[scudo] Use require_constant_initialization

[vitalybuka]

Summary

Attribute guaranties safe static initialization of globals.

[vitalybuka]

remove ;

[cryptoad]

Is this related to the GWP-ASan initialization issues?
I am unclear if we need to rework the init() vs initLinkInitialized() functions as well?

compiler-rt/lib/scudo/standalone/mutex.h

53

{} for Fuchsia as well?

[cryptoad]

compiler-rt/lib/scudo/standalone/primary64.h

287–288

This will probably have to be initialized as well for Fuchsia since it's not empty.

302–303

Same here.

[vitalybuka]

In D101514#2725659, @cryptoad wrote:

Is this related to the GWP-ASan initialization issues?

Yes. I tried to figure out rules for static initialization and looks like there is no way to be sure for such complex class without attribute or constinit of c++20.

I am unclear if we need to rework the init() vs initLinkInitialized() functions as well?

It's probably unrelated to this patch.

[vitalybuka]

Landed by mistake, reverting.

[vitalybuka]

addressed @cryptoad comments

[vitalybuka]

I probably missed something for android or Fuchsia, but diagnostics messages make it pretty clear what needs to be initialized and it should be easy to fix during integrations.

[hctim]

compiler-rt/lib/scudo/standalone/internal_defs.h

54

Judging by https://gcc.gnu.org/bugzilla/show_bug.cgi?id=86974, looks like this isn't supported on gcc (and I see us bumping to c++2a for constinit) :(. Ah well, I guess we only get the diagnostic on clang.

Looking into it further, looks like gcc/clang-O0 don't elide the GWP-ASan dynamic initializer because the parent Scudo allocator is default-initialized, and the GWP-ASan initializer is value-initialized with nonzero values. This patch effectively makes the Scudo allocator's implicit construct constexpr by initializing all its members, and triggers static constant initialization of the Scudo and GWP-ASan allocators.

It looks like https://reviews.llvm.org/D87478 removed the blocker (from https://reviews.llvm.org/D69265#inline-624315) to making Scudo's allocator constexpr, so now this is possible :).

I wrote a comment for posterity that would be good to include here, as it hopefully helps with debugging:

// This check is only available on Clang. This is essentialy an alias of C++20's
// 'constinit' specifier which will take care of this when (if?) we can ask all
// libc's that use Scudo to compile us with C++20. Dynamic initialization is
// bad; Scudo is designed to be lazy-initializated on the first call to
// malloc/free (and friends), and this generally happens in the loader somewhere
// in libdl's init. After the loader is done, control is transferred to libc's
// initialization, and the dynamic initializers are run. If there's a dynamic
// initializer for Scudo, then it will clobber the already-initialized Scudo,
// and re-initialize all its members back to default values, causing various
// explosions. Unfortunately, marking scudo::Allocator<>'s constructor as
// 'constexpr' isn't sufficient to prevent dynamic initialization, as default
// initialization is fine under 'constexpr' (but not 'constinit'). Clang at -O0,
// and gcc at all opt levels will emit a dynamic initializer for any
// constant-initialized variables if there is a mix of default-initialized and
// constant-initialized variables.
//
// If you're looking at this because your build failed, you probably introduced
// a new member to scudo::Allocator<> (possibly transiently) that didn't have an
// initializer. The fix is easy - just add one.

While constexpr != constinit, it might be helpful to explicitly define the default constructor for scudo::Allocator<> as constexpr (constexpr Allocator() {}) as well.

[vitalybuka]

compiler-rt/lib/scudo/standalone/internal_defs.h

54

Judging by https://gcc.gnu.org/bugzilla/show_bug.cgi?id=86974, looks like this isn't supported on gcc (and I see us bumping to c++2a for constinit) :(. Ah well, I guess we only get the diagnostic on clang.

I guess that's fine. At least on clang if I remove attribute it still makes it const initialized.

