On Thu, 26 Sep 2024 21:25:07 GMT, Phil Race <p...@openjdk.org> wrote:
> build team have indicated they do not support --enable-ubsan What 'build team' are you talking about ? Some Oracle internal build team? The ubsan support came in 2023, so nothing new (change was from Justin King) https://github.com/openjdk/jdk/commit/7a85d95e828283d57e1df0344be454626470675d And it was reviewed by erikj and ihse, I think those are members of the OpenJDK build group and very competent OpenJDK reviewers. So the flag is as good or bad as any other configure flag of OpenJDK . >and my experience with that and similar options is that they are a nightmare >to find a system on which they build We use and run this regularly on SUSE and Ubuntu Linux and have VERY good experience with it. It works (at least on recent Linux distros) very well. (on macOS our experience is a bit different there I had a couple of issues with ubsan) A lot of large C/C++ based OSS projects support it like Linux kernel, Android, Chromium etc. https://docs.kernel.org/dev-tools/ubsan.html https://source.android.com/docs/security/test/ubsan https://www.chromium.org/developers/testing/undefinedbehaviorsanitizer/ and btw. Oracle blogs happily about it too and recommends it https://blogs.oracle.com/linux/post/improving-application-security-with-undefinedbehaviorsanitizer-ubsan-and-gcc So it is a well established tool in the OSS world. ------------- PR Comment: https://git.openjdk.org/jdk/pull/21184#issuecomment-2378520093
