build: propagate ASAN/TSAN flags down to cmake_external deps.

.bazelrc

@@ -23,6 +23,12 @@ build:asan --copt -DADDRESS_SANITIZER=1
 build:asan --copt -D__SANITIZE_ADDRESS__
 build:asan --test_env=ASAN_OPTIONS=handle_abort=1:allow_addr2line=true:check_initialization_order=true:strict_init_order=true
 build:asan --test_env=ASAN_SYMBOLIZER_PATH
+# TODO(htuch): these are temporary workarounds, remove when
+# https://github.com/bazelbuild/rules_foreign_cc/issues/154#issuecomment-466504751 is resolved.
+build:asan --action_env=CC
+build:asan --action_env=CXX
+build:asan --action_env=CFLAGS="-fsanitize=address,undefined -fno-sanitize=vptr"
+build:asan --action_env=CXXFLAGS="-fsanitize=address,undefined -fno-sanitize=vptr"
 
 # Clang ASAN/UBSAN
 build:clang-asan --config=asan
@@ -36,8 +42,16 @@ build:macos-asan --copt -D_FORTIFY_SOURCE=0
 # Clang TSAN
 build:clang-tsan --define ENVOY_CONFIG_TSAN=1
 build:clang-tsan --copt -fsanitize=thread
+# This is needed because of https://github.com/libevent/libevent/issues/777
+build:clang-tsan --copt -DEVENT__DISABLE_DEBUG_MODE
 build:clang-tsan --linkopt -fsanitize=thread
 build:clang-tsan --define tcmalloc=disabled
+# TODO(htuch): these are temporary workarounds, remove when
+# https://github.com/bazelbuild/rules_foreign_cc/issues/154#issuecomment-466504751 is resolved.
+build:clang-tsan --action_env=CC
+build:clang-tsan --action_env=CXX
+build:clang-tsan --action_env=CFLAGS="-fsanitize=thread -DEVENT__DISABLE_DEBUG_MODE"
+build:clang-tsan --action_env=CXXFLAGS="-fsanitize=thread"
 
 # Clang MSAN - broken today since we need to rebuild lib[std]c++ and external deps with MSAN
 # support (see https://github.com/envoyproxy/envoy/issues/443).

bazel/foreign_cc/luajit.patch

@@ -48,7 +48,7 @@ new file mode 100755
 index 0000000..9c71271
 --- /dev/null
 +++ b/build.py
-@@ -0,0 +1,28 @@
+@@ -0,0 +1,34 @@
 +#!/usr/bin/env python
 +
 +import argparse
@@ -73,6 +73,12 @@ index 0000000..9c71271
 +    # fail on it.
 +    os.environ["LSAN_OPTIONS"] = "exitcode=0"
 +
++    # Blacklist LuaJIT from ASAN for now.
++    # TODO(htuch): Remove this when https://github.com/envoyproxy/envoy/issues/6084 is resolved.
++    with open("clang-asan-blacklist.txt", "w") as f:
++      f.write("fun:lj_*\n")
++    os.environ["TARGET_CFLAGS"] += " -fsanitize-blacklist=%s/com_github_luajit_luajit/clang-asan-blacklist.txt" % os.environ["PWD"]
++
 +    os.system('make V=1 PREFIX="{}" install'.format(args.prefix))
 +
 +main()

ci/build_setup.sh

@@ -17,7 +17,6 @@ function setup_gcc_toolchain() {
 }
 
 function setup_clang_toolchain() {
-  export PATH=/usr/lib/llvm-7/bin:$PATH
   export CC=clang
   export CXX=clang++
   export ASAN_SYMBOLIZER_PATH=/usr/lib/llvm-7/bin/llvm-symbolizer
@@ -64,7 +63,8 @@ if [[ -f "/etc/redhat-release" ]]
 then
   export BAZEL_BUILD_EXTRA_OPTIONS="--copt=-DENVOY_IGNORE_GLIBCXX_USE_CXX11_ABI_ERROR=1 --action_env=PATH ${BAZEL_BUILD_EXTRA_OPTIONS}"
 else
-  export BAZEL_BUILD_EXTRA_OPTIONS="--action_env=PATH=/bin:/usr/bin:/usr/lib/llvm-7/bin --linkopt=-fuse-ld=lld ${BAZEL_BUILD_EXTRA_OPTIONS}"
+  export BAZEL_BUILD_EXTRA_OPTIONS="--action_env=PATH=/bin:/usr/bin:/usr/lib/llvm-7/bin --linkopt=-fuse-ld=lld --host_linkopt=-fuse-ld=lld ${BAZEL_BUILD_EXTRA_OPTIONS}"
+  export PATH=/usr/lib/llvm-7/bin:$PATH
 fi
 
 # Not sandboxing, since non-privileged Docker can't do nested namespaces.