Bug 309649 – Sandbox .sb files are not regenerated when switching between ASan and non-ASan builds

• Status: RESOLVED
• Resolution: FIXED
• Component: Tools / Tests

[David Kilzer (:ddkilzer)]

When switching from a non-ASan build to an ASan build (or vice versa) without cleaning, the `.sb` sandbox profile files are not regenerated. Three `.sb.in` files contain `#if ASAN_ENABLED` blocks that conditionally allow `SYS_sigaltstack` (needed by ASan for alternate signal stacks). Without regeneration, the stale non-ASan `.sb` files block this syscall, causing `__sanitizer::SetAlternateSignalStack()` to fail with `SIGABRT` in the Networking, GPU, and WebContent processes.

The root cause is that the `%.sb : %.sb.in` pattern rule in `Source/WebKit/DerivedSources.make` has no dependency on `SANITIZE_FLAGS` or `ENABLE_ADDRESS_SANITIZER`. The `.sb.in` source files haven't changed, so make considers the `.sb` outputs up-to-date and skips regeneration.

Stack trace from the Networking process crash:
```
0   libsystem_kernel.dylib:  __pthread_kill
1   libsystem_pthread.dylib:  pthread_kill
2   libsystem_c.dylib:  abort
3   libclang_rt.asan_osx_dynamic.dylib:  __sanitizer::Abort()
4   libclang_rt.asan_osx_dynamic.dylib:  __sanitizer::Die()
5   libclang_rt.asan_osx_dynamic.dylib:  __sanitizer::CheckFailed()
6   libclang_rt.asan_osx_dynamic.dylib:  __sanitizer::SetAlternateSignalStack() (.cold.1)
7   libclang_rt.asan_osx_dynamic.dylib:  __sanitizer::SetAlternateSignalStack()
8   libclang_rt.asan_osx_dynamic.dylib:  asan_thread_start()
9   libsystem_pthread.dylib:  _pthread_start
```

ASan CHECK failure message:
```
AddressSanitizer: CHECK failed: sanitizer_posix_libcdep.cpp:191 "((0)) == ((sigaltstack(nullptr, &oldstack)))" (0x0, 0xffffffffffffffff)
```

The `sigaltstack()` syscall returns -1 because the sandbox profile does not allow `SYS_sigaltstack` when the `.sb` file was generated without `-fsanitize=address`.

<rdar://151774355>

[David Kilzer (:ddkilzer)]

Pull request: https://github.com/WebKit/WebKit/pull/60339

[EWS]

Committed 309211@main (2b63f0896352): <https://commits.webkit.org/309211@main>

Reviewed commits have been landed. Closing PR #60339 and removing active labels.