Add LLVM 22 ASan CI coverage and fix the issues it surfaced.

Add an ubu24-clang22-runtime22-asan row that consumes the llvm-asan
recipe from compiler-research/ci-workflows. Three consumer-side build
gaps had to be closed to let clad link against the recipe toolchain:
CMAKE_C_COMPILER/CMAKE_C_FLAGS are now swapped symmetrically with their
CXX counterparts for the unittests subdir (gtest otherwise configured
with a mixed toolchain); CMAKE_POSITION_INDEPENDENT_CODE is forced ON
(the sanitizer recipe's _INIT plumbing weakened LLVM's default -fPIC
enough that libcladDifferentiator.a ended up non-PIC and hit an
R_X86_64_PC32 link error); and clad_externalproject_add strips
-fsanitize=* from the flags it forwards, as CppInterOp does, so the
recipe -- which ships no libclang_rt -- can be consumed at all.

Two latent crashes surfaced once the sanitizer runtime started
shipping. clang::NestedNameSpecifier()'s default ctor builds
FlagKind::Invalid in clang 22 (Null is the std::nullopt ctor), so three
compat wrappers that used it for "no qualifier" produced an NNS that
converted to bool true and UNREACHABLE'd inside getKind(); they now use
the null sentinel. And cloneFunction's RebuildEnclosingNamespaces leaked
one clang::Scope per enclosing namespace because the outer
SaveAndRestore<Scope*> restored the pointer without deleting the chain;
cloneFunction now returns an RAII ClonedFunction that pops the scopes
(and their DeclContext pushes) in its destructor. CreateDerivativeOverload
and CreateVectorModeOverload, which rebuild the same namespaces while the
caller's handle is still live, bracket their state with SaveAndRestore so
the outer handle does not pop past the TU and crash.

Two hygiene changes round it out: DifferentiationOptions uses plain
default-initialised bool instead of `: 1` bit-fields (the packed ctor
did a read-modify-write of still-uninitialised storage bytes), and clad
resolves its own plugin path from a clad-owned symbol -- dladdr on POSIX,
GetModuleHandleExA + GetModuleFileNameA on Windows -- rather than
scraping FrontendOpts().Plugins. <windows.h> is included with NOMINMAX so
its min/max macros do not mangle std::numeric_limits<>::max() in
llvm/ADT/Sequence.h.

MSan is intentionally left out: clad runs as an in-process plugin inside
a clang whose own code is not uniformly instrumented, so every std object
crossing the clang->clad.so boundary reads as poisoned. Sound MSan
coverage needs clad statically linked into an instrumented clang, which
is follow-up infrastructure.

Author: vgvassilev

.github/workflows/ci.yml

@@ -44,6 +44,7 @@ jobs:
           - { name: ubu24-clang19-runtime20, os: ubuntu-24.04, compiler: clang-19, clang-runtime: '20' }
           - { name: ubu24-clang20-runtime21, os: ubuntu-24.04, compiler: clang-20, clang-runtime: '21' }
           - { name: ubu24-clang20-runtime22, os: ubuntu-24.04, compiler: clang-20, clang-runtime: '22' }
+          - { name: ubu24-clang22-runtime22-asan, os: ubuntu-24.04, compiler: clang-22, clang-runtime: '22', flavor: asan, extra_cmake_options: '-DLLVM_USE_SANITIZER=Address' }
           # --- MACOS: Last 5 Runtimes (17-21) ---
           # Using macOS ARM (standard) for all; Runtime 17 on Intel for x86 sanity
           - { name: osx-intel-runtime17, os: macos-15-intel, compiler: clang, clang-runtime: '17' }

CMakeLists.txt

@@ -7,6 +7,8 @@ endif()
 enable_language(CXX)
 set(CMAKE_CXX_EXTENSIONS NO)
 set(CMAKE_EXPORT_COMPILE_COMMANDS ON)
+# clad.so links libcladDifferentiator.a; every target must be PIC.
+set(CMAKE_POSITION_INDEPENDENT_CODE ON)
 include(GNUInstallDirs)
 
