SERVER-65273 parse denylist files to build icecream locally for some files

1 files changed, 57 insertions, 31 deletions

diff --git a/SConstruct b/SConstruct
index f328a6f2871..b47c00a4e2c 100644
--- a/SConstruct
+++ b/SConstruct
@@ -636,12 +636,6 @@ add_option('visibility-support',
     type='choice',
 )
 
-# TODO Remove this flag once SERVER-64999 is complete
-add_option("force-icecc-sanitizers",
-    help="Force the use of icecream with sanitizer builds, ignoring denylist issues from SERVER-59243.",
-    nargs=0,
-)
-
 try:
     with open("version.json", "r") as version_fp:
         version_data = json.load(version_fp)
@@ -3559,37 +3553,45 @@ def doConfigure(myenv):
         if supportedDenyfiles:
             # Unconditionally using the full path can affect SCons cached builds, so we only do
             # this in cases where we know it's going to matter.
+            denylist_options=[
+                f"-fsanitize-blacklist={denyfile.path}"
+                for denyfile in supportedDenyfiles
+            ]
+
             if 'ICECC' in env and env['ICECC']:
-                # We impose some guard rails to make sure users are aware of the issues around
-                # using icecream and sanitizers in networks which may have older iceccd remotes
-                # part of the network. Refer to SERVER-59243 for related issues.
-                # TODO Remove this flag once SERVER-64999 is complete
-                if not has_option("force-icecc-sanitizers"):
-                    env.FatalError(textwrap.dedent("""
-                        ERROR: Using icecream with sanitizers that use denylist files has known issues
-                        which cause the denylist to fail to be correctly applied. This will occur
-                        if the network you are building in contains remote icecream hosts which
-                        are older than icecc version 1.3. This will cause failures during
-                        exectution of the code. If you are aware of the risks, you can force
-                        icecream sanitizer builds with the '--force-icecc-sanitizers' option.
-                        """))
 
                 # Make these files available to remote icecream builds if requested.
                 # These paths *must* be absolute to match the paths in the remote
-                # toolchain archive.
-                denylist_options=[
-                    f"-fsanitize-blacklist={denyfile.get_abspath()}"
+                # toolchain archive. Local builds remain relative.
+                local_denylist_options = denylist_options[:]
+                denylist_options = [
+                    f"-fsanitize-blacklist={denyfile.abspath}"
                     for denyfile in supportedDenyfiles
                 ]
+
+
+                # Build a regex of all the regexes in the denylist
+                # the regex in the denylist are a shell wildcard format
+                # https://clang.llvm.org/docs/SanitizerSpecialCaseList.html#format
+                # so a bit of massaging (* -> .*) to get a python regex.
+                icecc_denylist_regexes = []
+                for denyfile in supportedDenyfiles:
+                    for line in denyfile.get_contents().decode('utf-8').split('\n'):
+                        if line.strip().startswith('src:'):
+                            regex_line = line.replace('src:', '').strip()
+                            regex_line = re.escape(regex_line)
+                            icecc_denylist_regexes += [regex_line.replace('\\*', ".*")]
+
+                icecc_denylist_regex = re.compile('^(?:' +  '|'.join(icecc_denylist_regexes) + ')$')
+
+                def is_local_compile(env, target, source, for_signature):
+                    return icecc_denylist_regex.match(str(source[0])) is not None
+
+                env['ICECC_LOCAL_COMPILATION_FILTER'] = is_local_compile
                 # If a sanitizer is in use with a denylist file, we have to ensure they get
                 # added to the toolchain package that gets sent to the remote hosts so they
                 # can be found by the remote compiler.
                 env.Append(ICECC_CREATE_ENV_ADDFILES=supportedDenyfiles)
-            else:
-                denylist_options=[
-                    f"-fsanitize-blacklist={denyfile.path}"
-                    for denyfile in supportedDenyfiles
-                ]
 
             if 'CCACHE' in env and env['CCACHE']:
                 # Work around the fact that some versions of ccache either don't yet support
@@ -3604,15 +3606,39 @@ def doConfigure(myenv):
                 env.Append(CCACHE_EXTRAFILES=supportedDenyfiles)
                 env['CCACHE_EXTRAFILES_USE_SOURCE_PATHS'] = True
 
-            def SanitizerDenylistGenerator(source, target, env, for_signature):
+            def CCSanitizerDenylistGenerator(source, target, env, for_signature):
+                # TODO: SERVER-60915 use new conftest API
+                if "conftest" in str(target[0]):
+                    return ''
+
+                # TODO: SERVER-64620 use scanner instead of for_signature
                 if for_signature:
                     return [f.get_csig() for f in supportedDenyfiles]
+
+                # Check if the denylist gets a match and if so it will be local
+                # build and should use the non-abspath.
+                # NOTE: in non icecream builds denylist_options becomes relative paths.
+                if env.subst('$ICECC_LOCAL_COMPILATION_FILTER', target=target, source=source) == 'True':
+                    return local_denylist_options
+
+                return denylist_options
+
+            def LinkSanitizerDenylistGenerator(source, target, env, for_signature):
+                # TODO: SERVER-60915 use new conftest API
+                if "conftest" in str(target[0]):
+                    return ''
+
+                # TODO: SERVER-64620 use scanner instead of for_signature
+                if for_signature:
+                    return [f.get_csig() for f in supportedDenyfiles]
+
                 return denylist_options
 
             myenv.AppendUnique(
-                SANITIZER_DENYLIST_GENERATOR=SanitizerDenylistGenerator,
-                CCFLAGS="${SANITIZER_DENYLIST_GENERATOR}",
-                LINKFLAGS="${SANITIZER_DENYLIST_GENERATOR}",
+                CC_SANITIZER_DENYLIST_GENERATOR=CCSanitizerDenylistGenerator,
+                LINK_SANITIZER_DENYLIST_GENERATOR=LinkSanitizerDenylistGenerator,
+                CCFLAGS="${CC_SANITIZER_DENYLIST_GENERATOR}",
+                LINKFLAGS="${LINK_SANITIZER_DENYLIST_GENERATOR}",
             )
 
         symbolizer_option = ""