DRAFT [libc++][hardening] In production hardening modes, trap rather than abort

[var-const]

• [libc++][hardening] Rework how the assertion handler can be overridden.
• Pass the original error message as the first argument.
• Update the documentation about overriding the default assertion handler.
• Update the release notes
• Add license to the new headers
• Partially address feedback, update how matching the error message works in tests.
• Finish addressing feedback
• • Use the COPYONLY option; - Reformat tests; - Remove the header from test scripts in cases where it's no longer relevant.
• Remove the new header from another script
• Try to fix the bootstrapping CI job (install the header consistently into the generic include directory).
• Fix the regex
• Workarounds for the % character in asserted expressions.
• Formatting
• Fix the CI.
• Mark the tests failing in no-localization configuration because of the new regex include as unsupported
• Wip
• Wip

[github-actions]

⚠️ C/C++ code formatter, clang-format found issues in your code. ⚠️

You can test this locally with the following command:

git-clang-format --diff 4f215fdd62d3f014750339eab9a46946b6fb1c4a 679718ac48a5d78bfdcae090f87c08fe4108d118 -- libcxx/include/__assert libcxx/include/__memory/assume_aligned.h libcxx/src/include/to_chars_floating_point.h libcxx/src/memory_resource.cpp libcxx/test/libcxx/assertions/modes/enabling_assertions_enables_extensive_mode.pass.cpp libcxx/test/libcxx/assertions/modes/override_with_debug_mode.pass.cpp libcxx/test/libcxx/assertions/modes/override_with_extensive_mode.pass.cpp libcxx/test/libcxx/assertions/modes/override_with_fast_mode.pass.cpp libcxx/test/libcxx/assertions/modes/override_with_unchecked_mode.pass.cpp libcxx/test/libcxx/containers/sequences/deque/asan_caterpillar.pass.cpp libcxx/test/std/algorithms/alg.modifying.operations/alg.fill/pstl.exception_handling.pass.cpp libcxx/test/std/algorithms/alg.modifying.operations/alg.move/pstl.exception_handling.pass.cpp libcxx/test/std/algorithms/alg.modifying.operations/alg.replace/pstl.exception_handling.pass.cpp libcxx/test/std/algorithms/alg.modifying.operations/alg.rotate/pstl.exception_handling.pass.cpp libcxx/test/std/algorithms/alg.modifying.operations/alg.transform/pstl.exception_handling.pass.cpp libcxx/test/std/algorithms/alg.nonmodifying/alg.all_of/pstl.exception_handling.pass.cpp libcxx/test/std/algorithms/alg.nonmodifying/alg.any_of/pstl.exception_handling.pass.cpp libcxx/test/std/algorithms/alg.nonmodifying/alg.equal/pstl.exception_handling.pass.cpp libcxx/test/std/algorithms/alg.nonmodifying/alg.find/pstl.exception_handling.pass.cpp libcxx/test/std/algorithms/alg.nonmodifying/alg.foreach/pstl.exception_handling.pass.cpp libcxx/test/std/algorithms/alg.nonmodifying/alg.none_of/pstl.exception_handling.pass.cpp libcxx/test/std/algorithms/alg.sorting/alg.merge/pstl.exception_handling.pass.cpp libcxx/test/std/algorithms/alg.sorting/alg.sort/stable.sort/pstl.exception_handling.pass.cpp libcxx/test/std/algorithms/numeric.ops/reduce/pstl.exception_handling.pass.cpp libcxx/test/std/algorithms/numeric.ops/transform.reduce/pstl.exception_handling.pass.cpp libcxx/test/support/check_assertion.h

View the diff from clang-format here.

diff --git a/libcxx/test/support/check_assertion.h b/libcxx/test/support/check_assertion.h
index 6534196956..bbe5027af4 100644
--- a/libcxx/test/support/check_assertion.h
+++ b/libcxx/test/support/check_assertion.h
@@ -58,9 +58,7 @@ struct AssertionInfoMatcher {
   }
 
   bool empty() const { return is_empty_; }
-  bool IsAnyMatcher() const {
-    return msg_ == any_msg && file_ == any_file && line_ == any_line;
-  }
+  bool IsAnyMatcher() const { return msg_ == any_msg && file_ == any_file && line_ == any_line; }
 
 private:
   bool CheckLineMatches(int got_line) const {
@@ -275,11 +273,7 @@ void std::__libcpp_verbose_abort(char const* message, ...) {
   std::exit(DeathTest::RK_Terminate);
 }
 
-enum class DeathCause {
-  VerboseAbort,
-  StdTerminate,
-  HardeningAssertion
-};
+enum class DeathCause { VerboseAbort, StdTerminate, HardeningAssertion };
 
 template <class Func>
 inline bool ExpectDeath(DeathCause expected_cause, const char* stmt, Func&& func, AssertionInfoMatcher matcher) {
@@ -310,15 +304,15 @@ inline bool ExpectDeath(DeathCause expected_cause, const char* stmt, Func&& func
 
   case DeathTest::RK_Trap:
     switch (expected_cause) {
-  case DeathCause::HardeningAssertion:
+    case DeathCause::HardeningAssertion:
 #if _LIBCPP_HARDENING_MODE != _LIBCPP_HARDENING_MODE_DEBUG
-    return true;
+      return true;
 #else
-    return OnFailure("The process has trapped but was expected to invoke verbose abort.");
+      return OnFailure("The process has trapped but was expected to invoke verbose abort.");
 #endif
-  case DeathCause::VerboseAbort:
+    case DeathCause::VerboseAbort:
       return OnFailure("The process has trapped but was expected to invoke verbose abort.");
-  case DeathCause::StdTerminate:
+    case DeathCause::StdTerminate:
       return OnFailure("The process has trapped but was expected to call `std::terminate`.");
     }
 
@@ -341,10 +335,15 @@ inline bool ExpectDeath(DeathCause expected_cause, const char* stmt, Func&& func
 }
 
 /// Assert that the specified expression aborts.
-#define EXPECT_DEATH(...) /*            */ assert((ExpectDeath(DeathCause::VerboseAbort, #__VA_ARGS__, [&]() { __VA_ARGS__; } )))
-#define EXPECT_DEATH_MATCHES(matcher, ...) assert((ExpectDeath(DeathCause::VerboseAbort, #__VA_ARGS__, [&]() { __VA_ARGS__; }, matcher)))
+#define EXPECT_DEATH(...) /*            */                                                                             \
+  assert((ExpectDeath(DeathCause::VerboseAbort, #__VA_ARGS__, [&]() { __VA_ARGS__; })))
+#define EXPECT_DEATH_MATCHES(matcher, ...)                                                                             \
+  assert((ExpectDeath(                                                                                                 \
+      DeathCause::VerboseAbort, #__VA_ARGS__, [&]() { __VA_ARGS__; }, matcher)))
 #define EXPECT_STD_TERMINATE(...) /*    */ assert(ExpectDeath(DeathCause::StdTerminate, #__VA_ARGS__, __VA_ARGS__))
 
-#define TEST_LIBCPP_ASSERT_FAILURE(expr, message) assert((ExpectDeath(DeathCause::HardeningAssertion, #expr, [&]() { (void)(expr); }, AssertionInfoMatcher(message))))
+#define TEST_LIBCPP_ASSERT_FAILURE(expr, message)                                                                      \
+  assert((ExpectDeath(                                                                                                 \
+      DeathCause::HardeningAssertion, #expr, [&]() { (void)(expr); }, AssertionInfoMatcher(message))))
 
 #endif // TEST_SUPPORT_CHECK_ASSERTION_H

[ldionne]

I would suggest refactoring the code to something like:

enum ResultKind { RK_DidNotDie, RK_Terminate, RK_Trap, RK_VerboseAbort, RK_SetupFailure, RK_Unknown };

Then, the child process would:

1. Use a std::terminate_handler to exit with RK_Terminate
2. Override __libcpp_verbose_abort to exit with RK_VerboseAbort and print the message to stderr (but wouldn't do any matching)
3. Would return RK_DidNotDie otherwise (as it does)

The parent process would:

1. Check whether the child exited with a trap -- which the child process unfortunately can't signal
2. In case it terminated with RK_VerboseAbort, match on stderr.

Finally we could do something like

#if _LIBCPP_HARDENING_MODE == _LIBCPP_HARDENING_MODE_DEBUG
#  define TEST_LIBCPP_ASSERT_FAILURE(expr, message) assert(ExpectDeath(DeathTest::RK_VerboseAbort, ...))
#else
#  define TEST_LIBCPP_ASSERT_FAILURE(expr, message) assert(ExpectDeath(DeathTest::RK_Trap, ...))
#endif

That way you'd have a single enum kind representing all ways the child process can exit, and the error matching would be done in the parent (which IMO makes more sense -- it's always been weird to do it from the child).

[ldionne]

This has moved to #78561 now.