Hi.
Normally, when we build stuff with clang in Fedora, we set the CFLAGS environment to this (on x86_64):
-O2 -flto=thin -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Werror=format-security -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=3 -Wp,-D_GLIBCXX_ASSERTIONS --config=/usr/lib/rpm/redhat/redhat-hardened-clang.cfg -fstack-protector-strong -m64 -march=x86-64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -mtls-dialect=gnu2 -fno-omit-frame-pointer -mno-omit-leaf-frame-pointer
Where /usr/lib/rpm/redhat/redhat-hardened-clang.cfg contains -fPIE.
I was wondering whether we should use (a subset of) the flags in CFLAGS_JIT, when we build the JIT stencils. We build Python with -O3, or -O0 for the debug build. Based on some experiments, some of the flags seem to raise AssertionErrors (like SHT_LLVM_LTO or SHT_X86_64_UNWIND in cpython/Tools/jit/_targets.py at v3.15.0a2 · python/cpython · GitHub). So, for x86_64, that leaves:
-O3 -g -grecord-gcc-switches -pipe -Wall -Werror=format-security -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=3 -Wp,-D_GLIBCXX_ASSERTIONS --config=/usr/lib/rpm/redhat/redhat-hardened-clang.cfg -fstack-protector-strong -m64 -march=x86-64 -mtune=generic -fstack-clash-protection -fcf-protection -mtls-dialect=gnu2 -fno-omit-frame-pointer -mno-omit-leaf-frame-pointer
And I wonder, is this something that we should do? I must admit that the stencils thing is a bit black magic for me, so I don’t know if this would work, or whether I should do it at all. I’d appreciate some advice from JIT experts – is this something we should even be touching?
Thanks.