[llvm][clang] Enable IO sandbox for assert builds by jansvoboda11 · Pull Request #171935 · llvm/llvm-project

jansvoboda11 · 2025-12-12T00:04:43Z

This PR enables the IO sandbox for supported tools (currently clang -cc1 and clang -cc1as) in assert builds. More details are in the RFC here: https://discourse.llvm.org/t/rfc-file-system-sandboxing-in-clang-llvm/88791

llvm-ci · 2025-12-16T16:45:21Z

LLVM Buildbot has detected a new failure on builder lldb-aarch64-windows running on linaro-armv8-windows-msvc-05 while building llvm at step 6 "test".

Full details are available at: https://lab.llvm.org/buildbot/#/builders/141/builds/13734

Here is the relevant piece of the build log for the reference

Step 6 (test) failure: build (failure)
...
PASS: lldb-api :: python_api/disassemble-raw-data/TestDisassemble_VST1_64.py (1117 of 2388)
UNSUPPORTED: lldb-api :: python_api/event/TestEvents.py (1118 of 2388)
UNSUPPORTED: lldb-api :: python_api/exprpath_synthetic/TestExprPathSynthetic.py (1119 of 2388)
PASS: lldb-api :: python_api/file_handle/TestFileHandle.py (1120 of 2388)
PASS: lldb-api :: python_api/exprpath_register/TestExprPathRegisters.py (1121 of 2388)
PASS: lldb-api :: python_api/find_in_memory/TestFindInMemory.py (1122 of 2388)
PASS: lldb-api :: python_api/findvalue_duplist/TestSBFrameFindValue.py (1123 of 2388)
PASS: lldb-api :: python_api/format/TestFormat.py (1124 of 2388)
PASS: lldb-api :: python_api/find_in_memory/TestFindRangesInMemory.py (1125 of 2388)
PASS: lldb-api :: python_api/formatters/TestFormattersSBAPI.py (1126 of 2388)
FAIL: lldb-api :: python_api/frame/TestFrames.py (1127 of 2388)
******************** TEST 'lldb-api :: python_api/frame/TestFrames.py' FAILED ********************
Script:
--
C:/Users/tcwg/scoop/apps/python/current/python.exe C:/Users/tcwg/llvm-worker/lldb-aarch64-windows/llvm-project/lldb\test\API\dotest.py -u CXXFLAGS -u CFLAGS --env LLVM_LIBS_DIR=C:/Users/tcwg/llvm-worker/lldb-aarch64-windows/build/./lib --env LLVM_INCLUDE_DIR=C:/Users/tcwg/llvm-worker/lldb-aarch64-windows/build/include --env LLVM_TOOLS_DIR=C:/Users/tcwg/llvm-worker/lldb-aarch64-windows/build/./bin --arch aarch64 --build-dir C:/Users/tcwg/llvm-worker/lldb-aarch64-windows/build/lldb-test-build.noindex --lldb-module-cache-dir C:/Users/tcwg/llvm-worker/lldb-aarch64-windows/build/lldb-test-build.noindex/module-cache-lldb\lldb-api --clang-module-cache-dir C:/Users/tcwg/llvm-worker/lldb-aarch64-windows/build/lldb-test-build.noindex/module-cache-clang\lldb-api --executable C:/Users/tcwg/llvm-worker/lldb-aarch64-windows/build/./bin/lldb.exe --compiler C:/Users/tcwg/llvm-worker/lldb-aarch64-windows/build/./bin/clang.exe --dsymutil C:/Users/tcwg/llvm-worker/lldb-aarch64-windows/build/./bin/dsymutil.exe --make C:/Users/tcwg/scoop/shims/make.exe --llvm-tools-dir C:/Users/tcwg/llvm-worker/lldb-aarch64-windows/build/./bin --lldb-obj-root C:/Users/tcwg/llvm-worker/lldb-aarch64-windows/build/tools/lldb --lldb-libs-dir C:/Users/tcwg/llvm-worker/lldb-aarch64-windows/build/./lib --cmake-build-type Release --skip-category=watchpoint C:\Users\tcwg\llvm-worker\lldb-aarch64-windows\llvm-project\lldb\test\API\python_api\frame -p TestFrames.py
--
Exit Code: 1

