Sanitizers: your new secret weapon to kill bugs

C++ will give you a job for life:

Buffer overflows
Data races
Use after delete
Invalid Pointer References
Undefined Behaviors
Memory Leaks
Use of uninitialized memory

What scares me...

Hard to reproduce, sporadic bugs
Bugs that disappear when you compile in Debug mode
Silent data corruption that doesn't trigger a SEGFAULT.

Welcome sanitizers

AddressSanitizer: detects use-after-free and buffer overflows

ThreadSanitizer: detects data races and deadlocks

MemorySanitizer: detects uninitialized memory reads

UndefinedBehaviorSanitizer: detects “simple” undefined behaviors

Sanitizers, AKA dynamic code analysis

You must run your code (it is not static code analysis)
Aims to zero false positives
Usually 10X faster than Valgrind
Very detailed error report, more convenient than GDB
Start using them in 1 minute...

AddressSanitizer: buffer-overflow

    int global_array[100];
    
    int main(int argc, char **argv) 
    {
        int stack_array[100];

        int index = 101 + argc; //index not know at compilation time

        global_array[index] = 42;
        stack_array[index] = 42;

        std::cout <<  global_array[index] << std::endl;
        std::cout <<  stack_array[index] << std::endl;
  
        return 0;
    }

AddressSanitizer: heap-overflow and use after free


    int main(int argc, char **argv)
    {
        int *array = new int[100];
    
        int index = 100 + argc; //argc not know at compilation time
    
        array[index] = 42; // BOOM?
        std::cout <<  array[index] << std::endl;
    
        delete [] array;
    
        array[0] = 23; // BOOM?
        std::cout <<  array[0] << std::endl;
    
        return 0;
    }

AddressSanitizer: container-overflow


    int main(int argc, char **argv)
    {
        std::vector<int> V(8, 42);
        V.resize(5); // capacity still 8
    
        // The memory is still there, but we are not supposed to
        // access this element
        std::cout <<  V[6] << std::endl;
    
        return 0;
    }

Note: previous examples may crash, but not this one.

AddressSanitizer: dangling reference

    const std::vector<int>& Vector42( int size )
    {
         std::vector<int> V(size, 42);
         return V;
    }
    
    int main()
    {
        const std::vector<int>& V = Vector42(8);
    
        // No problem, right?
        std::cout <<  V[6] << std::endl;
        // BOOOOM
        return 0;
    }

AddressSanitizer: memory leaks


    int main()
    {
        int *g = new int;
        g = nullptr; // Lost the pointer.

        return 0;
    }

Recently I found a bug like this in Qt, where you are not supposed to call delete explicitly...

AddressSanitizer overhead

CPU: 2X slowdown
RAM: 1.5X-3X memory overhead

ThreadSanitizer: example

    struct A 
    {
        virtual ~A() 
        {
            F();
        }
        virtual void F() 
        {
            printf("In A");
        }
    };

    struct B : public A 
    {
        virtual void F() 
        {
            printf("In B");
        }
    };
    // guess what it prints...

I recently fixed a bug like this one... if you don't see it, it is normal

    class A {
      public:
        A() : done_(false) {}
        virtual void F() { printf("A::F\n"); }
        void Done() {
                std::unique_lock<std::mutex> lk(m_);
                done_ = true;
                cv_.notify_one();
        }
        virtual ~A() {
            std::unique_lock<std::mutex> lk(m_);
            cv_.wait(lk, [this] {return done_;});
        }
     private:
        std::mutex m_;
        std::condition_variable cv_;
        bool done_;
    };
    
    class B : public A {
      public:
        virtual void F() { printf("B::F\n"); }
        virtual ~B() {}
    };
    
    int main() {
        A *a = new B;
        std::thread t1([a] {a->F(); a->Done();});
        std::thread t2([a] {delete a;});
        t1.join(); t2.join();
    }

ThreadSanitizer overhead

CPU: 4X-10X slowdown
RAM: 5X-8X memory overhead

If you write multi-threaded code, it does have bugs. Deal with it and sanitize it.

UndefinedBehaviorSanitizer

    int main(int argc, char **argv)
    {
        int t = 1 << 16;
        std::cout << t * t << std::endl;
        return 0;
    }

Bugs makes you sad? Start being awesome with Sanitizers!