#sanitizers
4 posts tagged #sanitizers.
What a C++ team can actually point at when asked about memory safety
The question now arrives in procurement paperwork rather than in conference talks, and C++26 shipped without the profiles that were supposed to answer it. What exists today is less impressive and more useful: a hardened standard library measured at a fraction of a percent, sanitizers in CI, and warnings that catch the class of bug being asked about.
RealtimeSanitizer checks the promise that a function never blocks
Mark a function [[clang::nonblocking]] and RealtimeSanitizer verifies at runtime that nothing inside it allocates, locks, or makes a syscall. It is the sanitizer for audio callbacks, control loops, and any deadline-bound code where a hidden malloc is a dropped frame. Episode 3 of the verification series.
Two compilers, one float-to-int cast, two different wrong answers
Converting a float to an int is undefined behavior when the value does not fit, and for NaN. Nothing warns by default, and GCC and Clang produce different results for the same cast. Worse, GCC deliberately leaves the check out of -fsanitize=undefined, so you have to name float-cast-overflow to catch it.
The sanitizers run live on Compiler Explorer
AddressSanitizer, UndefinedBehaviorSanitizer, and ThreadSanitizer all run in Compiler Explorer's execution pane. Add one -fsanitize flag, turn on execution, and the runtime report prints in the browser: the faulting line, the allocation site, the shadow-byte map, both racing stacks. There is no cheaper way to show a colleague exactly why a bug is a bug.