Command Output (stdout):
--
lldb version 22.0.0git (https://github.com/llvm/llvm-project.git revision f83de973a5daab2181442071d34758a0b413b6f2)
  clang revision f83de973a5daab2181442071d34758a0b413b6f2
  llvm revision f83de973a5daab2181442071d34758a0b413b6f2
a(val=1, ch='A')

b(val=2, ch='B')

c(val=3, ch='C')

a(1, 'A') returns 73

b(val=2, ch='B')

c(val=3, ch='C')

b(2, 'B') returns 73

a(val=3, ch='A')

c(val=4, ch='B')

a(3, 'A') returns 73

Skipping the following test categories: watchpoint, libc++, libstdcxx, dwo, dsym, gmodules, debugserver, objc, fork, pexpect


--
Command Output (stderr):
--

The flag was recently [1] enabled by default in asserts builds, breaking some of our plugin tests (see bug). Turn it off until those are fixed. [1] llvm/llvm-project#171935 Bug: 469485810 Change-Id: I1adc410a3fad0f7b93f4488338ae29fd2782c5e4 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7269105 Reviewed-by: Nico Weber <thakis@chromium.org> Auto-Submit: Hans Wennborg <hans@chromium.org> Commit-Queue: Nico Weber <thakis@chromium.org> Cr-Commit-Position: refs/heads/main@{#1559863}

nathanchance · 2025-12-18T06:19:40Z

I am seeing a violation with -flto=thin after this change when building the Linux kernel.

