build: update LLVM to 14.0.0 (envoyproxy#21135)

Risk Level: Low
Testing: CI
Docs Changes: Added
Release Notes: Added
Platform Specific Features:

Signed-off-by: Keith Smiley <keithbsmiley@gmail.com>
Signed-off-by: Lizan Zhou <lizan@tetrate.io>

.bazelrc

@@ -208,9 +208,9 @@ build:rbe-toolchain-asan --linkopt -fuse-ld=lld
 build:rbe-toolchain-asan --action_env=ENVOY_UBSAN_VPTR=1
 build:rbe-toolchain-asan --copt=-fsanitize=vptr,function
 build:rbe-toolchain-asan --linkopt=-fsanitize=vptr,function
-build:rbe-toolchain-asan --linkopt=-L/opt/llvm/lib/clang/12.0.1/lib/linux
-build:rbe-toolchain-asan --linkopt=-l:libclang_rt.ubsan_standalone-x86_64.a
-build:rbe-toolchain-asan --linkopt=-l:libclang_rt.ubsan_standalone_cxx-x86_64.a
+build:rbe-toolchain-asan --linkopt='-L/opt/llvm/lib/clang/14.0.0/lib/x86_64-unknown-linux-gnu'
+build:rbe-toolchain-asan --linkopt=-l:libclang_rt.ubsan_standalone.a
+build:rbe-toolchain-asan --linkopt=-l:libclang_rt.ubsan_standalone_cxx.a
 
 build:rbe-toolchain-msan --linkopt=-L/opt/libcxx_msan/lib
 build:rbe-toolchain-msan --linkopt=-Wl,-rpath,/opt/libcxx_msan/lib
@@ -284,7 +284,7 @@ build:remote-clang-cl --config=rbe-toolchain-clang-cl
 
 # Docker sandbox
 # NOTE: Update this from https://github.com/envoyproxy/envoy-build-tools/blob/main/toolchains/rbe_toolchains_config.bzl#L8
-build:docker-sandbox --experimental_docker_image=envoyproxy/envoy-build-ubuntu:a37d5f539f04b44e284953b4a075826ead117279
+build:docker-sandbox --experimental_docker_image=envoyproxy/envoy-build-ubuntu:6fff5a6c67db843ddabde4533e24cab6122c7011
 build:docker-sandbox --spawn_strategy=docker
 build:docker-sandbox --strategy=Javac=docker
 build:docker-sandbox --strategy=Closure=docker

.bazelversion

@@ -1 +1 @@
-6.0.0-pre.20220414.2
+6.0.0-pre.20220421.3

.devcontainer/Dockerfile

@@ -1,4 +1,4 @@
-FROM gcr.io/envoy-ci/envoy-build:a37d5f539f04b44e284953b4a075826ead117279
+FROM gcr.io/envoy-ci/envoy-build:6fff5a6c67db843ddabde4533e24cab6122c7011
 
 ARG USERNAME=vscode
 ARG USER_UID=501

bazel/README.md

@@ -349,8 +349,8 @@ for more details.
 
 ## Supported compiler versions
 
-We now require Clang >= 5.0 due to known issues with std::string thread safety and C++14 support. GCC >= 7 is also
-known to work. Currently the CI is running with Clang 10.
+We now require Clang >= 9 due to C++17 support and tcmalloc requirement. GCC >= 9 is also known to work.
+Currently the CI is running with Clang 14.
 
 ## Clang STL debug symbols
 
@@ -921,7 +921,7 @@ Note that if you run the `check_spelling.py` script you will need to have `aspel
 Edit the paths shown here to reflect the installation locations on your system:
 
 ```shell
-export CLANG_FORMAT="$HOME/ext/clang+llvm-12.0.1-x86_64-linux-gnu-ubuntu-16.04/bin/clang-format"
+export CLANG_FORMAT="$HOME/ext/clang+llvm-14.0.0-x86_64-linux-gnu-ubuntu-18.04/bin/clang-format"
 export BUILDIFIER_BIN="/usr/bin/buildifier"
 ```
 

