[sanitizer] Do not introduce __sanitizer namespace globally

[zaks.anna]

Summary

The definitions in sanitizer_common may conflict with definitions from system headers because:

1. The runtime includes the system headers after the project headers (as per LLVM coding guidelines).
2. lib/sanitizer_common/sanitizer_internal_defs.h pollutes the namespace of everything defined after it, which is all/most of the sanitizer .h and .cc files and the included system headers with: using namespace __sanitizer; // NOLINT

This patch solves the problem by introducing the namespace only within the sanitizer namespaces as proposed by Dmitry.

(TODO: This needs to be tested on Linux since we do not build a few sanitizers on macOS. I'll probably have to do more cleanup once I test on Linux.)

[dvyukov]

looks good to me, but please wait several days in case somebody else wants to chime in

[zaks.anna]

I tested my earlier patch on Linux and needed to add a few more updates as many sanitizers are not available on a mac.

[zaks.anna]

Will wait a couple of days and commit if there are no more comments.

compiler-rt/trunk/lib/asan/asan_interface_internal.h

 #ifndef ASAN_INTERFACE_INTERNAL_H
 #define ASAN_INTERFACE_INTERNAL_H
 
 #include "sanitizer_common/sanitizer_internal_defs.h"
 
 #include "asan_init_version.h"
 
 using __sanitizer::uptr;
+using __sanitizer::u64;
+using __sanitizer::u32;
 
 extern "C" {
   // This function should be called at the very beginning of the process,
   // before any instrumented code is executed and before any call to malloc.
   SANITIZER_INTERFACE_ATTRIBUTE void __asan_init();
 
   // This function exists purely to get a linker/loader error when using
   // incompatible versions of instrumentation and runtime library. Please note

compiler-rt/trunk/lib/asan/tests/asan_noinst_test.cc

 #include <assert.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>  // for memset()
 #include <algorithm>
 #include <vector>
 #include <limits>
 
+using namespace __sanitizer;
+
 // ATTENTION!
 // Please don't call intercepted functions (including malloc() and friends)
 // in this test. The static runtime library is linked explicitly (without
 // -fsanitize=address), thus the interceptors do not work correctly on OS X.
 
 // Make sure __asan_init is called before any test case is run.
 struct AsanInitCaller {
   AsanInitCaller() {

compiler-rt/trunk/lib/cfi/cfi.cc

 #include "sanitizer_common/sanitizer_flag_parser.h"
 #include "ubsan/ubsan_init.h"
 #include "ubsan/ubsan_flags.h"
 
 #ifdef CFI_ENABLE_DIAG
 #include "ubsan/ubsan_handlers.h"
 #endif
 
+using namespace __sanitizer;
+
 namespace __cfi {
 
 #define kCfiShadowLimitsStorageSize 4096 // 1 page
 // Lets hope that the data segment is mapped with 4K pages.
 // The pointer to the cfi shadow region is stored at the start of this page.
 // The rest of the page is unused and re-mapped read-only.
 static union {
   char space[kCfiShadowLimitsStorageSize];

compiler-rt/trunk/lib/dfsan/dfsan.h

 //===----------------------------------------------------------------------===//
 
 #ifndef DFSAN_H
 #define DFSAN_H
 
 #include "sanitizer_common/sanitizer_internal_defs.h"
 #include "dfsan_platform.h"
 
+using __sanitizer::uptr;
+using __sanitizer::u16;
+
 // Copy declarations from public sanitizer/dfsan_interface.h header here.
 typedef u16 dfsan_label;
 
 struct dfsan_label_info {
   dfsan_label l1;
   dfsan_label l2;
   const char *desc;
   void *userdata;

compiler-rt/trunk/lib/dfsan/dfsan_interceptors.cc

 //
 // Interceptors for standard library functions.
 //===----------------------------------------------------------------------===//
 
 #include "dfsan/dfsan.h"
 #include "interception/interception.h"
 #include "sanitizer_common/sanitizer_common.h"
 
+using namespace __sanitizer;
+
 INTERCEPTOR(void *, mmap, void *addr, SIZE_T length, int prot, int flags,
             int fd, OFF_T offset) {
   void *res = REAL(mmap)(addr, length, prot, flags, fd, offset);
   if (res != (void*)-1)
     dfsan_set_label(0, res, RoundUpTo(length, GetPageSize()));
   return res;
 }
 

compiler-rt/trunk/lib/esan/esan_flags.cpp

 // Esan flag parsing logic.
 //===----------------------------------------------------------------------===//
 
