Fix oso_prefix paths

crosstool/cc_toolchain_config.bzl

@@ -2145,7 +2145,7 @@ please file an issue at https://github.com/bazelbuild/apple_support/issues/new
         flag_sets = [
             flag_set(
                 actions = _DYNAMIC_LINK_ACTIONS,
-                flag_groups = [flag_group(flags = ["-Wl,-oso_prefix,__BAZEL_EXECUTION_ROOT__/"])],
+                flag_groups = [flag_group(flags = ["-Wl,-oso_prefix,__BAZEL_EXECUTION_ROOT_NO_SANDBOX__/"])],
             ),
         ],
     )

crosstool/wrapped_clang.cc

@@ -259,12 +259,14 @@ static std::unique_ptr<TempFile> WriteResponseFile(
 
 void ProcessArgument(const std::string arg, const std::string developer_dir,
                      const std::string sdk_root, const std::string cwd,
-                     bool relative_ast_path, std::string &linked_binary,
-                     std::string &dsym_path, std::string toolchain_path,
+                     const std::string nosandbox_root, bool relative_ast_path,
+                     std::string &linked_binary, std::string &dsym_path,
+                     std::string toolchain_path,
                      std::function<void(const std::string &)> consumer);
 
 bool ProcessResponseFile(const std::string arg, const std::string developer_dir,
                          const std::string sdk_root, const std::string cwd,
+                         const std::string nosandbox_root,
                          bool relative_ast_path, std::string &linked_binary,
                          std::string &dsym_path, std::string toolchain_path,
                          std::function<void(const std::string &)> consumer) {
@@ -280,7 +282,7 @@ bool ProcessResponseFile(const std::string arg, const std::string developer_dir,
     // Arguments in response files might be quoted/escaped, so we need to
     // unescape them ourselves.
     ProcessArgument(Unescape(arg_from_file), developer_dir, sdk_root, cwd,
-                    relative_ast_path, linked_binary, dsym_path,
+                    nosandbox_root, relative_ast_path, linked_binary, dsym_path,
                     toolchain_path, consumer);
   }
 
@@ -335,12 +337,13 @@ std::string GetToolchainPath(const std::string &toolchain_id) {
 
 void ProcessArgument(const std::string arg, const std::string developer_dir,
                      const std::string sdk_root, const std::string cwd,
-                     bool relative_ast_path, std::string &linked_binary,
-                     std::string &dsym_path, std::string toolchain_path,
+                     const std::string nosandbox_root, bool relative_ast_path,
+                     std::string &linked_binary, std::string &dsym_path,
+                     std::string toolchain_path,
                      std::function<void(const std::string &)> consumer) {
   auto new_arg = arg;
   if (arg[0] == '@') {
-    if (ProcessResponseFile(arg, developer_dir, sdk_root, cwd,
+    if (ProcessResponseFile(arg, developer_dir, sdk_root, cwd, nosandbox_root,
                             relative_ast_path, linked_binary, dsym_path,
                             toolchain_path, consumer)) {
       return;
@@ -355,6 +358,8 @@ void ProcessArgument(const std::string arg, const std::string developer_dir,
   }
 
   FindAndReplace("__BAZEL_EXECUTION_ROOT__", cwd, &new_arg);
+  FindAndReplace("__BAZEL_EXECUTION_ROOT_NO_SANDBOX__", nosandbox_root,
+                 &new_arg);
   FindAndReplace("__BAZEL_XCODE_DEVELOPER_DIR__", developer_dir, &new_arg);
   FindAndReplace("__BAZEL_XCODE_SDKROOT__", sdk_root, &new_arg);
   if (!toolchain_path.empty()) {
@@ -424,15 +429,29 @@ int main(int argc, char *argv[]) {
   std::vector<std::string> invocation_args = {"/usr/bin/xcrun", tool_name};
   std::vector<std::string> processed_args = {};
 
+  auto wrapper_path = std::filesystem::path(argv[0]);
+  auto nosandbox_root = GetCurrentDirectory();
+  if (std::filesystem::is_symlink(wrapper_path)) {
+    auto resolved_wrapper = std::filesystem::read_symlink(wrapper_path);
+    int components_to_remove =
+        std::distance(wrapper_path.begin(), wrapper_path.end());
+    for (int i = 0; i < components_to_remove; i++) {
+      resolved_wrapper = resolved_wrapper.parent_path();
+    }
+
+    nosandbox_root = resolved_wrapper.string();
+  }
+
   bool relative_ast_path = getenv("RELATIVE_AST_PATH") != nullptr;
   auto consumer = [&](const std::string &arg) {
     processed_args.push_back(arg);
   };
   for (int i = 1; i < argc; i++) {
     std::string arg(argv[i]);
 
-    ProcessArgument(arg, developer_dir, sdk_root, cwd, relative_ast_path,
-                    linked_binary, dsym_path, toolchain_path, consumer);
+    ProcessArgument(arg, developer_dir, sdk_root, cwd, nosandbox_root,
+                    relative_ast_path, linked_binary, dsym_path, toolchain_path,
+                    consumer);
   }
 
   char *modulemap = getenv("APPLE_SUPPORT_MODULEMAP");

test/binary_tests.bzl

@@ -22,6 +22,28 @@ def binary_test_suite(name):
         target_under_test = "//test/test_data:macos_binary",
     )
 
+    apple_verification_test(
+        name = "{}_relative_oso_test".format(name),
+        tags = [name],
+        build_type = "device",
+        compilation_mode = "dbg",
+        cpus = {"macos_cpus": "arm64"},
+        expected_platform_type = "macos",
+        verifier_script = "//test/shell:verify_relative_oso.sh",
+        target_under_test = "//test/test_data:cc_test_binary",
+    )
+
+    apple_verification_test(
+        name = "{}_relative_oso_test_no_sandbox".format(name),
+        tags = [name],
+        build_type = "device",
+        compilation_mode = "dbg",
+        cpus = {"macos_cpus": "arm64"},
+        expected_platform_type = "macos",
+        verifier_script = "//test/shell:verify_relative_oso.sh",
+        target_under_test = "//test/test_data:cc_test_binary_no_sandbox",
+    )
+
     apple_verification_test(
         name = "{}_macos_arm64e_binary_test".format(name),
         tags = [name],

test/shell/BUILD

@@ -1,4 +1,7 @@
-exports_files(["verify_binary.sh"])
+exports_files([
+    "verify_binary.sh",
+    "verify_relative_oso.sh",
+])
 
 filegroup(
     name = "for_bazel_tests",

test/shell/verify_relative_oso.sh

@@ -0,0 +1,10 @@
+#!/bin/bash
+
+set -euo pipefail
+
+readonly binary="%{binary}s"
+
+# [    51] 00001016 66 (N_OSO        ) 00     0001   0000000000000000 'bazel-out/darwin_arm64-dbg-macos-arm64-min13.0-applebin_macos-ST-659b080861c8/bin/test/test_data/libcc_main.a(main.o)'
+output=$(dsymutil -s "$binary" | grep N_OSO)
+echo "$output" | grep " 'bazel-out" \
+  || (echo "has non-relative N_OSO entries: $output" >&2 && exit 1)

test/test_data/BUILD

@@ -18,6 +18,12 @@ cc_binary(
     tags = TARGETS_UNDER_TEST_TAGS,
 )
 
+cc_binary(
+    name = "cc_test_binary_no_sandbox",
+    srcs = ["main.cc"],
+    tags = TARGETS_UNDER_TEST_TAGS + ["no-sandbox"],
+)
+
 cc_library(
     name = "cc_main",
     srcs = ["main.cc"],