPP_HIDE_FROM_ABI reference operator[](difference_type __n) const
2010-05-11 19:42:16 +00:00
{return *(*this + __n);}
_LIBCPP_HIDE_FROM_ABI friend
2010-05-11 19:42:16 +00:00
bool operator==(const __deque_iterator& __x, const __deque_iterator& __y)
{return __x.__ptr_ == __y.__ptr_;}
_LIBCPP_HIDE_FROM_ABI friend
2010-05-11 19:42:16 +00:00
bool operator!=(const __deque_iterator& __x, const __deque_iterator& __y)
{return !(__x == __y);}
_LIBCPP_HIDE_FROM_ABI friend
2010-05-11 19:42:16 +00:00
bool operator<(const __deque_iterator& __x, const __deque_iterator& __y)
{return __x.__m_iter_ < __y.__m_iter_ ||
(__x.__m_iter_ == __y.__m_iter_ && __x.__ptr_ < __y.__ptr_);}
_LIBCPP_HIDE_FROM_ABI friend
2010-05-11 19:42:16 +00:00
bool operator>(const __deque_iterator& __x, const __deque_iterator& __y)
{return __y < __x;}
_LIBCPP_HIDE_FROM_ABI friend
2010-05-11 19:42:16 +00:00
bool operator<=(const __deque_iterator& __x, const __deque_iterator& __y)
{return !(__y < __x);}
_LIBCPP_HIDE_FROM_ABI friend
2010-05-11 19:42:16 +00:00
bool operator>=(const __deque_iterator& __x, const __deque_iterator& __y)
{return !(__x < __y);}
private:
_LIBCPP_HIDE_FROM_ABI explicit __deque_iterator(__map_iterator __m, pointer __p) _NOEXCEPT
2010-05-11 19:42:16 +00:00
: __m_iter_(__m), __ptr_(__p) {}
template <class _Tp, class _Ap> friend class _LIBCPP_TEMPLATE_VIS deque;
template <class _Vp, class _Pp, class _Rp, class _MP, class _Dp, _Dp>
friend class _LIBCPP_TEMPLATE_VIS __deque_iterator;
2010-05-11 19:42:16 +00:00
template <class>
friend struct __segmented_iterator_traits;
};
template <class _ValueType, class _Pointer, class _Reference, class _MapPointer, class _DiffType, _DiffType _BlockSize>
struct __segmented_iterator_traits<
__deque_iterator<_ValueType, _Pointer, _Reference, _MapPointer, _DiffType, _BlockSize> > {
private:
using _Iterator = __deque_iterator<_ValueType, _Pointer, _Reference, _MapPointer, _DiffType, _BlockSize>;
public:
using __is_segmented_iterator = true_type;
using __segment_iterator = _MapPointer;
using __local_iterator = _Pointer;
static _LIBCPP_HIDE_FROM_ABI __segment_iterator __segment(_Iterator __iter) { return __iter.__m_iter_; }
static _LIBCPP_HIDE_FROM_ABI __local_iterator __local(_Iterator __iter) { return __iter.__ptr_; }
static _LIBCPP_HIDE_FROM_ABI __local_iterator __begin(__segment_iterator __iter) { return *__iter; }
static _LIBCPP_HIDE_FROM_ABI __local_iterator __end(__segment_iterator __iter) {
return *__iter + _Iterator::__block_size;
}
static _LIBCPP_HIDE_FROM_ABI _Iterator __compose(__segment_iterator __segment, __local_iterator __local) {
if (__local == __end(__segment)) {
++__segment;
return _Iterator(__segment, *__segment);
}
return _Iterator(__segment, __local);
}
2010-05-11 19:42:16 +00:00
};
template <class _ValueType, class _Pointer, class _Reference, class _MapPointer,
class _DiffType, _DiffType _BlockSize>
const _DiffType __deque_iterator<_ValueType, _Pointer, _Reference, _MapPointer,
_DiffType, _BlockSize>::__block_size =
__deque_block_size<_ValueType, _DiffType>::value;
template <class _Tp, class _Allocator /*= allocator<_Tp>*/>
class _LIBCPP_TEMPLATE_VIS deque
2010-05-11 19:42:16 +00:00
{
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
private:
using __default_allocator_type = allocator<_Tp>;
public:
// types:
using value_type = _Tp;
static_assert((is_same<typename _Allocator::value_type, value_type>::value),
"Allocator::value_type must be same type as value_type");
using allocator_type = _Allocator;
using __alloc_traits = allocator_traits<allocator_type>;
using size_type = typename __alloc_traits::size_type;
using difference_type = typename __alloc_traits::difference_type;
using pointer = typename __alloc_traits::pointer;
using const_pointer = typename __alloc_traits::const_pointer;
using __pointer_allocator = __rebind_alloc<__alloc_traits, pointer>;
using __const_pointer_allocator = __rebind_alloc<__alloc_traits, const_pointer>;
using __map = __split_buffer<pointer, __pointer_allocator>;
using __map_alloc_traits = allocator_traits<__pointer_allocator>;
using __map_pointer = typename __map_alloc_traits::pointer;
using __map_const_pointer = typename allocator_traits<__const_pointer_allocator>::const_pointer;
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
using __map_const_iterator = typename __map::const_iterator;
using reference = value_type&;
using const_reference = const value_type&;
using iterator = __deque_iterator<value_type, pointer, reference, __map_pointer, difference_type>;
using const_iterator =
__deque_iterator<value_type, const_pointer, const_reference, __map_const_pointer, difference_type>;
using reverse_iterator = std::reverse_iterator<iterator>;
using const_reverse_iterator = std::reverse_iterator<const_iterator>;
2010-05-11 19:42:16 +00:00
static_assert(is_same<allocator_type, __rebind_alloc<__alloc_traits, value_type> >::value,
"[allocator.requirements] states that rebinding an allocator to the same type should result in the "
"original allocator");
static_assert(is_nothrow_default_constructible<allocator_type>::value ==
is_nothrow_default_constructible<__pointer_allocator>::value,
"rebinding an allocator should not change excpetion guarantees");
static_assert(is_nothrow_move_constructible<allocator_type>::value ==
is_nothrow_move_constructible<typename __map::allocator_type>::value,
"rebinding an allocator should not change excpetion guarantees");
2010-05-11 19:42:16 +00:00
private:
struct __deque_block_range {
explicit _LIBCPP_HIDE_FROM_ABI
__deque_block_range(pointer __b, pointer __e) _NOEXCEPT : __begin_(__b), __end_(__e) {}
const pointer __begin_;
const pointer __end_;
};
2010-05-11 19:42:16 +00:00
struct __deque_range {
iterator __pos_;
const iterator __end_;
2010-05-11 19:42:16 +00:00
_LIBCPP_HIDE_FROM_ABI __deque_range(iterator __pos, iterator __e) _NOEXCEPT
: __pos_(__pos), __end_(__e) {}
2010-05-11 19:42:16 +00:00
explicit _LIBCPP_HIDE_FROM_ABI operator bool() const _NOEXCEPT {
return __pos_ != __end_;
2010-05-11 19:42:16 +00:00
}
_LIBCPP_HIDE_FROM_ABI __deque_range begin() const {
return *this;
}
_LIBCPP_HIDE_FROM_ABI __deque_range end() const {
return __deque_range(__end_, __end_);
2010-05-11 19:42:16 +00:00
}
_LIBCPP_HIDE_FROM_ABI __deque_block_range operator*() const _NOEXCEPT {
if (__pos_.__m_iter_ == __end_.__m_iter_) {
return __deque_block_range(__pos_.__ptr_, __end_.__ptr_);
}
return __deque_block_range(__pos_.__ptr_, *__pos_.__m_iter_ + __block_size);
2010-05-11 19:42:16 +00:00
}
_LIBCPP_HIDE_FROM_ABI __deque_range& operator++() _NOEXCEPT {
if (__pos_.__m_iter_ == __end_.__m_iter_) {
__pos_ = __end_;
} else {
++__pos_.__m_iter_;
__pos_.__ptr_ = *__pos_.__m_iter_;
}
return *this;
}
2010-05-11 19:42:16 +00:00
_LIBCPP_HIDE_FROM_ABI friend bool operator==(__deque_range const& __lhs, __deque_range const& __rhs) {
return __lhs.__pos_ == __rhs.__pos_;
2010-05-11 19:42:16 +00:00
}
_LIBCPP_HIDE_FROM_ABI friend bool operator!=(__deque_range const& __lhs, __deque_range const& __rhs) {
return !(__lhs == __rhs);
2010-05-11 19:42:16 +00:00
}
};
2010-05-11 19:42:16 +00:00
struct _ConstructTransaction {
_LIBCPP_HIDE_FROM_ABI _ConstructTransaction(deque* __db, __deque_block_range& __r)
: __pos_(__r.__begin_), __end_(__r.__end_), __begin_(__r.__begin_), __base_(__db) {}
2010-05-11 19:42:16 +00:00
_LIBCPP_HIDE_FROM_ABI ~_ConstructTransaction() {
__base_->__size() += (__pos_ - __begin_);
2010-05-11 19:42:16 +00:00
}
pointer __pos_;
const pointer __end_;
private:
const pointer __begin_;
deque* const __base_;
};
static const difference_type __block_size;
2010-05-11 19:42:16 +00:00
__map __map_;
size_type __start_;
__compressed_pair<size_type, allocator_type> __size_;
public:
2010-05-11 19:42:16 +00:00
// construct/copy/destroy:
_LIBCPP_HIDE_FROM_ABI
deque() _NOEXCEPT_(is_nothrow_default_constructible<allocator_type>::value)
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
: __start_(0), __size_(0, __default_init_tag()) {
__annotate_new(0);
}
2010-05-11 19:42:16 +00:00
_LIBCPP_HIDE_FROM_ABI ~deque() {
clear();
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
__annotate_delete();
typename __map::iterator __i = __map_.begin();
typename __map::iterator __e = __map_.end();
for (; __i != __e; ++__i)
__alloc_traits::deallocate(__alloc(), *__i, __block_size);
}
2010-05-11 19:42:16 +00:00
_LIBCPP_HIDE_FROM_ABI explicit deque(const allocator_type& __a)
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
: __map_(__pointer_allocator(__a)), __start_(0), __size_(0, __a) {
__annotate_new(0);
}
explicit _LIBCPP_HIDE_FROM_ABI deque(size_type __n);
#if _LIBCPP_STD_VER >= 14
explicit _LIBCPP_HIDE_FROM_ABI deque(size_type __n, const _Allocator& __a);
#endif
_LIBCPP_HIDE_FROM_ABI deque(size_type __n, const value_type& __v);
template <class = __enable_if_t<__is_allocator<_Allocator>::value> >
_LIBCPP_HIDE_FROM_ABI deque(size_type __n, const value_type& __v, const allocator_type& __a)
: __map_(__pointer_allocator(__a)), __start_(0), __size_(0, __a)
{
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
__annotate_new(0);
if (__n > 0)
__append(__n, __v);
}
2010-05-11 19:42:16 +00:00
template <class _InputIter>
_LIBCPP_HIDE_FROM_ABI deque(_InputIter __f, _InputIter __l,
typename enable_if<__has_input_iterator_category<_InputIter>::value>::type* = 0);
2010-05-11 19:42:16 +00:00
template <class _InputIter>
_LIBCPP_HIDE_FROM_ABI deque(_InputIter __f, _InputIter __l, const allocator_type& __a,
typename enable_if<__has_input_iterator_category<_InputIter>::value>::type* = 0);
#if _LIBCPP_STD_VER >= 23
template <_ContainerCompatibleRange<_Tp> _Range>
_LIBCPP_HIDE_FROM_ABI deque(from_range_t, _Range&& __range,
const allocator_type& __a = allocator_type())
: __map_(__pointer_allocator(__a)), __start_(0), __size_(0, __a) {
if constexpr (ranges::forward_range<_Range> || ranges::sized_range<_Range>) {
__append_with_size(ranges::begin(__range), ranges::distance(__range));
} else {
for (auto&& __e : __range) {
emplace_back(std::forward<decltype(__e)>(__e));
}
}
}
#endif
_LIBCPP_HIDE_FROM_ABI deque(const deque& __c);
_LIBCPP_HIDE_FROM_ABI deque(const deque& __c, const __type_identity_t<allocator_type>& __a);
_LIBCPP_HIDE_FROM_ABI deque& operator=(const deque& __c);
#ifndef _LIBCPP_CXX03_LANG
_LIBCPP_HIDE_FROM_ABI deque(initializer_list<value_type> __il);
_LIBCPP_HIDE_FROM_ABI deque(initializer_list<value_type> __il, const allocator_type& __a);
2010-05-11 19:42:16 +00:00
_LIBCPP_HIDE_FROM_ABI
2010-05-11 19:42:16 +00:00
deque& operator=(initializer_list<value_type> __il) {assign(__il); return *this;}
_LIBCPP_HIDE_FROM_ABI
deque(deque&& __c) _NOEXCEPT_(is_nothrow_move_constructible<allocator_type>::value);
_LIBCPP_HIDE_FROM_ABI
deque(deque&& __c, const __type_identity_t<allocator_type>& __a);
_LIBCPP_HIDE_FROM_ABI
deque& operator=(deque&& __c)
_NOEXCEPT_(__alloc_traits::propagate_on_container_move_assignment::value &&
is_nothrow_move_assignable<allocator_type>::value);
_LIBCPP_HIDE_FROM_ABI
void assign(initializer_list<value_type> __il) {assign(__il.begin(), __il.end());}
#endif // _LIBCPP_CXX03_LANG
2010-05-11 19:42:16 +00:00
template <class _InputIter>
_LIBCPP_HIDE_FROM_ABI void assign(_InputIter __f, _InputIter __l,
typename enable_if<__has_input_iterator_category<_InputIter>::value &&
!__has_random_access_iterator_category<_InputIter>::value>::type* = 0);
2010-05-11 19:42:16 +00:00
template <class _RAIter>
_LIBCPP_HIDE_FROM_ABI void assign(_RAIter __f, _RAIter __l,
typename enable_if<__has_random_access_iterator_category<_RAIter>::value>::type* = 0);
#if _LIBCPP_STD_VER >= 23
template <_ContainerCompatibleRange<_Tp> _Range>
_LIBCPP_HIDE_FROM_ABI
void assign_range(_Range&& __range) {
if constexpr (ranges::random_access_range<_Range>) {
auto __n = static_cast<size_type>(ranges::distance(__range));
__assign_with_size_random_access(ranges::begin(__range), __n);
} else if constexpr (ranges::forward_range<_Range> || ranges::sized_range<_Range>) {
auto __n = static_cast<size_type>(ranges::distance(__range));
__assign_with_size(ranges::begin(__range), __n);
} else {
__assign_with_sentinel(ranges::begin(__range), ranges::end(__range));
}
}
#endif
_LIBCPP_HIDE_FROM_ABI void assign(size_type __n, const value_type& __v);
2010-05-11 19:42:16 +00:00
_LIBCPP_HIDE_FROM_ABI
2011-06-02 16:10:22 +00:00
allocator_type get_allocator() const _NOEXCEPT;
_LIBCPP_HIDE_FROM_ABI allocator_type& __alloc() _NOEXCEPT { return __size_.second(); }
_LIBCPP_HIDE_FROM_ABI const allocator_type& __alloc() const _NOEXCEPT { return __size_.second(); }
// iterators:
_LIBCPP_HIDE_FROM_ABI iterator begin() _NOEXCEPT {
__map_pointer __mp = __map_.begin() + __start_ / __block_size;
return iterator(__mp, __map_.empty() ? 0 : *__mp + __start_ % __block_size);
}
_LIBCPP_HIDE_FROM_ABI const_iterator begin() const _NOEXCEPT {
__map_const_pointer __mp =
static_cast<__map_const_pointer>(__map_.begin() + __start_ / __block_size);
return const_iterator(__mp, __map_.empty() ? 0 : *__mp + __start_ % __block_size);
}
_LIBCPP_HIDE_FROM_ABI iterator end() _NOEXCEPT {
size_type __p = size() + __start_;
__map_pointer __mp = __map_.begin() + __p / __block_size;
return iterator(__mp, __map_.empty() ? 0 : *__mp + __p % __block_size);
}
_LIBCPP_HIDE_FROM_ABI const_iterator end() const _NOEXCEPT {
size_type __p = size() + __start_;
__map_const_pointer __mp = static_cast<__map_const_pointer>(__map_.begin() + __p / __block_size);
return const_iterator(__mp, __map_.empty() ? 0 : *__mp + __p % __block_size);
}
2010-05-11 19:42:16 +00:00
_LIBCPP_HIDE_FROM_ABI
2011-06-02 16:10:22 +00:00
reverse_iterator rbegin() _NOEXCEPT
{return reverse_iterator(end());}
_LIBCPP_HIDE_FROM_ABI
2011-06-02 16:10:22 +00:00
const_reverse_iterator rbegin() const _NOEXCEPT
{return const_reverse_iterator(end());}
_LIBCPP_HIDE_FROM_ABI
2011-06-02 16:10:22 +00:00
reverse_iterator rend() _NOEXCEPT
{return reverse_iterator(begin());}
_LIBCPP_HIDE_FROM_ABI
2011-06-02 16:10:22 +00:00
const_reverse_iterator rend() const _NOEXCEPT
{return const_reverse_iterator(begin());}
2010-05-11 19:42:16 +00:00
_LIBCPP_HIDE_FROM_ABI
2011-06-02 16:10:22 +00:00
const_iterator cbegin() const _NOEXCEPT
{return begin();}
_LIBCPP_HIDE_FROM_ABI
2011-06-02 16:10:22 +00:00
const_iterator cend() const _NOEXCEPT
{return end();}
_LIBCPP_HIDE_FROM_ABI
2011-06-02 16:10:22 +00:00
const_reverse_iterator crbegin() const _NOEXCEPT
{return const_reverse_iterator(end());}
_LIBCPP_HIDE_FROM_ABI
2011-06-02 16:10:22 +00:00
const_reverse_iterator crend() const _NOEXCEPT
{return const_reverse_iterator(begin());}
2010-05-11 19:42:16 +00:00
// capacity:
_LIBCPP_HIDE_FROM_ABI
size_type size() const _NOEXCEPT {return __size();}
_LIBCPP_HIDE_FROM_ABI size_type& __size() _NOEXCEPT { return __size_.first(); }
_LIBCPP_HIDE_FROM_ABI const size_type& __size() const _NOEXCEPT { return __size_.first(); }
_LIBCPP_HIDE_FROM_ABI
2011-06-02 16:10:22 +00:00
size_type max_size() const _NOEXCEPT
{return _VSTD::min<size_type>(
__alloc_traits::max_size(__alloc()),
numeric_limits<difference_type>::max());}
_LIBCPP_HIDE_FROM_ABI void resize(size_type __n);
_LIBCPP_HIDE_FROM_ABI void resize(size_type __n, const value_type& __v);
_LIBCPP_HIDE_FROM_ABI void shrink_to_fit() _NOEXCEPT;
_LIBCPP_NODISCARD_AFTER_CXX17 _LIBCPP_HIDE_FROM_ABI
bool empty() const _NOEXCEPT {return size() == 0;}
2010-05-11 19:42:16 +00:00
// element access:
_LIBCPP_HIDE_FROM_ABI
reference operator[](size_type __i) _NOEXCEPT;
_LIBCPP_HIDE_FROM_ABI
const_reference operator[](size_type __i) const _NOEXCEPT;
_LIBCPP_HIDE_FROM_ABI
2010-05-11 19:42:16 +00:00
reference at(size_type __i);
_LIBCPP_HIDE_FROM_ABI
2010-05-11 19:42:16 +00:00
const_reference at(size_type __i) const;
_LIBCPP_HIDE_FROM_ABI
reference front() _NOEXCEPT;
_LIBCPP_HIDE_FROM_ABI
const_reference front() const _NOEXCEPT;
_LIBCPP_HIDE_FROM_ABI
reference back() _NOEXCEPT;
_LIBCPP_HIDE_FROM_ABI
const_reference back() const _NOEXCEPT;
2010-05-11 19:42:16 +00:00
// 23.2.2.3 modifiers:
_LIBCPP_HIDE_FROM_ABI void push_front(const value_type& __v);
_LIBCPP_HIDE_FROM_ABI void push_back(const value_type& __v);
#ifndef _LIBCPP_CXX03_LANG
#if _LIBCPP_STD_VER >= 17
template <class... _Args> _LIBCPP_HIDE_FROM_ABI reference emplace_front(_Args&&... __args);
template <class... _Args> _LIBCPP_HIDE_FROM_ABI reference emplace_back (_Args&&... __args);
#else
template <class... _Args> _LIBCPP_HIDE_FROM_ABI void emplace_front(_Args&&... __args);
template <class... _Args> _LIBCPP_HIDE_FROM_ABI void emplace_back (_Args&&... __args);
#endif
template <class... _Args> _LIBCPP_HIDE_FROM_ABI iterator emplace(const_iterator __p, _Args&&... __args);
_LIBCPP_HIDE_FROM_ABI void push_front(value_type&& __v);
_LIBCPP_HIDE_FROM_ABI void push_back(value_type&& __v);
#if _LIBCPP_STD_VER >= 23
template <_ContainerCompatibleRange<_Tp> _Range>
_LIBCPP_HIDE_FROM_ABI
void prepend_range(_Range&& __range) {
insert_range(begin(), std::forward<_Range>(__range));
}
template <_ContainerCompatibleRange<_Tp> _Range>
_LIBCPP_HIDE_FROM_ABI
void append_range(_Range&& __range) {
insert_range(end(), std::forward<_Range>(__range));
}
#endif
_LIBCPP_HIDE_FROM_ABI iterator insert(const_iterator __p, value_type&& __v);
_LIBCPP_HIDE_FROM_ABI
iterator insert(const_iterator __p, initializer_list<value_type> __il)
{return insert(__p, __il.begin(), __il.end());}
#endif // _LIBCPP_CXX03_LANG
_LIBCPP_HIDE_FROM_ABI iterator insert(const_iterator __p, const value_type& __v);
_LIBCPP_HIDE_FROM_ABI iterator insert(const_iterator __p, size_type __n, const value_type& __v);
2010-05-11 19:42:16 +00:00
template <class _InputIter>
_LIBCPP_HIDE_FROM_ABI iterator insert(const_iterator __p, _InputIter __f, _InputIter __l,
typename enable_if<__has_exactly_input_iterator_category<_InputIter>::value>::type* = 0);
template <class _ForwardIterator>
_LIBCPP_HIDE_FROM_ABI iterator insert(const_iterator __p, _ForwardIterator __f, _ForwardIterator __l,
typename enable_if<__has_exactly_forward_iterator_category<_ForwardIterator>::value>::type* = 0);
2010-05-11 19:42:16 +00:00
template <class _BiIter>
_LIBCPP_HIDE_FROM_ABI iterator insert(const_iterator __p, _BiIter __f, _BiIter __l,
typename enable_if<__has_bidirectional_iterator_category<_BiIter>::value>::type* = 0);
#if _LIBCPP_STD_VER >= 23
template <_ContainerCompatibleRange<_Tp> _Range>
_LIBCPP_HIDE_FROM_ABI
iterator insert_range(const_iterator __position, _Range&& __range) {
if constexpr (ranges::bidirectional_range<_Range>) {
auto __n = static_cast<size_type>(ranges::distance(__range));
return __insert_bidirectional(__position, ranges::begin(__range), ranges::end(__range), __n);
} else if constexpr (ranges::forward_range<_Range> || ranges::sized_range<_Range>) {
auto __n = static_cast<size_type>(ranges::distance(__range));
return __insert_with_size(__position, ranges::begin(__range), __n);
} else {
return __insert_with_sentinel(__position, ranges::begin(__range), ranges::end(__range));
}
}
#endif
_LIBCPP_HIDE_FROM_ABI void pop_front();
_LIBCPP_HIDE_FROM_ABI void pop_back();
_LIBCPP_HIDE_FROM_ABI iterator erase(const_iterator __p);
_LIBCPP_HIDE_FROM_ABI iterator erase(const_iterator __f, const_iterator __l);
2010-05-11 19:42:16 +00:00
_LIBCPP_HIDE_FROM_ABI
void swap(deque& __c)
#if _LIBCPP_STD_VER >= 14
_NOEXCEPT;
#else
_NOEXCEPT_(!__alloc_traits::propagate_on_container_swap::value ||
__is_nothrow_swappable<allocator_type>::value);
#endif
_LIBCPP_HIDE_FROM_ABI
2011-06-02 16:10:22 +00:00
void clear() _NOEXCEPT;
2010-05-11 19:42:16 +00:00
_LIBCPP_HIDE_FROM_ABI
bool __invariants() const {
if (!__map_.__invariants())
return false;
if (__map_.size() >= size_type(-1) / __block_size)
return false;
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
for (__map_const_iterator __i = __map_.begin(), __e = __map_.end();
__i != __e; ++__i)
if (*__i == nullptr)
return false;
if (__map_.size() != 0)
{
if (size() >= __map_.size() * __block_size)
return false;
if (__start_ >= __map_.size() * __block_size - size())
return false;
}
else
{
if (size() != 0)
return false;
if (__start_ != 0)
return false;
}
return true;
}
_LIBCPP_HIDE_FROM_ABI
void __move_assign_alloc(deque& __c)
_NOEXCEPT_(!__alloc_traits::propagate_on_container_move_assignment::value ||
is_nothrow_move_assignable<allocator_type>::value)
{__move_assign_alloc(__c, integral_constant<bool,
__alloc_traits::propagate_on_container_move_assignment::value>());}
_LIBCPP_HIDE_FROM_ABI
void __move_assign_alloc(deque& __c, true_type)
_NOEXCEPT_(is_nothrow_move_assignable<allocator_type>::value)
{
__alloc() = _VSTD::move(__c.__alloc());
}
_LIBCPP_HIDE_FROM_ABI
void __move_assign_alloc(deque&, false_type) _NOEXCEPT
{}
_LIBCPP_HIDE_FROM_ABI
void __move_assign(deque& __c)
_NOEXCEPT_(__alloc_traits::propagate_on_container_move_assignment::value &&
is_nothrow_move_assignable<allocator_type>::value)
{
__map_ = _VSTD::move(__c.__map_);
__start_ = __c.__start_;
__size() = __c.size();
__move_assign_alloc(__c);
__c.__start_ = __c.__size() = 0;
}
_LIBCPP_HIDE_FROM_ABI
2010-05-11 19:42:16 +00:00
static size_type __recommend_blocks(size_type __n)
{
return __n / __block_size + (__n % __block_size != 0);
2010-05-11 19:42:16 +00:00
}
_LIBCPP_HIDE_FROM_ABI
2010-05-11 19:42:16 +00:00
size_type __capacity() const
{
return __map_.size() == 0 ? 0 : __map_.size() * __block_size - 1;
2010-05-11 19:42:16 +00:00
}
_LIBCPP_HIDE_FROM_ABI
size_type __block_count() const
{
return __map_.size();
}
_LIBCPP_HIDE_FROM_ABI
2010-05-11 19:42:16 +00:00
size_type __front_spare() const
{
return __start_;
2010-05-11 19:42:16 +00:00
}
_LIBCPP_HIDE_FROM_ABI
size_type __front_spare_blocks() const {
return __front_spare() / __block_size;
}
_LIBCPP_HIDE_FROM_ABI
2010-05-11 19:42:16 +00:00
size_type __back_spare() const
{
return __capacity() - (__start_ + size());
2010-05-11 19:42:16 +00:00
}
_LIBCPP_HIDE_FROM_ABI
size_type __back_spare_blocks() const {
return __back_spare() / __block_size;
}
private:
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
enum __asan_annotation_type {
__asan_unposion,
__asan_poison
};
enum __asan_annotation_place {
__asan_front_moved,
__asan_back_moved,
};
// The following functions are no-ops outside of AddressSanitizer mode.
// We call annotations only for the default Allocator.
#if !defined(_LIBCPP_HAS_NO_ASAN) && _LIBCPP_CLANG_VER >= 1600
// TODO LLVM18: Remove the special-casing
_LIBCPP_HIDE_FROM_ABI void __annotate_double_ended_contiguous_container(
const void* __beg,
const void* __end,
const void* __old_con_beg,
const void* __old_con_end,
const void* __new_con_beg,
const void* __new_con_end) const {
if (__beg && is_same<allocator_type, __default_allocator_type>::value)
__sanitizer_annotate_double_ended_contiguous_container(
__beg, __end, __old_con_beg, __old_con_end, __new_con_beg, __new_con_end);
}
#else
_LIBCPP_HIDE_FROM_ABI void __annotate_double_ended_contiguous_container(
const void*, const void*, const void*, const void*, const void*, const void*) const _NOEXCEPT {}
#endif // !defined(_LIBCPP_HAS_NO_ASAN) && _LIBCPP_CLANG_VER >= 1600
_LIBCPP_HIDE_FROM_ABI
void __annotate_from_to(size_type __beg, size_type __end, __asan_annotation_type __annotation_type, __asan_annotation_place __place) const _NOEXCEPT {
// __beg - index of the first item to annotate
// __end - index behind the last item to annotate (so last item + 1)
// __annotation_type - __asan_unposion or __asan_poison
// __place - __asan_front_moved or __asan_back_moved
// Note: All indexes in __map_
if (__beg == __end)
return;
// __annotations_beg_map - first chunk which annotations we want to modify
// __annotations_end_map - last chunk which annotations we want to modify
// NOTE: if __end % __block_size == 0, __annotations_end_map points at the next block, which may not exist
__map_const_iterator __annotations_beg_map = __map_.begin() + __beg / __block_size;
__map_const_iterator __annotations_end_map = __map_.begin() + __end / __block_size;
bool const __poisoning = __annotation_type == __asan_poison;
// __old_c_beg_index - index of the first element in old container
// __old_c_end_index - index of the end of old container (last + 1)
// Note: may be outside the area we are annotating
size_t __old_c_beg_index = (__poisoning && __place == __asan_front_moved) ? __beg : __start_;
size_t __old_c_end_index = (__poisoning && __place == __asan_back_moved) ? __end : __start_ + size();
bool const __front = __place == __asan_front_moved;
if (__poisoning && empty()) {
// Special case: we shouldn't trust __start_
__old_c_beg_index = __beg;
__old_c_end_index = __end;
}
// __old_c_beg_map - memory block (chunk) with first element
// __old_c_end_map - memory block (chunk) with end of old container
// Note: if __old_c_end_index % __block_size == 0, __old_c_end_map points at the next block,
// which may not exist
__map_const_iterator __old_c_beg_map = __map_.begin() + __old_c_beg_index / __block_size;
__map_const_iterator __old_c_end_map = __map_.begin() + __old_c_end_index / __block_size;
// One edge (front/end) of the container was moved and one was not modified.