 #include "esan_flags.h"
 #include "sanitizer_common/sanitizer_common.h"
 #include "sanitizer_common/sanitizer_flag_parser.h"
 #include "sanitizer_common/sanitizer_flags.h"
 
+using namespace __sanitizer;
+
 namespace __esan {
 
 static const char EsanOptsEnv[] = "ESAN_OPTIONS";
 
 Flags EsanFlagsDontUseDirectly;
 
 void Flags::setDefaults() {
 #define ESAN_FLAG(Type, Name, DefaultValue, Description) Name = DefaultValue;

compiler-rt/trunk/lib/esan/esan_interface_internal.h

 #ifndef ESAN_INTERFACE_INTERNAL_H
 #define ESAN_INTERFACE_INTERNAL_H
 
 #include <sanitizer_common/sanitizer_internal_defs.h>
 
 // This header should NOT include any other headers.
 // All functions in this header are extern "C" and start with __esan_.
 
+using __sanitizer::uptr;
+using __sanitizer::u32;
+
 extern "C" {
 
 // This should be kept consistent with LLVM's EfficiencySanitizerOptions.
 // The value is passed as a 32-bit integer by the compiler.
 typedef enum Type : u32 {
   ESAN_None = 0,
   ESAN_CacheFrag,
   ESAN_WorkingSet,

compiler-rt/trunk/lib/interception/interception.h

 // As it's decided at compile time which functions are to be intercepted on Mac,
 // INTERCEPT_FUNCTION() is effectively a no-op on this system.
 
 #if defined(__APPLE__)
 #include <sys/cdefs.h>  // For __DARWIN_ALIAS_C().
 
 // Just a pair of pointers.
 struct interpose_substitution {
-  const uptr replacement;
-  const uptr original;
+  const __sanitizer::uptr replacement;
+  const __sanitizer::uptr original;
 };
 
 // For a function foo() create a global pair of pointers { wrap_foo, foo } in
 // the __DATA,__interpose section.
 // As a result all the calls to foo() will be routed to wrap_foo() at runtime.
 #define INTERPOSER(func_name) __attribute__((used)) \
 const interpose_substitution substitution_##func_name[] \
     __attribute__((section("__DATA, __interpose"))) = { \

compiler-rt/trunk/lib/msan/msan_interface_internal.h

 void __msan_warning();
 
 // Print a warning and die.
 // Intrumentation inserts calls to this function when building in "fast" mode
 // (i.e. -mllvm -msan-keep-going)
 SANITIZER_INTERFACE_ATTRIBUTE __attribute__((noreturn))
 void __msan_warning_noreturn();
 
+using __sanitizer::uptr;
+using __sanitizer::sptr;
+using __sanitizer::uu64;
+using __sanitizer::uu32;
+using __sanitizer::uu16;
+using __sanitizer::u64;
+using __sanitizer::u32;
+using __sanitizer::u16;
+using __sanitizer::u8;
+
 SANITIZER_INTERFACE_ATTRIBUTE
 void __msan_maybe_warning_1(u8 s, u32 o);
 SANITIZER_INTERFACE_ATTRIBUTE
 void __msan_maybe_warning_2(u16 s, u32 o);
 SANITIZER_INTERFACE_ATTRIBUTE
 void __msan_maybe_warning_4(u32 s, u32 o);
 SANITIZER_INTERFACE_ATTRIBUTE
 void __msan_maybe_warning_8(u64 s, u32 o);

compiler-rt/trunk/lib/safestack/safestack.cc

 }
 
 // Per-thread unsafe stack information. It's not frequently accessed, so there
 // it can be kept out of the tcb in normal thread-local variables.
 static __thread void *unsafe_stack_start = nullptr;
 static __thread size_t unsafe_stack_size = 0;
 static __thread size_t unsafe_stack_guard = 0;
 
+using namespace __sanitizer;
+
 static inline void *unsafe_stack_alloc(size_t size, size_t guard) {
   CHECK_GE(size + guard, size);
   void *addr = MmapOrDie(size + guard, "unsafe_stack_alloc");
   MprotectNoAccess((uptr)addr, (uptr)guard);
   return (char *)addr + guard;
 }
 
 static inline void unsafe_stack_setup(void *start, size_t size, size_t guard) {

compiler-rt/trunk/lib/sanitizer_common/sanitizer_allocator_internal.h

 
 enum InternalAllocEnum {
   INTERNAL_ALLOC
 };
 