 # MUST be done before call to clad project
@@ -334,14 +336,20 @@ if (NOT CLAD_BUILD_STATIC_ONLY)
     # need to use a supported by clad compiler. Note that's a huge hack and it is
     # not guaranteed to work with cmake.
     set(stored_cxx_compiler ${CMAKE_CXX_COMPILER})
+    set(stored_c_compiler ${CMAKE_C_COMPILER})
     set(stored_cxx_flags ${CMAKE_CXX_FLAGS})
     set(stored_c_flags ${CMAKE_C_FLAGS})
     # FIXME: Remove when vgvassilev/clad#1665 is resolved.
     disable_werror(CMAKE_CXX_FLAGS CMAKE_C_FLAGS)
+    # Swap both C and C++ -- clad_externalproject_add forwards both,
+    # so a CXX-only swap leaves gtest with a mixed toolchain.
     set(CMAKE_CXX_COMPILER ${LLVM_TOOLS_BINARY_DIR}/clang)
-    # Filter some unsupported flags by clang.
-    string(REPLACE "-fno-lifetime-dse" "" CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS}")
-    string(REPLACE "-Wno-class-memaccess" "" CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS}")
+    set(CMAKE_C_COMPILER ${LLVM_TOOLS_BINARY_DIR}/clang)
+    # Drop GCC-only flags now that both C and CXX route through clang.
+    foreach(_flags CMAKE_CXX_FLAGS CMAKE_C_FLAGS)
+      string(REPLACE "-fno-lifetime-dse" "" ${_flags} "${${_flags}}")
+      string(REPLACE "-Wno-class-memaccess" "" ${_flags} "${${_flags}}")
+    endforeach()
   endif()
 
   if (NOT CLAD_DISABLE_TESTS)
@@ -355,8 +363,9 @@ if (NOT CLAD_BUILD_STATIC_ONLY)
   endif(CLAD_ENABLE_BENCHMARKS)
 
   if (stored_cxx_compiler)
-    # Restore the default compiler.
+    # Restore the default compilers.
     set(CMAKE_CXX_COMPILER ${stored_cxx_compiler})
+    set(CMAKE_C_COMPILER ${stored_c_compiler})
     set(CMAKE_CXX_FLAGS ${stored_cxx_flags})
     set(CMAKE_C_FLAGS ${stored_c_flags})
   endif()

cmake/modules/AddClad.cmake

@@ -234,6 +234,15 @@ function(clad_externalproject_add NAME)
   remove_coverage_flags(C_FLAGS_EXT CXX_FLAGS_EXT SHARED_CREATE_CXX_FLAGS_EXT EXE_LINKER_FLAGS_EXT SHARED_LINKER_FLAGS_EXT)
   disable_werror(C_FLAGS_EXT CXX_FLAGS_EXT)
 
+
+  # Strip sanitizer flags: 3rd-party externals build with cmake
+  # defaults; the parent keeps its -fsanitize=* from LLVM_USE_SANITIZER.
+  foreach(_flags C_FLAGS_EXT CXX_FLAGS_EXT)
+    foreach(_san "-fsanitize=address" "-fsanitize=undefined" "-fsanitize=memory")
+      string(REPLACE "${_san}" "" ${_flags} "${${_flags}}")
+    endforeach()
+  endforeach()
+
   # Everything EXCEPT EXTRA_CMAKE_ARGS gets forwarded unchanged
   set(FORWARDED_ARGS ${ARG_UNPARSED_ARGUMENTS})
 

include/clad/Differentiator/Compatibility.h

@@ -251,7 +251,9 @@ inline bool hasNNSPrefix(clang::NestedNameSpecifier NS) {
 inline clang::NestedNameSpecifier getNNSPrefix(clang::NestedNameSpecifier NS) {
   if (NS.getKind() == clang::NestedNameSpecifier::Kind::Namespace)
     return NS.getAsNamespaceAndPrefix().Prefix;
-  return clang::NestedNameSpecifier();
+  // Null (std::nullopt), not the default ctor's FlagKind::Invalid, which
+  // would later UNREACHABLE in getKind() if anyone inspected it.
+  return std::nullopt;
 }
 