Looking into it further, looks like gcc/clang-O0 don't elide the GWP-ASan dynamic initializer because the parent Scudo allocator is default-initialized, and the GWP-ASan initializer is value-initialized with nonzero values. This patch effectively makes the Scudo allocator's implicit construct constexpr by initializing all its members, and triggers static constant initialization of the Scudo and GWP-ASan allocators.

constexpr is not enough https://godbolt.org/z/s51zfv9sE

[vitalybuka]

compiler-rt/lib/scudo/standalone/internal_defs.h

54

As part of this patch I had all touched classes as constexpr, but as it's not relevant I reverted them.

[hctim]

compiler-rt/lib/scudo/standalone/internal_defs.h

54

I guess that's fine. At least on clang if I remove attribute it still makes it const initialized.

Sorry for any confusion, I mean to say the attribute is good as a defensive layer of compile-time checking and we should definitely keep it, even if it's just for clang.

constexpr is not enough https://godbolt.org/z/s51zfv9sE

Yep, from the comment:

// Unfortunately, marking scudo::Allocator<>'s constructor as
// 'constexpr' isn't sufficient to prevent dynamic initialization, as default
// initialization is fine under 'constexpr' (but not 'constinit')

Although I should have written "it makes the implicit constructor constexpr (this doesn't necessarily fix the problem), and also having no more non-default-initialized members elides the dynamic initializer".

constexpr on the c'tor just gives us a little bit of compile-time diagnostics on gcc (which the attribute is significantly better but clang-only).

[vitalybuka]

compiler-rt/lib/scudo/standalone/internal_defs.h

54

according standard "The constexpr specifier declares that it is *possible* to evaluate the value of the function or variable at compile time.", but with -O0 compiler does not bother.

Even O1
O1: https://godbolt.org/z/ov6ecoEqn
O2: https://godbolt.org/z/je4fff4bh

[vitalybuka]

Add comment explaining SCUDO_REQUIRE_CONSTANT_INITIALIZATION

[vitalybuka]

compiler-rt/lib/scudo/standalone/internal_defs.h

54

Now I see, you are proposing comment :)
I'll add it.

[vitalybuka]

ping

[hctim]

LGTM! Thank you!

compiler-rt/lib/scudo/standalone/combined.h

private:
   // 0 corresponds to the address of the user memory. This means that only
   // negative indexes may be used. The smallest index that may be used is -2,
   // which corresponds to 8 bytes before the user memory, because the chunk
   // header size is 8 bytes and in allocators that support memory tagging the
   // minimum alignment is at least the tag granule size (16 on aarch64).
   static const sptr MemTagAllocationTraceIndex = -2;
   static const sptr MemTagAllocationTidIndex = -1;
 
-  u32 Cookie;
-  u32 QuarantineMaxChunkSize;
+  u32 Cookie = 0;
+  u32 QuarantineMaxChunkSize = 0;
 
   GlobalStats Stats;
   PrimaryT Primary;
   SecondaryT Secondary;
   QuarantineT Quarantine;
   TSDRegistryT TSDRegistry;
 
 #ifdef GWP_ASAN_HOOKS
struct AllocationRingBuffer {
     atomic_uptr Pos;
 #ifdef SCUDO_FUZZ
     static const uptr NumEntries = 2;
 #else
     static const uptr NumEntries = 32768;
 #endif
     Entry Entries[NumEntries];
   };
-  AllocationRingBuffer RingBuffer;
+  AllocationRingBuffer RingBuffer = {};
 
   // The following might get optimized out by the compiler.
   NOINLINE void performSanityChecks() {
     // Verify that the header offset field can hold the maximum offset. In the
     // case of the Secondary allocator, it takes care of alignment and the
     // offset will always be small. In the case of the Primary, the worst case
     // scenario happens in the last size class, when the backend allocation
     // would already be aligned on the requested alignment, which would happen

compiler-rt/lib/scudo/standalone/internal_defs.h

 #define PREFETCH(X) __asm__("prefetchnta (%0)" : : "r"(X))
 #else
 #define PREFETCH(X) __builtin_prefetch(X)
 #endif
 #define UNUSED __attribute__((unused))
 #define USED __attribute__((used))
 #define NOEXCEPT noexcept
 
