GitLab

Cheng Shao pushed to branch wip/ubsan at Glasgow Haskell Compiler / GHC

Commits:

bb221aa0

by Cheng Shao at 2025-12-09T09:12:47+01:00

hadrian: add support for building with UndefinedBehaviorSanitizer

This patch adds a +ubsan flavour transformer to hadrian to build all
stage1+ C/C++ code with UndefinedBehaviorSanitizer. This is
particularly useful to catch potential undefined behavior in the RTS
codebase.

7273893c

by Cheng Shao at 2025-12-09T09:12:50+01:00

configure: bump LlvmMaxVersion to 22

This commit bumps LlvmMaxVersion to 22; 21.x releases have been
available since Aug 26th, 2025 and there's no regressions with 21.x so
far. This bump is also required for updating fedora image to 43.

f5bf2089

by Cheng Shao at 2025-12-09T09:12:50+01:00

ci: update alpine/fedora & add ubsan job

This patch updates alpine image to 3.23, fedora image to 43, and adds
a `x86_64-linux-fedora43-validate+debug_info+ubsan` job that's run in
validate/nightly pipelines to catch undefined behavior in the RTS
codebase.

6071743b

by Cheng Shao at 2025-12-09T09:12:50+01:00

rts: fix zero-length VLA undefined behavior in interpretBCO

This commit fixes a zero-length VLA undefined behavior in interpretBCO, caught by UBSan:

```
+rts/Interpreter.c:3133:19: runtime variable length array bound evaluates to non-positive value 0
```

284b2409

by Cheng Shao at 2025-12-09T09:12:50+01:00

rts: fix unaligned ReadSpB in interpretBCO

This commit fixes unaligned ReadSpB in interpretBCO, caught by UBSan:

```
+rts/Interpreter.c:2174:64: runtime load of misaligned address 0x004202059dd1 for type 'StgWord', which requires 8 byte alignment
```

To perform proper unaligned read, we define StgUnalignedWord as a type
alias of StgWord with aligned(1) attribute, and load StgUnalignedWord
instead of StgWord in ReadSpB, so the C compiler is aware that we're
not loading with natural alignment.

b59a2e28

by Cheng Shao at 2025-12-09T12:33:34+01:00

rts: fix signed integer overflow in subword arithmetic in interpretBCO

This commit fixes signed integer overflow in subword arithmetic in
interpretBCO, see added note for detailed explanation.

14 changed files:

.gitlab-ci.yml
.gitlab/generate-ci/gen_ci.hs
.gitlab/jobs.yaml
.gitlab/rel_eng/fetch-gitlab-artifacts/fetch_gitlab.py
.gitlab/rel_eng/mk-ghcup-metadata/mk_ghcup_metadata.py
configure.ac
hadrian/doc/flavours.md
hadrian/src/Flavour.hs
+ rts/.ubsan-suppressions
rts/Interpreter.c
rts/include/stg/Types.h
rts/rts.cabal
testsuite/driver/testglobals.py
testsuite/driver/testlib.py

Changes:

.gitlab-ci.yml

@@ -11,7 +11,7 @@ variables:
    GIT_SSL_NO_VERIFY: "1"
    # Commit of ghc/ci-images repository from which to pull Docker images
 -  DOCKER_REV: a97d5c67d803c6b3811c6cccdf33dc8e9d7eafe3
 +  DOCKER_REV: 71454506c0c2e215953306b04572092cb89a6c2a
    # Sequential version number of all cached things.
    # Bump to invalidate GitLab CI cache.
@@ -444,14 +444,14 @@ hadrian-ghc-in-ghci:
  hadrian-multi:
    stage: testing
    needs:
 -    - job: x86_64-linux-fedora42-release
 +    - job: x86_64-linux-fedora43-release
        optional: true
 -    - job: nightly-x86_64-linux-fedora42-release
 +    - job: nightly-x86_64-linux-fedora43-release
        optional: true
 -    - job: release-x86_64-linux-fedora42-release
 +    - job: release-x86_64-linux-fedora43-release
        optional: true
    dependencies: null
 -  image: "registry.gitlab.haskell.org/ghc/ci-images/x86_64-linux-fedora42:$DOCKER_REV"
 +  image: "registry.gitlab.haskell.org/ghc/ci-images/x86_64-linux-fedora43:$DOCKER_REV"
    before_script:
      # workaround for docker permissions
      - sudo chown ghc:ghc -R .
@@ -471,7 +471,7 @@ hadrian-multi:
      - ls
      - |
        mkdir tmp
 -      tar -xf ghc-x86_64-linux-fedora42-release.tar.xz -C tmp
 +      tar -xf ghc-x86_64-linux-fedora43-release.tar.xz -C tmp
        pushd tmp/ghc-*/
        ./configure --prefix=$root
        make install
@@ -533,17 +533,17 @@ test-cabal-reinstall-x86_64-linux-deb10:
  abi-test-nightly:
    stage: full-build
    needs:
 -    - job: nightly-x86_64-linux-fedora42-release-hackage
 -    - job: nightly-x86_64-linux-fedora42-release
 +    - job: nightly-x86_64-linux-fedora43-release-hackage
 +    - job: nightly-x86_64-linux-fedora43-release
    tags:
      - x86_64-linux
 -  image: "registry.gitlab.haskell.org/ghc/ci-images/x86_64-linux-fedora42:$DOCKER_REV"
 +  image: "registry.gitlab.haskell.org/ghc/ci-images/x86_64-linux-fedora43:$DOCKER_REV"
    dependencies: null
    before_script:
      - mkdir -p normal
      - mkdir -p hackage
 -    - tar -xf ghc-x86_64-linux-fedora42-release.tar.xz -C normal/
 -    - tar -xf ghc-x86_64-linux-fedora42-release-hackage_docs.tar.xz -C hackage/
 +    - tar -xf ghc-x86_64-linux-fedora43-release.tar.xz -C normal/
 +    - tar -xf ghc-x86_64-linux-fedora43-release-hackage_docs.tar.xz -C hackage/
    script:
      - .gitlab/ci.sh compare_interfaces_of "normal/ghc-*" "hackage/ghc-*"
    artifacts:
@@ -620,9 +620,9 @@ doc-tarball:
  hackage-doc-tarball:
    stage: packaging
    needs:
 -    - job: nightly-x86_64-linux-fedora42-release-hackage
 +    - job: nightly-x86_64-linux-fedora43-release-hackage
        optional: true
 -    - job: release-x86_64-linux-fedora42-release-hackage
 +    - job: release-x86_64-linux-fedora43-release-hackage
        optional: true
      - job: source-tarball
    tags:
@@ -639,7 +639,7 @@ hackage-doc-tarball:
        - hackage_docs
    before_script:
      - tar -xf ghc-*[0-9]-src.tar.xz
 -    - tar -xf ghc-x86_64-linux-fedora42-release.tar.xz -C ghc*/
 +    - tar -xf ghc-x86_64-linux-fedora43-release.tar.xz -C ghc*/
    script:
      - cd ghc*/
      - mv .gitlab/rel_eng/upload_ghc_libs.py .
@@ -765,7 +765,7 @@ test-bootstrap:
  # Triggering jobs in the ghc/head.hackage project requires that we have a job
  # token for that repository. Furthermore the head.hackage CI job must have
  # access to an unprivileged access token with the ability to query the ghc/ghc
 -# project such that it can find the job ID of the fedora42 job for the current
 +# project such that it can find the job ID of the fedora43 job for the current
  # pipeline.
+ #
  # hackage-lint: Can be triggered on any MR, normal validate pipeline or nightly build.
@@ -852,7 +852,7 @@ nightly-hackage-lint:
  nightly-hackage-perf:
    needs:
 -    - job: nightly-x86_64-linux-fedora42-release
 +    - job: nightly-x86_64-linux-fedora43-release
        optional: true
        artifacts: false
      - job: nightly-aarch64-linux-deb12-validate
@@ -871,7 +871,7 @@ nightly-hackage-perf:
  release-hackage-lint:
    needs:
 -    - job: release-x86_64-linux-fedora42-release
 +    - job: release-x86_64-linux-fedora43-release
        optional: true
        artifacts: false
      - job: release-aarch64-linux-deb12-release+no_split_sections
@@ -957,13 +957,13 @@ perf-nofib:
    allow_failure: true
    stage: testing
    needs:
 -    - job: x86_64-linux-fedora42-release
 +    - job: x86_64-linux-fedora43-release
        optional: true
 -    - job: nightly-x86_64-linux-fedora42-release
 +    - job: nightly-x86_64-linux-fedora43-release
        optional: true
 -    - job: release-x86_64-linux-fedora42-release
 +    - job: release-x86_64-linux-fedora43-release
        optional: true
 -  image: "registry.gitlab.haskell.org/ghc/ci-images/x86_64-linux-fedora42:$DOCKER_REV"
 +  image: "registry.gitlab.haskell.org/ghc/ci-images/x86_64-linux-fedora43:$DOCKER_REV"
    rules:
      - when: never
      - *full-ci
@@ -976,7 +976,7 @@ perf-nofib:
      - root=$(pwd)/ghc
      - |
        mkdir tmp
 -      tar -xf ../ghc-x86_64-linux-fedora42-release.tar.xz -C tmp
 +      tar -xf ../ghc-x86_64-linux-fedora43-release.tar.xz -C tmp
        pushd tmp/ghc-*/
        ./configure --prefix=$root
        make install
@@ -1000,14 +1000,14 @@ perf-nofib:
  perf:
    stage: testing
    needs:
 -    - job: x86_64-linux-fedora42-release
 +    - job: x86_64-linux-fedora43-release
        optional: true
 -    - job: nightly-x86_64-linux-fedora42-release
 +    - job: nightly-x86_64-linux-fedora43-release
        optional: true
 -    - job: release-x86_64-linux-fedora42-release
 +    - job: release-x86_64-linux-fedora43-release
        optional: true
    dependencies: null
 -  image: "registry.gitlab.haskell.org/ghc/ci-images/x86_64-linux-fedora42:$DOCKER_REV"
 +  image: "registry.gitlab.haskell.org/ghc/ci-images/x86_64-linux-fedora43:$DOCKER_REV"
    tags:
      - x86_64-linux-perf
    before_script:
@@ -1017,7 +1017,7 @@ perf:
      - root=$(pwd)/ghc
      - |
        mkdir tmp
 -      tar -xf ghc-x86_64-linux-fedora42-release.tar.xz -C tmp
 +      tar -xf ghc-x86_64-linux-fedora43-release.tar.xz -C tmp
        pushd tmp/ghc-*/
        ./configure --prefix=$root
        make install
@@ -1041,14 +1041,14 @@ perf:
  abi-test:
    stage: testing
    needs:
 -    - job: x86_64-linux-fedora42-release
 +    - job: x86_64-linux-fedora43-release
        optional: true
 -    - job: nightly-x86_64-linux-fedora42-release
 +    - job: nightly-x86_64-linux-fedora43-release
        optional: true
 -    - job: release-x86_64-linux-fedora42-release
 +    - job: release-x86_64-linux-fedora43-release
        optional: true
    dependencies: null
 -  image: "registry.gitlab.haskell.org/ghc/ci-images/x86_64-linux-fedora42:$DOCKER_REV"
 +  image: "registry.gitlab.haskell.org/ghc/ci-images/x86_64-linux-fedora43:$DOCKER_REV"
    rules:
      - if: $CI_MERGE_REQUEST_ID
      - if: '$CI_COMMIT_BRANCH == "master"'
@@ -1059,7 +1059,7 @@ abi-test:
      - root=$(pwd)/ghc
      - |
        mkdir tmp
 -      tar -xf ghc-x86_64-linux-fedora42-release.tar.xz -C tmp
 +      tar -xf ghc-x86_64-linux-fedora43-release.tar.xz -C tmp
        pushd tmp/ghc-*/
        ./configure --prefix=$root
        make install
@@ -1094,29 +1094,29 @@ abi-test:
  ghc-wasm-meta-gmp:
    extends: .ghc-wasm-meta
    needs:
 -    - job: x86_64-linux-alpine3_22-wasm-cross_wasm32-wasi-release+host_fully_static+text_simdutf
 +    - job: x86_64-linux-alpine3_23-wasm-cross_wasm32-wasi-release+host_fully_static+text_simdutf
        artifacts: false
    variables:
      UPSTREAM_GHC_FLAVOUR: gmp
 -    UPSTREAM_GHC_JOB_NAME: x86_64-linux-alpine3_22-wasm-cross_wasm32-wasi-release+host_fully_static+text_simdutf
 +    UPSTREAM_GHC_JOB_NAME: x86_64-linux-alpine3_23-wasm-cross_wasm32-wasi-release+host_fully_static+text_simdutf
  ghc-wasm-meta-native:
    extends: .ghc-wasm-meta
    needs:
 -    - job: x86_64-linux-alpine3_22-wasm-int_native-cross_wasm32-wasi-release+host_fully_static+text_simdutf
 +    - job: x86_64-linux-alpine3_23-wasm-int_native-cross_wasm32-wasi-release+host_fully_static+text_simdutf
        artifacts: false
    variables:
      UPSTREAM_GHC_FLAVOUR: native
 -    UPSTREAM_GHC_JOB_NAME: x86_64-linux-alpine3_22-wasm-int_native-cross_wasm32-wasi-release+host_fully_static+text_simdutf
 +    UPSTREAM_GHC_JOB_NAME: x86_64-linux-alpine3_23-wasm-int_native-cross_wasm32-wasi-release+host_fully_static+text_simdutf
  ghc-wasm-meta-unreg:
    extends: .ghc-wasm-meta
    needs:
 -    - job: x86_64-linux-alpine3_22-wasm-unreg-cross_wasm32-wasi-release+host_fully_static+text_simdutf
 +    - job: x86_64-linux-alpine3_23-wasm-unreg-cross_wasm32-wasi-release+host_fully_static+text_simdutf
        artifacts: false
    variables:
      UPSTREAM_GHC_FLAVOUR: unreg
 -    UPSTREAM_GHC_JOB_NAME: x86_64-linux-alpine3_22-wasm-unreg-cross_wasm32-wasi-release+host_fully_static+text_simdutf
 +    UPSTREAM_GHC_JOB_NAME: x86_64-linux-alpine3_23-wasm-unreg-cross_wasm32-wasi-release+host_fully_static+text_simdutf
  ############################################################
  # Documentation deployment via GitLab Pages
@@ -1218,7 +1218,7 @@ ghcup-metadata-nightly:
    extends: .ghcup-metadata
    # Explicit needs for validate pipeline because we only need certain bindists
    needs:
 -    - job: nightly-x86_64-linux-fedora42-release
 +    - job: nightly-x86_64-linux-fedora43-release
        artifacts: false
      - job: nightly-x86_64-linux-ubuntu24_04-validate
        artifacts: false
@@ -1236,7 +1236,7 @@ ghcup-metadata-nightly:
        artifacts: false
      - job: nightly-x86_64-windows-validate
        artifacts: false
 -    - job: nightly-x86_64-linux-alpine3_22-validate
 +    - job: nightly-x86_64-linux-alpine3_23-validate
        artifacts: false
      - job: nightly-x86_64-linux-deb9-validate
        artifacts: false
@@ -1244,7 +1244,7 @@ ghcup-metadata-nightly:
        artifacts: false
      - job: nightly-i386-linux-deb12-validate
        artifacts: false
 -    - job: nightly-i386-linux-alpine3_22-validate
 +    - job: nightly-i386-linux-alpine3_23-validate
        artifacts: false
      - job: nightly-x86_64-linux-deb10-validate
        artifacts: false
@@ -1256,7 +1256,7 @@ ghcup-metadata-nightly:
        artifacts: false
      - job: nightly-aarch64-linux-deb12-validate
        artifacts: false
 -    - job: nightly-aarch64-linux-alpine3_22-validate
 +    - job: nightly-aarch64-linux-alpine3_23-validate
        artifacts: false
      - job: source-tarball
        artifacts: false
@@ -1269,7 +1269,7 @@ ghcup-metadata-nightly:
  # Update the ghcup metadata with information about this nightly pipeline
  ghcup-metadata-nightly-push:
    stage: deploy
 -  image: "registry.gitlab.haskell.org/ghc/ci-images/x86_64-linux-fedora42:$DOCKER_REV"
 +  image: "registry.gitlab.haskell.org/ghc/ci-images/x86_64-linux-fedora43:$DOCKER_REV"
    dependencies: null
    tags:
      - x86_64-linux

