From 477e91e377277ba2d1457e6abcc6e0d127c3f759 Mon Sep 17 00:00:00 2001
From: Nick Wellnhofer <wellnhofer@aevum.de>
Date: Mon, 18 Mar 2024 03:02:25 +0100
Subject: [PATCH] ci: Full ASan

---
 .github/workflows/ci.yml | 133 +++++++++++++++------------------------
 1 file changed, 50 insertions(+), 83 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 77ff8e272..6736e8de1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -27,97 +27,65 @@ jobs:
         CC: clang
         CXX: clang++
 
-  linux:
+  posix:
 
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        cmake_opts:
-          - '-DBUILD_SHARED_LIBS=YES'
-          - ''
-        compiler:
-          - c: 'clang'
-            cpp: 'clang++'
-            cflags: '-gdwarf-4'
-          - c: 'gcc'
-            cpp: 'g++'
-    env:
-       CMAKE_OPTIONS: ${{ matrix.cmake_opts }}
-       CC: ${{ matrix.compiler.c }}
-       CXX: ${{ matrix.compiler.cpp }}
-       CFLAGS: ${{ matrix.compiler.cflags }}
-       CXXFLAGS: ${{ matrix.compiler.cflags }}
-
-    steps:
-    - uses: actions/checkout@v4
-    - name: Install valgrind
-      run: |
-         sudo apt update
-         sudo apt install -y valgrind
-    - name: Build and test
-      run: |
-         cmake $CMAKE_OPTIONS -DCMAKE_BUILD_TYPE=Debug -S . -B build
-         cmake --build build
-         ctest --test-dir build --output-on-failure
-         make leakcheck
-
-  sanitizers:
-
-    runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
+        os: [ubuntu-latest, macos-latest]
+        shared: [YES, NO]
+        cc: [clang, gcc]
         include:
-          - cmake_opts: '-DBUILD_SHARED_LIBS=NO'
-          - cmake_opts: '-DBUILD_SHARED_LIBS=YES'
-            cflags: '-shared-libasan'
+          - sanitizers: '-fsanitize=address,undefined -fno-sanitize-recover=all'
+          - cc: 'clang'
+            cxx: 'clang++'
+          - cc: 'gcc'
+            cxx: 'g++'
+          # We have to disable LeakSanitizer in shared library builds
+          # because we get false positives from Python.
+          - shared: 'YES'
+            asan_opts: 'detect_leaks=0'
+          # gcc defaults to -shared-libsasn
+          - shared: 'NO'
+            cc: 'gcc'
+            asan_cflags: '-static-libasan'
+          # LD_PRELOAD ASan runtime
+          - os: 'ubuntu-latest'
+            shared: 'YES'
+            cc: 'gcc'
+            test_env: 'LD_PRELOAD=$(gcc -print-file-name=libasan.so)'
+          - os: 'ubuntu-latest'
+            shared: 'YES'
+            cc: 'clang'
+            asan_cflags: '-shared-libasan'
             test_env: 'LD_PRELOAD=$(clang -print-file-name=libclang_rt.asan-x86_64.so)'
-            asan_options: 'detect_leaks=0'
+          # Shared libasan doesn't work with macOS system Python.
+          - os: 'macos-latest'
+            shared: 'YES'
+            sanitizers: ''
+        exclude:
+          - os: 'macos-latest'
+            cc: 'gcc'
+    runs-on: ${{ matrix.os }}
     env:
-       CMAKE_OPTIONS: ${{ matrix.cmake_opts }}
-       CC: 'clang'
-       CXX: 'clang++'
-       CFLAGS: '-fsanitize=address,undefined -fno-sanitize-recover=all ${{ matrix.cflags }}'
-       CXXFLAGS: '-fsanitize=address,undefined -fno-sanitize-recover=all ${{ matrix.cflags }}'
-       ASAN_OPTIONS: ${{ matrix.asan_options }}
+       ASAN_OPTIONS: ${{ matrix.asan_opts }}
+       CC: ${{ matrix.cc }}
+       CXX: ${{ matrix.cxx }}
+       CFLAGS: '${{ matrix.sanitizers }} ${{ matrix.asan_cflags }}'
+       CXXFLAGS: '${{ matrix.sanitizers }} ${{ matrix.asan_cflags }}'
 
     steps:
     - uses: actions/checkout@v4
     - name: Build and test
       run: |
-         cmake $CMAKE_OPTIONS -DCMAKE_BUILD_TYPE=Debug -S . -B build
+         cmake \
+            -DBUILD_SHARED_LIBS=${{ matrix.shared }} \
+            -DCMAKE_BUILD_TYPE=Debug \
+            -S . -B build
          cmake --build build
          # https://github.com/actions/runner-images/issues/9491
-         sudo sysctl vm.mmap_rnd_bits=28
-         env ${{ matrix.test_env }} ctest --test-dir build --output-on-failure
-
-  macos:
-
-    runs-on: macos-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        cmake_opts:
-          - '-DBUILD_SHARED_LIBS=YES'
-          - ''
-        compiler:
-          - c: 'clang'
-            cpp: 'clang++'
-          - c: 'gcc'
-            cpp: 'g++'
-    env:
-       CMAKE_OPTIONS: ${{ matrix.cmake_opts }}
-       CC: ${{ matrix.compiler.c }}
-       CXX: ${{ matrix.compiler.cpp }}
-
-    steps:
-    - uses: actions/checkout@v4
-    - name: Build and test
-      run: |
-         cmake $CMAKE_OPTIONS -DCMAKE_BUILD_TYPE=Debug -S . -B build
-         cmake --build build
-         ctest --test-dir build --output-on-failure
+         sudo sysctl vm.mmap_rnd_bits=28 || true
+         ${{ matrix.test_env }} ctest --test-dir build --output-on-failure
 
   windows:
 
@@ -125,18 +93,17 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        cmake_opts:
-          - '-DBUILD_SHARED_LIBS=YES'
-          - ''
-    env:
-       CMAKE_OPTIONS: ${{ matrix.cmake_opts }}
+        shared: [YES, NO]
 
     steps:
     - uses: actions/checkout@v4
     - uses: ilammy/msvc-dev-cmd@v1
     - name: Build and test
       run: |
-        cmake %CMAKE_OPTIONS%  -DCMAKE_BUILD_TYPE=Debug -S . -B build
+        cmake ^
+            -DBUILD_SHARED_LIBS=${{ matrix.shared }} ^
+            -DCMAKE_BUILD_TYPE=Debug ^
+            -S . -B build
         cmake --build build
         ctest --test-dir build -C Debug --output-on-failure
       shell: cmd