Add Rust ThreadSanitizer configuration and build-std

Author: mikea

.bazelrc

@@ -234,6 +234,8 @@ build:sanitizer-common --copt="-Og"
 build:sanitizer-common --copt="-g" --strip=never
 build:sanitizer-common --copt="-fno-optimize-sibling-calls"
 build:sanitizer-common --copt="-fno-omit-frame-pointer" --copt="-mno-omit-leaf-frame-pointer"
+# Rust's sanitizer support requires nightly
+build:sanitizer-common --@rules_rust//rust/toolchain/channel:channel=nightly
 
 # address sanitizer (https://github.com/google/sanitizers/wiki/AddressSanitizer)
 build:asan --config=sanitizer-common
@@ -261,6 +263,9 @@ build:tsan --test_timeout=30,150,600,2400
 # not currently derive these defines from the compiler's sanitizer flags.
 build:tsan --copt="-DV8_IS_TSAN"
 build:tsan --per_file_copt='external/.*v8@-DTHREAD_SANITIZER'
+build:tsan --extra_toolchains=//build/rust:tsan_toolchain
+build:tsan --@rules_rust//:extra_rustc_flag=-Zsanitizer=thread
+build:tsan --@rules_rust//:extra_rustc_flag=-Zexternal-clangrt
 
 # fuzzilli (https://github.com/googleprojectzero/fuzzilli/)
 build:fuzzilli --config=asan

build/deps/rust.MODULE.bazel

@@ -29,10 +29,31 @@ rust.toolchain(
         RUST_NIGHTLY_VERSION,
     ],
 )
-use_repo(rust, "rust_toolchains")
+use_repo(
+    rust,
+    "rust_toolchains",
+    rust_nightly_linux_x86_64 = "rust_linux_x86_64__x86_64-unknown-linux-gnu__nightly_tools",
+)
 
 register_toolchains("@rust_toolchains//:all")
 
+http_archive = use_repo_rule("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+
+http_archive(
+    name = "rust_nightly_src",
+    build_file_content = """
+filegroup(
+    name = "rust_src",
+    srcs = glob(["library/**"]),
+    visibility = ["//visibility:public"],
+)
+exports_files(["library/Cargo.toml"])
+""",
+    sha256 = "b8bb98533e65cb2468548b20b3575518d01b44e7738045a12de2dbb71a0d6cc2",
+    strip_prefix = "rust-src-nightly/rust-src/lib/rustlib/src/rust",
+    urls = ["https://static.rust-lang.org/dist/2026-07-16/rust-src-nightly.tar.xz"],
+)
+
 # rust-based lolhtml dependency, including the API header.
 # Presented as a separate repository to allow overrides.
 new_local_repository = use_repo_rule("@bazel_tools//tools/build_defs/repo:local.bzl", "new_local_repository")

