ci/gha: enable sanitisers

UBSAN finds something in the UWP build with the
regression/karaoke/357-k-and-kf-desynced.ass sample.
But due to lack of libubsan there's no report and
manual investigation is needed --- which requires a
Windows development setup.

1 files changed, 42 insertions, 3 deletions

diff --git a/.github/workflows/ghci.yml b/.github/workflows/ghci.yml
index e9db11c..6904e71 100644
--- a/.github/workflows/ghci.yml
+++ b/.github/workflows/ghci.yml
@@ -44,7 +44,8 @@ jobs:
             docker_image: oldlibs
             docker_pullprefix: 'ghcr.io/theoneric/libass-containers/'
             shell: '/usr/bin/docker exec dockerciimage sh -e {0}'
-            # various regression test fail, supposedly due to older deps
+            # Crash Tests detect (false?) leaks in Fontconfig, and
+            # various regression test fail, assumed due to older deps
             skip_tests: yes
           # Add a Windows build (MinGW-gcc via MSYS2) with no extras
           - os: windows-2019
@@ -61,6 +62,8 @@ jobs:
             extra_cflags: -DWINAPI_FAMILY=WINAPI_FAMILY_APP -specs=/tmp/windowsapp.specs
             shell: 'msys2 {0}'
             package_prefix: mingw-w64-ucrt-x86_64
+            # FIXME: UBSAN triggers on regression/karaoke/357-k-and-kf-desynced.ass
+            skip_tests: yes
 
     defaults:
       run:
@@ -128,14 +131,49 @@ jobs:
               ;;
             *)
               sudo apt-get update #&& sudo apt-get upgrade
+              ubver="$(apt-cache search libubsan | awk '/^libubsan[0-9]* / {print substr($1, 9)}' | sort -rn | head -n1)"
+              asver="$(apt-cache search libasan | awk '/^libasan[0-9]* / {print substr($1, 8)}' | sort -rn | head -n1)"
               sudo apt-get install -y --no-install-recommends \
                    autoconf automake make libtool \
                    libfontconfig1-dev libfreetype6-dev libfribidi-dev \
                    libharfbuzz-dev nasm ${{ matrix.cc }} \
-                   libpng-dev
+                   libpng-dev libubsan"$ubver" libasan"$asver"
               ;;
           esac
 
+      - name: Determine Sanitizer Flags
+        id: sanitizer
+        run: |
+          aflags="-fsanitize=address"
+          uflags="-fsanitize=undefined -fsanitize=float-cast-overflow"
+          if [ "${{ startsWith(matrix.cc, 'clang') }}" = "true" ] ; then
+            # Clang's UBSAN exits with code zero even if issues were found
+            # This options will instead force an SIGILL, but remove a report being printed
+            # see https://reviews.llvm.org/D35085
+            uflags="$uflags -fsanitize-undefined-trap-on-error"
+          fi
+
+          # UBSAN: Alpine and MSys2 doesn't ship the UBSAN library,
+          #        but when SIGILL'ing the lib is not needed
+          # ASAN:  Not supported with musl and in Windows
+          case "${{ matrix.docker_image || matrix.os }}" in
+            alpine*|windows-*)
+              flags="$uflags -fsanitize-undefined-trap-on-error" ;;
+            *)
+              flags="$aflags $uflags" ;;
+          esac
+
+          if [ -n "$flags" ] ; then
+            flags="$flags -fno-sanitize-recover=all"
+          fi
+
+          if [ "${{ matrix.cc }}" = "tcc" ] || [ "${{ matrix.skip_tests }}" = "yes" ] ; then
+            flags=""
+          fi
+
+          echo "SANFLAGS=$flags"
+          echo "::set-output name=flags::${flags}"
+
       - name: Customize compiler
         if: matrix.api == 'app' && matrix.cc == 'gcc'
         run: >
@@ -147,7 +185,8 @@ jobs:
       - name: configure
         run: |
           export CC="${{ matrix.cc }}\
-            ${{ matrix.extra_cflags && ' ' }}${{ matrix.extra_cflags }}"
+            ${{ matrix.extra_cflags && ' ' }}${{ matrix.extra_cflags }}\
+            ${{ steps.sanitizer.outputs.flags && ' ' }}${{ steps.sanitizer.outputs.flags }}"
           export LD="${{ matrix.ld }}"
           export ART_SAMPLES="${{ env.ART_SAMPLES }}"