.gitlab/generate-ci/gen_ci.hs

@@ -82,7 +82,7 @@ The generated names for the jobs is important as there are a few downstream cons
  of the jobs artifacts. Therefore some care should be taken if changing the generated
  names of jobs to update these other places.
 -1. fedora42 jobs are required by head.hackage
 +1. fedora43 jobs are required by head.hackage
 . The fetch-gitlab release utility pulls release artifacts from the
 . The ghc-head-from script downloads release artifacts based on a pipeline change.
 . Some subsequent CI jobs have explicit dependencies (for example docs-tarball, perf, perf-nofib)
@@ -118,14 +118,14 @@ data LinuxDistro
    | Debian11Js
    | Debian10
    | Debian9
 -  | Fedora42
 +  | Fedora43
    | Ubuntu2404LoongArch64
    | Ubuntu2404
    | Ubuntu2204
    | Ubuntu2004
    | Ubuntu1804
    | Alpine312
 -  | Alpine322
 +  | Alpine323
    | AlpineWasm
    | Rocky8
    deriving (Eq)
@@ -161,6 +161,7 @@ data BuildConfig
                  , hostFullyStatic :: Bool
                  , tablesNextToCode :: Bool
                  , threadSanitiser :: Bool
 +                , ubsan :: Bool
                  , noSplitSections :: Bool
                  , validateNonmovingGc :: Bool
                  , textWithSIMDUTF :: Bool
@@ -186,6 +187,7 @@ mkJobFlavour BuildConfig{..} = Flavour buildFlavour opts
             [FullyStatic | fullyStatic] ++
             [HostFullyStatic | hostFullyStatic] ++
             [ThreadSanitiser | threadSanitiser] ++
 +           [UBSan | ubsan] ++
             [NoSplitSections | noSplitSections, buildFlavour == Release ] ++
             [BootNonmovingGc | validateNonmovingGc ] ++
             [TextWithSIMDUTF | textWithSIMDUTF]
@@ -198,6 +200,7 @@ data FlavourTrans =
      | FullyStatic
      | HostFullyStatic
      | ThreadSanitiser
 +    | UBSan
      | NoSplitSections
      | BootNonmovingGc
      | TextWithSIMDUTF
@@ -226,6 +229,7 @@ vanilla = BuildConfig
    , hostFullyStatic = False
    , tablesNextToCode = True
    , threadSanitiser = False
 +  , ubsan = False
    , noSplitSections = False
    , validateNonmovingGc = False
    , textWithSIMDUTF = False
@@ -279,6 +283,9 @@ llvm = vanilla { llvmBootstrap = True }
  tsan :: BuildConfig
  tsan = vanilla { threadSanitiser = True }
 +enableUBSan :: BuildConfig
 +enableUBSan = vanilla { withDwarf = True, ubsan = True }
++
  noTntc :: BuildConfig
  noTntc = vanilla { tablesNextToCode = False }
@@ -318,15 +325,15 @@ distroName Debian12Riscv = "deb12-riscv"
  distroName Debian12Wine  = "deb12-wine"
  distroName Debian10      = "deb10"
  distroName Debian9       = "deb9"
 -distroName Fedora42      = "fedora42"
 +distroName Fedora43      = "fedora43"
  distroName Ubuntu2404LoongArch64 = "ubuntu24_04-loongarch"
  distroName Ubuntu1804    = "ubuntu18_04"
  distroName Ubuntu2004    = "ubuntu20_04"
  distroName Ubuntu2204    = "ubuntu22_04"
  distroName Ubuntu2404    = "ubuntu24_04"
  distroName Alpine312     = "alpine3_12"
 -distroName Alpine322     = "alpine3_22"
 -distroName AlpineWasm    = "alpine3_22-wasm"
 +distroName Alpine323     = "alpine3_23"
 +distroName AlpineWasm    = "alpine3_23-wasm"
  distroName Rocky8        = "rocky8"
  opsysName :: Opsys -> String
@@ -373,6 +380,7 @@ flavourString (Flavour base trans) = base_string base ++ concatMap (("+" ++) . f
      flavour_string FullyStatic = "fully_static"
      flavour_string HostFullyStatic = "host_fully_static"
      flavour_string ThreadSanitiser = "thread_sanitizer_cmm"
 +    flavour_string UBSan = "ubsan"
      flavour_string NoSplitSections = "no_split_sections"
      flavour_string BootNonmovingGc = "boot_nonmoving_gc"
      flavour_string TextWithSIMDUTF = "text_simdutf"
@@ -497,7 +505,7 @@ alpineVariables arch = mconcat $
  distroVariables :: Arch -> LinuxDistro -> Variables
  distroVariables arch Alpine312 = alpineVariables arch
 -distroVariables arch Alpine322 = alpineVariables arch
 +distroVariables arch Alpine323 = alpineVariables arch
  distroVariables _ _ = mempty
  -----------------------------------------------------------------------------
@@ -1196,13 +1204,22 @@ rhel_x86 =
  fedora_x86 :: [JobGroup Job]
  fedora_x86 =
 -  [ -- Fedora42 job is always built with perf so there's one job in the normal
 +  [ -- Fedora43 job is always built with perf so there's one job in the normal
      -- validate pipeline which is built with perf.
 -    fastCI (standardBuildsWithConfig Amd64 (Linux Fedora42) releaseConfig)
 +    fastCI (standardBuildsWithConfig Amd64 (Linux Fedora43) releaseConfig)
      -- This job is only for generating head.hackage docs
 -  , hackage_doc_job (disableValidate (standardBuildsWithConfig Amd64 (Linux Fedora42) releaseConfig))
 -  , disableValidate (standardBuildsWithConfig Amd64 (Linux Fedora42) dwarf)
 -  , disableValidate (standardBuilds Amd64 (Linux Fedora42))
 +  , hackage_doc_job (disableValidate (standardBuildsWithConfig Amd64 (Linux Fedora43) releaseConfig))
 +  , disableValidate (standardBuildsWithConfig Amd64 (Linux Fedora43) dwarf)
 +  , disableValidate (standardBuilds Amd64 (Linux Fedora43))
 +    -- For UBSan jobs, only enable for validate/nightly pipelines.
 +    -- Also disable docs since it's not the point for UBSan jobs.
 +  , modifyJobs
 +      ( setVariable "HADRIAN_ARGS" "--docs=none"
 +          . addVariable
 +            "UBSAN_OPTIONS"
 +            "suppressions=$CI_PROJECT_DIR/rts/.ubsan-suppressions"
 +      )
 +      $ validateBuilds Amd64 (Linux Fedora43) enableUBSan
+   ]
    where
      hackage_doc_job = rename (<> "-hackage") . modifyJobs (addVariable "HADRIAN_ARGS" "--haddock-for-hackage")
@@ -1230,8 +1247,8 @@ alpine_x86 =
      fullyStaticBrokenTests (standardBuildsWithConfig Amd64 (Linux Alpine312) (splitSectionsBroken static))
    , fullyStaticBrokenTests (disableValidate (allowFailureGroup (standardBuildsWithConfig Amd64 (Linux Alpine312) staticNativeInt)))
      -- Dynamically linked build, suitable for building your own static executables on alpine
 -  , disableValidate (standardBuildsWithConfig Amd64 (Linux Alpine322) (splitSectionsBroken vanilla))
 -  , allowFailureGroup (standardBuildsWithConfig I386 (Linux Alpine322) (splitSectionsBroken vanilla))
 +  , disableValidate (standardBuildsWithConfig Amd64 (Linux Alpine323) (splitSectionsBroken vanilla))
 +  , allowFailureGroup (standardBuildsWithConfig I386 (Linux Alpine323) (splitSectionsBroken vanilla))
+   ]
    where
      -- ghcilink002 broken due to #17869
@@ -1242,7 +1259,7 @@ alpine_x86 =
  alpine_aarch64 :: [JobGroup Job]
  alpine_aarch64 = [
 -  disableValidate (standardBuildsWithConfig AArch64 (Linux Alpine322) (splitSectionsBroken vanilla))
 +  disableValidate (standardBuildsWithConfig AArch64 (Linux Alpine323) (splitSectionsBroken vanilla))
+   ]
  cross_jobs :: [JobGroup Job]
@@ -1364,28 +1381,28 @@ platform_mapping = Map.map go combined_result
                  , "x86_64-linux-deb11-validate"
                  , "x86_64-linux-deb12-validate"
                  , "x86_64-linux-deb10-validate+debug_info"
 -                , "x86_64-linux-fedora42-release"
 +                , "x86_64-linux-fedora43-release"
                  , "x86_64-linux-deb11-cross_aarch64-linux-gnu-validate"
                  , "x86_64-windows-validate"
                  , "aarch64-linux-deb12-validate"
                  , "aarch64-linux-deb12-wine-int_native-cross_aarch64-unknown-mingw32-validate"
 -                , "nightly-x86_64-linux-alpine3_22-wasm-cross_wasm32-wasi-release+host_fully_static+text_simdutf"
 +                , "nightly-x86_64-linux-alpine3_23-wasm-cross_wasm32-wasi-release+host_fully_static+text_simdutf"
                  , "nightly-x86_64-linux-deb11-validate"
                  , "nightly-x86_64-linux-deb12-validate"
 -                , "x86_64-linux-alpine3_22-wasm-cross_wasm32-wasi-release+host_fully_static+text_simdutf"
 +                , "x86_64-linux-alpine3_23-wasm-cross_wasm32-wasi-release+host_fully_static+text_simdutf"
                  , "x86_64-linux-deb12-validate+thread_sanitizer_cmm"
                  , "nightly-aarch64-linux-deb10-validate"
                  , "nightly-aarch64-linux-deb12-validate"
                  , "nightly-aarch64-linux-deb12-wine-int_native-cross_aarch64-unknown-mingw32-validate"
                  , "nightly-x86_64-linux-alpine3_12-validate+fully_static"
                  , "nightly-x86_64-linux-deb10-validate"
 -                , "nightly-x86_64-linux-fedora42-release"
 +                , "nightly-x86_64-linux-fedora43-release"
                  , "nightly-x86_64-windows-validate"
                  , "release-x86_64-linux-alpine3_12-release+fully_static+no_split_sections"
                  , "release-x86_64-linux-deb10-release"
                  , "release-x86_64-linux-deb11-release"
                  , "release-x86_64-linux-deb12-release"
 -                , "release-x86_64-linux-fedora42-release"
 +                , "release-x86_64-linux-fedora43-release"
                  , "release-x86_64-windows-release"
+                 ]