 // Clang 22 (llvm/llvm-project#147835): keyword + qualifier ride inline
@@ -290,8 +292,8 @@ inline clang::QualType getElaboratedType(clang::ASTContext& C,
 // Clang 22: getRecordType -> getTagType with default keyword/qualifier.
 inline clang::QualType getRecordType(clang::ASTContext& C,
                                      const clang::RecordDecl* RD) {
-  return C.getTagType(clang::ElaboratedTypeKeyword::None,
-                      clang::NestedNameSpecifier(), RD, /*OwnsTag=*/false);
+  return C.getTagType(clang::ElaboratedTypeKeyword::None, std::nullopt, RD,
+                      /*OwnsTag=*/false);
 }
 
 // Clang 22: TagDecl::getTypeForDecl() was deleted; use
@@ -351,8 +353,8 @@ inline clang::QualType getTypeDeclType(clang::ASTContext& C,
 #if CLANG_VERSION_MAJOR < 22
   return C.getTypeDeclType(TD);
 #else
-  return C.getTypeDeclType(clang::ElaboratedTypeKeyword::None,
-                           clang::NestedNameSpecifier(), TD);
+  return C.getTypeDeclType(clang::ElaboratedTypeKeyword::None, std::nullopt,
+                           TD);
 #endif
 }
 

include/clad/Differentiator/DerivativeBuilder.h

@@ -53,12 +53,36 @@ namespace clad {
 namespace clad {
 class ErrorEstimationHandler;
 
-/// A pair of FunctionDecl and potential enclosing context, e.g. a function
-/// in nested namespaces.
-// This is the type returned by cloneFunction. Using OverloadedDeclWithContext
-// instead would lead to unnecessarily returning a nullptr in the overloaded
-// FD
-using DeclWithContext = std::pair<clang::FunctionDecl*, clang::Decl*>;
+class VisitorBase;
+
+/// RAII handle for a cloned derivative function. cloneFunction opens one
+/// clang::Scope and pushes one DeclContext per enclosing namespace of the
+/// original function; ClonedFunction owns those and pops them on
+/// destruction. The contained FunctionDecl* is independently AST-owned,
+/// so callers may keep using it after the handle goes away.
+///
+/// The handle is neither copyable nor movable: cloneFunction returns it by
+/// value, but under C++17 guaranteed copy elision the prvalue constructs the
+/// caller's object directly (ClonedFunction r = cloneFunction(...)), so no
+/// move is ever performed and none needs to exist.
+class ClonedFunction {
+  VisitorBase* m_Owner = nullptr;
+  unsigned m_NamespaceCount = 0;
+
+public:
+  clang::FunctionDecl* fd = nullptr;
+
+  ClonedFunction(VisitorBase& VB, unsigned NamespaceCount,
+                 clang::FunctionDecl* FD)
+      : m_Owner(&VB), m_NamespaceCount(NamespaceCount), fd(FD) {}
+
+  ClonedFunction(const ClonedFunction&) = delete;
+  ClonedFunction& operator=(const ClonedFunction&) = delete;
+  ClonedFunction(ClonedFunction&&) = delete;
+  ClonedFunction& operator=(ClonedFunction&&) = delete;
+  ~ClonedFunction();
+};
+
 /// Stores derivative and the corresponding overload. If no overload exist
 /// then `second` data member should be `nullptr`.
 struct DerivativeAndOverload {
@@ -95,11 +119,11 @@ struct DerivativeAndOverload {
     /// A flag to keep track of whether error diagnostics are requested by user
     /// for numerical differentiation.
     bool m_PrintNumericalDiffErrorDiag = false;
-    DeclWithContext cloneFunction(const clang::FunctionDecl* FD,
-                                  clad::VisitorBase& VB, clang::DeclContext* DC,
-                                  clang::SourceLocation& noLoc,
-                                  clang::DeclarationNameInfo name,
-                                  clang::QualType functionType);
+    ClonedFunction cloneFunction(const clang::FunctionDecl* FD,
+                                 clad::VisitorBase& VB, clang::DeclContext* DC,
+                                 clang::SourceLocation& noLoc,
+                                 clang::DeclarationNameInfo name,
+                                 clang::QualType functionType);
     /// Looks for a suitable overload for a given function.
     ///
     /// \param[in] Name The identification information of the function

