lgtm with comment added

I don't think this is warranted. There should not be any references to such things when building for Fuchsia.
This looks like it's intended to satisfy one reference in dead code in hwasan_interceptors.cpp.
I think the right solution is just to refactor the hwasan code so that the dead code is not compiled for Fuchsia at all.

lgtm

I think this clearly the correct semantics. The whole purpose of groups really is for GC and de-dup behavior. The "automatic" anchor semantics for identifier-named sections clearly only makes sense for sections outside groups where there is no other way to tell if they are meant to be referenced. When such a section is in a group, it clearly is meant to go with the symbol-referenced entities defined in the group (i.e. the function or data object whose symbol is the group's signature symbol in the COMDAT case). Group semantics require that the whole group be kept or discarded together, so if an identifier-named section within a group were always kept, then that whole group must always be kept--keeping the identifier named sections while discarding others in the same group would clearly be a bug by the spec. Keeping the whole group because of the identifier-named section inside it is clearly not correct for GC or COMDAT cases.

In D95919#2539790, @charco wrote:

Ah! It is already in the VDSO! I thought it was a regular system call, my bad. Fuchsia should probably document that.

remove obsolete #include

In D95919#2538591, @charco wrote:

The CL seems fine, but should we use sanitizer_common's GetPageSizeCached()[0] where we call GetPageSize() ? Fuchsia documentation indicates that it's OK for user apps to cache that value.

lgtm. typo in the commit message: "additional"

lgtm. I think it should only fail if the VMAR handle is bad or doesn't have WRITE rights or if the address range includes non-writable mappings. I think panic is desirable for those cases.

lgtm.
btw, I think fx test --count will do that for you.

I am also a C++ programmer working on C++ ABI support. I'm glad to be working on a platform that made many intentional design decisions to enable keeping the C++ ABI out of the platform ABI. It makes it vastly easier to do interesting work on C++ ABIs such as what Leo is doing. It also makes it significantly easier to do interesting work on platform ABIs, which I also do.

The Fuchsia platform ABI includes the SS & SCS ABI. There is no compatibility issue with those. PIC-friendly optimizations are purely an optimization and correctness issue for any PIC/PIE code, and is not an ABI issue.
The only thing where we have an incompatible difference in ABI between our compiler environments is the C++ ABI.

Many backends generate PIC-friendly jump tables. This is about generating IR initializers that translate to the same kind of backend assembly expressions as those backends use for their jump tables.

That plan sounds good to me. There is no way to fold #undef into a macro, so you can't avoid a little bit of boilerplate unless you generate the source code.

You've said you want to avoid expressing the C++ ABI as a generic switch orthogonal to target because people can use it when it's not what they actually want or isn't actually useful to attempt. This is true of all switches affecting ABI and they haven't all been rejected on this basis. But fine, consistency is the hobgoblin of small minds. If the concern there is either user confusion or support burden for configurations nobody wants to test, then both of those are easily addressed by having -fc++abi= constrain the settings it allows based on target. For Fuchsia targets, we want to maintain and test both "fuchsia" and "compat" (or "itanium") modes. If for other targets the only setting allowed is the one that's the default, or if using non-default settings generates a scare warning or suchlike, that's fine. That seems to be the natural way to constrain the explicit control of the C++ ABI to the supported cases, while not conflating control of the C++ ABI with the language-independent platform ABI being targeted.

It's fine to have a target tuple translate to a default C++ ABI.
But the C++ ABI selection is fundamentally not a target flavor thing. It's just a C++ ABI thing.
So using the target tuple as the sole mechanism to determine C++ ABI is fundamentally wrong.

lgtm

lgtm

In D92415#2426531, @hctim wrote:

In D92415#2426397, @mcgrathr wrote:

I'm troubled in two ways.

1. If this test is polluted by global (TLS) state from prior tests, that seems like a non-hermeticity problem for all these tests. Should we maybe be using a test fixture with SetUp/TearDown to wipe the global state between tests?

In other environments (both for upstream testing and Android) we run this test in isolation to avoid this problem.

I'm troubled in two ways.

1. If this test is polluted by global (TLS) state from prior tests, that seems like a non-hermeticity problem for all these tests. Should we maybe be using a test fixture with SetUp/TearDown to wipe the global state between tests?
2. It seems like the code under test actually has semantics that when uninitialized, it will sometimes sample (just rarely). That seems like a problem to me. If the initialized state as configured by the environment will be to never do a gwp allocation, then there should never be a window where one is randomly allowed to happen.

lgtm

updated macro

macro nit

style nit

In D91463#2395332, @hctim wrote:

I'm not sure adding this complexity here is warranted, why is -DGWP_ASAN_DEFAULT_ENABLED=false better than -DSCUDO_DEFAULT_OPTIONS=GWP_ASAN_Enabled=false?

The GCC documentation specifically gives the example of the standard C function qsort as one that does not qualify as __attribute__((leaf)) because it uses a callback function (that presumably might be from the caller's own TU). AIUI the claim the attribute makes is that no normal control flow (i.e. excluding only signal handlers) would call any function in the caller's TU by any means, nor longjmp to any state captured by a setjmp call in the caller's TU, and thus only normal return or normal C++ exception handling return/unwind would reach the caller's TU again after the jump (call) to this entry point. The caller is thus presumed not to share potentially-called functions with the callee by any means, whether direct symbol references or function pointers passed in the call or function pointers previously stored somewhere (e.g. a C++ vtable). The compiler can make whatever assumptions about potential dataflow/side-effect and the like are implied by this exclusion of TU-local code paths from the otherwise unknown call graph of the external call.

lgtm

LGTM with a few minor changes.
Thanks!

lgtm

There is an RFC going out with this prototype as reference. When there is consensus on the RFC, this will get in shape for landing with complete tests and all.

I already approved this as is. I just think it's dead code.

I think NanoTime is actually not reached at all. We can probably remove it.

This is fine. If we wanted to avoid wider use of _zx_utc_reference_get, I think it would also be fine for this one call to use the C11 timespec_get API rather than a pure Zircon API.

This is fine as is but there's really no need to carefully pack it into a uint64_t. It would be fine for Fuchsia's special header to have to meet some less trivial API. The main complexity there would be just figuring out the header arrangement so that Fuchsia's header could #include something to define the types it's supposed to use. But AFAICT it doesn't really need to be in guarded_pool_allocator.h like this. That generic header could just declare static ThreadLocalPackedVariables *getThreadLocals();. Then the platform header can provide the inline defn outside the class scope, and that header only needs to be used in guarded_pool_allocator.cpp itself.

Thanks!

LGTM. Different names and more comments would be preferable.

I don't really understand why the whole "lazy" logic exists. I can't tell what case it would ever be used in as the code stands. Every thread will pass through ASanThread::Init before it would ever just call fake_stack() and hit the "lazy" case. Is it intended that one could set __asan_option_detect_stack_use_after_return to false (either from startup or explicitly clear it), then create a thread, then set the flag explicitly on later?

Thanks for the fix!

LGTM. The section ordering details are conventional but not supposed to be semantically meaningful anyway.