Enable Clang sanitizers in Linux/Clang CI pipeline #8737
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## develop #8737 +/- ##
========================================
Coverage 80.00% 80.00%
========================================
Files 1700 1700
Lines 188254 188242 -12
Branches 73 73
========================================
- Hits 150615 150607 -8
+ Misses 37639 37635 -4 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
tautschnig
force-pushed
the
address-sanitizer-ci
branch
from
869c8c6 to
65d8860
Compare
kroening
reviewed
Dec 1, 2025
tautschnig
force-pushed
the
address-sanitizer-ci
branch
2 times, most recently
from
34e4887 to
c71effb
Compare
tautschnig
force-pushed
the
address-sanitizer-ci
branch
3 times, most recently
from
6ec771d to
ea2876b
Compare
Adds a dedicated CI job that runs unit and regression tests on Ubuntu 24.04 after compiling with Clang's sanitizers. Enables address sanitizer (buffer overflow, use-after-free, use-after-return, double-free), memory leak sanitizer, and undefined-behavior sanitizer (integer overflow). - [AddressSanitizer Documentation](https://clang.llvm.org/docs/AddressSanitizer.html) - [LeakSanitizer Documentation](https://clang.llvm.org/docs/LeakSanitizer.html) - [UndefinedBehaviorSanitizer Documentation](https://clang.llvm.org/docs/UndefinedBehaviorSanitizer.html) Fixes: diffblue#832
Shared pointers may be updated in yet-to-be-executed threads.
Although the temporary is bound by a const reference, that reference is then just passed on to subobject initialisers. Per https://en.cppreference.com/w/cpp/language/reference_initialization.html#Lifetime_of_a_temporary, "passing on" does not extend the lifetime of a temporary. Try working around asan
The constructor did not take care of them and our unit tests exposed that, at least within unit tests, we were accessing uninitialised members.
`goto_symex_statet` holds a reference to a language mode, which was being initialised to `goto_symext::language_mode` in `goto_symext::initialize_entry_point_state`. That `goto_symext` object, however, may be the one created in `single_path_symex_only_checkert::initialize_worklist`, whereupon the `goto_symex_statet` will outlive it. Fix this problem by getting rid of the `language_mode` member of `goto_symext` and initialise `goto_symex_statet::language_mode` from a mode in the symbol table, which outlives all goto-symex objects.
tautschnig
force-pushed
the
address-sanitizer-ci
branch
from
ea2876b to
cb0753c
Compare
Use mp_integer to compute the number of permitted objects as the number of object bits is related to the analysis target platform and need not be within the analysis-execution platform's limits.
tautschnig
force-pushed
the
address-sanitizer-ci
branch
from
cb0753c to
eaaf057
Compare
tautschnig
force-pushed
the
address-sanitizer-ci
branch
from
da1568c to
f5e79cc
Compare
tautschnig
force-pushed
the
address-sanitizer-ci
branch
from
39de428 to
0c544dc
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Adds a dedicated CI job that runs unit and regression tests on Ubuntu 24.04 after compiling with Clang's sanitizers. Enables address sanitizer (buffer overflow, use-after-free, use-after-return, double-free), memory leak sanitizer, and undefined-behavior sanitizer (integer overflow).
Fixes: #832