bazel/foreign_cc/BUILD

@@ -493,7 +493,7 @@ envoy_cmake(
         # Workaround for the -DDEBUG flag added in fastbuild on macOS,
         # which conflicts with DEBUG macro used in LLVM.
         "CFLAGS": "-UDEBUG",
-        "CXXFLAGS": "-UDEBUG",
+        "CXXFLAGS": "-UDEBUG -Wno-error=unused-but-set-variable",
         "ASMFLAGS": "-UDEBUG",
     },
     lib_source = "@com_github_wavm_wavm//:all",

bazel/repository_locations.bzl

@@ -64,11 +64,11 @@ REPOSITORY_LOCATIONS_SPEC = dict(
         project_name = "envoy-build-tools",
         project_desc = "Common build tools shared by the Envoy/UDPA ecosystem",
         project_url = "https://github.com/envoyproxy/envoy-build-tools",
-        version = "b37b15362fbea9de808e9a40f6978bfa7cc8abfc",
-        sha256 = "009651fc5e3f99da90990cd2e07550fa9db0e0d947cc846f39e23c8d20e8c433",
+        version = "afae694ee4b0036ee645db50ee2d972ee99c0ae5",
+        sha256 = "1c7502d489b9b36076fd338e2032e17a0c9cc9809048683a2e32ad8345445723",
         strip_prefix = "envoy-build-tools-{version}",
         urls = ["https://github.com/envoyproxy/envoy-build-tools/archive/{version}.tar.gz"],
-        release_date = "2022-04-11",
+        release_date = "2022-05-05",
         use_category = ["build"],
     ),
     boringssl = dict(
@@ -980,12 +980,12 @@ REPOSITORY_LOCATIONS_SPEC = dict(
         project_name = "compiler-rt",
         project_desc = "LLVM compiler runtime library",
         project_url = "https://compiler-rt.llvm.org",
-        version = "12.0.1",
-        sha256 = "b4c8d5f2a802332987c1c0a95b5afb35b1a66a96fe44add4e4ed4792c4cba0a4",
+        version = "14.0.0",
+        sha256 = "27ab7fcfb21d108093c0be766a9ed5fe18c04e4f74f936069711a312c8ae0377",
         # Only allow peeking at fuzzer related files for now.
         strip_prefix = "compiler-rt-{version}.src",
         urls = ["https://github.com/llvm/llvm-project/releases/download/llvmorg-{version}/compiler-rt-{version}.src.tar.xz"],
-        release_date = "2021-07-09",
+        release_date = "2022-03-23",
         use_category = ["test_only"],
         cpe = "cpe:2.3:a:llvm:compiler-rt:*",
     ),

bazel/setup_clang.sh

@@ -12,7 +12,7 @@ fi
 PATH="$("${LLVM_PREFIX}"/bin/llvm-config --bindir):${PATH}"
 export PATH
 
-RT_LIBRARY_PATH="$(dirname "$(find "$(llvm-config --libdir)" -name libclang_rt.ubsan_standalone_cxx-x86_64.a | head -1)")"
+RT_LIBRARY_PATH="$(llvm-config --libdir)/clang/$(llvm-config --version)/lib/$(llvm-config --host-target)"
 
 echo "# Generated file, do not edit. If you want to disable clang, just delete this file.
 build:clang --action_env='PATH=${PATH}'
@@ -27,6 +27,6 @@ build:clang-asan --action_env=ENVOY_UBSAN_VPTR=1
 build:clang-asan --copt=-fsanitize=vptr,function
 build:clang-asan --linkopt=-fsanitize=vptr,function
 build:clang-asan --linkopt='-L${RT_LIBRARY_PATH}'
-build:clang-asan --linkopt=-l:libclang_rt.ubsan_standalone-x86_64.a
-build:clang-asan --linkopt=-l:libclang_rt.ubsan_standalone_cxx-x86_64.a
-" > "${BAZELRC_FILE}"
+build:clang-asan --linkopt=-l:libclang_rt.ubsan_standalone.a
+build:clang-asan --linkopt=-l:libclang_rt.ubsan_standalone_cxx.a
+" >"${BAZELRC_FILE}"

changelogs/current.yaml

@@ -97,6 +97,9 @@ new_features:
 - area: ratelimit
   change: |
     added support for :ref:`masked_remote_address <envoy_v3_api_field_config.route.v3.RateLimit.Action.masked_remote_address>`.
+- area: build
+  change: |
+    official released binary is now built with Clang 14.0.0.
 
