Best effort to block particular kind of mutable expressions in Python Cloud Debugger.

The problem is with expressions like x.__setattr__('a', 1). For some reason Python just decides to skip the trace call, which makes calls to primitives like __setattr__ invisible for ImmutabilityTraces. This CL implements a best effort solution (which is by no mean complete). We scan names of a code object and block it if there is a string like "__setattr__". It is possible by bypass it, but it should cover vast majority of the cases when the user runs such expressions by mistake.
-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=112289038

Author: vladlf

src/googleclouddebugger/immutability_tracer.cc

@@ -98,6 +98,20 @@ static const char* kWhitelistedCFunctions[] = {
 };
 
 
+static const char* kBlacklistedCodeObjectNames[] = {
+  "__setattr__",
+  "__delattr__",
+  "__del__",
+  "__new__",
+  "__set__",
+  "__delete__",
+  "__call__",
+  "__setitem__",
+  "__delitem__",
+  "__setslice__",
+  "__delslice__",
+};
+
 ImmutabilityTracer::ImmutabilityTracer()
     : self_(nullptr),
       thread_state_(nullptr),
@@ -152,6 +166,7 @@ int ImmutabilityTracer::OnTraceCallbackInternal(
     PyObject* arg) {
   switch (what) {
     case PyTrace_CALL:
+      VerifyCodeObject(ScopedPyCodeObject::NewReference(frame->f_code));
       break;
 
     case PyTrace_EXCEPTION:
@@ -191,6 +206,48 @@ int ImmutabilityTracer::OnTraceCallbackInternal(
 }
 
 
+void ImmutabilityTracer::VerifyCodeObject(ScopedPyCodeObject code_object) {
+  if (code_object == nullptr) {
+    return;
+  }
+
+  if (verified_code_objects_.count(code_object) != 0) {
+    return;
+  }
+
+  // Try to block expressions like "x.__setattr__('a', 1)". Python interpreter
+  // doesn't generate any trace callback for calls to built-in primitives like
+  // "__setattr__". Our best effort is to enumerate over all names in the code
+  // object and block ones with names like "__setprop__". The user can still
+  // bypass it, so this is just best effort.
+  PyObject* names = code_object.get()->co_names;
+  if ((names == nullptr) || !PyTuple_CheckExact(names)) {
+    LOG(WARNING) << "Corrupted code object: co_names is not a valid tuple";
+    mutable_code_detected_ = true;
+    return;
+  }
+
+  int count = PyTuple_GET_SIZE(names);
+  for (int i = 0; i != count; ++i) {
+    const char* name = PyString_AsString(PyTuple_GET_ITEM(names, i));
+    if (name == nullptr) {
+      LOG(WARNING) << "Corrupted code object: name " << i << " is not a string";
+      mutable_code_detected_ = true;
+      return;
+    }
+
+    for (int j = 0; j != arraysize(kBlacklistedCodeObjectNames); ++j) {
+      if (!strcmp(kBlacklistedCodeObjectNames[j], name)) {
+        mutable_code_detected_ = true;
+        return;
+      }
+    }
+  }
+
+  verified_code_objects_.insert(code_object);
+}
+
+
 void ImmutabilityTracer::ProcessCodeLine(
     PyCodeObject* code_object,
     int line_number) {

src/googleclouddebugger/immutability_tracer.h

@@ -17,6 +17,7 @@
 #ifndef DEVTOOLS_CDBG_DEBUGLETS_PYTHON_IMMUTABILITY_TRACER_H_
 #define DEVTOOLS_CDBG_DEBUGLETS_PYTHON_IMMUTABILITY_TRACER_H_
 
+#include <unordered_set>
 #include "common.h"
 #include "python_util.h"
 
@@ -70,6 +71,9 @@ class ImmutabilityTracer {
   // Python tracer callback function (instance function for convenience).
   int OnTraceCallbackInternal(PyFrameObject* frame, int what, PyObject* arg);
 
+  // Verifies that the code object doesn't include calls to blocked primitives.
+  void VerifyCodeObject(ScopedPyCodeObject code_object);
+
   // Verifies immutability of code on a single line.
   void ProcessCodeLine(PyCodeObject* code_object, int line_number);
 
@@ -93,6 +97,11 @@ class ImmutabilityTracer {
   // Evaluation thread.
   PyThreadState* thread_state_;
 
+  // Set of code object verified to not have any blocked primitives.
+  std::unordered_set<
+      ScopedPyCodeObject,
+      ScopedPyCodeObject::Hash> verified_code_objects_;
+
   // Original value of PyThreadState::tracing. We revert it to 0 to enforce
   // trace callback on this thread, even if the whole thing was executed from
   // within another trace callback (that caught the breakpoint).