// __new_edge_index - index of new edge
// __new_edge_map - memory block (chunk) with new edge, it always equals to
// __annotations_beg_map or __annotations_end_map
// __old_edge_map - memory block (chunk) with old edge, it always equals to
// __old_c_beg_map or __old_c_end_map
size_t __new_edge_index = (__poisoning ^ __front) ? __beg : __end;
__map_const_iterator __new_edge_map = __map_.begin() + __new_edge_index / __block_size;
__map_const_iterator __old_edge_map = __front ? __old_c_end_map : __old_c_beg_map;
// We iterate over map pointers (chunks) and fully poison all memory blocks between the first and the last.
// First and last chunk may be partially poisoned.
// __annotate_end_map may point at not existing chunk, therefore we have to have a check for it.
for (__map_const_iterator __map_it = __annotations_beg_map; __map_it <= __annotations_end_map; ++__map_it) {
if (__map_it == __annotations_end_map && __end % __block_size == 0)
// Chunk may not exist, but nothing to do here anyway
break;
// The beginning and the end of the current memory block
const void* __mem_beg = std::__to_address(*__map_it);
const void* __mem_end = std::__to_address(*__map_it + __block_size);
// The beginning of memory-in-use in the memory block before container modification
const void* __old_beg =
(__map_it == __old_c_beg_map) ? std::__to_address(*__map_it + (__old_c_beg_index % __block_size)) : __mem_beg;
// The end of memory-in-use in the memory block before container modification
const void* __old_end;
if (__map_it < __old_c_beg_map || __map_it > __old_c_end_map || (!__poisoning && empty()))
__old_end = __old_beg;
else
__old_end = (__map_it == __old_c_end_map) ? std::__to_address(*__map_it + (__old_c_end_index % __block_size))
: __mem_end;
// New edge of the container in current memory block
// If the edge is in a different chunk it points on corresponding end of the memory block
const void* __new_edge;
if (__map_it == __new_edge_map)
__new_edge = std::__to_address(*__map_it + (__new_edge_index % __block_size));
else
__new_edge = (__poisoning ^ __front) ? __mem_beg : __mem_end;
// Not modified edge of the container
// If the edge is in a different chunk it points on corresponding end of the memory block
const void* __old_edge;
if (__map_it == __old_edge_map)
__old_edge = __front ? __old_end : __old_beg;
else
__old_edge = __front ? __mem_end : __mem_beg;
// __new_beg - the beginning of memory-in-use in the memory block after container modification
// __new_end - the end of memory-in-use in the memory block after container modification
const void* __new_beg = __front ? __new_edge : __old_edge;
const void* __new_end = __front ? __old_edge : __new_edge;
__annotate_double_ended_contiguous_container(__mem_beg, __mem_end, __old_beg, __old_end, __new_beg, __new_end);
}
}
_LIBCPP_HIDE_FROM_ABI
void __annotate_new(size_type __current_size) const _NOEXCEPT {
if (__current_size == 0)
__annotate_from_to(0, __map_.size() * __block_size, __asan_poison, __asan_back_moved);
else {
__annotate_from_to(0, __start_, __asan_poison, __asan_front_moved);
__annotate_from_to(__start_ + __current_size, __map_.size() * __block_size, __asan_poison, __asan_back_moved);
}
}
_LIBCPP_HIDE_FROM_ABI
void __annotate_delete() const _NOEXCEPT {
if (empty())
__annotate_from_to(0, __map_.size() * __block_size, __asan_unposion, __asan_back_moved);
else {
__annotate_from_to(0, __start_, __asan_unposion, __asan_front_moved);
__annotate_from_to(__start_ + size(), __map_.size() * __block_size, __asan_unposion, __asan_back_moved);
}
}
_LIBCPP_HIDE_FROM_ABI
void __annotate_increase_front(size_type __n) const _NOEXCEPT {
__annotate_from_to(__start_ - __n, __start_, __asan_unposion, __asan_front_moved);
}
_LIBCPP_HIDE_FROM_ABI
void __annotate_increase_back(size_type __n) const _NOEXCEPT {
__annotate_from_to(__start_ + size(), __start_ + size() + __n, __asan_unposion, __asan_back_moved);
}
_LIBCPP_HIDE_FROM_ABI
void __annotate_shrink_front(size_type __old_size, size_type __old_start) const _NOEXCEPT {
__annotate_from_to(__old_start, __old_start + (__old_size - size()), __asan_poison, __asan_front_moved);
}
_LIBCPP_HIDE_FROM_ABI
void __annotate_shrink_back(size_type __old_size, size_type __old_start) const _NOEXCEPT {
__annotate_from_to(__old_start + size(), __old_start + __old_size, __asan_poison, __asan_back_moved);
}
_LIBCPP_HIDE_FROM_ABI
void __annotate_whole_block(size_t __block_index, __asan_annotation_type __annotation_type, __asan_annotation_place __place) {
__annotate_from_to(__block_index * __block_size, (__block_index + 1) * __block_size, __annotation_type, __place);
}
_LIBCPP_HIDE_FROM_ABI
void __annotate_poison_block(void *__beginning, void *__end) {
__annotate_double_ended_contiguous_container(__beginning, __end, __beginning, __end, __end, __end);
}
#if !defined(_LIBCPP_HAS_NO_ASAN)
public:
_LIBCPP_HIDE_FROM_ABI
bool __verify_asan_annotations() const _NOEXCEPT {
// This function tests deque object annotations.
if (empty()) {
for (__map_const_iterator __it = __map_.begin(); __it != __map_.end(); ++__it) {
if (!__sanitizer_verify_double_ended_contiguous_container(
std::__to_address(*__it),
std::__to_address(*__it),
std::__to_address(*__it),
std::__to_address(*__it + __block_size)))
return false;
}
return true;
}
size_type __end = __start_ + size();
__map_const_iterator __first_mp = __map_.begin() + __start_ / __block_size;
__map_const_iterator __last_mp = __map_.begin() + (__end - 1) / __block_size;
// Pointers to first and after last elements
// Those can be in different deque blocks
void* __p_beg = std::__to_address(*__first_mp + (__start_ % __block_size));
void* __p_end =
std::__to_address(*__last_mp + ((__end % __block_size == 0) ? __block_size : __end % __block_size));
for (__map_const_iterator __it = __map_.begin(); __it != __map_.end(); ++__it) {
// Go over all blocks, find the place we are in and verify its annotations
// Note that __p_end points *behind* the last item.
// - blocks before the first block with container elements
// - first block with items
// - last block with items
// - blocks after last block with ciontainer elements
// Is the block before or after deque blocks that contain elements?
if (__it < __first_mp || __it > __last_mp) {
if (!__sanitizer_verify_double_ended_contiguous_container(
std::__to_address(*__it),
std::__to_address(*__it),
std::__to_address(*__it),
std::__to_address(*__it + __block_size)))
return false;
} else {
void* __containers_buffer_beg = (__it == __first_mp) ? __p_beg : (void*)std::__to_address(*__it);
void* __containers_buffer_end =
(__it == __last_mp) ? __p_end : (void*)std::__to_address(*__it + __block_size);
if (!__sanitizer_verify_double_ended_contiguous_container(
std::__to_address(*__it),
__containers_buffer_beg,
__containers_buffer_end,
std::__to_address(*__it + __block_size))) {
return false;
}
}
}
return true;
}
private:
#endif // _LIBCPP_VERIFY_ASAN_DEQUE_ANNOTATIONS
_LIBCPP_HIDE_FROM_ABI
bool __maybe_remove_front_spare(bool __keep_one = true) {
if (__front_spare_blocks() >= 2 || (!__keep_one && __front_spare_blocks())) {
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
__annotate_whole_block(0, __asan_unposion, __asan_back_moved);
__alloc_traits::deallocate(__alloc(), __map_.front(),
__block_size);
__map_.pop_front();
__start_ -= __block_size;
return true;
}
return false;
}
_LIBCPP_HIDE_FROM_ABI
bool __maybe_remove_back_spare(bool __keep_one = true) {
if (__back_spare_blocks() >= 2 || (!__keep_one && __back_spare_blocks())) {
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
__annotate_whole_block(__map_.size() - 1, __asan_unposion, __asan_back_moved);
__alloc_traits::deallocate(__alloc(), __map_.back(),
__block_size);
__map_.pop_back();
return true;
}
return false;
}
2010-05-11 19:42:16 +00:00
template <class _Iterator, class _Sentinel>
_LIBCPP_HIDE_FROM_ABI
void __assign_with_sentinel(_Iterator __f, _Sentinel __l);
template <class _RandomAccessIterator>
_LIBCPP_HIDE_FROM_ABI
void __assign_with_size_random_access(_RandomAccessIterator __f, difference_type __n);
template <class _Iterator>
_LIBCPP_HIDE_FROM_ABI
void __assign_with_size(_Iterator __f, difference_type __n);
template <class _Iterator, class _Sentinel>
_LIBCPP_HIDE_FROM_ABI
iterator __insert_with_sentinel(const_iterator __p, _Iterator __f, _Sentinel __l);
template <class _Iterator>
_LIBCPP_HIDE_FROM_ABI
iterator __insert_with_size(const_iterator __p, _Iterator __f, size_type __n);
template <class _BiIter, class _Sentinel>
_LIBCPP_HIDE_FROM_ABI
iterator __insert_bidirectional(const_iterator __p, _BiIter __f, _Sentinel __sent, size_type __n);
template <class _BiIter>
_LIBCPP_HIDE_FROM_ABI
iterator __insert_bidirectional(const_iterator __p, _BiIter __f, _BiIter __l, size_type __n);
2010-05-11 19:42:16 +00:00
template <class _InpIter>
_LIBCPP_HIDE_FROM_ABI void __append(_InpIter __f, _InpIter __l,
typename enable_if<__has_exactly_input_iterator_category<_InpIter>::value>::type* = 0);
2010-05-11 19:42:16 +00:00
template <class _ForIter>
_LIBCPP_HIDE_FROM_ABI void __append(_ForIter __f, _ForIter __l,
typename enable_if<__has_forward_iterator_category<_ForIter>::value>::type* = 0);
template <class _InputIterator>
_LIBCPP_HIDE_FROM_ABI void __append_with_size(_InputIterator __from, size_type __n);
template <class _InputIterator, class _Sentinel>
_LIBCPP_HIDE_FROM_ABI void __append_with_sentinel(_InputIterator __f, _Sentinel __l);
_LIBCPP_HIDE_FROM_ABI void __append(size_type __n);
_LIBCPP_HIDE_FROM_ABI void __append(size_type __n, const value_type& __v);
_LIBCPP_HIDE_FROM_ABI void __erase_to_end(const_iterator __f);
_LIBCPP_HIDE_FROM_ABI void __add_front_capacity();
_LIBCPP_HIDE_FROM_ABI void __add_front_capacity(size_type __n);
_LIBCPP_HIDE_FROM_ABI void __add_back_capacity();
_LIBCPP_HIDE_FROM_ABI void __add_back_capacity(size_type __n);
_LIBCPP_HIDE_FROM_ABI iterator __move_and_check(iterator __f, iterator __l, iterator __r,
2010-05-11 19:42:16 +00:00
const_pointer& __vt);
_LIBCPP_HIDE_FROM_ABI iterator __move_backward_and_check(iterator __f, iterator __l, iterator __r,
2010-05-11 19:42:16 +00:00
const_pointer& __vt);
_LIBCPP_HIDE_FROM_ABI void __move_construct_and_check(iterator __f, iterator __l,
2010-05-11 19:42:16 +00:00
iterator __r, const_pointer& __vt);
_LIBCPP_HIDE_FROM_ABI void __move_construct_backward_and_check(iterator __f, iterator __l,
2010-05-11 19:42:16 +00:00
iterator __r, const_pointer& __vt);
_LIBCPP_HIDE_FROM_ABI
2010-05-11 19:42:16 +00:00
void __copy_assign_alloc(const deque& __c)
{__copy_assign_alloc(__c, integral_constant<bool,
__alloc_traits::propagate_on_container_copy_assignment::value>());}
_LIBCPP_HIDE_FROM_ABI
2010-05-11 19:42:16 +00:00
void __copy_assign_alloc(const deque& __c, true_type)
{
if (__alloc() != __c.__alloc())
2010-05-11 19:42:16 +00:00
{
clear();
shrink_to_fit();
}
__alloc() = __c.__alloc();
__map_.__alloc() = __c.__map_.__alloc();
2010-05-11 19:42:16 +00:00
}
_LIBCPP_HIDE_FROM_ABI
void __copy_assign_alloc(const deque&, false_type)
2010-05-11 19:42:16 +00:00
{}
_LIBCPP_HIDE_FROM_ABI void __move_assign(deque& __c, true_type)
_NOEXCEPT_(is_nothrow_move_assignable<allocator_type>::value);
_LIBCPP_HIDE_FROM_ABI void __move_assign(deque& __c, false_type);
2010-05-11 19:42:16 +00:00
};
template <class _Tp, class _Alloc>
_LIBCPP_CONSTEXPR const typename allocator_traits<_Alloc>::difference_type deque<_Tp, _Alloc>::__block_size =
__deque_block_size<value_type, difference_type>::value;
#if _LIBCPP_STD_VER >= 17
template<class _InputIterator,
class _Alloc = allocator<__iter_value_type<_InputIterator>>,
class = enable_if_t<__has_input_iterator_category<_InputIterator>::value>,