 deprecated:
 - area: dubbo_proxy

ci/README.md

@@ -32,8 +32,8 @@ running tests that reflects the latest built Windows 2019 Envoy image.
 Currently there are three build images for Linux and one for Windows:
 
 * `envoyproxy/envoy-build` — alias to `envoyproxy/envoy-build-ubuntu`.
-* `envoyproxy/envoy-build-ubuntu` — based on Ubuntu 18.04 (Bionic) with GCC 9 and Clang 10 compiler.
-* `envoyproxy/envoy-build-centos` — based on CentOS 7 with GCC 9 and Clang 10 compiler, this image is experimental and not well tested.
+* `envoyproxy/envoy-build-ubuntu` — based on Ubuntu 18.04 (Bionic) with GCC 9 and Clang 14 compiler.
+* `envoyproxy/envoy-build-centos` — based on CentOS 7 with GCC 9 and Clang 14 compiler, this image is experimental and not well tested.
 * `envoyproxy/envoy-build-windows2019` — based on Windows ltsc2019 with VS 2019 Build Tools, as well as LLVM.
 
 The source for these images is located in the [envoyproxy/envoy-build-tools](https://github.com/envoyproxy/envoy-build-tools)

contrib/hyperscan/matching/input_matchers/source/BUILD

@@ -27,6 +27,9 @@ envoy_cmake(
         "CMAKE_INSTALL_LIBDIR": "lib",
         "RAGEL": "$EXT_BUILD_DEPS/ragel/bin/ragel",
     },
+    env = {
+        "CXXFLAGS": "-Wno-error=unused-but-set-variable -Wno-error=bitwise-instead-of-logical",
+    },
     lib_source = "@io_hyperscan//:all",
     out_static_libs = ["libhs.a"],
     tags = ["skip_on_windows"],

examples/wasm-cc/docker-compose-wasm.yaml

@@ -2,7 +2,7 @@ version: "3.8"
 
 services:
   wasm_compile_update:
-    image: envoyproxy/envoy-build-ubuntu:a37d5f539f04b44e284953b4a075826ead117279
+    image: envoyproxy/envoy-build-ubuntu:6fff5a6c67db843ddabde4533e24cab6122c7011
     command: |
       bash -c "bazel build //examples/wasm-cc:envoy_filter_http_wasm_updated_example.wasm && cp -a bazel-bin/examples/wasm-cc/* /build"
     working_dir: /source
@@ -11,7 +11,7 @@ services:
     - ./lib:/build
 
   wasm_compile:
-    image: envoyproxy/envoy-build-ubuntu:a37d5f539f04b44e284953b4a075826ead117279
+    image: envoyproxy/envoy-build-ubuntu:6fff5a6c67db843ddabde4533e24cab6122c7011
     command: |
       bash -c "bazel build //examples/wasm-cc:envoy_filter_http_wasm_example.wasm && cp -a bazel-bin/examples/wasm-cc/* /build"
     working_dir: /source

test/common/http/header_map_impl_test.cc

@@ -424,9 +424,8 @@ TEST_P(HeaderMapImplTest, AllInlineHeaders) {
     INLINE_REQ_RESP_STRING_HEADERS(TEST_INLINE_STRING_HEADER_FUNCS)
   }
   {
-    // No request trailer O(1) headers.
-  }
-  {
+      // No request trailer O(1) headers.
+  } {
     auto header_map = ResponseHeaderMapImpl::create();
     INLINE_RESP_STRING_HEADERS(TEST_INLINE_STRING_HEADER_FUNCS)
     INLINE_REQ_RESP_STRING_HEADERS(TEST_INLINE_STRING_HEADER_FUNCS)

