Address Sanitizer is a new project based on clang which aims to provide relatively cheap memory access checking. It is capable of detecting errors such as out-of-bounds access or use-after-free at runtime. Although its functionality is a subset of what Valgrind supports, running applications built with Address Sanitizer is noticeably faster than running them under Valgrind, which can simplify the testing process.
I recently got a build of Firefox with Address Sanitizer working. Getting these builds in relatively simple. Firstly, you should build Address Sanizer yourself. Then, you can use a mozconfig like this:
export CC=/path/to/address-sanitizer/asan_clang_Linux/bin/clang export CXX=/path/to/address-sanitizer/asan_clang_Linux/bin/clang++ export CFLAGS='-fasan -Dxmalloc=myxmalloc' export CXXFLAGS='-fasan -Dxmalloc=myxmalloc' export LDFLAGS=-ldl . $topsrcdir/browser/config/mozconfig mk_add_options MOZ_OBJDIR=@TOPSRCDIR@/objdir-ff-asan mk_add_options MOZ_MAKE_FLAGS="-j4" ac_add_options --enable-application=browser ac_add_options --enable-debug ac_add_options --disable-optimize ac_add_options --disable-jemalloc ac_add_options --disable-crashreporter
Once your mozconfig is set up, just build and run Firefox as you normally would. I have not yet found any memory safety issues in Firefox using Address Sanitizer, but it’s not really surprising, since I mostly attempted to run our unit tests with this build, but the build is fast enough that you can even use it as your main browser. If you do see an issue, please file a bug.