+// This check is only available on Clang. This is essentially an alias of
+// C++20's 'constinit' specifier which will take care of this when (if?) we can
+// ask all libc's that use Scudo to compile us with C++20. Dynamic
+// initialization is bad; Scudo is designed to be lazy-initializated on the
+// first call to malloc/free (and friends), and this generally happens in the
+// loader somewhere in libdl's init. After the loader is done, control is
+// transferred to libc's initialization, and the dynamic initializers are run.
+// If there's a dynamic initializer for Scudo, then it will clobber the
+// already-initialized Scudo, and re-initialize all its members back to default
+// values, causing various explosions. Unfortunately, marking
+// scudo::Allocator<>'s constructor as 'constexpr' isn't sufficient to prevent
+// dynamic initialization, as default initialization is fine under 'constexpr'
+// (but not 'constinit'). Clang at -O0, and gcc at all opt levels will emit a
+// dynamic initializer for any constant-initialized variables if there is a mix
+// of default-initialized and constant-initialized variables.
+//
+// If you're looking at this because your build failed, you probably introduced
+// a new member to scudo::Allocator<> (possibly transiently) that didn't have an
+// initializer. The fix is easy - just add one.
+#if defined(__has_attribute)
+#if __has_attribute(require_constant_initialization)
+#define SCUDO_REQUIRE_CONSTANT_INITIALIZATION                                  \
+  __attribute__((__require_constant_initialization__))
+#else
+#define SCUDO_REQUIRE_CONSTANT_INITIALIZATION
+#endif
+#endif
+
 namespace scudo {
 
 typedef unsigned long uptr;
 typedef unsigned char u8;
 typedef unsigned short u16;
 typedef unsigned int u32;
 typedef unsigned long long u64;
 typedef signed long sptr;

compiler-rt/lib/scudo/standalone/list.h

template <class T> struct IntrusiveList {
   Iterator end() { return Iterator(nullptr); }
 
   ConstIterator begin() const { return ConstIterator(First); }
   ConstIterator end() const { return ConstIterator(nullptr); }
 
   void checkConsistency() const;
 
 protected:
-  uptr Size;
-  T *First;
-  T *Last;
+  uptr Size = 0;
+  T *First = nullptr;
+  T *Last = nullptr;
 };
 
 template <class T> void IntrusiveList<T>::checkConsistency() const {
   if (Size == 0) {
     CHECK_EQ(First, nullptr);
     CHECK_EQ(Last, nullptr);
   } else {
     uptr Count = 0;

compiler-rt/lib/scudo/standalone/local_cache.h

private:
   static const uptr NumClasses = SizeClassMap::NumClasses;
   static const uptr BatchClassId = SizeClassMap::BatchClassId;
   struct PerClass {
     u32 Count;
     u32 MaxCount;
     uptr ClassSize;
     CompactPtrT Chunks[2 * TransferBatch::MaxNumCached];
   };
-  PerClass PerClassArray[NumClasses];
+  PerClass PerClassArray[NumClasses] = {};
   LocalStats Stats;
-  SizeClassAllocator *Allocator;
+  SizeClassAllocator *Allocator = nullptr;
 
   ALWAYS_INLINE void initCacheMaybe(PerClass *C) {
     if (LIKELY(C->MaxCount))
       return;
     initCache();
     DCHECK_NE(C->MaxCount, 0U);
   }
 

compiler-rt/lib/scudo/standalone/mutex.h

#endif
   }
   void unlock();
 
 private:
   static constexpr u8 NumberOfTries = 8U;
   static constexpr u8 NumberOfYields = 8U;
 
 #if SCUDO_LINUX
-  atomic_u32 M;
+  atomic_u32 M = {};
 #elif SCUDO_FUCHSIA
-  sync_mutex_t M;
+  sync_mutex_t M = {};
 #endif
 
   void lockSlow();
 };
 
 class ScopedLock {
 public:
   explicit ScopedLock(HybridMutex &M) : Mutex(M) { Mutex.lock(); }

compiler-rt/lib/scudo/standalone/options.h

 };
 
 template <typename Config> bool useMemoryTagging(Options Options) {
   return allocatorSupportsMemoryTagging<Config>() &&
          Options.get(OptionBit::UseMemoryTagging);
 }
 
 struct AtomicOptions {
-  atomic_u32 Val;
+  atomic_u32 Val = {};
 