test/per_file_coverage.sh

@@ -4,8 +4,8 @@
 # for existing directories with low coverage.
 declare -a KNOWN_LOW_COVERAGE=(
 "source/common:96.0"
-"source/common/api:82.5"
-"source/common/api/posix:81.7"
+"source/common/api:82.2"
+"source/common/api/posix:81.3"
 "source/common/common:96.2"
 "source/common/common/posix:92.7"
 "source/common/config:96.5"
@@ -22,9 +22,11 @@ declare -a KNOWN_LOW_COVERAGE=(
 "source/common/protobuf:94.8"
 "source/common/quic:91.8"
 "source/common/router:96.3"
+"source/common/runtime:96.4"
 "source/common/secret:94.9"
 "source/common/signal:86.9" # Death tests don't report LCOV
 "source/common/singleton:95.7"
+"source/common/stats:96.5"
 "source/common/tcp:90.6"
 "source/common/thread:0.0" # Death tests don't report LCOV
 "source/common/tracing:96.1"
@@ -66,13 +68,15 @@ declare -a KNOWN_LOW_COVERAGE=(
 "source/extensions/health_checkers/redis:95.7"
 "source/extensions/io_socket:96.2"
 "source/extensions/io_socket/user_space:96.2"
+"source/extensions/rate_limit_descriptors:95.5"
+"source/extensions/rate_limit_descriptors/expr:95.5"
 "source/extensions/stat_sinks/common:96.4"
 "source/extensions/stat_sinks/common/statsd:96.4"
 "source/extensions/stat_sinks/graphite_statsd:75.0"
 "source/extensions/stat_sinks/statsd:76.9"
-"source/extensions/tracers/opencensus:94.8"
+"source/extensions/tracers/opencensus:93.2"
 "source/extensions/tracers/xray:96.2"
-"source/extensions/tracers/zipkin:95.9"
+"source/extensions/tracers/zipkin:95.8"
 "source/extensions/transport_sockets:95.2"
 "source/extensions/transport_sockets/tls:94.2"
 "source/extensions/transport_sockets/tls/cert_validator:94.9"

test/run_envoy_bazel_coverage.sh

@@ -2,7 +2,7 @@
 
 set -e
 
-LLVM_VERSION="12.0.1"
+LLVM_VERSION="14.0.0"
 CLANG_VERSION=$(clang --version | grep version | sed -e 's/\ *clang version \(.*\)\ */\1/')
 LLVM_COV_VERSION=$(llvm-cov --version | grep version | sed -e 's/\ *LLVM version \(.*\)/\1/')
 LLVM_PROFDATA_VERSION=$(llvm-profdata show --version | grep version | sed -e 's/\ *LLVM version \(.*\)/\1/')

tools/code_format/check_format.py

@@ -146,7 +146,7 @@
     "./api/bazel/envoy_http_archive.bzl",
 )
 
-CLANG_FORMAT_PATH = os.getenv("CLANG_FORMAT", "clang-format-12")
+CLANG_FORMAT_PATH = os.getenv("CLANG_FORMAT", "clang-format-14")
 BUILDIFIER_PATH = paths.get_buildifier()
 BUILDOZER_PATH = paths.get_buildozer()
 ENVOY_BUILD_FIXER_PATH = os.path.join(
@@ -308,9 +308,9 @@ def check_tools(self):
                 "installed, but the binary name is different or it's not available in "
                 "PATH, please use CLANG_FORMAT environment variable to specify the path. "
                 "Examples:\n"
-                "    export CLANG_FORMAT=clang-format-12.0.1\n"
-                "    export CLANG_FORMAT=/opt/bin/clang-format-12\n"
-                "    export CLANG_FORMAT=/usr/local/opt/llvm@12/bin/clang-format".format(
+                "    export CLANG_FORMAT=clang-format-14.0.0\n"
+                "    export CLANG_FORMAT=/opt/bin/clang-format-14\n"
+                "    export CLANG_FORMAT=/usr/local/opt/llvm@14/bin/clang-format".format(
                     CLANG_FORMAT_PATH))
 
         def check_bazel_tool(name, path, var):