.gitlab/jobs.yaml

@@ -66,7 +66,7 @@
        "TEST_ENV": "aarch64-darwin-validate"
+     }
    },
 -  "aarch64-linux-alpine3_22-validate": {
 +  "aarch64-linux-alpine3_23-validate": {
      "after_script": [
        ".gitlab/ci.sh save_cache",
        ".gitlab/ci.sh save_test_output",
@@ -77,7 +77,7 @@
      "artifacts": {
        "expire_in": "2 weeks",
        "paths": [
 -        "ghc-aarch64-linux-alpine3_22-validate.tar.xz",
 +        "ghc-aarch64-linux-alpine3_23-validate.tar.xz",
          "junit.xml",
          "unexpected-test-output.tar.gz"
        ],
@@ -87,14 +87,14 @@
        "when": "always"
      },
      "cache": {
 -      "key": "aarch64-linux-alpine3_22-$CACHE_REV",
 +      "key": "aarch64-linux-alpine3_23-$CACHE_REV",
        "paths": [
          "cabal-cache",
          "toolchain"
+       ]
      },
      "dependencies": [],
 -    "image": "registry.gitlab.haskell.org/ghc/ci-images/aarch64-linux-alpine3_22:$DOCKER_REV",
 +    "image": "registry.gitlab.haskell.org/ghc/ci-images/aarch64-linux-alpine3_23:$DOCKER_REV",
      "needs": [
+       {
          "artifacts": false,
@@ -103,7 +103,7 @@
      ],
      "rules": [
+       {
 -        "if": "((($ONLY_JOBS) && ($ONLY_JOBS =~ /.*\\baarch64-linux-alpine3_22-validate(\\s|$).*/)) || (($ONLY_JOBS == null) && (\"disabled\" != \"disabled\"))) && ($RELEASE_JOB != \"yes\") && ($NIGHTLY == null)",
 +        "if": "((($ONLY_JOBS) && ($ONLY_JOBS =~ /.*\\baarch64-linux-alpine3_23-validate(\\s|$).*/)) || (($ONLY_JOBS == null) && (\"disabled\" != \"disabled\"))) && ($RELEASE_JOB != \"yes\") && ($NIGHTLY == null)",
          "when": "on_success"
+       }
      ],
@@ -120,13 +120,13 @@
      ],
      "variables": {
        "BIGNUM_BACKEND": "gmp",
 -      "BIN_DIST_NAME": "ghc-aarch64-linux-alpine3_22-validate",
 +      "BIN_DIST_NAME": "ghc-aarch64-linux-alpine3_23-validate",
        "BROKEN_TESTS": "encoding004 T10458",
        "BUILD_FLAVOUR": "validate",
        "CONFIGURE_ARGS": "--disable-ld-override --enable-ignore-build-platform-mismatch --build=aarch64-unknown-linux --host=aarch64-unknown-linux --target=aarch64-unknown-linux --enable-strict-ghc-toolchain-check",
        "INSTALL_CONFIGURE_ARGS": "--disable-ld-override --enable-strict-ghc-toolchain-check",
        "RUNTEST_ARGS": "",
 -      "TEST_ENV": "aarch64-linux-alpine3_22-validate"
 +      "TEST_ENV": "aarch64-linux-alpine3_23-validate"
+     }
    },
    "aarch64-linux-deb10-validate": {
@@ -477,7 +477,7 @@
        "WindresCmd": "/opt/llvm-mingw-linux/bin/aarch64-w64-mingw32-windres"
+     }
    },
 -  "i386-linux-alpine3_22-validate": {
 +  "i386-linux-alpine3_23-validate": {
      "after_script": [
        ".gitlab/ci.sh save_cache",
        ".gitlab/ci.sh save_test_output",
@@ -488,7 +488,7 @@
      "artifacts": {
        "expire_in": "2 weeks",
        "paths": [
 -        "ghc-i386-linux-alpine3_22-validate.tar.xz",
 +        "ghc-i386-linux-alpine3_23-validate.tar.xz",
          "junit.xml",
          "unexpected-test-output.tar.gz"
        ],
@@ -498,14 +498,14 @@
        "when": "always"
      },
      "cache": {
 -      "key": "i386-linux-alpine3_22-$CACHE_REV",
 +      "key": "i386-linux-alpine3_23-$CACHE_REV",
        "paths": [
          "cabal-cache",
          "toolchain"
+       ]
      },
      "dependencies": [],
 -    "image": "registry.gitlab.haskell.org/ghc/ci-images/i386-linux-alpine3_22:$DOCKER_REV",
 +    "image": "registry.gitlab.haskell.org/ghc/ci-images/i386-linux-alpine3_23:$DOCKER_REV",
      "needs": [
+       {
          "artifacts": false,
@@ -514,7 +514,7 @@
      ],
      "rules": [
+       {
 -        "if": "((($ONLY_JOBS) && ($ONLY_JOBS =~ /.*\\bi386-linux-alpine3_22-validate(\\s|$).*/)) || (($ONLY_JOBS == null) && ((($CI_MERGE_REQUEST_LABELS =~ /.*full-ci.*/) || ($CI_MERGE_REQUEST_LABELS =~ /.*marge_bot_batch_merge_job.*/) || ($CI_COMMIT_BRANCH == \"master\") || ($CI_COMMIT_BRANCH =~ /ghc-[0-9]+\\.[0-9]+/))))) && ($RELEASE_JOB != \"yes\") && ($NIGHTLY == null)",
 +        "if": "((($ONLY_JOBS) && ($ONLY_JOBS =~ /.*\\bi386-linux-alpine3_23-validate(\\s|$).*/)) || (($ONLY_JOBS == null) && ((($CI_MERGE_REQUEST_LABELS =~ /.*full-ci.*/) || ($CI_MERGE_REQUEST_LABELS =~ /.*marge_bot_batch_merge_job.*/) || ($CI_COMMIT_BRANCH == \"master\") || ($CI_COMMIT_BRANCH =~ /ghc-[0-9]+\\.[0-9]+/))))) && ($RELEASE_JOB != \"yes\") && ($NIGHTLY == null)",
          "when": "on_success"
+       }
      ],
@@ -531,13 +531,13 @@
      ],
      "variables": {
        "BIGNUM_BACKEND": "gmp",
 -      "BIN_DIST_NAME": "ghc-i386-linux-alpine3_22-validate",
 +      "BIN_DIST_NAME": "ghc-i386-linux-alpine3_23-validate",
        "BROKEN_TESTS": "encoding004 T10458 simd009 T25169",
        "BUILD_FLAVOUR": "validate",
        "CONFIGURE_ARGS": "--disable-ld-override --enable-strict-ghc-toolchain-check",
        "INSTALL_CONFIGURE_ARGS": "--disable-ld-override --enable-strict-ghc-toolchain-check",
        "RUNTEST_ARGS": "",
 -      "TEST_ENV": "i386-linux-alpine3_22-validate"
 +      "TEST_ENV": "i386-linux-alpine3_23-validate"
+     }
    },
    "i386-linux-deb10-validate": {
@@ -731,7 +731,7 @@
        "XZ_OPT": "-9"
+     }
    },
 -  "nightly-aarch64-linux-alpine3_22-validate": {
 +  "nightly-aarch64-linux-alpine3_23-validate": {
      "after_script": [
        ".gitlab/ci.sh save_cache",
        ".gitlab/ci.sh save_test_output",
@@ -742,7 +742,7 @@
      "artifacts": {
        "expire_in": "8 weeks",
        "paths": [
 -        "ghc-aarch64-linux-alpine3_22-validate.tar.xz",
 +        "ghc-aarch64-linux-alpine3_23-validate.tar.xz",
          "junit.xml",
          "unexpected-test-output.tar.gz"
        ],
@@ -752,14 +752,14 @@
        "when": "always"
      },
      "cache": {
 -      "key": "aarch64-linux-alpine3_22-$CACHE_REV",
 +      "key": "aarch64-linux-alpine3_23-$CACHE_REV",
        "paths": [
          "cabal-cache",
          "toolchain"
+       ]
      },
      "dependencies": [],
 -    "image": "registry.gitlab.haskell.org/ghc/ci-images/aarch64-linux-alpine3_22:$DOCKER_REV",
 +    "image": "registry.gitlab.haskell.org/ghc/ci-images/aarch64-linux-alpine3_23:$DOCKER_REV",
      "needs": [
+       {
          "artifacts": false,
@@ -785,13 +785,13 @@
      ],
      "variables": {
        "BIGNUM_BACKEND": "gmp",
 -      "BIN_DIST_NAME": "ghc-aarch64-linux-alpine3_22-validate",
 +      "BIN_DIST_NAME": "ghc-aarch64-linux-alpine3_23-validate",
        "BROKEN_TESTS": "encoding004 T10458",
        "BUILD_FLAVOUR": "validate",
        "CONFIGURE_ARGS": "--disable-ld-override --enable-ignore-build-platform-mismatch --build=aarch64-unknown-linux --host=aarch64-unknown-linux --target=aarch64-unknown-linux --enable-strict-ghc-toolchain-check",
        "INSTALL_CONFIGURE_ARGS": "--disable-ld-override --enable-strict-ghc-toolchain-check",
        "RUNTEST_ARGS": "",
 -      "TEST_ENV": "aarch64-linux-alpine3_22-validate",
 +      "TEST_ENV": "aarch64-linux-alpine3_23-validate",
        "XZ_OPT": "-9"
+     }
    },
@@ -1148,7 +1148,7 @@
        "XZ_OPT": "-9"
+     }
    },
 -  "nightly-i386-linux-alpine3_22-validate": {
 +  "nightly-i386-linux-alpine3_23-validate": {
      "after_script": [
        ".gitlab/ci.sh save_cache",
        ".gitlab/ci.sh save_test_output",
@@ -1159,7 +1159,7 @@
      "artifacts": {
        "expire_in": "8 weeks",
        "paths": [
 -        "ghc-i386-linux-alpine3_22-validate.tar.xz",
 +        "ghc-i386-linux-alpine3_23-validate.tar.xz",
          "junit.xml",
          "unexpected-test-output.tar.gz"
        ],
@@ -1169,14 +1169,14 @@
        "when": "always"
      },
      "cache": {
 -      "key": "i386-linux-alpine3_22-$CACHE_REV",
 +      "key": "i386-linux-alpine3_23-$CACHE_REV",
        "paths": [
          "cabal-cache",
          "toolchain"
+       ]
      },
      "dependencies": [],
 -    "image": "registry.gitlab.haskell.org/ghc/ci-images/i386-linux-alpine3_22:$DOCKER_REV",
 +    "image": "registry.gitlab.haskell.org/ghc/ci-images/i386-linux-alpine3_23:$DOCKER_REV",
      "needs": [
+       {
          "artifacts": false,
@@ -1202,13 +1202,13 @@
      ],
      "variables": {
        "BIGNUM_BACKEND": "gmp",
 -      "BIN_DIST_NAME": "ghc-i386-linux-alpine3_22-validate",
 +      "BIN_DIST_NAME": "ghc-i386-linux-alpine3_23-validate",
        "BROKEN_TESTS": "encoding004 T10458 simd009 T25169",