-public:
   Options load() const { return Options{atomic_load_relaxed(&Val)}; }
 
   void clear(OptionBit Opt) {
     atomic_fetch_and(&Val, ~(1U << static_cast<u32>(Opt)),
                      memory_order_relaxed);
   }
 
   void set(OptionBit Opt) {

compiler-rt/lib/scudo/standalone/primary32.h

if (Recorder.getReleasedRangesCount() > 0) {
       Sci->ReleaseInfo.LastReleasedBytes = Recorder.getReleasedBytes();
       TotalReleasedBytes += Sci->ReleaseInfo.LastReleasedBytes;
     }
     Sci->ReleaseInfo.LastReleaseAtNs = getMonotonicTime();
 
     return TotalReleasedBytes;
   }
 
-  SizeClassInfo SizeClassInfoArray[NumClasses];
+  SizeClassInfo SizeClassInfoArray[NumClasses] = {};
 
   // Track the regions in use, 0 is unused, otherwise store ClassId + 1.
-  ByteMap PossibleRegions;
-  atomic_s32 ReleaseToOsIntervalMs;
+  ByteMap PossibleRegions = {};
+  atomic_s32 ReleaseToOsIntervalMs = {};
   // Unless several threads request regions simultaneously from different size
   // classes, the stash rarely contains more than 1 entry.
   static constexpr uptr MaxStashedRegions = 4;
   HybridMutex RegionsStashMutex;
-  uptr NumberOfStashedRegions;
-  uptr RegionsStash[MaxStashedRegions];
+  uptr NumberOfStashedRegions = 0;
+  uptr RegionsStash[MaxStashedRegions] = {};
 };
 
 } // namespace scudo
 
 #endif // SCUDO_PRIMARY32_H_

compiler-rt/lib/scudo/standalone/primary64.h

struct ReleaseToOsInfo {
     uptr PushedBlocksAtLastRelease;
     uptr RangesReleased;
     uptr LastReleasedBytes;
     u64 LastReleaseAtNs;
   };
 
   struct UnpaddedRegionInfo {
     HybridMutex Mutex;
     SinglyLinkedList<TransferBatch> FreeList;
-    uptr RegionBeg;
-    RegionStats Stats;
-    u32 RandState;
-    uptr MappedUser;    // Bytes mapped for user memory.
-    uptr AllocatedUser; // Bytes allocated for user memory.
-    MapPlatformData Data;
-    ReleaseToOsInfo ReleaseInfo;
-    bool Exhausted;
+    uptr RegionBeg = 0;
+    RegionStats Stats = {};
+    u32 RandState = 0;
+    uptr MappedUser = 0;    // Bytes mapped for user memory.
+    uptr AllocatedUser = 0; // Bytes allocated for user memory.
+    MapPlatformData Data = {};
+    ReleaseToOsInfo ReleaseInfo = {};
+    bool Exhausted = false;
   };
   struct RegionInfo : UnpaddedRegionInfo {
     char Padding[SCUDO_CACHE_LINE_SIZE -
-                 (sizeof(UnpaddedRegionInfo) % SCUDO_CACHE_LINE_SIZE)];
+                 (sizeof(UnpaddedRegionInfo) % SCUDO_CACHE_LINE_SIZE)] = {};
   };
   static_assert(sizeof(RegionInfo) % SCUDO_CACHE_LINE_SIZE == 0, "");
 
-  uptr PrimaryBase;
-  MapPlatformData Data;
-  atomic_s32 ReleaseToOsIntervalMs;
+  uptr PrimaryBase = 0;
+  MapPlatformData Data = {};
+  atomic_s32 ReleaseToOsIntervalMs = {};
   alignas(SCUDO_CACHE_LINE_SIZE) RegionInfo RegionInfoArray[NumClasses];
 
