ci: Temporarily use clang in valgrind tasks
What the developer wrote
Authored by MarcoFalke
ci: Temporarily use clang in valgrind tasks
valgrind currently does not work on GCC -O2 compiled executables, which
contain std::optional use, due to an upstream bug. See
https://bugs.kde.org/show_bug.cgi?id=472329
One workaround could be to use -O1. However, that seems brittle, as
variantions of the bug were seen with -O1 as well.
So temporarily use clang in the valgrind CI tasks, because this also
allows to drop a false-positive suppression for:
-DCMAKE_CXX_FLAGS='-Wno-error=array-bounds'
Also, update the comment in contrib/valgrind.supp to mention the
background:
* GCC -O2 wasn't tested with the suppressions file, due to the mentioned
bug.
* Clang-17 (or later) on aarch64 wasn't tested due to bug
https://github.com/bitcoin/bitcoin/issues/29635 and the minimum
supported clang version is clang-17 right now.
* GUI isn't tested, because it requires a debug build, see the prior
commit.
This means the only tested config right now is the one mentioned in the
suppression file.
What changed, and why it matters
This commit only changes Bitcoin Core's continuous-integration (CI) test setup. It switches the compiler used during Valgrind memory-checking jobs from GCC to Clang, because a known bug in Valgrind makes it report false problems on GCC-optimized executables that use std::optional. No user-facing code, consensus rules, wallet, networking, or node behavior is changed. There is no security vulnerability being fixed or introduced here.
No security action required. This is a CI maintenance change. Reviewers may verify that the new Clang-based Valgrind jobs pass and that the suppression file comment accurately reflects the tested configuration.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The patch modifies three CI/QA files. It adds clang/llvm/libclang-rt-dev to two CI environment scripts and sets -DCMAKE_C_COMPILER=clang and -DCMAKE_CXX_COMPILER=clang++ for the Valgrind fuzz and non-fuzz CI tasks. It removes a prior -Wno-error=array-bounds CXX flag workaround and updates a comment in test/sanitizer_suppressions/valgrind.supp to document which compiler/optimization combinations were actually tested. The change is a testing-infrastructure workaround for upstream Valgrind/KDE bug 472329 and is unrelated to runtime security.
Changed components
ci/test/00_setup_env_native_fuzz_with_valgrind.shci/test/00_setup_env_native_valgrind.shtest/sanitizer_suppressions/valgrind.suppInspect captured patch +11 / −6
diff --git a/ci/test/00_setup_env_native_fuzz_with_valgrind.sh b/ci/test/00_setup_env_native_fuzz_with_valgrind.sh
index d8b0f5f1..ed84ae84 100755
--- a/ci/test/00_setup_env_native_fuzz_with_valgrind.sh
+++ b/ci/test/00_setup_env_native_fuzz_with_valgrind.sh
@@ -8,7 +8,7 @@ export LC_ALL=C.UTF-8
export CI_IMAGE_NAME_TAG="mirror.gcr.io/debian:trixie"
export CONTAINER_NAME=ci_native_fuzz_valgrind
-export PACKAGES="libevent-dev libboost-dev libsqlite3-dev valgrind libcapnp-dev capnproto"
+export PACKAGES="clang llvm libclang-rt-dev libevent-dev libboost-dev libsqlite3-dev valgrind libcapnp-dev capnproto"
export NO_DEPENDS=1
export RUN_UNIT_TESTS=false
export RUN_FUNCTIONAL_TESTS=false
@@ -17,5 +17,6 @@ export FUZZ_TESTS_CONFIG="--valgrind"
export GOAL="all"
export BITCOIN_CONFIG="\
-DBUILD_FOR_FUZZING=ON \
- -DCMAKE_CXX_FLAGS='-Wno-error=array-bounds' \
+ -DCMAKE_C_COMPILER=clang \
+ -DCMAKE_CXX_COMPILER=clang++ \
"
diff --git a/ci/test/00_setup_env_native_valgrind.sh b/ci/test/00_setup_env_native_valgrind.sh
index 89118324..0ca02f77 100755
--- a/ci/test/00_setup_env_native_valgrind.sh
+++ b/ci/test/00_setup_env_native_valgrind.sh
@@ -8,7 +8,7 @@ export LC_ALL=C.UTF-8
export CI_IMAGE_NAME_TAG="mirror.gcr.io/debian:trixie"
export CONTAINER_NAME=ci_native_valgrind
-export PACKAGES="valgrind python3-zmq libevent-dev libboost-dev libzmq3-dev libsqlite3-dev libcapnp-dev capnproto python3-pip"
+export PACKAGES="clang llvm libclang-rt-dev valgrind python3-zmq libevent-dev libboost-dev libzmq3-dev libsqlite3-dev libcapnp-dev capnproto python3-pip"
export PIP_PACKAGES="--break-system-packages pycapnp"
export USE_VALGRIND=1
export NO_DEPENDS=1
@@ -17,7 +17,9 @@ export TEST_RUNNER_EXTRA="--exclude rpc_bind --exclude feature_bind_extra"
export GOAL="install"
# GUI disabled, because it only passes with a DEBUG=1 depends build
export BITCOIN_CONFIG="\
- --preset=dev-mode \
+ --preset=dev-mode \
-DBUILD_GUI=OFF \
-DWITH_USDT=OFF \
+ -DCMAKE_C_COMPILER=clang \
+ -DCMAKE_CXX_COMPILER=clang++ \
"
diff --git a/test/sanitizer_suppressions/valgrind.supp b/test/sanitizer_suppressions/valgrind.supp
index 584cdcf7..8bcad914 100644
--- a/test/sanitizer_suppressions/valgrind.supp
+++ b/test/sanitizer_suppressions/valgrind.supp
@@ -12,8 +12,10 @@
# --error-limit=no build/bin/test_bitcoin
#
# Note that suppressions may depend on OS and/or library versions.
-# Tested on aarch64 and x86_64 with Ubuntu Noble system libs, using clang-16
-# and GCC, without gui.
+# Tested on Debian Trixie system libs,
+# * using clang (only x86_64, see https://bugs.kde.org/show_bug.cgi?id=485276),
+# * and GCC (only -O1, see https://bugs.kde.org/show_bug.cgi?id=472329),
+# without gui (because it only passes with a DEBUG=1 depends build).
{
Suppress leaks on shutdown
Memcheck:Leak
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.