        "BUILD_FLAVOUR": "validate",
        "CONFIGURE_ARGS": "--disable-ld-override --enable-strict-ghc-toolchain-check",
        "INSTALL_CONFIGURE_ARGS": "--disable-ld-override --enable-strict-ghc-toolchain-check",
        "RUNTEST_ARGS": "",
 -      "TEST_ENV": "i386-linux-alpine3_22-validate",
 +      "TEST_ENV": "i386-linux-alpine3_23-validate",
        "XZ_OPT": "-9"
+     }
    },
@@ -1602,7 +1602,7 @@
        "XZ_OPT": "-9"
+     }
    },
 -  "nightly-x86_64-linux-alpine3_22-validate": {
 +  "nightly-x86_64-linux-alpine3_23-validate": {
      "after_script": [
        ".gitlab/ci.sh save_cache",
        ".gitlab/ci.sh save_test_output",
@@ -1613,7 +1613,7 @@
      "artifacts": {
        "expire_in": "8 weeks",
        "paths": [
 -        "ghc-x86_64-linux-alpine3_22-validate.tar.xz",
 +        "ghc-x86_64-linux-alpine3_23-validate.tar.xz",
          "junit.xml",
          "unexpected-test-output.tar.gz"
        ],
@@ -1623,14 +1623,14 @@
        "when": "always"
      },
      "cache": {
 -      "key": "x86_64-linux-alpine3_22-$CACHE_REV",
 +      "key": "x86_64-linux-alpine3_23-$CACHE_REV",
        "paths": [
          "cabal-cache",
          "toolchain"
+       ]
      },
      "dependencies": [],
 -    "image": "registry.gitlab.haskell.org/ghc/ci-images/x86_64-linux-alpine3_22:$DOCKER_REV",
 +    "image": "registry.gitlab.haskell.org/ghc/ci-images/x86_64-linux-alpine3_23:$DOCKER_REV",
      "needs": [
+       {
          "artifacts": false,
@@ -1656,17 +1656,17 @@
      ],
      "variables": {
        "BIGNUM_BACKEND": "gmp",
 -      "BIN_DIST_NAME": "ghc-x86_64-linux-alpine3_22-validate",
 +      "BIN_DIST_NAME": "ghc-x86_64-linux-alpine3_23-validate",
        "BROKEN_TESTS": "encoding004 T10458",
        "BUILD_FLAVOUR": "validate",
        "CONFIGURE_ARGS": "--disable-ld-override --enable-strict-ghc-toolchain-check",
        "INSTALL_CONFIGURE_ARGS": "--disable-ld-override --enable-strict-ghc-toolchain-check",
        "RUNTEST_ARGS": "",
 -      "TEST_ENV": "x86_64-linux-alpine3_22-validate",
 +      "TEST_ENV": "x86_64-linux-alpine3_23-validate",
        "XZ_OPT": "-9"
+     }
    },
 -  "nightly-x86_64-linux-alpine3_22-wasm-cross_wasm32-wasi-release+host_fully_static+text_simdutf": {
 +  "nightly-x86_64-linux-alpine3_23-wasm-cross_wasm32-wasi-release+host_fully_static+text_simdutf": {
      "after_script": [
        ".gitlab/ci.sh save_cache",
        ".gitlab/ci.sh save_test_output",
@@ -1677,7 +1677,7 @@
      "artifacts": {
        "expire_in": "8 weeks",
        "paths": [
 -        "ghc-x86_64-linux-alpine3_22-wasm-cross_wasm32-wasi-release+host_fully_static+text_simdutf.tar.xz",
 +        "ghc-x86_64-linux-alpine3_23-wasm-cross_wasm32-wasi-release+host_fully_static+text_simdutf.tar.xz",
          "junit.xml",
          "unexpected-test-output.tar.gz"
        ],
@@ -1687,14 +1687,14 @@
        "when": "always"
      },
      "cache": {
 -      "key": "x86_64-linux-alpine3_22-wasm-$CACHE_REV",
 +      "key": "x86_64-linux-alpine3_23-wasm-$CACHE_REV",
        "paths": [
          "cabal-cache",
          "toolchain"
+       ]
      },
      "dependencies": [],
 -    "image": "registry.gitlab.haskell.org/ghc/ci-images/x86_64-linux-alpine3_22-wasm:$DOCKER_REV",
 +    "image": "registry.gitlab.haskell.org/ghc/ci-images/x86_64-linux-alpine3_23-wasm:$DOCKER_REV",
      "needs": [
+       {
          "artifacts": false,
@@ -1720,18 +1720,18 @@
      ],
      "variables": {
        "BIGNUM_BACKEND": "gmp",
 -      "BIN_DIST_NAME": "ghc-x86_64-linux-alpine3_22-wasm-cross_wasm32-wasi-release+host_fully_static+text_simdutf",
 +      "BIN_DIST_NAME": "ghc-x86_64-linux-alpine3_23-wasm-cross_wasm32-wasi-release+host_fully_static+text_simdutf",
        "BUILD_FLAVOUR": "release+host_fully_static+text_simdutf",
        "CONFIGURE_ARGS": "--with-intree-gmp --with-system-libffi --enable-strict-ghc-toolchain-check",
        "CROSS_TARGET": "wasm32-wasi",
        "FIREFOX_LAUNCH_OPTS": "{\"browser\":\"firefox\",\"executablePath\":\"/usr/bin/firefox\"}",
        "HADRIAN_ARGS": "--docs=no-sphinx-pdfs --docs=no-sphinx-man",
        "RUNTEST_ARGS": "",
 -      "TEST_ENV": "x86_64-linux-alpine3_22-wasm-cross_wasm32-wasi-release+host_fully_static+text_simdutf",
 +      "TEST_ENV": "x86_64-linux-alpine3_23-wasm-cross_wasm32-wasi-release+host_fully_static+text_simdutf",
        "XZ_OPT": "-9"
+     }
    },
 -  "nightly-x86_64-linux-alpine3_22-wasm-int_native-cross_wasm32-wasi-release+host_fully_static+text_simdutf": {
 +  "nightly-x86_64-linux-alpine3_23-wasm-int_native-cross_wasm32-wasi-release+host_fully_static+text_simdutf": {
      "after_script": [
        ".gitlab/ci.sh save_cache",
        ".gitlab/ci.sh save_test_output",
@@ -1742,7 +1742,7 @@
      "artifacts": {
        "expire_in": "8 weeks",
        "paths": [
 -        "ghc-x86_64-linux-alpine3_22-wasm-int_native-cross_wasm32-wasi-release+host_fully_static+text_simdutf.tar.xz",
 +        "ghc-x86_64-linux-alpine3_23-wasm-int_native-cross_wasm32-wasi-release+host_fully_static+text_simdutf.tar.xz",
          "junit.xml",
          "unexpected-test-output.tar.gz"
        ],
@@ -1752,14 +1752,14 @@
        "when": "always"
      },
      "cache": {
 -      "key": "x86_64-linux-alpine3_22-wasm-$CACHE_REV",
 +      "key": "x86_64-linux-alpine3_23-wasm-$CACHE_REV",
        "paths": [
          "cabal-cache",
          "toolchain"
+       ]
      },
      "dependencies": [],
 -    "image": "registry.gitlab.haskell.org/ghc/ci-images/x86_64-linux-alpine3_22-wasm:$DOCKER_REV",
 +    "image": "registry.gitlab.haskell.org/ghc/ci-images/x86_64-linux-alpine3_23-wasm:$DOCKER_REV",
      "needs": [
+       {
          "artifacts": false,
@@ -1785,18 +1785,18 @@
      ],
      "variables": {
        "BIGNUM_BACKEND": "native",
 -      "BIN_DIST_NAME": "ghc-x86_64-linux-alpine3_22-wasm-int_native-cross_wasm32-wasi-release+host_fully_static+text_simdutf",
 +      "BIN_DIST_NAME": "ghc-x86_64-linux-alpine3_23-wasm-int_native-cross_wasm32-wasi-release+host_fully_static+text_simdutf",
        "BUILD_FLAVOUR": "release+host_fully_static+text_simdutf",
        "CONFIGURE_ARGS": "--with-intree-gmp --with-system-libffi --enable-strict-ghc-toolchain-check",
        "CROSS_TARGET": "wasm32-wasi",
        "FIREFOX_LAUNCH_OPTS": "{\"browser\":\"firefox\",\"executablePath\":\"/usr/bin/firefox\"}",
        "HADRIAN_ARGS": "--docs=no-sphinx-pdfs --docs=no-sphinx-man",
        "RUNTEST_ARGS": "",
 -      "TEST_ENV": "x86_64-linux-alpine3_22-wasm-int_native-cross_wasm32-wasi-release+host_fully_static+text_simdutf",
 +      "TEST_ENV": "x86_64-linux-alpine3_23-wasm-int_native-cross_wasm32-wasi-release+host_fully_static+text_simdutf",
        "XZ_OPT": "-9"
+     }
    },
 -  "nightly-x86_64-linux-alpine3_22-wasm-unreg-cross_wasm32-wasi-release+host_fully_static+text_simdutf": {
 +  "nightly-x86_64-linux-alpine3_23-wasm-unreg-cross_wasm32-wasi-release+host_fully_static+text_simdutf": {
      "after_script": [
        ".gitlab/ci.sh save_cache",
        ".gitlab/ci.sh save_test_output",
@@ -1807,7 +1807,7 @@
      "artifacts": {
        "expire_in": "8 weeks",
        "paths": [
 -        "ghc-x86_64-linux-alpine3_22-wasm-unreg-cross_wasm32-wasi-release+host_fully_static+text_simdutf.tar.xz",
 +        "ghc-x86_64-linux-alpine3_23-wasm-unreg-cross_wasm32-wasi-release+host_fully_static+text_simdutf.tar.xz",
          "junit.xml",
          "unexpected-test-output.tar.gz"
        ],
@@ -1817,14 +1817,14 @@
        "when": "always"
      },
      "cache": {
 -      "key": "x86_64-linux-alpine3_22-wasm-$CACHE_REV",
 +      "key": "x86_64-linux-alpine3_23-wasm-$CACHE_REV",
        "paths": [
          "cabal-cache",
          "toolchain"
+       ]
      },
      "dependencies": [],
 -    "image": "registry.gitlab.haskell.org/ghc/ci-images/x86_64-linux-alpine3_22-wasm:$DOCKER_REV",
 +    "image": "registry.gitlab.haskell.org/ghc/ci-images/x86_64-linux-alpine3_23-wasm:$DOCKER_REV",
      "needs": [
+       {
          "artifacts": false,
@@ -1850,14 +1850,14 @@
      ],
      "variables": {
        "BIGNUM_BACKEND": "gmp",
 -      "BIN_DIST_NAME": "ghc-x86_64-linux-alpine3_22-wasm-unreg-cross_wasm32-wasi-release+host_fully_static+text_simdutf",
 +      "BIN_DIST_NAME": "ghc-x86_64-linux-alpine3_23-wasm-unreg-cross_wasm32-wasi-release+host_fully_static+text_simdutf",