   RegionInfo *getRegionInfo(uptr ClassId) {
     DCHECK_LT(ClassId, NumClasses);
     return &RegionInfoArray[ClassId];
   }
 
   uptr getRegionBaseByClassId(uptr ClassId) const {

compiler-rt/lib/scudo/standalone/quarantine.h

Str->append(
         "Stats: Quarantine: batches: %zu; bytes: %zu (user: %zu); chunks: %zu "
         "(capacity: %zu); %zu%% chunks used; %zu%% memory overhead\n",
         BatchCount, TotalBytes, TotalQuarantinedBytes, TotalQuarantineChunks,
         QuarantineChunksCapacity, ChunksUsagePercent, MemoryOverheadPercent);
   }
 
 private:
   SinglyLinkedList<QuarantineBatch> List;
-  atomic_uptr Size;
+  atomic_uptr Size = {};
 
   void addToSize(uptr add) { atomic_store_relaxed(&Size, getSize() + add); }
   void subFromSize(uptr sub) { atomic_store_relaxed(&Size, getSize() - sub); }
 };
 
 // The callback interface is:
 // void Callback::recycle(Node *Ptr);
 // void *Callback::allocate(uptr Size);
void enable() {
     RecycleMutex.unlock();
   }
 
 private:
   // Read-only data.
   alignas(SCUDO_CACHE_LINE_SIZE) HybridMutex CacheMutex;
   CacheT Cache;
   alignas(SCUDO_CACHE_LINE_SIZE) HybridMutex RecycleMutex;
-  atomic_uptr MinSize;
-  atomic_uptr MaxSize;
-  alignas(SCUDO_CACHE_LINE_SIZE) atomic_uptr MaxCacheSize;
+  atomic_uptr MinSize = {};
+  atomic_uptr MaxSize = {};
+  alignas(SCUDO_CACHE_LINE_SIZE) atomic_uptr MaxCacheSize = {};
 
   void NOINLINE recycle(uptr MinSize, Callback Cb) {
     CacheT Tmp;
     Tmp.init();
     {
       ScopedLock L(CacheMutex);
       // Go over the batches and merge partially filled ones to
       // save some memory, otherwise batches themselves (since the memory used

compiler-rt/lib/scudo/standalone/secondary.h

void releaseOlderThan(u64 Time) {
     OldestTime = 0;
     for (uptr I = 0; I < Config::SecondaryCacheQuarantineSize; I++)
       releaseIfOlderThan(Quarantine[I], Time);
     for (uptr I = 0; I < Config::SecondaryCacheEntriesArraySize; I++)
       releaseIfOlderThan(Entries[I], Time);
   }
 
   HybridMutex Mutex;
-  u32 EntriesCount;
-  u32 QuarantinePos;
-  atomic_u32 MaxEntriesCount;
-  atomic_uptr MaxEntrySize;
-  u64 OldestTime;
-  u32 IsFullEvents;
-  atomic_s32 ReleaseToOsIntervalMs;
+  u32 EntriesCount = 0;
+  u32 QuarantinePos = 0;
+  atomic_u32 MaxEntriesCount = {};
+  atomic_uptr MaxEntrySize = {};
+  u64 OldestTime = 0;
+  u32 IsFullEvents = 0;
+  atomic_s32 ReleaseToOsIntervalMs = {};
 
-  CachedBlock Entries[Config::SecondaryCacheEntriesArraySize];
-  CachedBlock Quarantine[Config::SecondaryCacheQuarantineSize];
+  CachedBlock Entries[Config::SecondaryCacheEntriesArraySize] = {};
+  CachedBlock Quarantine[Config::SecondaryCacheQuarantineSize] = {};
 };
 
 template <typename Config> class MapAllocator {
 public:
   void initLinkerInitialized(GlobalStats *S, s32 ReleaseToOsInterval = -1) {
     Cache.initLinkerInitialized(ReleaseToOsInterval);
     Stats.initLinkerInitialized();
     if (LIKELY(S))
public:
 
   void disableMemoryTagging() { Cache.disableMemoryTagging(); }
 
 private:
   typename Config::SecondaryCache Cache;
 