 } // namespace __sanitizer
 
 inline void *operator new(__sanitizer::operator_new_size_type size,
-                          InternalAllocEnum) {
-  return InternalAlloc(size);
+                          __sanitizer::InternalAllocEnum) {
+  return __sanitizer::InternalAlloc(size);
 }
 
 #endif // SANITIZER_ALLOCATOR_INTERNAL_H

compiler-rt/trunk/lib/sanitizer_common/sanitizer_common.h

 // to do).  This function will abort the process if running on a kernel
 // that looks vulnerable.
 #if SANITIZER_LINUX && SANITIZER_S390_64
 void AvoidCVE_2016_2143();
 #else
 INLINE void AvoidCVE_2016_2143() {}
 #endif
 
+struct StackDepotStats {
+  uptr n_uniq_ids;
+  uptr allocated;
+};
+
 }  // namespace __sanitizer
 
 inline void *operator new(__sanitizer::operator_new_size_type size,
                           __sanitizer::LowLevelAllocator &alloc) {
   return alloc.Allocate(size);
 }
 
-struct StackDepotStats {
-  uptr n_uniq_ids;
-  uptr allocated;
-};
-
 #endif  // SANITIZER_COMMON_H

compiler-rt/trunk/lib/sanitizer_common/sanitizer_common_libcdep.cc

#if SANITIZER_LINUX && \
   internal_start_thread(BackgroundThread, nullptr);
 #endif
 }
 
 }  // namespace __sanitizer
 
 void NOINLINE
 __sanitizer_sandbox_on_notify(__sanitizer_sandbox_arguments *args) {
-  PrepareForSandboxing(args);
-  if (sandboxing_callback)
-    sandboxing_callback();
+  __sanitizer::PrepareForSandboxing(args);
+  if (__sanitizer::sandboxing_callback)
+    __sanitizer::sandboxing_callback();
 }

compiler-rt/trunk/lib/sanitizer_common/sanitizer_coverage_libcdep.cc

 #include "sanitizer_common.h"
 #include "sanitizer_libc.h"
 #include "sanitizer_mutex.h"
 #include "sanitizer_procmaps.h"
 #include "sanitizer_stacktrace.h"
 #include "sanitizer_symbolizer.h"
 #include "sanitizer_flags.h"
 
+using namespace __sanitizer;
+
 static const u64 kMagic64 = 0xC0BFFFFFFFFFFF64ULL;
 static const u64 kMagic32 = 0xC0BFFFFFFFFFFF32ULL;
 static const uptr kNumWordsForMagic = SANITIZER_WORDSIZE == 64 ? 1 : 2;
 static const u64 kMagic = SANITIZER_WORDSIZE == 64 ? kMagic64 : kMagic32;
 
 static atomic_uint32_t dump_once_guard;  // Ensure that CovDump runs only once.
 
 static atomic_uintptr_t coverage_counter;

compiler-rt/trunk/lib/sanitizer_common/sanitizer_internal_defs.h

#define ENABLE_FRAME_POINTER                                       \
   do {                                                             \
     volatile uptr enable_fp;                                       \
     enable_fp = GET_CURRENT_FRAME();                               \
     (void)enable_fp;                                               \
   } while (0)
 
 }  // namespace __sanitizer
 
-using namespace __sanitizer;  // NOLINT
+namespace __asan  { using namespace __sanitizer; }  // NOLINT
+namespace __dsan  { using namespace __sanitizer; }  // NOLINT
+namespace __dfsan { using namespace __sanitizer; }  // NOLINT
+namespace __esan  { using namespace __sanitizer; }  // NOLINT
+namespace __lsan  { using namespace __sanitizer; }  // NOLINT
+namespace __msan  { using namespace __sanitizer; }  // NOLINT
+namespace __tsan  { using namespace __sanitizer; }  // NOLINT
+namespace __scudo { using namespace __sanitizer; }  // NOLINT
+namespace __ubsan { using namespace __sanitizer; }  // NOLINT
+namespace __xray  { using namespace __sanitizer; }  // NOLINT
+namespace __interception  { using namespace __sanitizer; }  // NOLINT
+
 
 #endif  // SANITIZER_DEFS_H

compiler-rt/trunk/lib/sanitizer_common/sanitizer_mac.h

 
 MacosVersion GetMacosVersion();
 
 char **GetEnviron();
 
