I did specify “this ASAN implementation” with emphasis on the “this”, since it was presented higher in the thread as having marginal performance impact and exce

I did specify “this ASAN implementation” with emphasis on the “this”, since it was presented higher in the thread as having marginal performance impact and excellent, rust-like safety. Google’s ASAN is not used on all production instances, last I heard, due to the large performance penalty. All sorts of memory safety issues slip past ASAN right now, especially when it is only used outside of production. If ASAN were a silver bullet, C memory safety vulnerabilities would be a distant memory. They’re not. ASAN helps, but it isn’t enough.