        "BUILD_FLAVOUR": "release+host_fully_static+text_simdutf",
        "CONFIGURE_ARGS": "--enable-unregisterised --with-intree-gmp --with-system-libffi --enable-strict-ghc-toolchain-check",
        "CROSS_TARGET": "wasm32-wasi",
        "FIREFOX_LAUNCH_OPTS": "{\"browser\":\"firefox\",\"executablePath\":\"/usr/bin/firefox\"}",
        "HADRIAN_ARGS": "--docs=no-sphinx-pdfs --docs=no-sphinx-man",
        "RUNTEST_ARGS": "",
 -      "TEST_ENV": "x86_64-linux-alpine3_22-wasm-unreg-cross_wasm32-wasi-release+host_fully_static+text_simdutf",
 +      "TEST_ENV": "x86_64-linux-alpine3_23-wasm-unreg-cross_wasm32-wasi-release+host_fully_static+text_simdutf",
        "XZ_OPT": "-9"
+     }
    },
@@ -2942,7 +2942,7 @@
        "XZ_OPT": "-9"
+     }
    },
 -  "nightly-x86_64-linux-fedora42-release": {
 +  "nightly-x86_64-linux-fedora43-release": {
      "after_script": [
        ".gitlab/ci.sh save_cache",
        ".gitlab/ci.sh save_test_output",
@@ -2953,7 +2953,7 @@
      "artifacts": {
        "expire_in": "8 weeks",
        "paths": [
 -        "ghc-x86_64-linux-fedora42-release.tar.xz",
 +        "ghc-x86_64-linux-fedora43-release.tar.xz",
          "junit.xml",
          "unexpected-test-output.tar.gz"
        ],
@@ -2963,14 +2963,14 @@
        "when": "always"
      },
      "cache": {
 -      "key": "x86_64-linux-fedora42-$CACHE_REV",
 +      "key": "x86_64-linux-fedora43-$CACHE_REV",
        "paths": [
          "cabal-cache",
          "toolchain"
+       ]
      },
      "dependencies": [],
 -    "image": "registry.gitlab.haskell.org/ghc/ci-images/x86_64-linux-fedora42:$DOCKER_REV",
 +    "image": "registry.gitlab.haskell.org/ghc/ci-images/x86_64-linux-fedora43:$DOCKER_REV",
      "needs": [
+       {
          "artifacts": false,
@@ -2996,16 +2996,16 @@
      ],
      "variables": {
        "BIGNUM_BACKEND": "gmp",
 -      "BIN_DIST_NAME": "ghc-x86_64-linux-fedora42-release",
 +      "BIN_DIST_NAME": "ghc-x86_64-linux-fedora43-release",
        "BUILD_FLAVOUR": "release",
        "CONFIGURE_ARGS": "--enable-strict-ghc-toolchain-check",
        "INSTALL_CONFIGURE_ARGS": "--enable-strict-ghc-toolchain-check",
        "RUNTEST_ARGS": "",
 -      "TEST_ENV": "x86_64-linux-fedora42-release",
 +      "TEST_ENV": "x86_64-linux-fedora43-release",
        "XZ_OPT": "-9"
+     }
    },
 -  "nightly-x86_64-linux-fedora42-release-hackage": {
 +  "nightly-x86_64-linux-fedora43-release-hackage": {
      "after_script": [
        ".gitlab/ci.sh save_cache",
        ".gitlab/ci.sh save_test_output",
@@ -3016,7 +3016,7 @@
      "artifacts": {
        "expire_in": "8 weeks",
        "paths": [
 -        "ghc-x86_64-linux-fedora42-release.tar.xz",
 +        "ghc-x86_64-linux-fedora43-release.tar.xz",
          "junit.xml",
          "unexpected-test-output.tar.gz"
        ],
@@ -3026,14 +3026,14 @@
        "when": "always"
      },
      "cache": {
 -      "key": "x86_64-linux-fedora42-$CACHE_REV",
 +      "key": "x86_64-linux-fedora43-$CACHE_REV",
        "paths": [
          "cabal-cache",
          "toolchain"
+       ]
      },
      "dependencies": [],
 -    "image": "registry.gitlab.haskell.org/ghc/ci-images/x86_64-linux-fedora42:$DOCKER_REV",
 +    "image": "registry.gitlab.haskell.org/ghc/ci-images/x86_64-linux-fedora43:$DOCKER_REV",
      "needs": [
+       {
          "artifacts": false,
@@ -3059,17 +3059,17 @@
      ],
      "variables": {
        "BIGNUM_BACKEND": "gmp",
 -      "BIN_DIST_NAME": "ghc-x86_64-linux-fedora42-release",
 +      "BIN_DIST_NAME": "ghc-x86_64-linux-fedora43-release",
        "BUILD_FLAVOUR": "release",
        "CONFIGURE_ARGS": "--enable-strict-ghc-toolchain-check",
        "HADRIAN_ARGS": "--haddock-for-hackage",
        "INSTALL_CONFIGURE_ARGS": "--enable-strict-ghc-toolchain-check",
        "RUNTEST_ARGS": "",
 -      "TEST_ENV": "x86_64-linux-fedora42-release",
 +      "TEST_ENV": "x86_64-linux-fedora43-release",
        "XZ_OPT": "-9"
+     }
    },
 -  "nightly-x86_64-linux-fedora42-validate": {
 +  "nightly-x86_64-linux-fedora43-validate": {
      "after_script": [
        ".gitlab/ci.sh save_cache",
        ".gitlab/ci.sh save_test_output",
@@ -3080,7 +3080,7 @@
      "artifacts": {
        "expire_in": "8 weeks",
        "paths": [
 -        "ghc-x86_64-linux-fedora42-validate.tar.xz",
 +        "ghc-x86_64-linux-fedora43-validate.tar.xz",
          "junit.xml",
          "unexpected-test-output.tar.gz"
        ],
@@ -3090,14 +3090,14 @@
        "when": "always"
      },
      "cache": {
 -      "key": "x86_64-linux-fedora42-$CACHE_REV",
 +      "key": "x86_64-linux-fedora43-$CACHE_REV",
        "paths": [
          "cabal-cache",
          "toolchain"
+       ]
      },
      "dependencies": [],
 -    "image": "registry.gitlab.haskell.org/ghc/ci-images/x86_64-linux-fedora42:$DOCKER_REV",
 +    "image": "registry.gitlab.haskell.org/ghc/ci-images/x86_64-linux-fedora43:$DOCKER_REV",
      "needs": [
+       {
          "artifacts": false,
@@ -3123,16 +3123,16 @@
      ],
      "variables": {
        "BIGNUM_BACKEND": "gmp",
 -      "BIN_DIST_NAME": "ghc-x86_64-linux-fedora42-validate",
 +      "BIN_DIST_NAME": "ghc-x86_64-linux-fedora43-validate",
        "BUILD_FLAVOUR": "validate",
        "CONFIGURE_ARGS": "--enable-strict-ghc-toolchain-check",
        "INSTALL_CONFIGURE_ARGS": "--enable-strict-ghc-toolchain-check",
        "RUNTEST_ARGS": "",
 -      "TEST_ENV": "x86_64-linux-fedora42-validate",
 +      "TEST_ENV": "x86_64-linux-fedora43-validate",
        "XZ_OPT": "-9"
+     }
    },
 -  "nightly-x86_64-linux-fedora42-validate+debug_info": {
 +  "nightly-x86_64-linux-fedora43-validate+debug_info": {
      "after_script": [
        ".gitlab/ci.sh save_cache",
        ".gitlab/ci.sh save_test_output",
@@ -3143,7 +3143,7 @@
      "artifacts": {
        "expire_in": "8 weeks",
        "paths": [
 -        "ghc-x86_64-linux-fedora42-validate+debug_info.tar.xz",
 +        "ghc-x86_64-linux-fedora43-validate+debug_info.tar.xz",
          "junit.xml",
          "unexpected-test-output.tar.gz"
        ],
@@ -3153,14 +3153,14 @@
        "when": "always"
      },
      "cache": {
 -      "key": "x86_64-linux-fedora42-$CACHE_REV",
 +      "key": "x86_64-linux-fedora43-$CACHE_REV",
        "paths": [
          "cabal-cache",
          "toolchain"
+       ]
      },
      "dependencies": [],
 -    "image": "registry.gitlab.haskell.org/ghc/ci-images/x86_64-linux-fedora42:$DOCKER_REV",
 +    "image": "registry.gitlab.haskell.org/ghc/ci-images/x86_64-linux-fedora43:$DOCKER_REV",
      "needs": [
+       {
          "artifacts": false,
@@ -3186,12 +3186,77 @@
      ],
      "variables": {
        "BIGNUM_BACKEND": "gmp",
 -      "BIN_DIST_NAME": "ghc-x86_64-linux-fedora42-validate+debug_info",
 +      "BIN_DIST_NAME": "ghc-x86_64-linux-fedora43-validate+debug_info",
        "BUILD_FLAVOUR": "validate+debug_info",
        "CONFIGURE_ARGS": "--enable-strict-ghc-toolchain-check",
        "INSTALL_CONFIGURE_ARGS": "--enable-strict-ghc-toolchain-check",
        "RUNTEST_ARGS": "",
 -      "TEST_ENV": "x86_64-linux-fedora42-validate+debug_info",
 +      "TEST_ENV": "x86_64-linux-fedora43-validate+debug_info",
 +      "XZ_OPT": "-9"
 +    }
 +  },
 +  "nightly-x86_64-linux-fedora43-validate+debug_info+ubsan": {
 +    "after_script": [
 +      ".gitlab/ci.sh save_cache",
 +      ".gitlab/ci.sh save_test_output",
 +      ".gitlab/ci.sh clean",
 +      "cat ci_timings.txt"
 +    ],
 +    "allow_failure": false,
 +    "artifacts": {
 +      "expire_in": "8 weeks",
 +      "paths": [
 +        "ghc-x86_64-linux-fedora43-validate+debug_info+ubsan.tar.xz",
 +        "junit.xml",
 +        "unexpected-test-output.tar.gz"
 +      ],
 +      "reports": {
 +        "junit": "junit.xml"
 +      },
 +      "when": "always"
 +    },
 +    "cache": {
 +      "key": "x86_64-linux-fedora43-$CACHE_REV",
 +      "paths": [
 +        "cabal-cache",
 +        "toolchain"
 +      ]
 +    },
 +    "dependencies": [],
 +    "image": "registry.gitlab.haskell.org/ghc/ci-images/x86_64-linux-fedora43:$DOCKER_REV",
 +    "needs": [
 +      {
 +        "artifacts": false,
 +        "job": "hadrian-ghc-in-ghci"
 +      }
 +    ],
 +    "rules": [
 +      {
 +        "if": "(\"true\" == \"true\") && ($RELEASE_JOB != \"yes\") && ($NIGHTLY)",
 +        "when": "on_success"
 +      }
 +    ],
