1386297 - (asan-nightly-project) [meta] AddressSanitizer Nightly Project

Status: NEW

(Firefox :: General, enhancement, P5)

Description

[Christian Holler (:decoder)]

This bug should serve as a tracking bug for all bugs related to the AddressSanitizer (ASan) Nightly Project. The goal of the project is to provide a version of Nightly that is built with ASan and automatically reports back any ASan crash information to us.

The project will be opt-in and targeting users that are willing to run these kinds of builds for daily browsing despite the performance overhead that comes with ASan.

Since ASan detects memory corruptions much better (e.g. triggers on use-after-free, which often does not crash) and also provides much better diagnostic information, the results might allow us to fix additional stability and security bugs in our codebase.

In terms of operating systems, the first OS to be supported will be Linux, maybe we can extend this to Mac later. ASan for Firefox on Windows is in its early stages so it is not clear when it will be stable enough.

Comment 1

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

This could be a problem for sandboxing: currently we disable sandboxing on Linux ASan builds, because of problems with LeakSanitizer (see bug 1287971 comment #9), and to a certain extent we rely on Nightly users to catch problems on unusual configurations or distributions that Mozilla's test infrastructure doesn't cover.  So if the more experimental parts of the Linux Nightly population start using ASan builds, this would increase our risk of brokenness making it to Release.  

It sounds like this ASan Nightly won't need Leak Sanitizer, which suggests a possibility: get sandboxing + ASan working again, have it disable LSan in child processes by default, and allow tests to choose LSan instead of sandboxing.

The one weak point there is getting test coverage for ASan + sandboxing, but as long as ASan and sandboxing are tested separately, the risks are mainly around the ASan crash handler working as expected in child processes (including media plugins if possible), and that should be testable much more cheaply than running an extra copy of the entire test suite.

Comment 2

[Christian Holler (:decoder)]

(In reply to Jed Davis [:jld] (⏰UTC-6) from comment #1)

I don't think this is an issue at the moment, because we don't expect that a substantial amount of the Nightly population will participate in this program. This program is entirely opt-in and requires a separate build to be downloaded. It is not that we move a percentage of Nightly users to this type of channel.

That said, if you can get sandboxing to work properly with ASan (and the ASan reporter system addon), that would of course be nice :)

Comment 3

[Takanori MATSUURA]

Do we still keep this bug as a separate one from bug 863846?