include/clad/Differentiator/VisitorBase.h

@@ -654,8 +654,16 @@ namespace clad {
     /// modes.
     clang::FunctionDecl*
     CreateDerivativeOverload(clang::FunctionDecl derivative);
-    /// Rebuild a sequence of nested namespaces ending with DC.
-    clang::NamespaceDecl* RebuildEnclosingNamespaces(clang::DeclContext* DC);
+    /// Rebuild a sequence of nested namespaces ending with DC and return
+    /// how many were opened. Each opens a Scope that the caller (via
+    /// ClonedFunction's RAII handle) must balance with the same count
+    /// passed to popEnclosingNamespaceScopes -- otherwise the Scope
+    /// objects leak when SaveAndRestore restores the outer Scope*.
+    unsigned RebuildEnclosingNamespaces(clang::DeclContext* DC);
+
+    /// Pop N namespace Scopes (and their matching DeclContext pushes).
+    /// Used only by ClonedFunction's destructor.
+    void popEnclosingNamespaceScopes(unsigned N);
     /// Clones a statement
     clang::Stmt* Clone(const clang::Stmt* S);
     /// A shorthand to simplify cloning of expressions.

lib/Differentiator/BaseForwardModeVisitor.cpp

@@ -157,9 +157,11 @@ DerivativeAndOverload BaseForwardModeVisitor::Derive() {
 
   m_Sema.CurContext = DC;
   QualType derivedFnType = GetDerivativeType();
-  DeclWithContext result =
+  // `result` owns the namespace Scopes cloneFunction opens; its
+  // destructor pops them before SaveScope restores.
+  ClonedFunction result =
       m_Builder.cloneFunction(FD, *this, DC, validLoc, name, derivedFnType);
-  FunctionDecl* derivedFD = result.first;
+  FunctionDecl* derivedFD = result.fd;
   m_Derivative = derivedFD;
 
   // Function declaration scope
@@ -232,7 +234,7 @@ DerivativeAndOverload BaseForwardModeVisitor::Derive() {
 
   endScope(); // Function decl scope
 
-  return DerivativeAndOverload{result.first,
+  return DerivativeAndOverload{result.fd,
                                /*OverloadFunctionDecl=*/nullptr};
 }
 

lib/Differentiator/DerivativeBuilder.cpp

@@ -24,6 +24,7 @@
 #include "clad/Differentiator/Timers.h"
 #include "clad/Differentiator/VectorForwardModeVisitor.h"
 #include "clad/Differentiator/VectorPushForwardModeVisitor.h"
+#include "clad/Differentiator/VisitorBase.h"
 
 #include "clang/AST/ASTContext.h"
 #include "clang/AST/Attr.h"
@@ -49,7 +50,6 @@
 #include <cstddef>
 #include <memory>
 #include <string>
-#include <utility>
 
 using namespace clang;
 
@@ -113,12 +113,14 @@ static void registerDerivative(Decl* D, Sema& S, const DiffRequest& R) {
     return false;
   }
 
-  DeclWithContext DerivativeBuilder::cloneFunction(
+  ClonedFunction DerivativeBuilder::cloneFunction(
       const clang::FunctionDecl* FD, clad::VisitorBase& VB,
       clang::DeclContext* DC, clang::SourceLocation& noLoc,
       clang::DeclarationNameInfo name, clang::QualType functionType) {
     FunctionDecl* returnedFD = nullptr;
-    NamespaceDecl* enclosingNS = nullptr;
+    // Count of namespace Scopes RebuildEnclosingNamespaces opens for
+    // this clone -- the returned handle pops exactly that many.
+    unsigned NamespaceCount = 0;
     TypeSourceInfo* TSI = m_Context.getTrivialTypeSourceInfo(functionType);
     if (isa<CXXMethodDecl>(FD)) {
       CXXRecordDecl* CXXRD = cast<CXXRecordDecl>(DC);
@@ -136,7 +138,7 @@ static void registerDerivative(Decl* D, Sema& S, const DiffRequest& R) {
       returnedFD->setAccess(AS_public);
     } else {
       assert (isa<FunctionDecl>(FD) && "Unexpected!");
-      enclosingNS = VB.RebuildEnclosingNamespaces(DC);
+      NamespaceCount = VB.RebuildEnclosingNamespaces(DC);
 
