Skip to content

CI: update sanitizer CI to use python compiled with ASAN and TSAN #28273

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Feb 5, 2025

Conversation

ngoldbaum
Copy link
Member

Fixes #28267.

This PR substantially updates the sanitizer CI.

  • Moves the CI jobs to a macos-latest runner to use a CPU with relaxed memory ordering. This also more closely matches my development environment so it's more convenient for me.
  • Drops UBSAN CI. We've always run UBSAN without triggering test failures and try as I might, no one has taken up BUG: undefined behavior detected by ubsan in sanitizer CI runs #24209 to fix that. On top of that, when I tried building Python using UBSAN, it generated a ton of noise so I don't think Python is UBSAN-safe yet. If we want to have UBSAN running in CI, we should have a job explicitly for that and someone should fix the issues or add suppressions.
  • Updates ASAN CI to use a Python built with ASAN. This means we can detect issues that cross the Python C API barrier. It found a use-after-free in the ufunc.at implementation that is fixed in this PR.
  • Adds TSAN CI and reorganizes tests that use threading to be in fewer files. Because TSAN is very slow, it's not tenable to run the full test suite (see this CI run on my NumPy fork that completed after more than an hour) so instead I set it up so it only runs the tests in files that do import threading, which cuts down on the time by quite a bit. TSAN is only useful if you actually trigger thread safety issues by doing concurrent operations, so it's not very useful to run it on single-threaded tests.

- name: Build Python with thread sanitizer support
run: |
# free-threaded Python is much more likely to trigger races
CONFIGURE_OPTS="--with-thread-sanitizer" pyenv install 3.13t
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This takes about 10 minutes and Python releases happen infrequently enough I think we'd benefit from using a cache. Is it ok to add a new Github actions cache entry for this step? I don't think the Python installation is all that big on-disk but I can double check.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Only five minutes on the CI run for this PR 🤷‍♂️

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That seems fine to me. Not essential though if it's indeed 5 minutes - whatever you prefer.

pip install -r requirements/test_requirements.txt
- name: Build
run:
python -m spin build -j2 -- -Db_sanitize=thread
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this might also benefit from setting up ccache

@ngoldbaum ngoldbaum added 39 - free-threading PRs and issues related to support for free-threading CPython (a.k.a. no-GIL, PEP 703) component: CI labels Feb 4, 2025
Copy link
Member

@rgommers rgommers left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This looks pretty good! Moving to macOS is making the runs more expensive (latency wise, we don't actually have to pay for it), but in this particular instance there are good reasons for it.

I reviewed only the CI changes, approving that part of the PR since the jobs look fine as is, even though you may still want to add caching.

@ngoldbaum
Copy link
Member Author

Once the aarch64 CI is merged I might move one of these over to using an aarch64 ubuntu image and I'll take a look at whether that improves build times.

@ngoldbaum ngoldbaum merged commit a34660d into numpy:main Feb 5, 2025
69 checks passed
@charris
Copy link
Member

charris commented Feb 5, 2025

Is the fix without all the rest worth backporting?

@ngoldbaum
Copy link
Member Author

Yup, I'm actually in the middle of doing a PR.

ngoldbaum added a commit to ngoldbaum/numpy that referenced this pull request Feb 5, 2025
charris added a commit that referenced this pull request Feb 5, 2025
BUG: backport resource cleanup bugfix from gh-28273
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
39 - free-threading PRs and issues related to support for free-threading CPython (a.k.a. no-GIL, PEP 703) component: CI
Projects
None yet
Development

Successfully merging this pull request may close these issues.

BUG: Heap use after free detected using python/numpy compiled with ASAN
3 participants