configs.i.txt
config_data.gz

$ clang --target=aarch64-linux-gnu -flto=thin -c -o /dev/null configs.i
...
fatal error: error in backend: IO sandbox violation
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0.	Program arguments: clang --target=aarch64-linux-gnu -flto=thin -c -o /dev/null configs.i
1.	<eof> parser at end of file
2.	Optimizer
3.	Running pass "ThinLTOBitcodeWriterPass" on module "kernel/configs.c"
 #0 0x0000561f8c44e548 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (clang-22+0x5f02548)
 #1 0x0000561f8c44bc91 llvm::sys::RunSignalHandlers() (clang-22+0x5effc91)
 #2 0x0000561f8c44d91c llvm::sys::CleanupOnSignal(unsigned long) (clang-22+0x5f0191c)
 #3 0x0000561f8c3cc4b7 (anonymous namespace)::CrashRecoveryContextImpl::HandleCrash(int, unsigned long) CrashRecoveryContext.cpp:0:0
 #4 0x0000561f8c3cc44f llvm::CrashRecoveryContext::HandleExit(int) (clang-22+0x5e8044f)
 #5 0x0000561f8c448707 llvm::sys::Process::Exit(int, bool) (clang-22+0x5efc707)
 #6 0x0000561f8a2e5296 (clang-22+0x3d99296)
 #7 0x0000561f8c3d34a6 llvm::report_fatal_error(llvm::Twine const&, bool) (clang-22+0x5e874a6)
 #8 0x0000561f8c3d3396 (clang-22+0x5e87396)
 #9 0x0000561f8c3d363b (clang-22+0x5e8763b)
#10 0x0000561f8c3eb506 (clang-22+0x5e9f506)
#11 0x0000561f8c3f33b6 llvm::SourceMgr::OpenIncludeFile(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>&) (clang-22+0x5ea73b6)
#12 0x0000561f8c3f329d llvm::SourceMgr::AddIncludeFile(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, llvm::SMLoc, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>&) (clang-22+0x5ea729d)
#13 0x0000561f8c212692 (anonymous namespace)::AsmParser::parseDirectiveIncbin() AsmParser.cpp:0:0
#14 0x0000561f8c20ecb7 (anonymous namespace)::AsmParser::parseStatement((anonymous namespace)::ParseStatementInfo&, llvm::MCAsmParserSemaCallback*) AsmParser.cpp:0:0
#15 0x0000561f8c207af1 (anonymous namespace)::AsmParser::Run(bool, bool) AsmParser.cpp:0:0
#16 0x0000561f8f65f25c initializeRecordStreamer(llvm::Module const&, llvm::function_ref<void (llvm::RecordStreamer&)>) ModuleSymbolTable.cpp:0:0
#17 0x0000561f8f65edc5 llvm::ModuleSymbolTable::CollectAsmSymbols(llvm::Module const&, llvm::function_ref<void (llvm::StringRef, llvm::object::BasicSymbolRef::Flags)>) (clang-22+0x9112dc5)
#18 0x0000561f8b75120c llvm::buildModuleSummaryIndex(llvm::Module const&, std::function<llvm::BlockFrequencyInfo* (llvm::Function const&)>, llvm::ProfileSummaryInfo*, std::function<llvm::StackSafetyInfo const* (llvm::Function const&)>) (clang-22+0x520520c)
#19 0x0000561f8b758ea4 llvm::ModuleSummaryIndexAnalysis::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (clang-22+0x520cea4)
#20 0x0000561f8d4aea12 llvm::detail::AnalysisPassModel<llvm::Module, llvm::ModuleSummaryIndexAnalysis, llvm::AnalysisManager<llvm::Module>::Invalidator>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) PassBuilder.cpp:0:0
#21 0x0000561f8bf7366f llvm::AnalysisManager<llvm::Module>::getResultImpl(llvm::AnalysisKey*, llvm::Module&) (clang-22+0x5a2766f)
#22 0x0000561f8ccd145e llvm::ThinLTOBitcodeWriterPass::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (clang-22+0x678545e)
#23 0x0000561f8bf71bc7 llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (clang-22+0x5a25bc7)
#24 0x0000561f8cbd2f1e (anonymous namespace)::EmitAssemblyHelper::RunOptimizationPipeline(clang::BackendAction, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream>>&, std::unique_ptr<llvm::ToolOutputFile, std::default_delete<llvm::ToolOutputFile>>&, clang::BackendConsumer*) BackendUtil.cpp:0:0
#25 0x0000561f8cbc8c52 clang::emitBackendOutput(clang::CompilerInstance&, clang::CodeGenOptions&, llvm::StringRef, llvm::Module*, clang::BackendAction, llvm::IntrusiveRefCntPtr<llvm::vfs::FileSystem>, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream>>, clang::BackendConsumer*) (clang-22+0x667cc52)
#26 0x0000561f8cbde678 clang::BackendConsumer::HandleTranslationUnit(clang::ASTContext&) (clang-22+0x6692678)
#27 0x0000561f8e1cdcd9 clang::ParseAST(clang::Sema&, bool, bool) (clang-22+0x7c81cd9)
#28 0x0000561f8d0c5626 clang::FrontendAction::Execute() (clang-22+0x6b79626)
#29 0x0000561f8d02cd7d clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (clang-22+0x6ae0d7d)
#30 0x0000561f8d1a0205 clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (clang-22+0x6c54205)
#31 0x0000561f8a2e4b46 cc1_main(llvm::ArrayRef<char const*>, char const*, void*) (clang-22+0x3d98b46)
#32 0x0000561f8a2e0655 ExecuteCC1Tool(llvm::SmallVectorImpl<char const*>&, llvm::ToolContext const&, llvm::IntrusiveRefCntPtr<llvm::vfs::FileSystem>) driver.cpp:0:0
#33 0x0000561f8a2e2c2d int llvm::function_ref<int (llvm::SmallVectorImpl<char const*>&)>::callback_fn<clang_main(int, char**, llvm::ToolContext const&)::$_0>(long, llvm::SmallVectorImpl<char const*>&) driver.cpp:0:0
#34 0x0000561f8cea4159 void llvm::function_ref<void ()>::callback_fn<clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*, bool*) const::$_0>(long) Job.cpp:0:0
#35 0x0000561f8c3cc3ee llvm::CrashRecoveryContext::RunSafely(llvm::function_ref<void ()>) (clang-22+0x5e803ee)
#36 0x0000561f8cea398c clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*, bool*) const (clang-22+0x695798c)
#37 0x0000561f8ce651dc clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&, clang::driver::Command const*&, bool) const (clang-22+0x69191dc)
#38 0x0000561f8ce653f7 clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&, bool) const (clang-22+0x69193f7)
#39 0x0000561f8ce821b8 clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&) (clang-22+0x69361b8)
#40 0x0000561f8a2dfea0 clang_main(int, char**, llvm::ToolContext const&) (clang-22+0x3d93ea0)
#41 0x0000561f8a2f0327 main (clang-22+0x3da4327)
#42 0x00007f856bc27635 (/usr/lib/libc.so.6+0x27635)
#43 0x00007f856bc276e9 __libc_start_main (/usr/lib/libc.so.6+0x276e9)
#44 0x0000561f8a2de065 _start (clang-22+0x3d92065)
clang: error: clang frontend command failed with exit code 70 (use -v to see invocation)
ClangBuiltLinux clang version 22.0.0git (https://github.com/llvm/llvm-project.git 48c8c4547584cf3b389bafb52a10ce8781d473dc)
...

jansvoboda11 · 2025-12-18T16:12:58Z

Thanks for reporting this @nathanchance. I'll take a look today.