 +    "script": [
 +      "sudo chown ghc:ghc -R .",
 +      ".gitlab/ci.sh setup",
 +      ".gitlab/ci.sh configure",
 +      ".gitlab/ci.sh build_hadrian",
 +      ".gitlab/ci.sh test_hadrian"
 +    ],
 +    "stage": "full-build",
 +    "tags": [
 +      "x86_64-linux"
 +    ],
 +    "variables": {
 +      "BIGNUM_BACKEND": "gmp",
 +      "BIN_DIST_NAME": "ghc-x86_64-linux-fedora43-validate+debug_info+ubsan",
 +      "BUILD_FLAVOUR": "validate+debug_info+ubsan",
 +      "CONFIGURE_ARGS": "--enable-strict-ghc-toolchain-check",
 +      "HADRIAN_ARGS": "--docs=none",
 +      "INSTALL_CONFIGURE_ARGS": "--enable-strict-ghc-toolchain-check",
 +      "RUNTEST_ARGS": "",
 +      "TEST_ENV": "x86_64-linux-fedora43-validate+debug_info+ubsan",
 +      "UBSAN_OPTIONS": "suppressions=$CI_PROJECT_DIR/rts/.ubsan-suppressions",
        "XZ_OPT": "-9"
+     }
    },
@@ -3769,7 +3834,7 @@
        "XZ_OPT": "-9"
+     }
    },
 -  "release-aarch64-linux-alpine3_22-release+no_split_sections": {
 +  "release-aarch64-linux-alpine3_23-release+no_split_sections": {
      "after_script": [
        ".gitlab/ci.sh save_cache",
        ".gitlab/ci.sh save_test_output",
@@ -3780,7 +3845,7 @@
      "artifacts": {
        "expire_in": "1 year",
        "paths": [
 -        "ghc-aarch64-linux-alpine3_22-release+no_split_sections.tar.xz",
 +        "ghc-aarch64-linux-alpine3_23-release+no_split_sections.tar.xz",
          "junit.xml",
          "unexpected-test-output.tar.gz"
        ],
@@ -3790,14 +3855,14 @@
        "when": "always"
      },
      "cache": {
 -      "key": "aarch64-linux-alpine3_22-$CACHE_REV",
 +      "key": "aarch64-linux-alpine3_23-$CACHE_REV",
        "paths": [
          "cabal-cache",
          "toolchain"
+       ]
      },
      "dependencies": [],
 -    "image": "registry.gitlab.haskell.org/ghc/ci-images/aarch64-linux-alpine3_22:$DOCKER_REV",
 +    "image": "registry.gitlab.haskell.org/ghc/ci-images/aarch64-linux-alpine3_23:$DOCKER_REV",
      "needs": [
+       {
          "artifacts": false,
@@ -3823,14 +3888,14 @@
      ],
      "variables": {
        "BIGNUM_BACKEND": "gmp",
 -      "BIN_DIST_NAME": "ghc-aarch64-linux-alpine3_22-release+no_split_sections",
 +      "BIN_DIST_NAME": "ghc-aarch64-linux-alpine3_23-release+no_split_sections",
        "BROKEN_TESTS": "encoding004 T10458",
        "BUILD_FLAVOUR": "release+no_split_sections",
        "CONFIGURE_ARGS": "--disable-ld-override --enable-ignore-build-platform-mismatch --build=aarch64-unknown-linux --host=aarch64-unknown-linux --target=aarch64-unknown-linux --enable-strict-ghc-toolchain-check",
        "IGNORE_PERF_FAILURES": "all",
        "INSTALL_CONFIGURE_ARGS": "--disable-ld-override --enable-strict-ghc-toolchain-check",
        "RUNTEST_ARGS": "",
 -      "TEST_ENV": "aarch64-linux-alpine3_22-release+no_split_sections",
 +      "TEST_ENV": "aarch64-linux-alpine3_23-release+no_split_sections",
        "XZ_OPT": "-9"
+     }
    },
@@ -3962,7 +4027,7 @@
        "XZ_OPT": "-9"
+     }
    },
 -  "release-i386-linux-alpine3_22-release+no_split_sections": {
 +  "release-i386-linux-alpine3_23-release+no_split_sections": {
      "after_script": [
        ".gitlab/ci.sh save_cache",
        ".gitlab/ci.sh save_test_output",
@@ -3973,7 +4038,7 @@
      "artifacts": {
        "expire_in": "1 year",
        "paths": [
 -        "ghc-i386-linux-alpine3_22-release+no_split_sections.tar.xz",
 +        "ghc-i386-linux-alpine3_23-release+no_split_sections.tar.xz",
          "junit.xml",
          "unexpected-test-output.tar.gz"
        ],
@@ -3983,14 +4048,14 @@
        "when": "always"
      },
      "cache": {
 -      "key": "i386-linux-alpine3_22-$CACHE_REV",
 +      "key": "i386-linux-alpine3_23-$CACHE_REV",
        "paths": [
          "cabal-cache",
          "toolchain"
+       ]
      },
      "dependencies": [],
 -    "image": "registry.gitlab.haskell.org/ghc/ci-images/i386-linux-alpine3_22:$DOCKER_REV",
 +    "image": "registry.gitlab.haskell.org/ghc/ci-images/i386-linux-alpine3_23:$DOCKER_REV",
      "needs": [
+       {
          "artifacts": false,
@@ -4016,14 +4081,14 @@
      ],
      "variables": {
        "BIGNUM_BACKEND": "gmp",
 -      "BIN_DIST_NAME": "ghc-i386-linux-alpine3_22-release+no_split_sections",
 +      "BIN_DIST_NAME": "ghc-i386-linux-alpine3_23-release+no_split_sections",
        "BROKEN_TESTS": "encoding004 T10458 simd009 T25169",
        "BUILD_FLAVOUR": "release+no_split_sections",
        "CONFIGURE_ARGS": "--disable-ld-override --enable-strict-ghc-toolchain-check",
        "IGNORE_PERF_FAILURES": "all",
        "INSTALL_CONFIGURE_ARGS": "--disable-ld-override --enable-strict-ghc-toolchain-check",
        "RUNTEST_ARGS": "",
 -      "TEST_ENV": "i386-linux-alpine3_22-release+no_split_sections",
 +      "TEST_ENV": "i386-linux-alpine3_23-release+no_split_sections",
        "XZ_OPT": "-9"
+     }
    },
@@ -4423,7 +4488,7 @@
        "XZ_OPT": "-9"
+     }
    },
 -  "release-x86_64-linux-alpine3_22-release+no_split_sections": {
 +  "release-x86_64-linux-alpine3_23-release+no_split_sections": {
      "after_script": [
        ".gitlab/ci.sh save_cache",
        ".gitlab/ci.sh save_test_output",
@@ -4434,7 +4499,7 @@
      "artifacts": {
        "expire_in": "1 year",
        "paths": [
 -        "ghc-x86_64-linux-alpine3_22-release+no_split_sections.tar.xz",
 +        "ghc-x86_64-linux-alpine3_23-release+no_split_sections.tar.xz",
          "junit.xml",
          "unexpected-test-output.tar.gz"
        ],
@@ -4444,14 +4509,14 @@
        "when": "always"
      },
      "cache": {
 -      "key": "x86_64-linux-alpine3_22-$CACHE_REV",
 +      "key": "x86_64-linux-alpine3_23-$CACHE_REV",
        "paths": [
          "cabal-cache",
          "toolchain"
+       ]
      },
      "dependencies": [],
 -    "image": "registry.gitlab.haskell.org/ghc/ci-images/x86_64-linux-alpine3_22:$DOCKER_REV",
 +    "image": "registry.gitlab.haskell.org/ghc/ci-images/x86_64-linux-alpine3_23:$DOCKER_REV",
      "needs": [
+       {
          "artifacts": false,
@@ -4477,14 +4542,14 @@
      ],
      "variables": {
        "BIGNUM_BACKEND": "gmp",
 -      "BIN_DIST_NAME": "ghc-x86_64-linux-alpine3_22-release+no_split_sections",
 +      "BIN_DIST_NAME": "ghc-x86_64-linux-alpine3_23-release+no_split_sections",
        "BROKEN_TESTS": "encoding004 T10458",
        "BUILD_FLAVOUR": "release+no_split_sections",
        "CONFIGURE_ARGS": "--disable-ld-override --enable-strict-ghc-toolchain-check",
        "IGNORE_PERF_FAILURES": "all",
        "INSTALL_CONFIGURE_ARGS": "--disable-ld-override --enable-strict-ghc-toolchain-check",
        "RUNTEST_ARGS": "",
 -      "TEST_ENV": "x86_64-linux-alpine3_22-release+no_split_sections",
 +      "TEST_ENV": "x86_64-linux-alpine3_23-release+no_split_sections",
        "XZ_OPT": "-9"
+     }
    },
@@ -4808,7 +4873,7 @@
        "XZ_OPT": "-9"
+     }
    },
 -  "release-x86_64-linux-fedora42-release": {
 +  "release-x86_64-linux-fedora43-release": {
      "after_script": [
        ".gitlab/ci.sh save_cache",
        ".gitlab/ci.sh save_test_output",
@@ -4819,7 +4884,7 @@
      "artifacts": {
        "expire_in": "1 year",
        "paths": [
 -        "ghc-x86_64-linux-fedora42-release.tar.xz",
 +        "ghc-x86_64-linux-fedora43-release.tar.xz",
          "junit.xml",
          "unexpected-test-output.tar.gz"
        ],
@@ -4829,14 +4894,14 @@
        "when": "always"
      },
      "cache": {
 -      "key": "x86_64-linux-fedora42-$CACHE_REV",
 +      "key": "x86_64-linux-fedora43-$CACHE_REV",
        "paths": [
          "cabal-cache",
          "toolchain"
+       ]
      },
      "dependencies": [],
 -    "image": "registry.gitlab.haskell.org/ghc/ci-images/x86_64-linux-fedora42:$DOCKER_REV",
 +    "image": "registry.gitlab.haskell.org/ghc/ci-images/x86_64-linux-fedora43:$DOCKER_REV",
      "needs": [
+       {
          "artifacts": false,
@@ -4862,17 +4927,17 @@
      ],
      "variables": {
        "BIGNUM_BACKEND": "gmp",
 -      "BIN_DIST_NAME": "ghc-x86_64-linux-fedora42-release",
 +      "BIN_DIST_NAME": "ghc-x86_64-linux-fedora43-release",
        "BUILD_FLAVOUR": "release",
        "CONFIGURE_ARGS": "--enable-strict-ghc-toolchain-check",
        "IGNORE_PERF_FAILURES": "all",
        "INSTALL_CONFIGURE_ARGS": "--enable-strict-ghc-toolchain-check",
        "RUNTEST_ARGS": "",