 }  // namespace __sanitizer
 
 extern "C" {
-static char __crashreporter_info_buff__[kErrorMessageBufferSize] = {};
+static char __crashreporter_info_buff__[__sanitizer::kErrorMessageBufferSize] =
+  {};
 static const char *__crashreporter_info__ __attribute__((__used__)) =
   &__crashreporter_info_buff__[0];
 asm(".desc ___crashreporter_info__, 0x10");
 } // extern "C"
+
+namespace __sanitizer {
 static BlockingMutex crashreporter_info_mutex(LINKER_INITIALIZED);
 
 INLINE void CRAppendCrashLogMessage(const char *msg) {
   BlockingMutexLock l(&crashreporter_info_mutex);
   internal_strlcat(__crashreporter_info_buff__, msg,
                    sizeof(__crashreporter_info_buff__)); }
+}  // namespace __sanitizer
 
 #endif  // SANITIZER_MAC
 #endif  // SANITIZER_MAC_H

compiler-rt/trunk/lib/sanitizer_common/sanitizer_platform_limits_linux.cc

 
 #include <linux/aio_abi.h>
 
 #if !SANITIZER_ANDROID
 #include <sys/statfs.h>
 #include <linux/perf_event.h>
 #endif
 
+using namespace __sanitizer;
+
 namespace __sanitizer {
 #if !SANITIZER_ANDROID
   unsigned struct_statfs64_sz = sizeof(struct statfs64);
 #endif
 }  // namespace __sanitizer
 
 #if !defined(__powerpc64__) && !defined(__x86_64__) && !defined(__aarch64__)\
                             && !defined(__mips__) && !defined(__s390__)

compiler-rt/trunk/lib/sanitizer_common/sanitizer_platform_limits_posix.cc

 #else
   const int errno_EOWNERDEAD = -1;
 #endif
 
   const int si_SEGV_MAPERR = SEGV_MAPERR;
   const int si_SEGV_ACCERR = SEGV_ACCERR;
 } // namespace __sanitizer
 
+using namespace __sanitizer;
+
 COMPILER_CHECK(sizeof(__sanitizer_pthread_attr_t) >= sizeof(pthread_attr_t));
 
 COMPILER_CHECK(sizeof(socklen_t) == sizeof(unsigned));
 CHECK_TYPE_SIZE(pthread_key_t);
 
 #if SANITIZER_LINUX
 // FIXME: We define those on Linux and Mac, but only check on Linux.
 COMPILER_CHECK(IOC_NRBITS == _IOC_NRBITS);

compiler-rt/trunk/lib/sanitizer_common/sanitizer_stacktrace_libcdep.cc

#endif
   } else {
     FastUnwindStack(pc, bp, stack_top, stack_bottom, max_depth);
   }
 }
 
 }  // namespace __sanitizer
 
 extern "C" {
-SANITIZER_INTERFACE_ATTRIBUTE
-void __sanitizer_symbolize_pc(uptr pc, const char *fmt, char *out_buf,
-                              uptr out_buf_size) {
+void __sanitizer_symbolize_pc(__sanitizer::uptr pc,
+                              const char *fmt, char *out_buf,
+                              __sanitizer::uptr out_buf_size) {
   if (!out_buf_size) return;
   using namespace __sanitizer;
   pc = StackTrace::GetPreviousInstructionPc(pc);
   SymbolizedStack *frame = Symbolizer::GetOrInit()->SymbolizePC(pc);
   if (!frame) {
     internal_strncpy(out_buf, "<can't symbolize>", out_buf_size);
     out_buf[out_buf_size - 1] = 0;
     return;

compiler-rt/trunk/lib/sanitizer_common/sanitizer_stoptheworld_linux_libcdep.cc

 // are two reasons for this:
 // 1. calling a library function while threads are suspended could cause a
 // deadlock, if one of the treads happens to be holding a libc lock;
 // 2. it's generally not safe to call libc functions from the tracer task,
 // because clone() does not set up a thread-local storage for it. Any
 // thread-local variables used by libc will be shared between the tracer task
 // and the thread which spawned it.
 
-COMPILER_CHECK(sizeof(SuspendedThreadID) == sizeof(pid_t));
-
 namespace __sanitizer {
 
+COMPILER_CHECK(sizeof(SuspendedThreadID) == sizeof(pid_t));
+
 // Structure for passing arguments into the tracer thread.
 struct TracerThreadArgument {
   StopTheWorldCallback callback;
   void *callback_argument;
   // The tracer thread waits on this mutex while the parent finishes its
   // preparations.
   BlockingMutex mutex;
   // Tracer thread signals its completion by setting done.

compiler-rt/trunk/lib/sanitizer_common/tests/sanitizer_allocator_test.cc

 
 #include "gtest/gtest.h"
 
 #include <stdlib.h>
 #include <algorithm>
 #include <vector>
 #include <set>
 
+using namespace __sanitizer;
+
 // Too slow for debug build
 #if !SANITIZER_DEBUG
 
 #if SANITIZER_CAN_USE_ALLOCATOR64
 #if SANITIZER_WINDOWS
 // On Windows 64-bit there is no easy way to find a large enough fixed address
 // space that is always available. Thus, a dynamically allocated address space
 // is used instead (i.e. ~(uptr)0).

compiler-rt/trunk/lib/sanitizer_common/tests/sanitizer_libc_test.cc

 #include <windows.h>
 #undef NOMINMAX
 #endif
 #if SANITIZER_POSIX
 # include <sys/stat.h>
 # include "sanitizer_common/sanitizer_posix.h"
 #endif
 
+using namespace __sanitizer;
+
 // A regression test for internal_memmove() implementation.
 TEST(SanitizerCommon, InternalMemmoveRegression) {
   char src[] = "Hello World";
   char *dest = src + 6;
   __sanitizer::internal_memmove(dest, src, 5);
   EXPECT_EQ(dest[0], src[0]);
   EXPECT_EQ(dest[4], src[4]);
 }

compiler-rt/trunk/lib/sanitizer_common/tests/sanitizer_nolibc_test_main.cc

 // This file is a part of ThreadSanitizer/AddressSanitizer runtime.
 // Tests for libc independence of sanitizer_common.
 //
 //===----------------------------------------------------------------------===//
 
 #include "sanitizer_common/sanitizer_libc.h"
 
 extern "C" void _start() {
-  internal__exit(0);
+  __sanitizer::internal__exit(0);
 }

compiler-rt/trunk/lib/sanitizer_common/tests/sanitizer_test_main.cc

 #include "sanitizer_common/sanitizer_flags.h"
 
 const char *argv0;
 
 int main(int argc, char **argv) {
   argv0 = argv[0];
   testing::GTEST_FLAG(death_test_style) = "threadsafe";
   testing::InitGoogleTest(&argc, argv);
-  SetCommonFlagsDefaults();
+  __sanitizer::SetCommonFlagsDefaults();
   return RUN_ALL_TESTS();
 }

compiler-rt/trunk/lib/tsan/rtl/tsan_interface.h

 // The functions declared in this header will be inserted by the instrumentation
 // module.
 // This header can be included by the instrumented program or by TSan tests.
 //===----------------------------------------------------------------------===//
 #ifndef TSAN_INTERFACE_H
 #define TSAN_INTERFACE_H
 
 #include <sanitizer_common/sanitizer_internal_defs.h>
+using __sanitizer::uptr;
 
 // This header should NOT include any other headers.
 // All functions in this header are extern "C" and start with __tsan_.
 
 #ifdef __cplusplus
 extern "C" {
 #endif
 

compiler-rt/trunk/lib/ubsan/ubsan_type_hash_itanium.cc

public:
   unsigned int base_count;
   __base_class_type_info base_info[1];
 };
 
 }
 
 namespace abi = __cxxabiv1;
 
+using namespace __sanitizer;
+
 // We implement a simple two-level cache for type-checking results. For each
 // (vptr,type) pair, a hash is computed. This hash is assumed to be globally
 // unique; if it collides, we will get false negatives, but:
 //  * such a collision would have to occur on the *first* bad access,
 //  * the probability of such a collision is low (and for a 64-bit target, is
 //    negligible), and
 //  * the vptr, and thus the hash, can be affected by ASLR, so multiple runs
 //    give better coverage.

compiler-rt/trunk/lib/xray/xray_init.cc

 #include "xray_interface_internal.h"
 
 extern "C" {
 void __xray_init();
 extern const XRaySledEntry __start_xray_instr_map[] __attribute__((weak));
 extern const XRaySledEntry __stop_xray_instr_map[] __attribute__((weak));
 }
 
+using namespace __sanitizer;
 using namespace __xray;
 
 // When set to 'true' this means the XRay runtime has been initialised. We use
 // the weak symbols defined above (__start_xray_inst_map and
 // __stop_xray_instr_map) to initialise the instrumentation map that XRay uses
 // for runtime patching/unpatching of instrumentation points.
 //
 // FIXME: Support DSO instrumentation maps too. The current solution only works