| Commit-Queue | +1 |
This doesn't feel great, but I don't have any other solutions at the moment. wdyt?
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
| Code-Review | +1 |
If this is all, I suppose this is at least fine to unblock things. Have you tried win/android/cros cross builds?
What's your local perfetto patch?
The reason we don't hit this in 3p code is because we suppress the warning there, right?
I do wonder what the path forward is for this. It's in the end "don't call printf() with %s, ever", right? Does printf support something like %.*s to include the string length in the args, and does that prevent the warning? If so, I suppose switching to that would work. (Not in this CL.) For our own functions, having a way to tell clang that something takes a span would be nice.
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
If this is all, I suppose this is at least fine to unblock things. Have you tried win/android/cros cross builds?
What's your local perfetto patch?
The reason we don't hit this in 3p code is because we suppress the warning there, right?
I do wonder what the path forward is for this. It's in the end "don't call printf() with %s, ever", right? Does printf support something like %.*s to include the string length in the args, and does that prevent the warning? If so, I suppose switching to that would work. (Not in this CL.) For our own functions, having a way to tell clang that something takes a span would be nice.
Have you tried win/android/cros cross builds?
No. I figured I'd land this and watch the ToT bots to see how much is left.
What's your local perfetto patch?
```
diff --git a/include/perfetto/base/logging.h b/include/perfetto/base/logging.h
index 6b87980973..2c882e2681 100644
--- a/include/perfetto/base/logging.h
+++ b/include/perfetto/base/logging.h
@@ -202,7 +202,7 @@ inline void MaybeSerializeLastLogsForCrashReporting() {}
#if defined(__GNUC__) || defined(__clang__)
#define PERFETTO_PLOG(x, ...) \
- PERFETTO_ELOG(x " (errno: %d, %s)", ##__VA_ARGS__, errno, strerror(errno))
+ PERFETTO_ELOG(x " (errno: %d, %s)", ##__VA_ARGS__, errno, "foo")
#else
// MSVC expands __VA_ARGS__ in a different order. Give up, not worth it.
#define PERFETTO_PLOG PERFETTO_ELOG
```
obviously we need something better :-D
> The reason we don't hit this in 3p code is because we suppress the warning there, right?
Right, this only fires in code that is opted in to the unsafe buffers warning, which I think is still a relatively small subset of the codebase.
I do wonder what the path forward is for this. It's in the end "don't call printf() with %s, ever", right?
Me too. The warning has carveouts for what it considers safe arguments. If `s` is a `std::string`, then using `%s` with `s.c_str()` is okay. (Maybe any type with `.c_str()`?) Also a literal like `"foo"` is fine, but it's not smart and will currently flag `b ? "foo" : "bar"`.
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
obviously we need something better :-D
Can we UNSAFE_TODO() all uses of that perfetto macro? Or are there tons?
Me too.
Maybe worth asking about upstream as well?
Can we UNSAFE_TODO() all uses of that perfetto macro? Or are there tons?
I think these are affected:
```
$ git grep -In -E "TRACE_EVENT_BEGIN[0-9]" | wc -l
129
```
So it seems doable, but ugly. And it's just because of this DCHECK: https://source.chromium.org/chromium/chromium/src/+/main:third_party/perfetto/include/perfetto/tracing/track_event_legacy.h;l=110 which happens to log strerror(errno) on failure.
Maybe. But it seems weird that Perfetto should have to work around this, given that it's not opted in to unsafe-buffers warnings.
If we're going to make Perfetto changes, we might as well use a pragma for disabling it there.
Hm, maybe the diag should be emitted pointing at the format string? Then the suppression would work, right?
I don't think so. Both the format string, the argument (`strerror(errno)`) and the call to the logging function are defined in macros in Perfetto.
My current ideas are:
How much change can we put into perfetto?
You are correct that macros do not have file-based suppression based upon where they are defined, but only where they are used.
One way around this is to make the macro call an intermediate function which then invokes the printf(), keeping the offending printf() call in a file that is covered by suppression.
We'd have to ask the perfetto maintainers. But it sounds like we have a few ideas at least.
thakis: Would you be comfortable giving owners-override for this so we can land it for now?
| Code-Review | +1 |
| Owners-Override | +1 |
Oh yeah, I thought I had clicked that last time already. Must've missed the button, apologies!
Put UNSAFE_TODO around newly flagged printf-style function calls
Recent Clang (see bug) started implicitly treating PRINTF_FORMAT
functions similar to printf for -Wunsafe-buffer-usage-in-libc-call.
This suppresses those warnings until they can be fixed.
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |