Build libc++ with sanitizers enabled

Author: dzbarsky

3rd_party/llvm-project/x.x/libcxx/libcxx.BUILD.bazel

@@ -4,8 +4,8 @@ load("@bazel_skylib//rules:copy_file.bzl", "copy_file")
 load("@bazel_skylib//rules:write_file.bzl", "write_file")
 load("@llvm//3rd_party/llvm-project/21.x/libcxx:libcxx_headers.bzl", "LIBCXX_HEADERS_FILES_21")
 load("@llvm//3rd_party/llvm-project/22.x/libcxx:libcxx_headers.bzl", "LIBCXX_HEADERS_FILES_22")
-load("@llvm//toolchain/runtimes:cc_runtime_shared_library.bzl", "cc_runtime_stage1_shared_library")
-load("@llvm//toolchain/runtimes:cc_runtime_static_library.bzl", "cc_runtime_stage0_static_library")
+load("@llvm//toolchain/runtimes:cc_runtime_shared_library.bzl", "cc_runtime_stage1_sanitized_shared_library")
+load("@llvm//toolchain/runtimes:cc_runtime_static_library.bzl", "cc_runtime_stage0_sanitized_static_library")
 load("@llvm-project//:vars.bzl", "LLVM_VERSION_MAJOR")
 load("@rules_cc//cc:cc_library.bzl", "cc_library")
 
@@ -40,6 +40,14 @@ _CONFIG_SITE_NO_MUSL_LINES = [
     "#define _LIBCPP_HAS_MUSL_LIBC 0",
 ]
 
+_CONFIG_SITE_ASAN_LINES = [
+    "#define _LIBCPP_INSTRUMENTED_WITH_ASAN 1",
+]
+
+_CONFIG_SITE_NO_ASAN_LINES = [
+    "#define _LIBCPP_INSTRUMENTED_WITH_ASAN 0",
+]
+
 _CONFIG_SITE_THREAD_API_WIN32_LINES = [
     "#define _LIBCPP_HAS_THREAD_API_PTHREAD 0",
     "#define _LIBCPP_HAS_THREAD_API_WIN32   1",
@@ -74,7 +82,6 @@ _CONFIG_SITE_GENERIC_LINES = [
     "#define _LIBCPP_HAS_STD_MODULES         0",
     "#define _LIBCPP_HAS_TIME_ZONE_DATABASE  1",
     "#define _LIBCPP_HAS_VENDOR_AVAILABILITY_ANNOTATIONS 0",
-    "#define _LIBCPP_INSTRUMENTED_WITH_ASAN  0",
     "",
     "#define _LIBCPP_PSTL_BACKEND_SERIAL",
     "// #define _LIBCPP_PSTL_BACKEND_STD_THREAD",
@@ -110,6 +117,10 @@ write_file(
               select({
                   "@platforms//os:windows": _CONFIG_SITE_THREAD_API_WIN32_LINES,
                   "//conditions:default": _CONFIG_SITE_THREAD_API_PTHREAD_LINES,
+              }) +
+              select({
+                  "@llvm//config:asan_enabled": _CONFIG_SITE_ASAN_LINES,
+                  "//conditions:default": _CONFIG_SITE_NO_ASAN_LINES,
               }),
     visibility = ["//visibility:public"],
 )
@@ -349,15 +360,15 @@ cc_library(
     ],
 )
 
-cc_runtime_stage0_static_library(
+cc_runtime_stage0_sanitized_static_library(
     name = "libcxx.static",
     visibility = ["//visibility:public"],
     deps = [
         ":libcxx",
     ],
 )
 
-cc_runtime_stage1_shared_library(
+cc_runtime_stage1_sanitized_shared_library(
     name = "libcxx.shared",
     shared_lib_name = "libc++.so.1",
     user_link_flags = [

e2e/rules_cc/BUILD.bazel

@@ -770,6 +770,17 @@ asan_cc_binary(
     }),
 )
 
+exec_test(
+    name = "asan_libcxx_container_overflow_test",
+    srcs = ["asan_libcxx_container_overflow.cc"],
+    linkopts = ["-Wl,--icf=none"],
+    rule = asan_cc_binary,
+    target_compatible_with = select({
+        "@platforms//os:linux": [],
+        "//conditions:default": ["@platforms//:incompatible"],
+    }),
+)
+
 exec_test(
     name = "asan_output_test",
     srcs = ["asan_output_test.sh"],

e2e/rules_cc/asan_libcxx_container_overflow.cc

@@ -0,0 +1,19 @@
+#include <sanitizer/asan_interface.h>
+
+#include <cstdio>
+#include <string>
+
+int main() {
+  std::string value;
+  if (!__asan_address_is_poisoned(value.data() + 1)) {
+    std::fprintf(stderr, "std::string ASan annotations are disabled\n");
+    return 1;
+  }
+
+  value.push_back('x');
+
+  // push_back must unpoison the new null terminator. If libc++ is not built
+  // with ASan, reading the valid null terminator reports container-overflow.
+  volatile char terminator = value.c_str()[value.size()];
+  return terminator == '\0' ? 0 : 1;
+}

toolchain/runtimes/cc_runtime_shared_library.bzl

@@ -10,5 +10,11 @@ _builder = with_cfg(
 
 cc_runtime_stage0_shared_library, _cc_stage0_shared_library_internal = configure_builder_for_runtimes(_builder.clone(), "stage0", "dynamic").build()
 cc_runtime_stage1_shared_library, _cc_stage1_shared_library_internal = configure_builder_for_runtimes(_builder.clone(), "stage1", "dynamic").build()
+cc_runtime_stage1_sanitized_shared_library, _cc_stage1_sanitized_shared_library_internal = configure_builder_for_runtimes(
+    _builder.clone(),
+    "stage1",
+    "dynamic",
+    sanitizers = True,
+).build()
 cc_runtime_stage2_shared_library, _cc_stage2_shared_library_internal = configure_builder_for_runtimes(_builder.clone(), "stage2", "dynamic").build()
 cc_runtime_stage3_shared_library, _cc_stage3_shared_library_internal = configure_builder_for_runtimes(_builder.clone(), "stage3", "dynamic").build()

toolchain/runtimes/cc_runtime_static_library.bzl

@@ -9,3 +9,8 @@ _builder = with_cfg(
 # NOTE: runtime static libraries do not have >stage0 dependencies.
 # Those are only needed for shared libraries.
 cc_runtime_stage0_static_library, _cc_stage0_static_library_internal = configure_builder_for_runtimes(_builder.clone(), "stage0").build()
+cc_runtime_stage0_sanitized_static_library, _cc_stage0_sanitized_static_library_internal = configure_builder_for_runtimes(
+    _builder.clone(),
+    "stage0",
+    sanitizers = True,
+).build()