build/rust/BUILD.bazel

@@ -0,0 +1,80 @@
+load("@rules_rust//rust:toolchain.bzl", "rust_toolchain")
+load(":build_std.bzl", "compiler_runtime_files", "instrumented_rust_std")
+
+exports_files(["build_std.sh"])
+
+_RUST_TOOLS = "@rust_nightly_linux_x86_64"
+
+_TARGET_TRIPLE = "x86_64-unknown-linux-gnu"
+
+compiler_runtime_files(
+    name = "nightly_rustc_lib",
+    src = _RUST_TOOLS + "//:rustc_lib",
+    sanitizer = "tsan",
+    tags = ["manual"],
+    target_compatible_with = ["//build/platforms:sanitizer_thread"],
+)
+
+instrumented_rust_std(
+    name = "tsan_rust_std",
+    rust_src = "@rust_nightly_src",
+    rust_tools = _RUST_TOOLS,
+    sanitizer = "thread",
+    tags = ["manual"],
+    target_compatible_with = ["//build/platforms:sanitizer_thread"],
+    target_triple = _TARGET_TRIPLE,
+    visibility = ["//src/rust/tsan-test:__pkg__"],
+)
+
+rust_toolchain(
+    name = "tsan_toolchain_impl",
+    allocator_library = "@rules_rust//ffi/rs:empty",
+    binary_ext = "",
+    cargo = _RUST_TOOLS + "//:cargo",
+    cargo_clippy = _RUST_TOOLS + "//:cargo_clippy_bin",
+    channel = "nightly",
+    clippy_driver = _RUST_TOOLS + "//:clippy_driver_bin",
+    default_edition = "2024",
+    dylib_ext = ".so",
+    exec_triple = _TARGET_TRIPLE,
+    extra_exec_rustc_flags = [],
+    extra_rustc_flags = ["-Ctarget-feature=+sse4.2,+pclmulqdq"],
+    iso_date = "2026-07-16",
+    linker = _RUST_TOOLS + "//:rust-lld",
+    linker_type = "direct",
+    llvm_cov = _RUST_TOOLS + "//:llvm_cov_bin",
+    llvm_lib = _RUST_TOOLS + "//:llvm_lib",
+    llvm_profdata = _RUST_TOOLS + "//:llvm_profdata_bin",
+    rust_doc = _RUST_TOOLS + "//:rustdoc",
+    rust_objcopy = _RUST_TOOLS + "//:rust-objcopy",
+    rust_std = ":tsan_rust_std",
+    rustc = _RUST_TOOLS + "//:rustc",
+    rustc_lib = ":nightly_rustc_lib",
+    rustfmt = _RUST_TOOLS + "//:rustfmt_bin",
+    staticlib_ext = ".a",
+    stdlib_linkflags = [
+        "-ldl",
+        "-lpthread",
+    ],
+    tags = ["manual"],
+    target_compatible_with = ["//build/platforms:sanitizer_thread"],
+    target_triple = _TARGET_TRIPLE,
+    version = "1.99.0",
+)
+
+toolchain(
+    name = "tsan_toolchain",
+    exec_compatible_with = [
+        "@platforms//cpu:x86_64",
+        "@platforms//os:linux",
+    ],
+    tags = ["manual"],
+    target_compatible_with = [
+        "@platforms//cpu:x86_64",
+        "@platforms//os:linux",
+        "//build/platforms:sanitizer_thread",
+    ],
+    target_settings = ["@rules_rust//rust/toolchain/channel:nightly"],
+    toolchain = ":tsan_toolchain_impl",
+    toolchain_type = "@rules_rust//rust:toolchain",
+)