This reverts commit f83de97.

Reverts #171935. The sandbox infrastructure was (incorrectly) only implemented for `clang -cc1` jobs created by the driver in #165350. Direct `clang -cc1` invocations had the sandbox disabled. This reduced the coverage of our test suite and lead to sandbox violations for people using asserts-enabled Clang. This PR temporarily disables the sandbox for asserts builds, so that we have time to investigate and fix sandbox violations for direct `clang -cc1` commands and re-enable for asserts builds at a later time.

… (#173074) Reverts llvm/llvm-project#171935. The sandbox infrastructure was (incorrectly) only implemented for `clang -cc1` jobs created by the driver in llvm/llvm-project#165350. Direct `clang -cc1` invocations had the sandbox disabled. This reduced the coverage of our test suite and lead to sandbox violations for people using asserts-enabled Clang. This PR temporarily disables the sandbox for asserts builds, so that we have time to investigate and fix sandbox violations for direct `clang -cc1` commands and re-enable for asserts builds at a later time.

This PR enables the IO sandbox for supported tools (currently `clang -cc1` and `clang -cc1as`) in assert builds. More details are in the RFC here: https://discourse.llvm.org/t/rfc-file-system-sandboxing-in-clang-llvm/88791

Reverts llvm#171935. The sandbox infrastructure was (incorrectly) only implemented for `clang -cc1` jobs created by the driver in llvm#165350. Direct `clang -cc1` invocations had the sandbox disabled. This reduced the coverage of our test suite and lead to sandbox violations for people using asserts-enabled Clang. This PR temporarily disables the sandbox for asserts builds, so that we have time to investigate and fix sandbox violations for direct `clang -cc1` commands and re-enable for asserts builds at a later time.

Reverts llvm/llvm-project#171935. The sandbox infrastructure was (incorrectly) only implemented for `clang -cc1` jobs created by the driver in llvm/llvm-project#165350. Direct `clang -cc1` invocations had the sandbox disabled. This reduced the coverage of our test suite and lead to sandbox violations for people using asserts-enabled Clang. This PR temporarily disables the sandbox for asserts builds, so that we have time to investigate and fix sandbox violations for direct `clang -cc1` commands and re-enable for asserts builds at a later time. (cherry picked from commit 56c0173)

[llvm][clang] Enable IO sandbox for assert builds

ec749ce

jansvoboda11 requested a review from benlangmuir December 12, 2025 00:04

benlangmuir approved these changes Dec 12, 2025

View reviewed changes

jansvoboda11 merged commit f83de97 into llvm:main Dec 16, 2025
11 checks passed

jansvoboda11 deleted the sandboxing-enablement branch December 16, 2025 16:01

jansvoboda11 mentioned this pull request Dec 17, 2025

[llvm][clang] Fix IO sandbox violations swiftlang/llvm-project#12022

Merged

jansvoboda11 added a commit that referenced this pull request Dec 19, 2025

Revert "[llvm][clang] Enable IO sandbox for assert builds (#171935)"

3ba3410

This reverts commit f83de97.

jansvoboda11 mentioned this pull request Dec 19, 2025

Revert "[llvm][clang] Enable IO sandbox for assert builds" #173074

Merged

zmodem mentioned this pull request Feb 3, 2026

[llvm][clang][lld][COFF] Add support for case-insensitive path lookup #178585

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[llvm][clang] Enable IO sandbox for assert builds#171935

[llvm][clang] Enable IO sandbox for assert builds#171935
jansvoboda11 merged 1 commit intollvm:mainfrom
jansvoboda11:sandboxing-enablement

jansvoboda11 commented Dec 12, 2025

Uh oh!

Uh oh!

llvm-ci commented Dec 16, 2025

Uh oh!

nathanchance commented Dec 18, 2025

Uh oh!

jansvoboda11 commented Dec 18, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

jansvoboda11 commented Dec 12, 2025

Uh oh!

Uh oh!

llvm-ci commented Dec 16, 2025

Uh oh!

nathanchance commented Dec 18, 2025

Uh oh!

jansvoboda11 commented Dec 18, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants