[Toybox] [PATCH SET] Fix test harness issues and fix tests

[Andy Chu]

FYI with these patches, and this addition to expr.test:

# Case that triggers ASAN error
testing "regex" "expr 3 : '\(.\)' = 4 : '\(.\)'" "0\n" "" ""

Then running the following command line shows a heap-use-after-free
error in expr, detected by ASAN.  (Basically there are two regex
captures, and you compare them for equality.  There are definitely
other cases that will fail at head -- I'm just pointing out this one.)

I think the 3rd patch I sent with track() is the shortest and simplest
solution that's correct ...  If you want to free sooner, I think you
would have to separate out "ret" and "lhs", and probably have a flag
inside 'struct value' about whether the string needs to be freed or
not.  However that is more code that will intertwine itself throughout
the evaluation logic.

$ ./test.sh single -asan expr
scripts/make.sh toybox_asan
Generate headers from toys/*/*.c...
...

PASS: expr adjacent literals
PASS: expr non-integer argument
=================================================================
==25529==ERROR: AddressSanitizer: heap-use-after-free on address
0x60200000edd0 at pc 0x00000045098e bp 0x7fffa02938f0 sp
0x7fffa02930b0
READ of size 1 at 0x60200000edd0 thread T0
    #0 0x45098d in StrtolFixAndCheck(void*, char const*, char**,
char*, int) /home/development/llvm/3.8.0/final/llvm.src/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:2596:3
    #1 0x4a0952 in strtoll
/home/development/llvm/3.8.0/final/llvm.src/projects/compiler-rt/lib/asan/asan_interceptors.cc:686:3
    #2 0x53808e in get_int /home/andy/git/other/toybox/toys/pending/expr.c:84:12
    #3 0x538501 in eval_op /home/andy/git/other/toybox/toys/pending/expr.c:169:9
    #4 0x539358 in eval_expr
/home/andy/git/other/toybox/toys/pending/expr.c:241:5
    #5 0x538db4 in expr_main
/home/andy/git/other/toybox/toys/pending/expr.c:251:3
    #6 0x4e7539 in toy_exec /home/andy/git/other/toybox/main.c:148:19
    #7 0x4e693c in toybox_main /home/andy/git/other/toybox/main.c:161:21
    #8 0x4e770b in main /home/andy/git/other/toybox/main.c:220:5
    #9 0x7fc2d5d3eec4 in __libc_start_main
/build/buildd/eglibc-2.19/csu/libc-start.c:287
    #10 0x41bc75 in _start (/home/andy/git/other/toybox/toybox_asan+0x41bc75)

0x60200000edd0 is located 0 bytes inside of 2-byte region
[0x60200000edd0,0x60200000edd2)
freed by thread T0 here:
    #0 0x4b1ceb in __interceptor_free
/home/development/llvm/3.8.0/final/llvm.src/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:38:3
    #1 0x538967 in re /home/andy/git/other/toybox/toys/pending/expr.c:117:22
    #2 0x538967 in eval_op /home/andy/git/other/toybox/toys/pending/expr.c:203
    #3 0x539358 in eval_expr
/home/andy/git/other/toybox/toys/pending/expr.c:241:5
    #4 0x539349 in eval_expr
/home/andy/git/other/toybox/toys/pending/expr.c:240:5
    #5 0x538db4 in expr_main
/home/andy/git/other/toybox/toys/pending/expr.c:251:3
    #6 0x4e7539 in toy_exec /home/andy/git/other/toybox/main.c:148:19
    #7 0x4e693c in toybox_main /home/andy/git/other/toybox/main.c:161:21
    #8 0x7fc2d5d3eec4 in __libc_start_main
/build/buildd/eglibc-2.19/csu/libc-start.c:287

previously allocated by thread T0 here:
    #0 0x4b200b in malloc
/home/development/llvm/3.8.0/final/llvm.src/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:52:3
    #1 0x4e4082 in xmalloc /home/andy/git/other/toybox/lib/xwrap.c:62:15
    #2 0x538928 in re /home/andy/git/other/toybox/toys/pending/expr.c:116:16
    #3 0x538928 in eval_op /home/andy/git/other/toybox/toys/pending/expr.c:203
    #4 0x539358 in eval_expr
/home/andy/git/other/toybox/toys/pending/expr.c:241:5
    #5 0x538db4 in expr_main
/home/andy/git/other/toybox/toys/pending/expr.c:251:3
    #6 0x4e7539 in toy_exec /home/andy/git/other/toybox/main.c:148:19
    #7 0x4e693c in toybox_main /home/andy/git/other/toybox/main.c:161:21
    #8 0x7fc2d5d3eec4 in __libc_start_main
/build/buildd/eglibc-2.19/csu/libc-start.c:287

SUMMARY: AddressSanitizer: heap-use-after-free
/home/development/llvm/3.8.0/final/llvm.src/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:2596:3
in StrtolFixAndCheck(void*, char const*, char**, char*, i
nt)
Shadow bytes around the buggy address:
  0x0c047fff9d60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9d70: fa fa 02 fa fa fa fd fa fa fa fd fd fa fa fd fa
  0x0c047fff9d80: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fd
  0x0c047fff9d90: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
  0x0c047fff9da0: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
=>0x0c047fff9db0: fa fa fd fa fa fa fd fa fa fa[fd]fa fa fa fd fa
  0x0c047fff9dc0: fa fa fd fd fa fa fd fa fa fa fd fa fa fa fd fa
  0x0c047fff9dd0: fa fa fd fa fa fa fd fd fa fa fd fa fa fa fd fa
  0x0c047fff9de0: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
  0x0c047fff9df0: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
  0x0c047fff9e00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==25529==ABORTING
FAIL: expr regex
toybox expr: 1 total failures

 1459126106.0