build/rust/build_std.bzl

@@ -0,0 +1,136 @@
+"""Builds an instrumented Rust standard library for a rules_rust toolchain.
+
+rules_rust consumes prebuilt standard-library rlibs but does not implement Cargo's
+-Zbuild-std. This rule invokes Cargo as a Bazel action instead of reproducing
+Rust's internal crate graph as Bazel targets (which would introduce a toolchain
+cycle).
+"""
+
+load("@rules_rust//rust:toolchain.bzl", "rust_stdlib_filegroup")
+
+# rustc_lib contains host compiler libraries plus prebuilt target metadata. A
+# replacement toolchain must discard that metadata while retaining the runtime
+# archive needed when rustc links sanitizer-instrumented execution tools.
+def _compiler_runtime_files_impl(ctx):
+    sanitizer_runtime = "_rt.{}.a".format(ctx.attr.sanitizer)
+    return [DefaultInfo(files = depset([
+        file
+        for file in ctx.files.src
+        if "/lib/rustlib/" not in file.path or file.basename.endswith(sanitizer_runtime)
+    ]))]
+
+compiler_runtime_files = rule(
+    implementation = _compiler_runtime_files_impl,
+    attrs = {
+        "sanitizer": attr.string(mandatory = True),
+        "src": attr.label(mandatory = True, allow_files = True),
+    },
+)
+
+# Bazel must know the output names before Cargo assigns metadata hashes. Keep the
+# expected -Zbuild-std closure in one place and copy each artifact to a stable name.
+_STDLIB_CRATES = [
+    "addr2line",
+    "adler2",
+    "alloc",
+    "cfg_if",
+    "compiler_builtins",
+    "core",
+    "getopts",
+    "gimli",
+    "hashbrown",
+    "libc",
+    "memchr",
+    "miniz_oxide",
+    "object",
+    "panic_abort",
+    "panic_unwind",
+    "proc_macro",
+    "rustc_demangle",
+    "rustc_literal_escaper",
+    "rustc_std_workspace_alloc",
+    "rustc_std_workspace_core",
+    "rustc_std_workspace_std",
+    "std",
+    "std_detect",
+    "test",
+    "unwind",
+]
+
+def _rust_build_std_impl(ctx):
+    outputs = [
+        ctx.actions.declare_file("{}/lib{}_{}.rlib".format(ctx.label.name, crate, crate))
+        for crate in _STDLIB_CRATES
+    ]
+
+    output_dir = outputs[0].dirname
+    ctx.actions.run(
+        mnemonic = "RustBuildStd",
+        progress_message = "Building the Rust standard library with {} instrumentation".format(ctx.attr.sanitizer),
+        executable = ctx.executable._build_std,
+        arguments = [
+            ctx.executable.rustc.dirname.removesuffix("/bin"),
+            ctx.file.rust_src_manifest.dirname,
+            output_dir + "-target",
+            output_dir,
+            output_dir + "-work",
+            ctx.attr.target_triple,
+            ctx.attr.sanitizer,
+        ] + _STDLIB_CRATES,
+        inputs = depset(
+            ctx.files.rust_src + ctx.files.rust_toolchain_files,
+        ),
+        outputs = outputs,
+        tools = [ctx.executable.cargo, ctx.executable.rustc],
+    )
+
+    return [DefaultInfo(files = depset(outputs))]
+
+rust_build_std = rule(
+    implementation = _rust_build_std_impl,
+    attrs = {
+        "cargo": attr.label(mandatory = True, executable = True, allow_files = True, cfg = "exec"),
+        "rustc": attr.label(mandatory = True, executable = True, allow_files = True, cfg = "exec"),
+        "rust_src": attr.label(mandatory = True, allow_files = True),
+        "rust_src_manifest": attr.label(mandatory = True, allow_single_file = True),
+        "rust_toolchain_files": attr.label_list(mandatory = True, allow_files = True),
+        "sanitizer": attr.string(mandatory = True),
+        "target_triple": attr.string(mandatory = True),
+        "_build_std": attr.label(
+            default = Label("//build/rust:build_std.sh"),
+            executable = True,
+            allow_single_file = True,
+            cfg = "exec",
+        ),
+    },
+)
+
+def instrumented_rust_std(
+        name,
+        sanitizer,
+        target_triple,
+        rust_tools,
+        rust_src,
+        tags = None,
+        target_compatible_with = None,
+        visibility = None):
+    """Defines a rules_rust standard library instrumented by `sanitizer`."""
+    rust_build_std(
+        name = name + "_build",
+        cargo = rust_tools + "//:cargo",
+        rustc = rust_tools + "//:rustc",
+        rust_src = rust_src + "//:rust_src",
+        rust_src_manifest = rust_src + "//:library/Cargo.toml",
+        rust_toolchain_files = [rust_tools + "//:rustc_lib"],
+        sanitizer = sanitizer,
+        target_triple = target_triple,
+        tags = tags,
+        target_compatible_with = target_compatible_with,
+    )
+    rust_stdlib_filegroup(
+        name = name,
+        srcs = [":" + name + "_build"],
+        tags = tags,
+        target_compatible_with = target_compatible_with,
+        visibility = visibility,
+    )