 -      "TEST_ENV": "x86_64-linux-fedora42-release",
 +      "TEST_ENV": "x86_64-linux-fedora43-release",
        "XZ_OPT": "-9"
+     }
    },
 -  "release-x86_64-linux-fedora42-release+debug_info": {
 +  "release-x86_64-linux-fedora43-release+debug_info": {
      "after_script": [
        ".gitlab/ci.sh save_cache",
        ".gitlab/ci.sh save_test_output",
@@ -4883,7 +4948,7 @@
      "artifacts": {
        "expire_in": "1 year",
        "paths": [
 -        "ghc-x86_64-linux-fedora42-release+debug_info.tar.xz",
 +        "ghc-x86_64-linux-fedora43-release+debug_info.tar.xz",
          "junit.xml",
          "unexpected-test-output.tar.gz"
        ],
@@ -4893,14 +4958,14 @@
        "when": "always"
      },
      "cache": {
 -      "key": "x86_64-linux-fedora42-$CACHE_REV",
 +      "key": "x86_64-linux-fedora43-$CACHE_REV",
        "paths": [
          "cabal-cache",
          "toolchain"
+       ]
      },
      "dependencies": [],
 -    "image": "registry.gitlab.haskell.org/ghc/ci-images/x86_64-linux-fedora42:$DOCKER_REV",
 +    "image": "registry.gitlab.haskell.org/ghc/ci-images/x86_64-linux-fedora43:$DOCKER_REV",
      "needs": [
+       {
          "artifacts": false,
@@ -4926,17 +4991,17 @@
      ],
      "variables": {
        "BIGNUM_BACKEND": "gmp",
 -      "BIN_DIST_NAME": "ghc-x86_64-linux-fedora42-release+debug_info",
 +      "BIN_DIST_NAME": "ghc-x86_64-linux-fedora43-release+debug_info",
        "BUILD_FLAVOUR": "release+debug_info",
        "CONFIGURE_ARGS": "--enable-strict-ghc-toolchain-check",
        "IGNORE_PERF_FAILURES": "all",
        "INSTALL_CONFIGURE_ARGS": "--enable-strict-ghc-toolchain-check",
        "RUNTEST_ARGS": "",
 -      "TEST_ENV": "x86_64-linux-fedora42-release+debug_info",
 +      "TEST_ENV": "x86_64-linux-fedora43-release+debug_info",
        "XZ_OPT": "-9"
+     }
    },
 -  "release-x86_64-linux-fedora42-release-hackage": {
 +  "release-x86_64-linux-fedora43-release-hackage": {
      "after_script": [
        ".gitlab/ci.sh save_cache",
        ".gitlab/ci.sh save_test_output",
@@ -4947,7 +5012,7 @@
      "artifacts": {
        "expire_in": "1 year",
        "paths": [
 -        "ghc-x86_64-linux-fedora42-release.tar.xz",
 +        "ghc-x86_64-linux-fedora43-release.tar.xz",
          "junit.xml",
          "unexpected-test-output.tar.gz"
        ],
@@ -4957,14 +5022,14 @@
        "when": "always"
      },
      "cache": {
 -      "key": "x86_64-linux-fedora42-$CACHE_REV",
 +      "key": "x86_64-linux-fedora43-$CACHE_REV",
        "paths": [
          "cabal-cache",
          "toolchain"
+       ]
      },
      "dependencies": [],
 -    "image": "registry.gitlab.haskell.org/ghc/ci-images/x86_64-linux-fedora42:$DOCKER_REV",
 +    "image": "registry.gitlab.haskell.org/ghc/ci-images/x86_64-linux-fedora43:$DOCKER_REV",
      "needs": [
+       {
          "artifacts": false,
@@ -4990,14 +5055,14 @@
      ],
      "variables": {
        "BIGNUM_BACKEND": "gmp",
 -      "BIN_DIST_NAME": "ghc-x86_64-linux-fedora42-release",
 +      "BIN_DIST_NAME": "ghc-x86_64-linux-fedora43-release",
        "BUILD_FLAVOUR": "release",
        "CONFIGURE_ARGS": "--enable-strict-ghc-toolchain-check",
        "HADRIAN_ARGS": "--haddock-for-hackage",
        "IGNORE_PERF_FAILURES": "all",
        "INSTALL_CONFIGURE_ARGS": "--enable-strict-ghc-toolchain-check",
        "RUNTEST_ARGS": "",
 -      "TEST_ENV": "x86_64-linux-fedora42-release",
 +      "TEST_ENV": "x86_64-linux-fedora43-release",
        "XZ_OPT": "-9"
+     }
    },
@@ -5709,7 +5774,7 @@
        "TEST_ENV": "x86_64-linux-alpine3_12-validate+fully_static"
+     }
    },
 -  "x86_64-linux-alpine3_22-validate": {
 +  "x86_64-linux-alpine3_23-validate": {
      "after_script": [
        ".gitlab/ci.sh save_cache",
        ".gitlab/ci.sh save_test_output",
@@ -5720,7 +5785,7 @@
      "artifacts": {
        "expire_in": "2 weeks",
        "paths": [
 -        "ghc-x86_64-linux-alpine3_22-validate.tar.xz",
 +        "ghc-x86_64-linux-alpine3_23-validate.tar.xz",
          "junit.xml",
          "unexpected-test-output.tar.gz"
        ],
@@ -5730,14 +5795,14 @@
        "when": "always"
      },
      "cache": {
 -      "key": "x86_64-linux-alpine3_22-$CACHE_REV",
 +      "key": "x86_64-linux-alpine3_23-$CACHE_REV",
        "paths": [
          "cabal-cache",
          "toolchain"
+       ]
      },
      "dependencies": [],
 -    "image": "registry.gitlab.haskell.org/ghc/ci-images/x86_64-linux-alpine3_22:$DOCKER_REV",
 +    "image": "registry.gitlab.haskell.org/ghc/ci-images/x86_64-linux-alpine3_23:$DOCKER_REV",
      "needs": [
+       {
          "artifacts": false,
@@ -5746,7 +5811,7 @@
      ],
      "rules": [
+       {
 -        "if": "((($ONLY_JOBS) && ($ONLY_JOBS =~ /.*\\bx86_64-linux-alpine3_22-validate(\\s|$).*/)) || (($ONLY_JOBS == null) && (\"disabled\" != \"disabled\"))) && ($RELEASE_JOB != \"yes\") && ($NIGHTLY == null)",
 +        "if": "((($ONLY_JOBS) && ($ONLY_JOBS =~ /.*\\bx86_64-linux-alpine3_23-validate(\\s|$).*/)) || (($ONLY_JOBS == null) && (\"disabled\" != \"disabled\"))) && ($RELEASE_JOB != \"yes\") && ($NIGHTLY == null)",
          "when": "on_success"
+       }
      ],
@@ -5763,16 +5828,16 @@
      ],
      "variables": {
        "BIGNUM_BACKEND": "gmp",
 -      "BIN_DIST_NAME": "ghc-x86_64-linux-alpine3_22-validate",
 +      "BIN_DIST_NAME": "ghc-x86_64-linux-alpine3_23-validate",
        "BROKEN_TESTS": "encoding004 T10458",
        "BUILD_FLAVOUR": "validate",
        "CONFIGURE_ARGS": "--disable-ld-override --enable-strict-ghc-toolchain-check",
        "INSTALL_CONFIGURE_ARGS": "--disable-ld-override --enable-strict-ghc-toolchain-check",
        "RUNTEST_ARGS": "",
 -      "TEST_ENV": "x86_64-linux-alpine3_22-validate"
 +      "TEST_ENV": "x86_64-linux-alpine3_23-validate"
+     }
    },
 -  "x86_64-linux-alpine3_22-wasm-cross_wasm32-wasi-release+host_fully_static+text_simdutf": {
 +  "x86_64-linux-alpine3_23-wasm-cross_wasm32-wasi-release+host_fully_static+text_simdutf": {
      "after_script": [
        ".gitlab/ci.sh save_cache",
        ".gitlab/ci.sh save_test_output",
@@ -5783,7 +5848,7 @@
      "artifacts": {
        "expire_in": "2 weeks",
        "paths": [
 -        "ghc-x86_64-linux-alpine3_22-wasm-cross_wasm32-wasi-release+host_fully_static+text_simdutf.tar.xz",
 +        "ghc-x86_64-linux-alpine3_23-wasm-cross_wasm32-wasi-release+host_fully_static+text_simdutf.tar.xz",
          "junit.xml",
          "unexpected-test-output.tar.gz"
        ],
@@ -5793,14 +5858,14 @@
        "when": "always"
      },
      "cache": {
 -      "key": "x86_64-linux-alpine3_22-wasm-$CACHE_REV",
 +      "key": "x86_64-linux-alpine3_23-wasm-$CACHE_REV",
        "paths": [
          "cabal-cache",
          "toolchain"
+       ]
      },
      "dependencies": [],
 -    "image": "registry.gitlab.haskell.org/ghc/ci-images/x86_64-linux-alpine3_22-wasm:$DOCKER_REV",
 +    "image": "registry.gitlab.haskell.org/ghc/ci-images/x86_64-linux-alpine3_23-wasm:$DOCKER_REV",
      "needs": [
+       {
          "artifacts": false,
@@ -5809,7 +5874,7 @@
      ],
      "rules": [
+       {
 -        "if": "((($ONLY_JOBS) && ($ONLY_JOBS =~ /.*\\bx86_64-linux-alpine3_22-wasm-cross_wasm32-wasi-release\\+host_fully_static\\+text_simdutf(\\s|$).*/)) || (($ONLY_JOBS == null) && ((($CI_MERGE_REQUEST_LABELS =~ /.*full-ci.*/) || ($CI_MERGE_REQUEST_LABELS =~ /.*marge_bot_batch_merge_job.*/) || ($CI_COMMIT_BRANCH == \"master\") || ($CI_COMMIT_BRANCH =~ /ghc-[0-9]+\\.[0-9]+/)) || ($CI_MERGE_REQUEST_LABELS =~ /.*wasm.*/)))) && ($RELEASE_JOB != \"yes\") && ($NIGHTLY == null)",
 +        "if": "((($ONLY_JOBS) && ($ONLY_JOBS =~ /.*\\bx86_64-linux-alpine3_23-wasm-cross_wasm32-wasi-release\\+host_fully_static\\+text_simdutf(\\s|$).*/)) || (($ONLY_JOBS == null) && ((($CI_MERGE_REQUEST_LABELS =~ /.*full-ci.*/) || ($CI_MERGE_REQUEST_LABELS =~ /.*marge_bot_batch_merge_job.*/) || ($CI_COMMIT_BRANCH == \"master\") || ($CI_COMMIT_BRANCH =~ /ghc-[0-9]+\\.[0-9]+/)) || ($CI_MERGE_REQUEST_LABELS =~ /.*wasm.*/)))) && ($RELEASE_JOB != \"yes\") && ($NIGHTLY == null)",
          "when": "on_success"
+       }
      ],
@@ -5826,17 +5891,17 @@
      ],
      "variables": {
        "BIGNUM_BACKEND": "gmp",
 -      "BIN_DIST_NAME": "ghc-x86_64-linux-alpine3_22-wasm-cross_wasm32-wasi-release+host_fully_static+text_simdutf",
