[R-pkg-devel] Possible false negative for compiled C++ code in CRAN checks

[Dirk Eddelbuettel]

On 14 November 2024 at 16:24, Mauricio Vargas Sepulveda wrote:
| After enabling the SAN flags, I cannot reproduce the gcc-san error [2].
| 
| Should I report this as a false positive?

No.

Replicating ASAN/UBSAN issues is known to be potentially tricky.

It drove me so batty a decade ago that I created a package (on CRAN at [1])
with _known triggers_ from the corresponding ASAN/UBSAN wiki. They help
ensure a given setup finds what it is supposed to find. (It also helps to
become familiar with ASAN/UBSAN because you can also assert that standard g++
/ clang++ do not necessarily find these. But the newer compilers are getting
better so some issue may now be flagged too.)

We have known-good containers: I maintain two within Rocker, they have weekly
builds, Winston has the ones in the sumu container [2] which many of us
(myself included) use. There is also rhub2 but that failed for me when I
tried a while back, it may be better now.

Sadly the CRAN one is not available as a container. But not reproducing the
CRAN findings does not imply CRAN is wrong. More likely it means your setup
does not (yet ?) match CRAN.

Dirk

[1] https://cran.r-project.org/package=sanitizers
[2] https://github.com/wch/r-debug

-- 
dirk.eddelbuettel.com | @eddelbuettel | edd using debian.org