build/rust/build_std.sh

@@ -0,0 +1,100 @@
+#!/usr/bin/env bash
+
+# Builds a sanitizer-instrumented Rust standard library for rules_rust.
+#
+# Arguments:
+#   RUST_TOOLCHAIN_ROOT  Toolchain containing rustc and Cargo.
+#   RUST_LIBRARY         Root of Rust's library source tree.
+#   TARGET_DIR           Cargo target directory.
+#   OUTPUT_DIR           Directory for stable-named rlibs declared to Bazel.
+#   WORK_DIR             Scratch directory for the generated Cargo package.
+#   TARGET_TRIPLE        Rust target triple.
+#   SANITIZER            rustc -Zsanitizer value.
+#   CRATE...             Standard-library crates declared as Bazel outputs.
+
+set -euo pipefail
+
+if [[ $# -lt 9 ]]; then
+  echo "usage: $0 RUST_TOOLCHAIN_ROOT RUST_LIBRARY TARGET_DIR OUTPUT_DIR WORK_DIR TARGET_TRIPLE SANITIZER CRATE..." >&2
+  exit 2
+fi
+
+rust_root=$(realpath "$1")
+rust_library=$(realpath "$2")
+target_dir=$(realpath -m "$3")
+output_dir=$(realpath -m "$4")
+work=$(realpath -m "$5")
+target_triple=$6
+sanitizer=$7
+shift 7
+crates=("$@")
+
+rm -rf "$target_dir" "$output_dir" "$work"
+mkdir -p "$work/src" "$work/cargo-home" "$output_dir"
+
+cat > "$work/Cargo.toml" <<'EOF'
+[package]
+name = "workerd-build-std"
+version = "0.0.0"
+edition = "2024"
+
+[profile.release]
+debug = true
+EOF
+
+cat > "$work/src/lib.rs" <<'EOF'
+#[test]
+fn build_std() {}
+EOF
+
+# rust-src includes the exact third-party sources selected by the standard
+# library's lockfile. Offline mode keeps this action hermetic.
+cat > "$work/cargo-home/config.toml" <<EOF
+[source.crates-io]
+replace-with = "vendored-sources"
+[source.vendored-sources]
+directory = "$rust_library/vendor"
+EOF
+
+export PATH="$rust_root/bin:$PATH"
+export RUSTC="$rust_root/bin/rustc"
+export CARGO_HOME="$work/cargo-home"
+export CARGO_NET_OFFLINE=true
+export CARGO_TARGET_DIR="$target_dir"
+# Cargo has no public override for rust-src's location. This test-only hook is
+# what Cargo itself uses to exercise -Zbuild-std against a separate source tree.
+export __CARGO_TESTS_ONLY_SRC_ROOT="$rust_library"
+
+# Cargo applies target-specific flags to the generated package and every
+# build-std dependency. The temporary test binary may use Rust's sanitizer
+# runtime; Bazel-built targets use -Zexternal-clangrt to share Clang's runtime
+# with C++ at their final link.
+env_name="CARGO_TARGET_${target_triple^^}_RUSTFLAGS"
+env_name=${env_name//-/_}
+export "$env_name=-Zsanitizer=$sanitizer -Zexternal-clangrt -Clinker=clang -Clink-arg=-fsanitize=$sanitizer"
+
+"$rust_root/bin/cargo" test \
+  --manifest-path "$work/Cargo.toml" \
+  --no-run \
+  --release \
+  --target "$target_triple" \
+  -Zbuild-std=std,panic_unwind,test \
+  -Zbuild-std-features=backtrace,panic-unwind
+
+deps="$target_dir/$target_triple/release/deps"
+copy_unique_rlib() {
+  local crate=$1
+  local destination=$2
+  local sources=()
+  mapfile -t sources < <(find "$deps" -maxdepth 1 -name "lib$crate-*.rlib" -print)
+  if [[ ${#sources[@]} -ne 1 ]]; then
+    echo "Cargo produced ${#sources[@]} rlibs for $crate; expected exactly one" >&2
+    printf '  %s\n' "${sources[@]}" >&2
+    exit 1
+  fi
+  cp "${sources[0]}" "$destination"
+}
+
+for crate in "${crates[@]}"; do
+  copy_unique_rlib "$crate" "$output_dir/lib${crate}_${crate}.rlib"
+done

src/rust/tsan-test/BUILD.bazel

@@ -0,0 +1,25 @@
+load("@rules_rust//rust:defs.bzl", "rust_binary")
+load("@rules_shell//shell:sh_test.bzl", "sh_test")
+
+rust_binary(
+    name = "race",
+    srcs = ["race.rs"],
+    edition = "2024",
+    target_compatible_with = select({
+        "//build/platforms:sanitizer_thread": [],
+        "//conditions:default": ["@platforms//:incompatible"],
+    }),
+)
+
+sh_test(
+    name = "tsan-integration-test",
+    srcs = ["verify.sh"],
+    data = [
+        ":race",
+        "//build/rust:tsan_rust_std",
+    ],
+    target_compatible_with = select({
+        "//build/platforms:sanitizer_thread": [],
+        "//conditions:default": ["@platforms//:incompatible"],
+    }),
+)