   HybridMutex Mutex;
   DoublyLinkedList<LargeBlock::Header> InUseBlocks;
-  uptr AllocatedBytes;
-  uptr FreedBytes;
-  uptr LargestSize;
-  u32 NumberOfAllocs;
-  u32 NumberOfFrees;
+  uptr AllocatedBytes = 0;
+  uptr FreedBytes = 0;
+  uptr LargestSize = 0;
+  u32 NumberOfAllocs = 0;
+  u32 NumberOfFrees = 0;
   LocalStats Stats;
 };
 
 // As with the Primary, the size passed to this function includes any desired
 // alignment, so that the frontend can align the user allocation. The hint
 // parameter allows us to unmap spurious memory when dealing with larger
 // (greater than a page) alignments on 32-bit platforms.
 // Due to the sparsity of address space available on those platforms, requesting

compiler-rt/lib/scudo/standalone/stack_depot.h

u32 get() {
     X *= M;
     X ^= X >> 15;
     return X;
   }
 };
 
 class StackDepot {
   HybridMutex RingEndMu;
-  u32 RingEnd;
+  u32 RingEnd = 0;
 
   // This data structure stores a stack trace for each allocation and
   // deallocation when stack trace recording is enabled, that may be looked up
   // using a hash of the stack trace. The lower bits of the hash are an index
   // into the Tab array, which stores an index into the Ring array where the
   // stack traces are stored. As the name implies, Ring is a ring buffer, so a
   // stack trace may wrap around to the start of the array.
   //

 #ifdef SCUDO_FUZZ
   // Use smaller table sizes for fuzzing in order to reduce input size.
   static const uptr TabBits = 4;
 #else
   static const uptr TabBits = 16;
 #endif
   static const uptr TabSize = 1 << TabBits;
   static const uptr TabMask = TabSize - 1;
-  atomic_u32 Tab[TabSize];
+  atomic_u32 Tab[TabSize] = {};
 
 #ifdef SCUDO_FUZZ
   static const uptr RingBits = 4;
 #else
   static const uptr RingBits = 19;
 #endif
   static const uptr RingSize = 1 << RingBits;
   static const uptr RingMask = RingSize - 1;
-  atomic_u64 Ring[RingSize];
+  atomic_u64 Ring[RingSize] = {};
 
 public:
   // Insert hash of the stack trace [Begin, End) into the stack depot, and
   // return the hash.
   u32 insert(uptr *Begin, uptr *End) {
     MurMur2HashBuilder B;
     for (uptr *I = Begin; I != End; ++I)
       B.add(u32(*I) >> 2);

compiler-rt/lib/scudo/standalone/stats.h

void sub(StatType I, uptr V) {
     V = atomic_load_relaxed(&StatsArray[I]) - V;
     atomic_store_relaxed(&StatsArray[I], V);
   }
 
   void set(StatType I, uptr V) { atomic_store_relaxed(&StatsArray[I], V); }
 
   uptr get(StatType I) const { return atomic_load_relaxed(&StatsArray[I]); }
 
-  LocalStats *Next;
-  LocalStats *Prev;
+  LocalStats *Next = nullptr;
+  LocalStats *Prev = nullptr;
 
 private:
-  atomic_uptr StatsArray[StatCount];
+  atomic_uptr StatsArray[StatCount] = {};
 };
 
 // Global stats, used for aggregation and querying.
 class GlobalStats : public LocalStats {
 public:
   void initLinkerInitialized() {}
   void init() {
     LocalStats::init();

compiler-rt/lib/scudo/standalone/tsd.h

 #define PTHREAD_DESTRUCTOR_ITERATIONS 4
 #endif
 
 namespace scudo {
 
 template <class Allocator> struct alignas(SCUDO_CACHE_LINE_SIZE) TSD {
   typename Allocator::CacheT Cache;
   typename Allocator::QuarantineCacheT QuarantineCache;
-  u8 DestructorIterations;
+  u8 DestructorIterations = 0;
 
   void initLinkerInitialized(Allocator *Instance) {
     Instance->initCache(&Cache);
     DestructorIterations = PTHREAD_DESTRUCTOR_ITERATIONS;
   }
   void init(Allocator *Instance) {
     memset(this, 0, sizeof(*this));
     initLinkerInitialized(Instance);
inline void lock() {
     atomic_store_relaxed(&Precedence, 0);
     Mutex.lock();
   }
   inline void unlock() { Mutex.unlock(); }
   inline uptr getPrecedence() { return atomic_load_relaxed(&Precedence); }
 
 private:
   HybridMutex Mutex;
-  atomic_uptr Precedence;
+  atomic_uptr Precedence = {};
 };
 
 } // namespace scudo
 
 #endif // SCUDO_TSD_H_

compiler-rt/lib/scudo/standalone/tsd_exclusive.h

if (UNLIKELY(MinimalInit))
       return;
     CHECK_EQ(
         pthread_setspecific(PThreadKey, reinterpret_cast<void *>(Instance)), 0);
     ThreadTSD.initLinkerInitialized(Instance);
     State.InitState = ThreadState::Initialized;
     Instance->callPostInitCallback();
   }
 
-  pthread_key_t PThreadKey;
-  bool Initialized;
-  atomic_u8 Disabled;
+  pthread_key_t PThreadKey = {};
+  bool Initialized = false;
+  atomic_u8 Disabled = {};
   TSD<Allocator> FallbackTSD;
   HybridMutex Mutex;
   static thread_local ThreadState State;
   static thread_local TSD<Allocator> ThreadTSD;
 
   friend void teardownThread<Allocator>(void *Ptr);
 };
 

compiler-rt/lib/scudo/standalone/wrappers_c.cpp

 #define SCUDO_PREFIX(name) name
 #define SCUDO_ALLOCATOR Allocator
 
 extern "C" void SCUDO_PREFIX(malloc_postinit)();
 
 // Export the static allocator so that the C++ wrappers can access it.
 // Technically we could have a completely separated heap for C & C++ but in
 // reality the amount of cross pollination between the two is staggering.
+SCUDO_REQUIRE_CONSTANT_INITIALIZATION
 scudo::Allocator<scudo::Config, SCUDO_PREFIX(malloc_postinit)> SCUDO_ALLOCATOR;
 
 #include "wrappers_c.inc"
 
 #undef SCUDO_ALLOCATOR
 #undef SCUDO_PREFIX
 
 extern "C" INTERFACE void __scudo_print_stats(void) { Allocator.printStats(); }
 
 #endif // !SCUDO_ANDROID || !_BIONIC

compiler-rt/lib/scudo/standalone/wrappers_c_bionic.cpp

 #include <stdint.h>
 #include <stdio.h>
 
 // Regular MallocDispatch definitions.
 #define SCUDO_PREFIX(name) CONCATENATE(scudo_, name)
 #define SCUDO_ALLOCATOR Allocator
 
 extern "C" void SCUDO_PREFIX(malloc_postinit)();
+SCUDO_REQUIRE_CONSTANT_INITIALIZATION
 static scudo::Allocator<scudo::AndroidConfig, SCUDO_PREFIX(malloc_postinit)>
     SCUDO_ALLOCATOR;
 
 #include "wrappers_c.inc"
 
 #undef SCUDO_ALLOCATOR
 #undef SCUDO_PREFIX
 
 // Svelte MallocDispatch definitions.
 #define SCUDO_PREFIX(name) CONCATENATE(scudo_svelte_, name)
 #define SCUDO_ALLOCATOR SvelteAllocator
 
 extern "C" void SCUDO_PREFIX(malloc_postinit)();
+SCUDO_REQUIRE_CONSTANT_INITIALIZATION
 static scudo::Allocator<scudo::AndroidSvelteConfig,
                         SCUDO_PREFIX(malloc_postinit)>
     SCUDO_ALLOCATOR;
 
 #include "wrappers_c.inc"
 
 #undef SCUDO_ALLOCATOR
 #undef SCUDO_PREFIX