From dff13b41c9932ee871f4d1e700c0e1ab8e27edff Mon Sep 17 00:00:00 2001
From: Mitchell Hashimoto <m@mitchellh.com>
Date: Fri, 21 Aug 2026 07:55:09 -0700
Subject: [PATCH] pkg/{afl++,wuffs}: fix builds for CI

---
 pkg/afl++/build.zig | 24 +++++++++++++++++++-----
 pkg/wuffs/build.zig |  8 +++++++-
 2 files changed, 26 insertions(+), 6 deletions(-)

diff --git a/pkg/afl++/build.zig b/pkg/afl++/build.zig
index 9f6f70e96..42e514a0b 100644
--- a/pkg/afl++/build.zig
+++ b/pkg/afl++/build.zig
@@ -9,11 +9,6 @@ pub fn addInstrumentedExe(
     b: *std.Build,
     obj: *std.Build.Step.Compile,
 ) std.Build.LazyPath {
-    // Force the build system to produce the binary artifact even though we
-    // only consume the LLVM bitcode below. Without this, the dependency
-    // tracking doesn't wire up correctly.
-    _ = obj.getEmittedBin();
-
     const pkg = b.dependencyFromBuildZig(
         @This(),
         .{},
@@ -34,6 +29,25 @@ pub fn addInstrumentedExe(
     const fuzz_exe = afl_cc.addOutputFileArg(obj.name);
     afl_cc.addFileArg(pkg.path("afl.c"));
     afl_cc.addFileArg(obj.getEmittedLlvmBc());
+
+    // The LLVM bitcode only contains the Zig code in the compilation.
+    // C source files in the module graph are compiled to native objects
+    // that live only in the static archive, so link the archive after
+    // the bitcode to resolve those symbols. The archive members holding
+    // the Zig code are never pulled in (and so can't conflict) because
+    // the bitcode object already defines every symbol they provide.
+    // Those C objects are built with UBSan in debug modes and we link
+    // with an external compiler that doesn't provide Zig's ubsan
+    // runtime, so it must be bundled. The ubsan runtime uses f128
+    // conversion builtins that the external compiler's runtime may not
+    // provide (e.g. Apple's), so Zig's compiler-rt must be bundled too.
+    // The archive members must also be built as PIC since external
+    // compilers typically default to PIE executables.
+    obj.bundle_ubsan_rt = true;
+    obj.bundle_compiler_rt = true;
+    obj.root_module.pic = true;
+    afl_cc.addFileArg(obj.getEmittedBin());
+
     return fuzz_exe;
 }
 
diff --git a/pkg/wuffs/build.zig b/pkg/wuffs/build.zig
index edda0aac6..2ae45585f 100644
--- a/pkg/wuffs/build.zig
+++ b/pkg/wuffs/build.zig
@@ -71,7 +71,13 @@ pub fn build(b: *std.Build) !void {
         var flags: std.ArrayList([]const u8) = .empty;
         defer flags.deinit(b.allocator);
         try flags.append(b.allocator, "-DWUFFS_IMPLEMENTATION");
-        if (target.result.abi == .msvc) {
+
+        // Disable ubsan on Windows to avoid undefined __ubsan_handle_*
+        // references: Zig's ubsan runtime can't be bundled on Windows
+        // (its /exclude-symbols directives break the MSVC linker), so
+        // these handlers would go unresolved. This affects both the
+        // MSVC and GNU ABIs.
+        if (windows) {
             try flags.append(b.allocator, "-fno-sanitize=undefined");
             try flags.append(b.allocator, "-fno-sanitize-trap=undefined");
         }