       auto TrailingRequiresClause =
           CLAD_COMPAT_CLANG21_getTrailingRequiresClause(FD);
@@ -167,7 +169,14 @@ static void registerDerivative(Decl* D, Sema& S, const DiffRequest& R) {
       }
     }
 
-    return { returnedFD, enclosingNS };
+    return ClonedFunction{VB, NamespaceCount, returnedFD};
+  }
+
+  // The destructor is defined here so the header can hold just a forward
+  // declaration of VisitorBase.
+  ClonedFunction::~ClonedFunction() {
+    if (m_Owner)
+      m_Owner->popEnclosingNamespaceScopes(m_NamespaceCount);
   }
 
   // This method is derived from the source code of both

lib/Differentiator/HessianModeVisitor.cpp

@@ -239,9 +239,11 @@ DerivativeAndOverload HessianModeVisitor::Derive() {
                                            getEnclosingNamespaceOrTUScope());
     m_Sema.CurContext = DC;
 
-    DeclWithContext result = m_Builder.cloneFunction(
+    // `result` owns the namespace Scopes cloneFunction opens; its
+    // destructor pops them before SaveScope restores.
+    ClonedFunction result = m_Builder.cloneFunction(
         m_DiffReq.Function, *this, DC, noLoc, name, hessianFunctionType);
-    FunctionDecl* hessianFD = result.first;
+    FunctionDecl* hessianFD = result.fd;
 
     beginScope(Scope::FunctionPrototypeScope | Scope::FunctionDeclarationScope |
                Scope::DeclScope);
@@ -392,7 +394,7 @@ DerivativeAndOverload HessianModeVisitor::Derive() {
     m_Sema.PopDeclContext();
     endScope(); // Function decl scope
 
-    return DerivativeAndOverload{result.first,
+    return DerivativeAndOverload{result.fd,
                                  /*OverloadFunctionDecl=*/nullptr};
   }
 } // end namespace clad

lib/Differentiator/JacobianModeVisitor.cpp

@@ -36,19 +36,22 @@ DerivativeAndOverload JacobianModeVisitor::Derive() {
 
   QualType vectorDiffFunctionType = GetDerivativeType();
 
+  // Save Sema state before cloneFunction mutates it.
+  llvm::SaveAndRestore<DeclContext*> SaveContext(m_Sema.CurContext);
+  llvm::SaveAndRestore<Scope*> SaveScope(getCurrentScope());
   // Create the function declaration for the derivative.
   // FIXME: We should not use const_cast to get the decl context here.
   // NOLINTNEXTLINE(cppcoreguidelines-pro-type-const-cast)
   auto* DC = const_cast<DeclContext*>(m_DiffReq->getDeclContext());
   m_Sema.CurContext = DC;
-  DeclWithContext result = m_Builder.cloneFunction(
+  // `result` owns the namespace Scopes cloneFunction opens; its
+  // destructor pops them before SaveScope restores.
+  ClonedFunction result = m_Builder.cloneFunction(
       m_DiffReq.Function, *this, DC, loc, name, vectorDiffFunctionType);
-  FunctionDecl* vectorDiffFD = result.first;
+  FunctionDecl* vectorDiffFD = result.fd;
   m_Derivative = vectorDiffFD;
 
   // Function declaration scope
-  llvm::SaveAndRestore<DeclContext*> SaveContext(m_Sema.CurContext);
-  llvm::SaveAndRestore<Scope*> SaveScope(getCurrentScope());
   beginScope(Scope::FunctionPrototypeScope | Scope::FunctionDeclarationScope |
              Scope::DeclScope);
   m_Sema.PushFunctionScope();