[libc++] Use enable_if_t instead of _EnableIf I just ran into a compiler error involving __bind_back and some overloads that were being disabled with _EnableIf. I noticed that the error message was quite bad and did not mention the reason for the overload being excluded. Specifically, the error looked like this: candidate template ignored: substitution failure [with _Args = <ContiguousView>]: no member named '_EnableIfImpl' in 'std::_MetaBase<false>' Instead, when using enable_if or enable_if_t, the compiler is clever and can produce better diagnostics, like so: candidate template ignored: requirement 'is_invocable_v< std::__bind_back_op<1, std::integer_sequence<unsigned long, 0>>, std::ranges::views::__transform::__fn &, std::tuple<PlusOne> &, ContiguousView>' was not satisfied [with _Args = <ContiguousView>] Basically, it tries to do a poor man's implementation of concepts, which is already a lot better than simply complaining about substitution failure. Hence, this commit uses enable_if_t instead of _EnableIf whenever possible. That is both more straightforward than using the internal helper, and also leads to better error messages in those cases. I understand the motivation for _EnableIf's implementation was to improve compile-time performance, however I believe striving to improve error messages is even more important for our QOI, hence this patch. Furthermore, it is unclear that _EnableIf actually improved compile-time performance in any noticeable way (see discussion in the review for details). Differential Revision: https://reviews.llvm.org/D108216
2021-08-17 16:26:09 +00:00
class = enable_if_t<__is_allocator<_Alloc>::value>
>
deque(_InputIterator, _InputIterator)
-> deque<__iter_value_type<_InputIterator>, _Alloc>;
template<class _InputIterator,
class _Alloc,
class = enable_if_t<__has_input_iterator_category<_InputIterator>::value>,
[libc++] Use enable_if_t instead of _EnableIf I just ran into a compiler error involving __bind_back and some overloads that were being disabled with _EnableIf. I noticed that the error message was quite bad and did not mention the reason for the overload being excluded. Specifically, the error looked like this: candidate template ignored: substitution failure [with _Args = <ContiguousView>]: no member named '_EnableIfImpl' in 'std::_MetaBase<false>' Instead, when using enable_if or enable_if_t, the compiler is clever and can produce better diagnostics, like so: candidate template ignored: requirement 'is_invocable_v< std::__bind_back_op<1, std::integer_sequence<unsigned long, 0>>, std::ranges::views::__transform::__fn &, std::tuple<PlusOne> &, ContiguousView>' was not satisfied [with _Args = <ContiguousView>] Basically, it tries to do a poor man's implementation of concepts, which is already a lot better than simply complaining about substitution failure. Hence, this commit uses enable_if_t instead of _EnableIf whenever possible. That is both more straightforward than using the internal helper, and also leads to better error messages in those cases. I understand the motivation for _EnableIf's implementation was to improve compile-time performance, however I believe striving to improve error messages is even more important for our QOI, hence this patch. Furthermore, it is unclear that _EnableIf actually improved compile-time performance in any noticeable way (see discussion in the review for details). Differential Revision: https://reviews.llvm.org/D108216
2021-08-17 16:26:09 +00:00
class = enable_if_t<__is_allocator<_Alloc>::value>
>
deque(_InputIterator, _InputIterator, _Alloc)
-> deque<__iter_value_type<_InputIterator>, _Alloc>;
#endif
#if _LIBCPP_STD_VER >= 23
template <ranges::input_range _Range,
class _Alloc = allocator<ranges::range_value_t<_Range>>,
class = enable_if_t<__is_allocator<_Alloc>::value>
>
deque(from_range_t, _Range&&, _Alloc = _Alloc())
-> deque<ranges::range_value_t<_Range>, _Alloc>;
#endif
2010-05-11 19:42:16 +00:00
template <class _Tp, class _Allocator>
deque<_Tp, _Allocator>::deque(size_type __n)
: __start_(0), __size_(0, __default_init_tag())
2010-05-11 19:42:16 +00:00
{
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
__annotate_new(0);
2010-05-11 19:42:16 +00:00
if (__n > 0)
__append(__n);
}
#if _LIBCPP_STD_VER >= 14
template <class _Tp, class _Allocator>
deque<_Tp, _Allocator>::deque(size_type __n, const _Allocator& __a)
: __map_(__pointer_allocator(__a)), __start_(0), __size_(0, __a)
{
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
__annotate_new(0);
if (__n > 0)
__append(__n);
}
#endif
2010-05-11 19:42:16 +00:00
template <class _Tp, class _Allocator>
deque<_Tp, _Allocator>::deque(size_type __n, const value_type& __v)
: __start_(0), __size_(0, __default_init_tag())
2010-05-11 19:42:16 +00:00
{
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
__annotate_new(0);
2010-05-11 19:42:16 +00:00
if (__n > 0)
__append(__n, __v);
}
template <class _Tp, class _Allocator>
template <class _InputIter>
deque<_Tp, _Allocator>::deque(_InputIter __f, _InputIter __l,
typename enable_if<__has_input_iterator_category<_InputIter>::value>::type*)
: __start_(0), __size_(0, __default_init_tag())
2010-05-11 19:42:16 +00:00
{
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
__annotate_new(0);
2010-05-11 19:42:16 +00:00
__append(__f, __l);
}
template <class _Tp, class _Allocator>
template <class _InputIter>
deque<_Tp, _Allocator>::deque(_InputIter __f, _InputIter __l, const allocator_type& __a,
typename enable_if<__has_input_iterator_category<_InputIter>::value>::type*)
: __map_(__pointer_allocator(__a)), __start_(0), __size_(0, __a)
2010-05-11 19:42:16 +00:00
{
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
__annotate_new(0);
2010-05-11 19:42:16 +00:00
__append(__f, __l);
}
template <class _Tp, class _Allocator>
deque<_Tp, _Allocator>::deque(const deque& __c)
: __map_(__pointer_allocator(__alloc_traits::select_on_container_copy_construction(__c.__alloc()))),
__start_(0),
__size_(0, __map_.__alloc())
2010-05-11 19:42:16 +00:00
{
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
__annotate_new(0);
2010-05-11 19:42:16 +00:00
__append(__c.begin(), __c.end());
}
template <class _Tp, class _Allocator>
deque<_Tp, _Allocator>::deque(const deque& __c, const __type_identity_t<allocator_type>& __a)
: __map_(__pointer_allocator(__a)), __start_(0), __size_(0, __a)
2010-05-11 19:42:16 +00:00
{
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
__annotate_new(0);
2010-05-11 19:42:16 +00:00
__append(__c.begin(), __c.end());
}
template <class _Tp, class _Allocator>
deque<_Tp, _Allocator>&
deque<_Tp, _Allocator>::operator=(const deque& __c)
{
if (this != _VSTD::addressof(__c))
{
__copy_assign_alloc(__c);
assign(__c.begin(), __c.end());
}
return *this;
}
#ifndef _LIBCPP_CXX03_LANG
2010-05-11 19:42:16 +00:00
template <class _Tp, class _Allocator>
deque<_Tp, _Allocator>::deque(initializer_list<value_type> __il)
: __start_(0), __size_(0, __default_init_tag())
2010-05-11 19:42:16 +00:00
{
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
__annotate_new(0);
2010-05-11 19:42:16 +00:00
__append(__il.begin(), __il.end());
}
template <class _Tp, class _Allocator>
deque<_Tp, _Allocator>::deque(initializer_list<value_type> __il, const allocator_type& __a)
: __map_(__pointer_allocator(__a)), __start_(0), __size_(0, __a)
2010-05-11 19:42:16 +00:00
{
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
__annotate_new(0);
2010-05-11 19:42:16 +00:00
__append(__il.begin(), __il.end());
}
template <class _Tp, class _Allocator>
inline
2010-05-11 19:42:16 +00:00
deque<_Tp, _Allocator>::deque(deque&& __c)
_NOEXCEPT_(is_nothrow_move_constructible<allocator_type>::value)
: __map_(std::move(__c.__map_)), __start_(std::move(__c.__start_)), __size_(std::move(__c.__size_))
2010-05-11 19:42:16 +00:00
{
__c.__start_ = 0;
__c.__size() = 0;
2010-05-11 19:42:16 +00:00
}
template <class _Tp, class _Allocator>
inline
deque<_Tp, _Allocator>::deque(deque&& __c, const __type_identity_t<allocator_type>& __a)
: __map_(std::move(__c.__map_), __pointer_allocator(__a)),
__start_(std::move(__c.__start_)),
__size_(std::move(__c.__size()), __a)
2010-05-11 19:42:16 +00:00
{
if (__a == __c.__alloc())
{
__c.__start_ = 0;
__c.__size() = 0;
}
else
2010-05-11 19:42:16 +00:00
{
__map_.clear();
__start_ = 0;
__size() = 0;
typedef move_iterator<iterator> _Ip;
assign(_Ip(__c.begin()), _Ip(__c.end()));
2010-05-11 19:42:16 +00:00
}
}
template <class _Tp, class _Allocator>
inline
2010-05-11 19:42:16 +00:00
deque<_Tp, _Allocator>&
deque<_Tp, _Allocator>::operator=(deque&& __c)
_NOEXCEPT_(__alloc_traits::propagate_on_container_move_assignment::value &&
is_nothrow_move_assignable<allocator_type>::value)
2010-05-11 19:42:16 +00:00
{
__move_assign(__c, integral_constant<bool,
__alloc_traits::propagate_on_container_move_assignment::value>());
return *this;
}
template <class _Tp, class _Allocator>
void
deque<_Tp, _Allocator>::__move_assign(deque& __c, false_type)
{
if (__alloc() != __c.__alloc())
2010-05-11 19:42:16 +00:00
{
typedef move_iterator<iterator> _Ip;
assign(_Ip(__c.begin()), _Ip(__c.end()));
2010-05-11 19:42:16 +00:00
}
else
__move_assign(__c, true_type());
}
template <class _Tp, class _Allocator>
void
deque<_Tp, _Allocator>::__move_assign(deque& __c, true_type)
_NOEXCEPT_(is_nothrow_move_assignable<allocator_type>::value)
2010-05-11 19:42:16 +00:00
{
clear();
shrink_to_fit();
__move_assign(__c);
2010-05-11 19:42:16 +00:00
}
#endif // _LIBCPP_CXX03_LANG
2010-05-11 19:42:16 +00:00
template <class _Tp, class _Allocator>
template <class _InputIter>
void
deque<_Tp, _Allocator>::assign(_InputIter __f, _InputIter __l,
typename enable_if<__has_input_iterator_category<_InputIter>::value &&
!__has_random_access_iterator_category<_InputIter>::value>::type*)
2010-05-11 19:42:16 +00:00
{
__assign_with_sentinel(__f, __l);
}
template <class _Tp, class _Allocator>
template <class _Iterator, class _Sentinel>
_LIBCPP_HIDE_FROM_ABI
void deque<_Tp, _Allocator>::__assign_with_sentinel(_Iterator __f, _Sentinel __l) {
iterator __i = begin();
iterator __e = end();
for (; __f != __l && __i != __e; ++__f, (void) ++__i)
2010-05-11 19:42:16 +00:00
*__i = *__f;
if (__f != __l)
__append_with_sentinel(std::move(__f), std::move(__l));
2010-05-11 19:42:16 +00:00
else
__erase_to_end(__i);
}
template <class _Tp, class _Allocator>
template <class _RAIter>
void
deque<_Tp, _Allocator>::assign(_RAIter __f, _RAIter __l,
typename enable_if<__has_random_access_iterator_category<_RAIter>::value>::type*)
2010-05-11 19:42:16 +00:00
{
__assign_with_size_random_access(__f, __l - __f);
}
template <class _Tp, class _Allocator>
template <class _RandomAccessIterator>
_LIBCPP_HIDE_FROM_ABI
void deque<_Tp, _Allocator>::__assign_with_size_random_access(_RandomAccessIterator __f, difference_type __n) {
if (static_cast<size_type>(__n) > size())
2010-05-11 19:42:16 +00:00
{
auto __l = __f + size();
std::copy(__f, __l, begin());
__append_with_size(__l, __n - size());
2010-05-11 19:42:16 +00:00
}
else
__erase_to_end(std::copy_n(__f, __n, begin()));
}
template <class _Tp, class _Allocator>
template <class _Iterator>
_LIBCPP_HIDE_FROM_ABI
void deque<_Tp, _Allocator>::__assign_with_size(_Iterator __f, difference_type __n) {
if (static_cast<size_type>(__n) > size()) {
auto __added_size = __n - size();
auto __i = begin();
for (auto __count = size(); __count != 0; --__count) {
*__i++ = *__f++;
}
__append_with_size(__f, __added_size);
} else {
__erase_to_end(std::copy_n(__f, __n, begin()));
}
2010-05-11 19:42:16 +00:00
}
template <class _Tp, class _Allocator>
void
deque<_Tp, _Allocator>::assign(size_type __n, const value_type& __v)
{
if (__n > size())
2010-05-11 19:42:16 +00:00
{
_VSTD::fill_n(begin(), size(), __v);
__n -= size();
2010-05-11 19:42:16 +00:00
__append(__n, __v);
}
else
__erase_to_end(_VSTD::fill_n(begin(), __n, __v));
2010-05-11 19:42:16 +00:00
}
template <class _Tp, class _Allocator>
inline
2010-05-11 19:42:16 +00:00
_Allocator
2011-06-02 16:10:22 +00:00
deque<_Tp, _Allocator>::get_allocator() const _NOEXCEPT
2010-05-11 19:42:16 +00:00
{
return __alloc();
2010-05-11 19:42:16 +00:00
}
template <class _Tp, class _Allocator>
void
deque<_Tp, _Allocator>::resize(size_type __n)
{
if (__n > size())
__append(__n - size());
else if (__n < size())
__erase_to_end(begin() + __n);
2010-05-11 19:42:16 +00:00
}
template <class _Tp, class _Allocator>
void
deque<_Tp, _Allocator>::resize(size_type __n, const value_type& __v)
{
if (__n > size())
__append(__n - size(), __v);
else if (__n < size())
__erase_to_end(begin() + __n);
2010-05-11 19:42:16 +00:00
}
template <class _Tp, class _Allocator>
void
deque<_Tp, _Allocator>::shrink_to_fit() _NOEXCEPT
2010-05-11 19:42:16 +00:00
{
allocator_type& __a = __alloc();
2010-05-11 19:42:16 +00:00
if (empty())
{
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
__annotate_delete();
while (__map_.size() > 0)
2010-05-11 19:42:16 +00:00
{
__alloc_traits::deallocate(__a, __map_.back(), __block_size);
__map_.pop_back();
2010-05-11 19:42:16 +00:00
}
__start_ = 0;
2010-05-11 19:42:16 +00:00
}
else
{
__maybe_remove_front_spare(/*__keep_one=*/false);
__maybe_remove_back_spare(/*__keep_one=*/false);
2010-05-11 19:42:16 +00:00
}
__map_.shrink_to_fit();
2010-05-11 19:42:16 +00:00
}
template <class _Tp, class _Allocator>
inline
2010-05-11 19:42:16 +00:00
typename deque<_Tp, _Allocator>::reference
deque<_Tp, _Allocator>::operator[](size_type __i) _NOEXCEPT
2010-05-11 19:42:16 +00:00
{
size_type __p = __start_ + __i;
return *(*(__map_.begin() + __p / __block_size) + __p % __block_size);
2010-05-11 19:42:16 +00:00
}
template <class _Tp, class _Allocator>
inline
2010-05-11 19:42:16 +00:00
typename deque<_Tp, _Allocator>::const_reference
deque<_Tp, _Allocator>::operator[](size_type __i) const _NOEXCEPT
2010-05-11 19:42:16 +00:00
{
size_type __p = __start_ + __i;
return *(*(__map_.begin() + __p / __block_size) + __p % __block_size);
2010-05-11 19:42:16 +00:00
}
template <class _Tp, class _Allocator>
inline
2010-05-11 19:42:16 +00:00
typename deque<_Tp, _Allocator>::reference
deque<_Tp, _Allocator>::at(size_type __i)
{
if (__i >= size())
_VSTD::__throw_out_of_range("deque");
size_type __p = __start_ + __i;
return *(*(__map_.begin() + __p / __block_size) + __p % __block_size);
2010-05-11 19:42:16 +00:00
}
template <class _Tp, class _Allocator>
inline
2010-05-11 19:42:16 +00:00
typename deque<_Tp, _Allocator>::const_reference
deque<_Tp, _Allocator>::at(size_type __i) const
{
if (__i >= size())
_VSTD::__throw_out_of_range("deque");
size_type __p = __start_ + __i;
return *(*(__map_.begin() + __p / __block_size) + __p % __block_size);
2010-05-11 19:42:16 +00:00
}
template <class _Tp, class _Allocator>
inline
2010-05-11 19:42:16 +00:00
typename deque<_Tp, _Allocator>::reference
deque<_Tp, _Allocator>::front() _NOEXCEPT
2010-05-11 19:42:16 +00:00
{
return *(*(__map_.begin() + __start_ / __block_size)
+ __start_ % __block_size);
2010-05-11 19:42:16 +00:00
}
template <class _Tp, class _Allocator>
inline
2010-05-11 19:42:16 +00:00
typename deque<_Tp, _Allocator>::const_reference
deque<_Tp, _Allocator>::front() const _NOEXCEPT
2010-05-11 19:42:16 +00:00
{
return *(*(__map_.begin() + __start_ / __block_size)
+ __start_ % __block_size);
2010-05-11 19:42:16 +00:00
}
template <class _Tp, class _Allocator>
inline
2010-05-11 19:42:16 +00:00
typename deque<_Tp, _Allocator>::reference
deque<_Tp, _Allocator>::back() _NOEXCEPT
2010-05-11 19:42:16 +00:00
{
size_type __p = size() + __start_ - 1;
return *(*(__map_.begin() + __p / __block_size) + __p % __block_size);
2010-05-11 19:42:16 +00:00
}
template <class _Tp, class _Allocator>
inline
2010-05-11 19:42:16 +00:00
typename deque<_Tp, _Allocator>::const_reference
deque<_Tp, _Allocator>::back() const _NOEXCEPT
2010-05-11 19:42:16 +00:00
{
size_type __p = size() + __start_ - 1;
return *(*(__map_.begin() + __p / __block_size) + __p % __block_size);
2010-05-11 19:42:16 +00:00
}
template <class _Tp, class _Allocator>
void
deque<_Tp, _Allocator>::push_back(const value_type& __v)
{
allocator_type& __a = __alloc();
2010-05-11 19:42:16 +00:00
if (__back_spare() == 0)
__add_back_capacity();
// __back_spare() >= 1
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
__annotate_increase_back(1);
__alloc_traits::construct(__a, _VSTD::addressof(*end()), __v);
++__size();
2010-05-11 19:42:16 +00:00
}
template <class _Tp, class _Allocator>
void
deque<_Tp, _Allocator>::push_front(const value_type& __v)
{
allocator_type& __a = __alloc();
if (__front_spare() == 0)
__add_front_capacity();
// __front_spare() >= 1
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
__annotate_increase_front(1);
__alloc_traits::construct(__a, _VSTD::addressof(*--begin()), __v);
--__start_;
++__size();
}
2010-05-11 19:42:16 +00:00
#ifndef _LIBCPP_CXX03_LANG
2010-05-11 19:42:16 +00:00
template <class _Tp, class _Allocator>
void
deque<_Tp, _Allocator>::push_back(value_type&& __v)
{
allocator_type& __a = __alloc();
2010-05-11 19:42:16 +00:00
if (__back_spare() == 0)
__add_back_capacity();
// __back_spare() >= 1
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
__annotate_increase_back(1);
__alloc_traits::construct(__a, _VSTD::addressof(*end()), _VSTD::move(__v));
++__size();
2010-05-11 19:42:16 +00:00
}
template <class _Tp, class _Allocator>
template <class... _Args>
#if _LIBCPP_STD_VER >= 17
typename deque<_Tp, _Allocator>::reference
#else
void
#endif
2010-05-11 19:42:16 +00:00
deque<_Tp, _Allocator>::emplace_back(_Args&&... __args)
{
allocator_type& __a = __alloc();
2010-05-11 19:42:16 +00:00
if (__back_spare() == 0)
__add_back_capacity();
// __back_spare() >= 1
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
__annotate_increase_back(1);
__alloc_traits::construct(__a, _VSTD::addressof(*end()),
_VSTD::forward<_Args>(__args)...);
++__size();
#if _LIBCPP_STD_VER >= 17
return *--end();
#endif
2010-05-11 19:42:16 +00:00
}
template <class _Tp, class _Allocator>
void
deque<_Tp, _Allocator>::push_front(value_type&& __v)
{
allocator_type& __a = __alloc();
2010-05-11 19:42:16 +00:00
if (__front_spare() == 0)
__add_front_capacity();
// __front_spare() >= 1
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
__annotate_increase_front(1);
__alloc_traits::construct(__a, _VSTD::addressof(*--begin()), _VSTD::move(__v));
--__start_;
++__size();
2010-05-11 19:42:16 +00:00
}
2010-05-11 19:42:16 +00:00
template <class _Tp, class _Allocator>
template <class... _Args>
#if _LIBCPP_STD_VER >= 17
typename deque<_Tp, _Allocator>::reference
#else
void
#endif
2010-05-11 19:42:16 +00:00
deque<_Tp, _Allocator>::emplace_front(_Args&&... __args)
{
allocator_type& __a = __alloc();
2010-05-11 19:42:16 +00:00
if (__front_spare() == 0)
__add_front_capacity();
// __front_spare() >= 1
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
__annotate_increase_front(1);
__alloc_traits::construct(__a, _VSTD::addressof(*--begin()), _VSTD::forward<_Args>(__args)...);
--__start_;
++__size();
#if _LIBCPP_STD_VER >= 17
return *begin();
#endif
2010-05-11 19:42:16 +00:00
}
template <class _Tp, class _Allocator>
typename deque<_Tp, _Allocator>::iterator
deque<_Tp, _Allocator>::insert(const_iterator __p, value_type&& __v)
2010-05-11 19:42:16 +00:00
{
size_type __pos = __p - begin();
size_type __to_end = size() - __pos;
allocator_type& __a = __alloc();
2010-05-11 19:42:16 +00:00
if (__pos < __to_end)
{ // insert by shifting things backward
if (__front_spare() == 0)
__add_front_capacity();
// __front_spare() >= 1
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
__annotate_increase_front(1);
2010-05-11 19:42:16 +00:00
if (__pos == 0)
{
__alloc_traits::construct(__a, _VSTD::addressof(*--begin()), _VSTD::move(__v));
--__start_;
++__size();
2010-05-11 19:42:16 +00:00
}
else
{
iterator __b = begin();
iterator __bm1 = _VSTD::prev(__b);
__alloc_traits::construct(__a, _VSTD::addressof(*__bm1), _VSTD::move(*__b));
--__start_;
++__size();
2010-05-11 19:42:16 +00:00
if (__pos > 1)
__b = _VSTD::move(_VSTD::next(__b), __b + __pos, __b);
*__b = _VSTD::move(__v);
2010-05-11 19:42:16 +00:00
}
}
else
{ // insert by shifting things forward
if (__back_spare() == 0)
__add_back_capacity();
// __back_capacity >= 1
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
__annotate_increase_back(1);
size_type __de = size() - __pos;
2010-05-11 19:42:16 +00:00
if (__de == 0)
{
__alloc_traits::construct(__a, _VSTD::addressof(*end()), _VSTD::move(__v));
++__size();
2010-05-11 19:42:16 +00:00
}
else
{
iterator __e = end();
iterator __em1 = _VSTD::prev(__e);
__alloc_traits::construct(__a, _VSTD::addressof(*__e), _VSTD::move(*__em1));
++__size();
2010-05-11 19:42:16 +00:00
if (__de > 1)
__e = _VSTD::move_backward(__e - __de, __em1, __e);
*--__e = _VSTD::move(__v);
2010-05-11 19:42:16 +00:00
}
}
return begin() + __pos;
2010-05-11 19:42:16 +00:00
}
template <class _Tp, class _Allocator>
template <class... _Args>
2010-05-11 19:42:16 +00:00
typename deque<_Tp, _Allocator>::iterator
deque<_Tp, _Allocator>::emplace(const_iterator __p, _Args&&... __args)
2010-05-11 19:42:16 +00:00
{
size_type __pos = __p - begin();
size_type __to_end = size() - __pos;
allocator_type& __a = __alloc();
2010-05-11 19:42:16 +00:00
if (__pos < __to_end)
{ // insert by shifting things backward
if (__front_spare() == 0)
__add_front_capacity();
// __front_spare() >= 1
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
__annotate_increase_front(1);
2010-05-11 19:42:16 +00:00
if (__pos == 0)
{
__alloc_traits::construct(__a, _VSTD::addressof(*--begin()), _VSTD::forward<_Args>(__args)...);
--__start_;
++__size();
2010-05-11 19:42:16 +00:00
}
else
{
__temp_value<value_type, _Allocator> __tmp(__alloc(), _VSTD::forward<_Args>(__args)...);
iterator __b = begin();
iterator __bm1 = _VSTD::prev(__b);
__alloc_traits::construct(__a, _VSTD::addressof(*__bm1), _VSTD::move(*__b));
--__start_;
++__size();
2010-05-11 19:42:16 +00:00
if (__pos > 1)
__b = _VSTD::move(_VSTD::next(__b), __b + __pos, __b);
*__b = _VSTD::move(__tmp.get());
2010-05-11 19:42:16 +00:00
}
}
else
{ // insert by shifting things forward
if (__back_spare() == 0)
__add_back_capacity();
// __back_capacity >= 1
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
__annotate_increase_back(1);
size_type __de = size() - __pos;
2010-05-11 19:42:16 +00:00
if (__de == 0)
{
__alloc_traits::construct(__a, _VSTD::addressof(*end()), _VSTD::forward<_Args>(__args)...);
++__size();
2010-05-11 19:42:16 +00:00
}
else
{
__temp_value<value_type, _Allocator> __tmp(__alloc(), _VSTD::forward<_Args>(__args)...);
iterator __e = end();
iterator __em1 = _VSTD::prev(__e);
__alloc_traits::construct(__a, _VSTD::addressof(*__e), _VSTD::move(*__em1));
++__size();
2010-05-11 19:42:16 +00:00
if (__de > 1)
__e = _VSTD::move_backward(__e - __de, __em1, __e);
*--__e = _VSTD::move(__tmp.get());
2010-05-11 19:42:16 +00:00
}
}
return begin() + __pos;
2010-05-11 19:42:16 +00:00
}
#endif // _LIBCPP_CXX03_LANG
2010-05-11 19:42:16 +00:00
template <class _Tp, class _Allocator>
typename deque<_Tp, _Allocator>::iterator
deque<_Tp, _Allocator>::insert(const_iterator __p, const value_type& __v)
2010-05-11 19:42:16 +00:00
{
size_type __pos = __p - begin();
size_type __to_end = size() - __pos;
allocator_type& __a = __alloc();
2010-05-11 19:42:16 +00:00
if (__pos < __to_end)
{ // insert by shifting things backward
if (__front_spare() == 0)
__add_front_capacity();
// __front_spare() >= 1
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
__annotate_increase_front(1);
2010-05-11 19:42:16 +00:00
if (__pos == 0)
{
__alloc_traits::construct(__a, _VSTD::addressof(*--begin()), __v);
--__start_;
++__size();
2010-05-11 19:42:16 +00:00
}
else
{
const_pointer __vt = pointer_traits<const_pointer>::pointer_to(__v);
iterator __b = begin();
iterator __bm1 = _VSTD::prev(__b);
if (__vt == pointer_traits<const_pointer>::pointer_to(*__b))
__vt = pointer_traits<const_pointer>::pointer_to(*__bm1);
__alloc_traits::construct(__a, _VSTD::addressof(*__bm1), _VSTD::move(*__b));
--__start_;
++__size();
2010-05-11 19:42:16 +00:00
if (__pos > 1)
__b = __move_and_check(_VSTD::next(__b), __b + __pos, __b, __vt);
*__b = *__vt;
2010-05-11 19:42:16 +00:00
}
}
else
{ // insert by shifting things forward
if (__back_spare() == 0)
__add_back_capacity();
// __back_capacity >= 1
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
__annotate_increase_back(1);
size_type __de = size() - __pos;
2010-05-11 19:42:16 +00:00
if (__de == 0)
{
__alloc_traits::construct(__a, _VSTD::addressof(*end()), __v);
++__size();
2010-05-11 19:42:16 +00:00
}
else
{
const_pointer __vt = pointer_traits<const_pointer>::pointer_to(__v);
iterator __e = end();
iterator __em1 = _VSTD::prev(__e);
if (__vt == pointer_traits<const_pointer>::pointer_to(*__em1))
__vt = pointer_traits<const_pointer>::pointer_to(*__e);
__alloc_traits::construct(__a, _VSTD::addressof(*__e), _VSTD::move(*__em1));
++__size();
2010-05-11 19:42:16 +00:00
if (__de > 1)
__e = __move_backward_and_check(__e - __de, __em1, __e, __vt);
*--__e = *__vt;
2010-05-11 19:42:16 +00:00
}
}
return begin() + __pos;
2010-05-11 19:42:16 +00:00
}
template <class _Tp, class _Allocator>
typename deque<_Tp, _Allocator>::iterator
deque<_Tp, _Allocator>::insert(const_iterator __p, size_type __n, const value_type& __v)
{
size_type __pos = __p - begin();
size_type __to_end = __size() - __pos;
allocator_type& __a = __alloc();
2010-05-11 19:42:16 +00:00
if (__pos < __to_end)
{ // insert by shifting things backward
if (__n > __front_spare())
__add_front_capacity(__n - __front_spare());
// __n <= __front_spare()
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
__annotate_increase_front(__n);
iterator __old_begin = begin();
2010-05-11 19:42:16 +00:00
iterator __i = __old_begin;
if (__n > __pos)
{
for (size_type __m = __n - __pos; __m; --__m, --__start_, ++__size())
__alloc_traits::construct(__a, _VSTD::addressof(*--__i), __v);
2010-05-11 19:42:16 +00:00
__n = __pos;
}
if (__n > 0)
{
const_pointer __vt = pointer_traits<const_pointer>::pointer_to(__v);
iterator __obn = __old_begin + __n;
__move_construct_backward_and_check(__old_begin, __obn, __i, __vt);
if (__n < __pos)
__old_begin = __move_and_check(__obn, __old_begin + __pos, __old_begin, __vt);
_VSTD::fill_n(__old_begin, __n, *__vt);
2010-05-11 19:42:16 +00:00
}
}
else
{ // insert by shifting things forward
size_type __back_capacity = __back_spare();
if (__n > __back_capacity)
__add_back_capacity(__n - __back_capacity);
// __n <= __back_capacity
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
__annotate_increase_back(__n);
iterator __old_end = end();
2010-05-11 19:42:16 +00:00
iterator __i = __old_end;
size_type __de = size() - __pos;
2010-05-11 19:42:16 +00:00
if (__n > __de)
{
for (size_type __m = __n - __de; __m; --__m, (void) ++__i, ++__size())
__alloc_traits::construct(__a, _VSTD::addressof(*__i), __v);
2010-05-11 19:42:16 +00:00
__n = __de;
}
if (__n > 0)
{
const_pointer __vt = pointer_traits<const_pointer>::pointer_to(__v);
iterator __oen = __old_end - __n;
__move_construct_and_check(__oen, __old_end, __i, __vt);
if (__n < __de)
__old_end = __move_backward_and_check(__old_end - __de, __oen, __old_end, __vt);
_VSTD::fill_n(__old_end - __n, __n, *__vt);
2010-05-11 19:42:16 +00:00
}
}
return begin() + __pos;
2010-05-11 19:42:16 +00:00
}
template <class _Tp, class _Allocator>
template <class _InputIter>
typename deque<_Tp, _Allocator>::iterator
deque<_Tp, _Allocator>::insert(const_iterator __p, _InputIter __f, _InputIter __l,
typename enable_if<__has_exactly_input_iterator_category<_InputIter>::value>::type*)
2010-05-11 19:42:16 +00:00
{
return __insert_with_sentinel(__p, __f, __l);
}
template <class _Tp, class _Allocator>
template <class _Iterator, class _Sentinel>
_LIBCPP_HIDE_FROM_ABI
typename deque<_Tp, _Allocator>::iterator
deque<_Tp, _Allocator>::__insert_with_sentinel(const_iterator __p, _Iterator __f, _Sentinel __l) {
__split_buffer<value_type, allocator_type&> __buf(__alloc());
__buf.__construct_at_end_with_sentinel(std::move(__f), std::move(__l));
2010-05-11 19:42:16 +00:00
typedef typename __split_buffer<value_type, allocator_type&>::iterator __bi;
return insert(__p, move_iterator<__bi>(__buf.begin()), move_iterator<__bi>(__buf.end()));
}
template <class _Tp, class _Allocator>
template <class _ForwardIterator>
typename deque<_Tp, _Allocator>::iterator
deque<_Tp, _Allocator>::insert(const_iterator __p, _ForwardIterator __f, _ForwardIterator __l,
typename enable_if<__has_exactly_forward_iterator_category<_ForwardIterator>::value>::type*)
{
return __insert_with_size(__p, __f, std::distance(__f, __l));
}
template <class _Tp, class _Allocator>
template <class _Iterator>
_LIBCPP_HIDE_FROM_ABI
typename deque<_Tp, _Allocator>::iterator
deque<_Tp, _Allocator>::__insert_with_size(const_iterator __p, _Iterator __f, size_type __n) {
__split_buffer<value_type, allocator_type&> __buf(__n, 0, __alloc());
__buf.__construct_at_end_with_size(__f, __n);
typedef typename __split_buffer<value_type, allocator_type&>::iterator __fwd;
return insert(__p, move_iterator<__fwd>(__buf.begin()), move_iterator<__fwd>(__buf.end()));
}
2010-05-11 19:42:16 +00:00
template <class _Tp, class _Allocator>
template <class _BiIter>
typename deque<_Tp, _Allocator>::iterator
deque<_Tp, _Allocator>::insert(const_iterator __p, _BiIter __f, _BiIter __l,
typename enable_if<__has_bidirectional_iterator_category<_BiIter>::value>::type*)
2010-05-11 19:42:16 +00:00
{
return __insert_bidirectional(__p, __f, __l, std::distance(__f, __l));
}
template <class _Tp, class _Allocator>
template <class _BiIter, class _Sentinel>
_LIBCPP_HIDE_FROM_ABI
typename deque<_Tp, _Allocator>::iterator
deque<_Tp, _Allocator>::__insert_bidirectional(const_iterator __p, _BiIter __f, _Sentinel, size_type __n) {
return __insert_bidirectional(__p, __f, std::next(__f, __n), __n);
}
template <class _Tp, class _Allocator>
template <class _BiIter>
_LIBCPP_HIDE_FROM_ABI
typename deque<_Tp, _Allocator>::iterator
deque<_Tp, _Allocator>::__insert_bidirectional(const_iterator __p, _BiIter __f, _BiIter __l, size_type __n) {
size_type __pos = __p - begin();
size_type __to_end = size() - __pos;
allocator_type& __a = __alloc();
2010-05-11 19:42:16 +00:00
if (__pos < __to_end)
{ // insert by shifting things backward
if (__n > __front_spare())
__add_front_capacity(__n - __front_spare());
// __n <= __front_spare()
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
__annotate_increase_front(__n);
iterator __old_begin = begin();
2010-05-11 19:42:16 +00:00
iterator __i = __old_begin;
_BiIter __m = __f;
if (__n > __pos)
{
__m = __pos < __n / 2 ? _VSTD::prev(__l, __pos) : _VSTD::next(__f, __n - __pos);
for (_BiIter __j = __m; __j != __f; --__start_, ++__size())
__alloc_traits::construct(__a, _VSTD::addressof(*--__i), *--__j);
2010-05-11 19:42:16 +00:00
__n = __pos;
}
if (__n > 0)
{
iterator __obn = __old_begin + __n;
for (iterator __j = __obn; __j != __old_begin;)
{
__alloc_traits::construct(__a, _VSTD::addressof(*--__i), _VSTD::move(*--__j));
--__start_;
++__size();
2010-05-11 19:42:16 +00:00
}
if (__n < __pos)
__old_begin = _VSTD::move(__obn, __old_begin + __pos, __old_begin);
_VSTD::copy(__m, __l, __old_begin);
2010-05-11 19:42:16 +00:00
}
}
else
{ // insert by shifting things forward
size_type __back_capacity = __back_spare();
if (__n > __back_capacity)
__add_back_capacity(__n - __back_capacity);
// __n <= __back_capacity
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
__annotate_increase_back(__n);
iterator __old_end = end();
2010-05-11 19:42:16 +00:00
iterator __i = __old_end;
_BiIter __m = __l;
size_type __de = size() - __pos;
2010-05-11 19:42:16 +00:00
if (__n > __de)
{
__m = __de < __n / 2 ? _VSTD::next(__f, __de) : _VSTD::prev(__l, __n - __de);
for (_BiIter __j = __m; __j != __l; ++__i, (void) ++__j, ++__size())
__alloc_traits::construct(__a, _VSTD::addressof(*__i), *__j);
2010-05-11 19:42:16 +00:00
__n = __de;
}
if (__n > 0)
{
iterator __oen = __old_end - __n;
for (iterator __j = __oen; __j != __old_end; ++__i, (void) ++__j, ++__size())
__alloc_traits::construct(__a, _VSTD::addressof(*__i), _VSTD::move(*__j));
2010-05-11 19:42:16 +00:00
if (__n < __de)
__old_end = _VSTD::move_backward(__old_end - __de, __oen, __old_end);
_VSTD::copy_backward(__f, __m, __old_end);
2010-05-11 19:42:16 +00:00
}
}
return begin() + __pos;
2010-05-11 19:42:16 +00:00
}
template <class _Tp, class _Allocator>
template <class _InpIter>
void
deque<_Tp, _Allocator>::__append(_InpIter __f, _InpIter __l,
typename enable_if<__has_exactly_input_iterator_category<_InpIter>::value>::type*)
2010-05-11 19:42:16 +00:00
{
__append_with_sentinel(__f, __l);
}
template <class _Tp, class _Allocator>
template <class _InputIterator, class _Sentinel>
_LIBCPP_HIDE_FROM_ABI
void deque<_Tp, _Allocator>::__append_with_sentinel(_InputIterator __f, _Sentinel __l) {
2010-05-11 19:42:16 +00:00
for (; __f != __l; ++__f)
#ifdef _LIBCPP_CXX03_LANG
2010-05-11 19:42:16 +00:00
push_back(*__f);
#else
emplace_back(*__f);
#endif
2010-05-11 19:42:16 +00:00
}
template <class _Tp, class _Allocator>
template <class _ForIter>
void
deque<_Tp, _Allocator>::__append(_ForIter __f, _ForIter __l,
typename enable_if<__has_forward_iterator_category<_ForIter>::value>::type*)
2010-05-11 19:42:16 +00:00
{
__append_with_size(__f, std::distance(__f, __l));
}
template <class _Tp, class _Allocator>
template <class _InputIterator>
_LIBCPP_HIDE_FROM_ABI
void deque<_Tp, _Allocator>::__append_with_size(_InputIterator __f, size_type __n) {
allocator_type& __a = __alloc();
2010-05-11 19:42:16 +00:00
size_type __back_capacity = __back_spare();
if (__n > __back_capacity)
__add_back_capacity(__n - __back_capacity);
2010-05-11 19:42:16 +00:00
// __n <= __back_capacity
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
__annotate_increase_back(__n);
for (__deque_block_range __br : __deque_range(end(), end() + __n)) {
_ConstructTransaction __tx(this, __br);
for (; __tx.__pos_ != __tx.__end_; ++__tx.__pos_, (void)++__f) {
__alloc_traits::construct(__a, _VSTD::__to_address(__tx.__pos_), *__f);
}
}
2010-05-11 19:42:16 +00:00
}
template <class _Tp, class _Allocator>
void
deque<_Tp, _Allocator>::__append(size_type __n)
{
allocator_type& __a = __alloc();
2010-05-11 19:42:16 +00:00
size_type __back_capacity = __back_spare();
if (__n > __back_capacity)
__add_back_capacity(__n - __back_capacity);
// __n <= __back_capacity
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
__annotate_increase_back(__n);
for (__deque_block_range __br : __deque_range(end(), end() + __n)) {
_ConstructTransaction __tx(this, __br);
for (; __tx.__pos_ != __tx.__end_; ++__tx.__pos_) {
__alloc_traits::construct(__a, _VSTD::__to_address(__tx.__pos_));
}
}
2010-05-11 19:42:16 +00:00
}
template <class _Tp, class _Allocator>
void
deque<_Tp, _Allocator>::__append(size_type __n, const value_type& __v)
{
allocator_type& __a = __alloc();
2010-05-11 19:42:16 +00:00
size_type __back_capacity = __back_spare();
if (__n > __back_capacity)
__add_back_capacity(__n - __back_capacity);
// __n <= __back_capacity
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
__annotate_increase_back(__n);
for (__deque_block_range __br : __deque_range(end(), end() + __n)) {
_ConstructTransaction __tx(this, __br);
for (; __tx.__pos_ != __tx.__end_; ++__tx.__pos_) {
__alloc_traits::construct(__a, _VSTD::__to_address(__tx.__pos_), __v);
}
}
2010-05-11 19:42:16 +00:00
}
// Create front capacity for one block of elements.
// Strong guarantee. Either do it or don't touch anything.
template <class _Tp, class _Allocator>
void
deque<_Tp, _Allocator>::__add_front_capacity()
{
allocator_type& __a = __alloc();
if (__back_spare() >= __block_size)
2010-05-11 19:42:16 +00:00
{
__start_ += __block_size;
pointer __pt = __map_.back();
__map_.pop_back();
__map_.push_front(__pt);
2010-05-11 19:42:16 +00:00
}
// Else if __map_.size() < __map_.capacity() then we need to allocate 1 buffer
else if (__map_.size() < __map_.capacity())
2010-05-11 19:42:16 +00:00
{ // we can put the new buffer into the map, but don't shift things around
// until all buffers are allocated. If we throw, we don't need to fix
// anything up (any added buffers are undetectible)
if (__map_.__front_spare() > 0)
__map_.push_front(__alloc_traits::allocate(__a, __block_size));
2010-05-11 19:42:16 +00:00
else
{
__map_.push_back(__alloc_traits::allocate(__a, __block_size));
2010-05-11 19:42:16 +00:00
// Done allocating, reorder capacity
pointer __pt = __map_.back();
__map_.pop_back();
__map_.push_front(__pt);
2010-05-11 19:42:16 +00:00
}
__start_ = __map_.size() == 1 ?
__block_size / 2 :
__start_ + __block_size;
2010-05-11 19:42:16 +00:00
}
// Else need to allocate 1 buffer, *and* we need to reallocate __map_.
else
{
__split_buffer<pointer, __pointer_allocator&>
__buf(std::max<size_type>(2 * __map_.capacity(), 1),
0, __map_.__alloc());
typedef __allocator_destructor<_Allocator> _Dp;
unique_ptr<pointer, _Dp> __hold(
__alloc_traits::allocate(__a, __block_size),
_Dp(__a, __block_size));
__buf.push_back(__hold.get());
__hold.release();
for (__map_pointer __i = __map_.begin();
__i != __map_.end(); ++__i)
2010-05-11 19:42:16 +00:00
__buf.push_back(*__i);
_VSTD::swap(__map_.__first_, __buf.__first_);
_VSTD::swap(__map_.__begin_, __buf.__begin_);
_VSTD::swap(__map_.__end_, __buf.__end_);
_VSTD::swap(__map_.__end_cap(), __buf.__end_cap());
__start_ = __map_.size() == 1 ?
__block_size / 2 :
__start_ + __block_size;
2010-05-11 19:42:16 +00:00
}
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
__annotate_whole_block(0, __asan_poison, __asan_front_moved);
2010-05-11 19:42:16 +00:00
}
// Create front capacity for __n elements.
// Strong guarantee. Either do it or don't touch anything.
template <class _Tp, class _Allocator>
void
deque<_Tp, _Allocator>::__add_front_capacity(size_type __n)
{
allocator_type& __a = __alloc();
size_type __nb = __recommend_blocks(__n + __map_.empty());
2010-05-11 19:42:16 +00:00
// Number of unused blocks at back:
size_type __back_capacity = __back_spare() / __block_size;
__back_capacity = _VSTD::min(__back_capacity, __nb); // don't take more than you need
2010-05-11 19:42:16 +00:00
__nb -= __back_capacity; // number of blocks need to allocate
// If __nb == 0, then we have sufficient capacity.
if (__nb == 0)
{
__start_ += __block_size * __back_capacity;
2010-05-11 19:42:16 +00:00
for (; __back_capacity > 0; --__back_capacity)
{
pointer __pt = __map_.back();
__map_.pop_back();
__map_.push_front(__pt);
2010-05-11 19:42:16 +00:00
}
}
// Else if __nb <= __map_.capacity() - __map_.size() then we need to allocate __nb buffers
else if (__nb <= __map_.capacity() - __map_.size())
2010-05-11 19:42:16 +00:00
{ // we can put the new buffers into the map, but don't shift things around
// until all buffers are allocated. If we throw, we don't need to fix
// anything up (any added buffers are undetectible)
for (; __nb > 0; --__nb, __start_ += __block_size - (__map_.size() == 1))
2010-05-11 19:42:16 +00:00
{
if (__map_.__front_spare() == 0)
2010-05-11 19:42:16 +00:00
break;
__map_.push_front(__alloc_traits::allocate(__a, __block_size));
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
__annotate_whole_block(0, __asan_poison, __asan_front_moved);
2010-05-11 19:42:16 +00:00
}
for (; __nb > 0; --__nb, ++__back_capacity)
__map_.push_back(__alloc_traits::allocate(__a, __block_size));
2010-05-11 19:42:16 +00:00
// Done allocating, reorder capacity
__start_ += __back_capacity * __block_size;
2010-05-11 19:42:16 +00:00
for (; __back_capacity > 0; --__back_capacity)
{
pointer __pt = __map_.back();
__map_.pop_back();
__map_.push_front(__pt);
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
__annotate_whole_block(0, __asan_poison, __asan_front_moved);
2010-05-11 19:42:16 +00:00
}
}
// Else need to allocate __nb buffers, *and* we need to reallocate __map_.
else
{
size_type __ds = (__nb + __back_capacity) * __block_size - __map_.empty();
__split_buffer<pointer, __pointer_allocator&>
__buf(std::max<size_type>(2* __map_.capacity(),
__nb + __map_.size()),
0, __map_.__alloc());
#ifndef _LIBCPP_HAS_NO_EXCEPTIONS
2010-05-11 19:42:16 +00:00
try
{
#endif // _LIBCPP_HAS_NO_EXCEPTIONS
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
for (; __nb > 0; --__nb) {
__buf.push_back(__alloc_traits::allocate(__a, __block_size));
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
// ASan: this is empty container, we have to poison whole block
__annotate_poison_block(
std::__to_address(__buf.back()),
std::__to_address(__buf.back() + __block_size));
}
#ifndef _LIBCPP_HAS_NO_EXCEPTIONS
2010-05-11 19:42:16 +00:00
}
catch (...)
{
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
__annotate_delete();
for (__map_pointer __i = __buf.begin();
2010-05-11 19:42:16 +00:00
__i != __buf.end(); ++__i)
__alloc_traits::deallocate(__a, *__i, __block_size);
2010-05-11 19:42:16 +00:00
throw;
}
#endif // _LIBCPP_HAS_NO_EXCEPTIONS
2010-05-11 19:42:16 +00:00
for (; __back_capacity > 0; --__back_capacity)
{
__buf.push_back(__map_.back());
__map_.pop_back();
2010-05-11 19:42:16 +00:00
}
for (__map_pointer __i = __map_.begin();
__i != __map_.end(); ++__i)
2010-05-11 19:42:16 +00:00
__buf.push_back(*__i);
_VSTD::swap(__map_.__first_, __buf.__first_);
_VSTD::swap(__map_.__begin_, __buf.__begin_);
_VSTD::swap(__map_.__end_, __buf.__end_);
_VSTD::swap(__map_.__end_cap(), __buf.__end_cap());
__start_ += __ds;
2010-05-11 19:42:16 +00:00
}
}
// Create back capacity for one block of elements.
// Strong guarantee. Either do it or don't touch anything.
template <class _Tp, class _Allocator>
void
deque<_Tp, _Allocator>::__add_back_capacity()
{
allocator_type& __a = __alloc();
if (__front_spare() >= __block_size)
2010-05-11 19:42:16 +00:00
{
__start_ -= __block_size;
pointer __pt = __map_.front();
__map_.pop_front();
__map_.push_back(__pt);
2010-05-11 19:42:16 +00:00
}
// Else if __nb <= __map_.capacity() - __map_.size() then we need to allocate __nb buffers
else if (__map_.size() < __map_.capacity())
2010-05-11 19:42:16 +00:00
{ // we can put the new buffer into the map, but don't shift things around
// until it is allocated. If we throw, we don't need to fix
// anything up (any added buffers are undetectible)
if (__map_.__back_spare() != 0)
__map_.push_back(__alloc_traits::allocate(__a, __block_size));
2010-05-11 19:42:16 +00:00
else
{
__map_.push_front(__alloc_traits::allocate(__a, __block_size));
2010-05-11 19:42:16 +00:00
// Done allocating, reorder capacity
pointer __pt = __map_.front();
__map_.pop_front();
__map_.push_back(__pt);
2010-05-11 19:42:16 +00:00
}
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
__annotate_whole_block(__map_.size() - 1, __asan_poison, __asan_back_moved);
2010-05-11 19:42:16 +00:00
}
// Else need to allocate 1 buffer, *and* we need to reallocate __map_.
else
{
__split_buffer<pointer, __pointer_allocator&>
__buf(std::max<size_type>(2* __map_.capacity(), 1),
__map_.size(),
__map_.__alloc());
typedef __allocator_destructor<_Allocator> _Dp;
unique_ptr<pointer, _Dp> __hold(
__alloc_traits::allocate(__a, __block_size),
_Dp(__a, __block_size));
__buf.push_back(__hold.get());
__hold.release();
for (__map_pointer __i = __map_.end();
__i != __map_.begin();)
2010-05-11 19:42:16 +00:00
__buf.push_front(*--__i);
_VSTD::swap(__map_.__first_, __buf.__first_);
_VSTD::swap(__map_.__begin_, __buf.__begin_);
_VSTD::swap(__map_.__end_, __buf.__end_);
_VSTD::swap(__map_.__end_cap(), __buf.__end_cap());
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
__annotate_whole_block(__map_.size() - 1, __asan_poison, __asan_back_moved);
2010-05-11 19:42:16 +00:00
}
}
// Create back capacity for __n elements.
// Strong guarantee. Either do it or don't touch anything.
template <class _Tp, class _Allocator>
void
deque<_Tp, _Allocator>::__add_back_capacity(size_type __n)
{
allocator_type& __a = __alloc();
size_type __nb = __recommend_blocks(__n + __map_.empty());
2010-05-11 19:42:16 +00:00
// Number of unused blocks at front:
size_type __front_capacity = __front_spare() / __block_size;
__front_capacity = _VSTD::min(__front_capacity, __nb); // don't take more than you need
2010-05-11 19:42:16 +00:00
__nb -= __front_capacity; // number of blocks need to allocate
// If __nb == 0, then we have sufficient capacity.
if (__nb == 0)
{
__start_ -= __block_size * __front_capacity;
2010-05-11 19:42:16 +00:00
for (; __front_capacity > 0; --__front_capacity)
{
pointer __pt = __map_.front();
__map_.pop_front();
__map_.push_back(__pt);
2010-05-11 19:42:16 +00:00
}
}
// Else if __nb <= __map_.capacity() - __map_.size() then we need to allocate __nb buffers
else if (__nb <= __map_.capacity() - __map_.size())
2010-05-11 19:42:16 +00:00
{ // we can put the new buffers into the map, but don't shift things around
// until all buffers are allocated. If we throw, we don't need to fix
// anything up (any added buffers are undetectible)
for (; __nb > 0; --__nb)
{
if (__map_.__back_spare() == 0)
2010-05-11 19:42:16 +00:00
break;
__map_.push_back(__alloc_traits::allocate(__a, __block_size));
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
__annotate_whole_block(__map_.size() - 1, __asan_poison, __asan_back_moved);
2010-05-11 19:42:16 +00:00
}
for (; __nb > 0; --__nb, ++__front_capacity, __start_ +=
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
__block_size - (__map_.size() == 1)) {
__map_.push_front(__alloc_traits::allocate(__a, __block_size));
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
__annotate_whole_block(0, __asan_poison, __asan_back_moved);
}
2010-05-11 19:42:16 +00:00
// Done allocating, reorder capacity
__start_ -= __block_size * __front_capacity;
2010-05-11 19:42:16 +00:00
for (; __front_capacity > 0; --__front_capacity)
{
pointer __pt = __map_.front();
__map_.pop_front();
__map_.push_back(__pt);
2010-05-11 19:42:16 +00:00
}
}
// Else need to allocate __nb buffers, *and* we need to reallocate __map_.
else
{
size_type __ds = __front_capacity * __block_size;
__split_buffer<pointer, __pointer_allocator&>
__buf(std::max<size_type>(2* __map_.capacity(),
__nb + __map_.size()),
__map_.size() - __front_capacity,
__map_.__alloc());
#ifndef _LIBCPP_HAS_NO_EXCEPTIONS
2010-05-11 19:42:16 +00:00
try
{
#endif // _LIBCPP_HAS_NO_EXCEPTIONS
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
for (; __nb > 0; --__nb) {
__buf.push_back(__alloc_traits::allocate(__a, __block_size));
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
// ASan: this is an empty container, we have to poison the whole block
__annotate_poison_block(
std::__to_address(__buf.back()),
std::__to_address(__buf.back() + __block_size));
}
#ifndef _LIBCPP_HAS_NO_EXCEPTIONS
2010-05-11 19:42:16 +00:00
}
catch (...)
{
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
__annotate_delete();
for (__map_pointer __i = __buf.begin();
2010-05-11 19:42:16 +00:00
__i != __buf.end(); ++__i)
__alloc_traits::deallocate(__a, *__i, __block_size);
2010-05-11 19:42:16 +00:00
throw;
}
#endif // _LIBCPP_HAS_NO_EXCEPTIONS
2010-05-11 19:42:16 +00:00
for (; __front_capacity > 0; --__front_capacity)
{
__buf.push_back(__map_.front());
__map_.pop_front();
2010-05-11 19:42:16 +00:00
}
for (__map_pointer __i = __map_.end();
__i != __map_.begin();)
2010-05-11 19:42:16 +00:00
__buf.push_front(*--__i);
_VSTD::swap(__map_.__first_, __buf.__first_);
_VSTD::swap(__map_.__begin_, __buf.__begin_);
_VSTD::swap(__map_.__end_, __buf.__end_);
_VSTD::swap(__map_.__end_cap(), __buf.__end_cap());
__start_ -= __ds;
2010-05-11 19:42:16 +00:00
}
}
template <class _Tp, class _Allocator>
void
deque<_Tp, _Allocator>::pop_front()
{
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
size_type __old_sz = size();
size_type __old_start = __start_;
allocator_type& __a = __alloc();
__alloc_traits::destroy(__a, _VSTD::__to_address(*(__map_.begin() +
__start_ / __block_size) +
__start_ % __block_size));
--__size();
++__start_;
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
__annotate_shrink_front(__old_sz, __old_start);
__maybe_remove_front_spare();
2010-05-11 19:42:16 +00:00
}
template <class _Tp, class _Allocator>
void
deque<_Tp, _Allocator>::pop_back()
{
_LIBCPP_ASSERT(!empty(), "deque::pop_back called on an empty deque");
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
size_type __old_sz = size();
size_type __old_start = __start_;
allocator_type& __a = __alloc();
size_type __p = size() + __start_ - 1;
__alloc_traits::destroy(__a, _VSTD::__to_address(*(__map_.begin() +
__p / __block_size) +
__p % __block_size));
--__size();
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
__annotate_shrink_back(__old_sz, __old_start);
__maybe_remove_back_spare();
2010-05-11 19:42:16 +00:00
}
// move assign [__f, __l) to [__r, __r + (__l-__f)).
// If __vt points into [__f, __l), then subtract (__f - __r) from __vt.
template <class _Tp, class _Allocator>
typename deque<_Tp, _Allocator>::iterator
deque<_Tp, _Allocator>::__move_and_check(iterator __f, iterator __l, iterator __r,
const_pointer& __vt)
{
// as if
// for (; __f != __l; ++__f, ++__r)
// *__r = _VSTD::move(*__f);
2010-05-11 19:42:16 +00:00
difference_type __n = __l - __f;
while (__n > 0)
{
pointer __fb = __f.__ptr_;
pointer __fe = *__f.__m_iter_ + __block_size;
2010-05-11 19:42:16 +00:00
difference_type __bs = __fe - __fb;
if (__bs > __n)
{
__bs = __n;
__fe = __fb + __bs;
}
if (__fb <= __vt && __vt < __fe)
__vt = (const_iterator(static_cast<__map_const_pointer>(__f.__m_iter_), __vt) -= __f - __r).__ptr_;
__r = _VSTD::move(__fb, __fe, __r);
2010-05-11 19:42:16 +00:00
__n -= __bs;
__f += __bs;
}
return __r;
}
// move assign [__f, __l) to [__r - (__l-__f), __r) backwards.
// If __vt points into [__f, __l), then add (__r - __l) to __vt.
template <class _Tp, class _Allocator>
typename deque<_Tp, _Allocator>::iterator
deque<_Tp, _Allocator>::__move_backward_and_check(iterator __f, iterator __l, iterator __r,
const_pointer& __vt)
{
// as if
// while (__f != __l)
// *--__r = _VSTD::move(*--__l);
2010-05-11 19:42:16 +00:00
difference_type __n = __l - __f;
while (__n > 0)
{
--__l;
pointer __lb = *__l.__m_iter_;
pointer __le = __l.__ptr_ + 1;
difference_type __bs = __le - __lb;
if (__bs > __n)
{
__bs = __n;
__lb = __le - __bs;
}
if (__lb <= __vt && __vt < __le)
__vt = (const_iterator(static_cast<__map_const_pointer>(__l.__m_iter_), __vt) += __r - __l - 1).__ptr_;
__r = _VSTD::move_backward(__lb, __le, __r);
2010-05-11 19:42:16 +00:00
__n -= __bs;
__l -= __bs - 1;
}
return __r;
}
// move construct [__f, __l) to [__r, __r + (__l-__f)).
// If __vt points into [__f, __l), then add (__r - __f) to __vt.
template <class _Tp, class _Allocator>
void
deque<_Tp, _Allocator>::__move_construct_and_check(iterator __f, iterator __l,
iterator __r, const_pointer& __vt)
{
allocator_type& __a = __alloc();
2010-05-11 19:42:16 +00:00
// as if
// for (; __f != __l; ++__r, ++__f, ++__size())
// __alloc_traits::construct(__a, _VSTD::addressof(*__r), _VSTD::move(*__f));
2010-05-11 19:42:16 +00:00
difference_type __n = __l - __f;
while (__n > 0)
{
pointer __fb = __f.__ptr_;
pointer __fe = *__f.__m_iter_ + __block_size;
2010-05-11 19:42:16 +00:00
difference_type __bs = __fe - __fb;
if (__bs > __n)
{
__bs = __n;
__fe = __fb + __bs;
}
if (__fb <= __vt && __vt < __fe)
__vt = (const_iterator(static_cast<__map_const_pointer>(__f.__m_iter_), __vt) += __r - __f).__ptr_;
for (; __fb != __fe; ++__fb, ++__r, ++__size())
__alloc_traits::construct(__a, _VSTD::addressof(*__r), _VSTD::move(*__fb));
2010-05-11 19:42:16 +00:00
__n -= __bs;
__f += __bs;
}
}
// move construct [__f, __l) to [__r - (__l-__f), __r) backwards.
// If __vt points into [__f, __l), then subtract (__l - __r) from __vt.
template <class _Tp, class _Allocator>
void
deque<_Tp, _Allocator>::__move_construct_backward_and_check(iterator __f, iterator __l,
iterator __r, const_pointer& __vt)
{
allocator_type& __a = __alloc();
2010-05-11 19:42:16 +00:00
// as if
// for (iterator __j = __l; __j != __f;)
// {
// __alloc_traitsconstruct(__a, _VSTD::addressof(*--__r), _VSTD::move(*--__j));
// --__start_;
// ++__size();
2010-05-11 19:42:16 +00:00
// }
difference_type __n = __l - __f;
while (__n > 0)
{
--__l;
pointer __lb = *__l.__m_iter_;
pointer __le = __l.__ptr_ + 1;
difference_type __bs = __le - __lb;
if (__bs > __n)
{
__bs = __n;
__lb = __le - __bs;
}
if (__lb <= __vt && __vt < __le)
__vt = (const_iterator(static_cast<__map_const_pointer>(__l.__m_iter_), __vt) -= __l - __r + 1).__ptr_;
2010-05-11 19:42:16 +00:00
while (__le != __lb)
{
__alloc_traits::construct(__a, _VSTD::addressof(*--__r), _VSTD::move(*--__le));
--__start_;
++__size();
2010-05-11 19:42:16 +00:00
}
__n -= __bs;
__l -= __bs - 1;
}
}
template <class _Tp, class _Allocator>
typename deque<_Tp, _Allocator>::iterator
deque<_Tp, _Allocator>::erase(const_iterator __f)
{
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
size_type __old_sz = size();
size_type __old_start = __start_;
iterator __b = begin();
2010-05-11 19:42:16 +00:00
difference_type __pos = __f - __b;
iterator __p = __b + __pos;
allocator_type& __a = __alloc();
if (static_cast<size_t>(__pos) <= (size() - 1) / 2)
2010-05-11 19:42:16 +00:00
{ // erase from front
_VSTD::move_backward(__b, __p, _VSTD::next(__p));
__alloc_traits::destroy(__a, _VSTD::addressof(*__b));
--__size();
++__start_;
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
__annotate_shrink_front(__old_sz, __old_start);
__maybe_remove_front_spare();
2010-05-11 19:42:16 +00:00
}
else
{ // erase from back
iterator __i = _VSTD::move(_VSTD::next(__p), end(), __p);
__alloc_traits::destroy(__a, _VSTD::addressof(*__i));
--__size();
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
__annotate_shrink_back(__old_sz, __old_start);
__maybe_remove_back_spare();
2010-05-11 19:42:16 +00:00
}
return begin() + __pos;
2010-05-11 19:42:16 +00:00
}
template <class _Tp, class _Allocator>
typename deque<_Tp, _Allocator>::iterator
deque<_Tp, _Allocator>::erase(const_iterator __f, const_iterator __l)
{
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
size_type __old_sz = size();
size_type __old_start = __start_;
2010-05-11 19:42:16 +00:00
difference_type __n = __l - __f;
iterator __b = begin();
2010-05-11 19:42:16 +00:00
difference_type __pos = __f - __b;
iterator __p = __b + __pos;
if (__n > 0)
{
allocator_type& __a = __alloc();
if (static_cast<size_t>(__pos) <= (size() - __n) / 2)
2010-05-11 19:42:16 +00:00
{ // erase from front
iterator __i = _VSTD::move_backward(__b, __p, __p + __n);
2010-05-11 19:42:16 +00:00
for (; __b != __i; ++__b)
__alloc_traits::destroy(__a, _VSTD::addressof(*__b));
__size() -= __n;
__start_ += __n;
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
__annotate_shrink_front(__old_sz, __old_start);
while (__maybe_remove_front_spare()) {
2010-05-11 19:42:16 +00:00
}
}
else
{ // erase from back
iterator __i = _VSTD::move(__p + __n, end(), __p);
for (iterator __e = end(); __i != __e; ++__i)
__alloc_traits::destroy(__a, _VSTD::addressof(*__i));
__size() -= __n;
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
__annotate_shrink_back(__old_sz, __old_start);
while (__maybe_remove_back_spare()) {
2010-05-11 19:42:16 +00:00
}
}
}
return begin() + __pos;
2010-05-11 19:42:16 +00:00
}
template <class _Tp, class _Allocator>
void
deque<_Tp, _Allocator>::__erase_to_end(const_iterator __f)
{
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
size_type __old_sz = size();
size_type __old_start = __start_;
iterator __e = end();
2010-05-11 19:42:16 +00:00
difference_type __n = __e - __f;
if (__n > 0)
{
allocator_type& __a = __alloc();
iterator __b = begin();
2010-05-11 19:42:16 +00:00
difference_type __pos = __f - __b;
for (iterator __p = __b + __pos; __p != __e; ++__p)
__alloc_traits::destroy(__a, _VSTD::addressof(*__p));
__size() -= __n;
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
__annotate_shrink_back(__old_sz, __old_start);
while (__maybe_remove_back_spare()) {
2010-05-11 19:42:16 +00:00
}
}
}
template <class _Tp, class _Allocator>
inline
2010-05-11 19:42:16 +00:00
void
deque<_Tp, _Allocator>::swap(deque& __c)
#if _LIBCPP_STD_VER >= 14
_NOEXCEPT
#else
_NOEXCEPT_(!__alloc_traits::propagate_on_container_swap::value ||
__is_nothrow_swappable<allocator_type>::value)
#endif
2010-05-11 19:42:16 +00:00
{
__map_.swap(__c.__map_);
_VSTD::swap(__start_, __c.__start_);
_VSTD::swap(__size(), __c.__size());
_VSTD::__swap_allocator(__alloc(), __c.__alloc());
2010-05-11 19:42:16 +00:00
}
template <class _Tp, class _Allocator>
inline
2010-05-11 19:42:16 +00:00
void
2011-06-02 16:10:22 +00:00
deque<_Tp, _Allocator>::clear() _NOEXCEPT
2010-05-11 19:42:16 +00:00
{
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
__annotate_delete();
allocator_type& __a = __alloc();
for (iterator __i = begin(), __e = end(); __i != __e; ++__i)
__alloc_traits::destroy(__a, _VSTD::addressof(*__i));
__size() = 0;
while (__map_.size() > 2)
{
__alloc_traits::deallocate(__a, __map_.front(), __block_size);
__map_.pop_front();
}
switch (__map_.size())
{
case 1:
__start_ = __block_size / 2;
break;
case 2:
__start_ = __block_size;
break;
}
[2a/3][ASan][libcxx] std::deque annotations This revision is a part of a series of patches extending AddressSanitizer C++ container overflow detection capabilities by adding annotations, similar to those existing in std::vector, to std::string and `std::deque` collections. These changes allow ASan to detect cases when the instrumented program accesses memory which is internally allocated by the collection but is still not in-use (accesses before or after the stored elements for `std::deque`, or between the size and capacity bounds for `std::string`). The motivation for the research and those changes was a bug, found by Trail of Bits, in a real code where an out-of-bounds read could happen as two strings were compared via a std::equals function that took `iter1_begin`, `iter1_end`, `iter2_begin` iterators (with a custom comparison function). When object `iter1` was longer than `iter2`, read out-of-bounds on `iter2` could happen. Container sanitization would detect it. This revision introduces annotations for `std::deque`. Each chunk of the container can now be annotated using the `__sanitizer_annotate_double_ended_contiguous_container` function, which was added in the rG1c5ad6d2c01294a0decde43a88e9c27d7437d157. Any attempt to access poisoned memory will trigger an ASan error. Although false negatives are rare, they are possible due to limitations in the ASan API, where a few (usually up to 7) bytes before the container may remain unpoisoned. There are no false positives in the same way as with `std::vector` annotations. This patch only supports objects (deques) that use the standard allocator. However, it can be easily extended to support all allocators, as suggested in the D146815 revision. Furthermore, the patch includes the addition of the `is_double_ended_contiguous_container_asan_correct` function to libcxx/test/support/asan_testing.h. This function can be used to verify whether a `std::deque` object has been correctly annotated. Finally, the patch extends the unit tests to verify ASan annotations (added LIBCPP_ASSERTs). If a program is compiled without ASan, all helper functions will be no-ops. In binaries with ASan, there is a negligible performance impact since the code from the change is only executed when the deque container changes in size and it’s proportional to the change. It is important to note that regardless of whether or not these changes are in use, every access to the container's memory is instrumented. Reviewed By: #libc, philnik Spies: vitalybuka, hans, mikhail.ramalho, Enna1, #sanitizers, philnik, libcxx-commits Differential Revision: https://reviews.llvm.org/D132092
2023-05-24 21:26:14 +00:00
__annotate_new(0);
2010-05-11 19:42:16 +00:00
}
template <class _Tp, class _Allocator>
inline _LIBCPP_HIDE_FROM_ABI
2010-05-11 19:42:16 +00:00
bool
operator==(const deque<_Tp, _Allocator>& __x, const deque<_Tp, _Allocator>& __y)
{
const typename deque<_Tp, _Allocator>::size_type __sz = __x.size();
return __sz == __y.size() && _VSTD::equal(__x.begin(), __x.end(), __y.begin());
2010-05-11 19:42:16 +00:00
}
#if _LIBCPP_STD_VER <= 17
2010-05-11 19:42:16 +00:00
template <class _Tp, class _Allocator>
inline _LIBCPP_HIDE_FROM_ABI
2010-05-11 19:42:16 +00:00
bool
operator!=(const deque<_Tp, _Allocator>& __x, const deque<_Tp, _Allocator>& __y)
{
return !(__x == __y);
}
template <class _Tp, class _Allocator>
inline _LIBCPP_HIDE_FROM_ABI
2010-05-11 19:42:16 +00:00
bool
operator< (const deque<_Tp, _Allocator>& __x, const deque<_Tp, _Allocator>& __y)
{
return _VSTD::lexicographical_compare(__x.begin(), __x.end(), __y.begin(), __y.end());
2010-05-11 19:42:16 +00:00
}
template <class _Tp, class _Allocator>
inline _LIBCPP_HIDE_FROM_ABI
2010-05-11 19:42:16 +00:00
bool
operator> (const deque<_Tp, _Allocator>& __x, const deque<_Tp, _Allocator>& __y)
{
return __y < __x;
}
template <class _Tp, class _Allocator>
inline _LIBCPP_HIDE_FROM_ABI
2010-05-11 19:42:16 +00:00
bool
operator>=(const deque<_Tp, _Allocator>& __x, const deque<_Tp, _Allocator>& __y)
{
return !(__x < __y);
}
template <class _Tp, class _Allocator>
inline _LIBCPP_HIDE_FROM_ABI
2010-05-11 19:42:16 +00:00
bool
operator<=(const deque<_Tp, _Allocator>& __x, const deque<_Tp, _Allocator>& __y)
{
return !(__y < __x);
}
#else // _LIBCPP_STD_VER <= 17
template<class _Tp, class _Allocator>
inline _LIBCPP_HIDE_FROM_ABI
__synth_three_way_result<_Tp>
operator<=>(const deque<_Tp, _Allocator>& __x, const deque<_Tp, _Allocator>& __y)
{
return std::lexicographical_compare_three_way(
__x.begin(), __x.end(), __y.begin(), __y.end(), std::__synth_three_way<_Tp, _Tp>);
}
#endif // _LIBCPP_STD_VER <= 17
2010-05-11 19:42:16 +00:00
template <class _Tp, class _Allocator>
inline _LIBCPP_HIDE_FROM_ABI
2010-05-11 19:42:16 +00:00
void
swap(deque<_Tp, _Allocator>& __x, deque<_Tp, _Allocator>& __y)
_NOEXCEPT_(_NOEXCEPT_(__x.swap(__y)))
2010-05-11 19:42:16 +00:00
{
__x.swap(__y);
}
#if _LIBCPP_STD_VER >= 20
template <class _Tp, class _Allocator, class _Up>
inline _LIBCPP_HIDE_FROM_ABI typename deque<_Tp, _Allocator>::size_type
erase(deque<_Tp, _Allocator>& __c, const _Up& __v) {
auto __old_size = __c.size();
__c.erase(_VSTD::remove(__c.begin(), __c.end(), __v), __c.end());
return __old_size - __c.size();
}
template <class _Tp, class _Allocator, class _Predicate>
inline _LIBCPP_HIDE_FROM_ABI typename deque<_Tp, _Allocator>::size_type
erase_if(deque<_Tp, _Allocator>& __c, _Predicate __pred) {
auto __old_size = __c.size();
__c.erase(_VSTD::remove_if(__c.begin(), __c.end(), __pred), __c.end());
return __old_size - __c.size();
}
template <>
inline constexpr bool __format::__enable_insertable<std::deque<char>> = true;
#ifndef _LIBCPP_HAS_NO_WIDE_CHARACTERS
template <>
inline constexpr bool __format::__enable_insertable<std::deque<wchar_t>> = true;
#endif
#endif // _LIBCPP_STD_VER >= 20
2010-05-11 19:42:16 +00:00
_LIBCPP_END_NAMESPACE_STD
#if _LIBCPP_STD_VER >= 17
_LIBCPP_BEGIN_NAMESPACE_STD
namespace pmr {
template <class _ValueT>
using deque = std::deque<_ValueT, polymorphic_allocator<_ValueT>>;
} // namespace pmr
_LIBCPP_END_NAMESPACE_STD
#endif
_LIBCPP_POP_MACROS
#if !defined(_LIBCPP_REMOVE_TRANSITIVE_INCLUDES) && _LIBCPP_STD_VER <= 20
# include <algorithm>
# include <atomic>
# include <concepts>
# include <cstdlib>
# include <functional>
# include <iosfwd>
# include <iterator>
# include <type_traits>
# include <typeinfo>
#endif
#endif // _LIBCPP_DEQUE