 +      "BIN_DIST_NAME": "ghc-x86_64-linux-alpine3_23-wasm-cross_wasm32-wasi-release+host_fully_static+text_simdutf",
        "BUILD_FLAVOUR": "release+host_fully_static+text_simdutf",
        "CONFIGURE_ARGS": "--with-intree-gmp --with-system-libffi --enable-strict-ghc-toolchain-check",
        "CROSS_TARGET": "wasm32-wasi",
        "FIREFOX_LAUNCH_OPTS": "{\"browser\":\"firefox\",\"executablePath\":\"/usr/bin/firefox\"}",
        "HADRIAN_ARGS": "--docs=no-sphinx-pdfs --docs=no-sphinx-man",
        "RUNTEST_ARGS": "",
 -      "TEST_ENV": "x86_64-linux-alpine3_22-wasm-cross_wasm32-wasi-release+host_fully_static+text_simdutf"
 +      "TEST_ENV": "x86_64-linux-alpine3_23-wasm-cross_wasm32-wasi-release+host_fully_static+text_simdutf"
+     }
    },
 -  "x86_64-linux-alpine3_22-wasm-int_native-cross_wasm32-wasi-release+host_fully_static+text_simdutf": {
 +  "x86_64-linux-alpine3_23-wasm-int_native-cross_wasm32-wasi-release+host_fully_static+text_simdutf": {
      "after_script": [
        ".gitlab/ci.sh save_cache",
        ".gitlab/ci.sh save_test_output",
@@ -5847,7 +5912,7 @@
      "artifacts": {
        "expire_in": "2 weeks",
        "paths": [
 -        "ghc-x86_64-linux-alpine3_22-wasm-int_native-cross_wasm32-wasi-release+host_fully_static+text_simdutf.tar.xz",
 +        "ghc-x86_64-linux-alpine3_23-wasm-int_native-cross_wasm32-wasi-release+host_fully_static+text_simdutf.tar.xz",
          "junit.xml",
          "unexpected-test-output.tar.gz"
        ],
@@ -5857,14 +5922,14 @@
        "when": "always"
      },
      "cache": {
 -      "key": "x86_64-linux-alpine3_22-wasm-$CACHE_REV",
 +      "key": "x86_64-linux-alpine3_23-wasm-$CACHE_REV",
        "paths": [
          "cabal-cache",
          "toolchain"
+       ]
      },
      "dependencies": [],
 -    "image": "registry.gitlab.haskell.org/ghc/ci-images/x86_64-linux-alpine3_22-wasm:$DOCKER_REV",
 +    "image": "registry.gitlab.haskell.org/ghc/ci-images/x86_64-linux-alpine3_23-wasm:$DOCKER_REV",
      "needs": [
+       {
          "artifacts": false,
@@ -5874,7 +5939,7 @@
      "rules": [
+       {
          "allow_failure": true,
 -        "if": "((($ONLY_JOBS) && ($ONLY_JOBS =~ /.*\\bx86_64-linux-alpine3_22-wasm-int_native-cross_wasm32-wasi-release\\+host_fully_static\\+text_simdutf(\\s|$).*/)) || (($ONLY_JOBS == null) && ((($CI_MERGE_REQUEST_LABELS =~ /.*full-ci.*/) || ($CI_MERGE_REQUEST_LABELS =~ /.*marge_bot_batch_merge_job.*/) || ($CI_COMMIT_BRANCH == \"master\") || ($CI_COMMIT_BRANCH =~ /ghc-[0-9]+\\.[0-9]+/)) || ($CI_MERGE_REQUEST_LABELS =~ /.*wasm.*/)))) && ($RELEASE_JOB != \"yes\") && ($NIGHTLY == null)",
 +        "if": "((($ONLY_JOBS) && ($ONLY_JOBS =~ /.*\\bx86_64-linux-alpine3_23-wasm-int_native-cross_wasm32-wasi-release\\+host_fully_static\\+text_simdutf(\\s|$).*/)) || (($ONLY_JOBS == null) && ((($CI_MERGE_REQUEST_LABELS =~ /.*full-ci.*/) || ($CI_MERGE_REQUEST_LABELS =~ /.*marge_bot_batch_merge_job.*/) || ($CI_COMMIT_BRANCH == \"master\") || ($CI_COMMIT_BRANCH =~ /ghc-[0-9]+\\.[0-9]+/)) || ($CI_MERGE_REQUEST_LABELS =~ /.*wasm.*/)))) && ($RELEASE_JOB != \"yes\") && ($NIGHTLY == null)",
          "when": "manual"
+       }
      ],
@@ -5891,17 +5956,17 @@
      ],
      "variables": {
        "BIGNUM_BACKEND": "native",
 -      "BIN_DIST_NAME": "ghc-x86_64-linux-alpine3_22-wasm-int_native-cross_wasm32-wasi-release+host_fully_static+text_simdutf",
 +      "BIN_DIST_NAME": "ghc-x86_64-linux-alpine3_23-wasm-int_native-cross_wasm32-wasi-release+host_fully_static+text_simdutf",
        "BUILD_FLAVOUR": "release+host_fully_static+text_simdutf",
        "CONFIGURE_ARGS": "--with-intree-gmp --with-system-libffi --enable-strict-ghc-toolchain-check",
        "CROSS_TARGET": "wasm32-wasi",
        "FIREFOX_LAUNCH_OPTS": "{\"browser\":\"firefox\",\"executablePath\":\"/usr/bin/firefox\"}",
        "HADRIAN_ARGS": "--docs=no-sphinx-pdfs --docs=no-sphinx-man",
        "RUNTEST_ARGS": "",
 -      "TEST_ENV": "x86_64-linux-alpine3_22-wasm-int_native-cross_wasm32-wasi-release+host_fully_static+text_simdutf"
 +      "TEST_ENV": "x86_64-linux-alpine3_23-wasm-int_native-cross_wasm32-wasi-release+host_fully_static+text_simdutf"
+     }
    },
 -  "x86_64-linux-alpine3_22-wasm-unreg-cross_wasm32-wasi-release+host_fully_static+text_simdutf": {
 +  "x86_64-linux-alpine3_23-wasm-unreg-cross_wasm32-wasi-release+host_fully_static+text_simdutf": {
      "after_script": [
        ".gitlab/ci.sh save_cache",
        ".gitlab/ci.sh save_test_output",
@@ -5912,7 +5977,7 @@
      "artifacts": {
        "expire_in": "2 weeks",
        "paths": [
 -        "ghc-x86_64-linux-alpine3_22-wasm-unreg-cross_wasm32-wasi-release+host_fully_static+text_simdutf.tar.xz",
 +        "ghc-x86_64-linux-alpine3_23-wasm-unreg-cross_wasm32-wasi-release+host_fully_static+text_simdutf.tar.xz",
          "junit.xml",
          "unexpected-test-output.tar.gz"
        ],
@@ -5922,14 +5987,14 @@
        "when": "always"
      },
      "cache": {
 -      "key": "x86_64-linux-alpine3_22-wasm-$CACHE_REV",
 +      "key": "x86_64-linux-alpine3_23-wasm-$CACHE_REV",
        "paths": [
          "cabal-cache",
          "toolchain"
+       ]
      },
      "dependencies": [],
 -    "image": "registry.gitlab.haskell.org/ghc/ci-images/x86_64-linux-alpine3_22-wasm:$DOCKER_REV",
 +    "image": "registry.gitlab.haskell.org/ghc/ci-images/x86_64-linux-alpine3_23-wasm:$DOCKER_REV",
      "needs": [
+       {
          "artifacts": false,
@@ -5939,7 +6004,7 @@
      "rules": [
+       {
          "allow_failure": true,
 -        "if": "((($ONLY_JOBS) && ($ONLY_JOBS =~ /.*\\bx86_64-linux-alpine3_22-wasm-unreg-cross_wasm32-wasi-release\\+host_fully_static\\+text_simdutf(\\s|$).*/)) || (($ONLY_JOBS == null) && ((($CI_MERGE_REQUEST_LABELS =~ /.*full-ci.*/) || ($CI_MERGE_REQUEST_LABELS =~ /.*marge_bot_batch_merge_job.*/) || ($CI_COMMIT_BRANCH == \"master\") || ($CI_COMMIT_BRANCH =~ /ghc-[0-9]+\\.[0-9]+/)) || ($CI_MERGE_REQUEST_LABELS =~ /.*wasm.*/)))) && ($RELEASE_JOB != \"yes\") && ($NIGHTLY == null)",
 +        "if": "((($ONLY_JOBS) && ($ONLY_JOBS =~ /.*\\bx86_64-linux-alpine3_23-wasm-unreg-cross_wasm32-wasi-release\\+host_fully_static\\+text_simdutf(\\s|$).*/)) || (($ONLY_JOBS == null) && ((($CI_MERGE_REQUEST_LABELS =~ /.*full-ci.*/) || ($CI_MERGE_REQUEST_LABELS =~ /.*marge_bot_batch_merge_job.*/) || ($CI_COMMIT_BRANCH == \"master\") || ($CI_COMMIT_BRANCH =~ /ghc-[0-9]+\\.[0-9]+/)) || ($CI_MERGE_REQUEST_LABELS =~ /.*wasm.*/)))) && ($RELEASE_JOB != \"yes\") && ($NIGHTLY == null)",
          "when": "manual"
+       }
      ],
@@ -5956,14 +6021,14 @@
      ],
      "variables": {
        "BIGNUM_BACKEND": "gmp",
 -      "BIN_DIST_NAME": "ghc-x86_64-linux-alpine3_22-wasm-unreg-cross_wasm32-wasi-release+host_fully_static+text_simdutf",
 +      "BIN_DIST_NAME": "ghc-x86_64-linux-alpine3_23-wasm-unreg-cross_wasm32-wasi-release+host_fully_static+text_simdutf",
        "BUILD_FLAVOUR": "release+host_fully_static+text_simdutf",
        "CONFIGURE_ARGS": "--enable-unregisterised --with-intree-gmp --with-system-libffi --enable-strict-ghc-toolchain-check",
        "CROSS_TARGET": "wasm32-wasi",
        "FIREFOX_LAUNCH_OPTS": "{\"browser\":\"firefox\",\"executablePath\":\"/usr/bin/firefox\"}",
        "HADRIAN_ARGS": "--docs=no-sphinx-pdfs --docs=no-sphinx-man",
        "RUNTEST_ARGS": "",
 -      "TEST_ENV": "x86_64-linux-alpine3_22-wasm-unreg-cross_wasm32-wasi-release+host_fully_static+text_simdutf"
 +      "TEST_ENV": "x86_64-linux-alpine3_23-wasm-unreg-cross_wasm32-wasi-release+host_fully_static+text_simdutf"
+     }
    },
    "x86_64-linux-deb10-validate": {
@@ -7032,7 +7097,7 @@
        "TEST_ENV": "x86_64-linux-deb9-validate"
+     }
    },
 -  "x86_64-linux-fedora42-release": {
 +  "x86_64-linux-fedora43-release": {
      "after_script": [
        ".gitlab/ci.sh save_cache",
        ".gitlab/ci.sh save_test_output",
@@ -7043,7 +7108,7 @@
      "artifacts": {
        "expire_in": "2 weeks",
        "paths": [
 -        "ghc-x86_64-linux-fedora42-release.tar.xz",
 +        "ghc-x86_64-linux-fedora43-release.tar.xz",
          "junit.xml",
          "unexpected-test-output.tar.gz"
        ],
@@ -7053,14 +7118,14 @@
        "when": "always"
      },
      "cache": {
 -      "key": "x86_64-linux-fedora42-$CACHE_REV",
 +      "key": "x86_64-linux-fedora43-$CACHE_REV",
        "paths": [
          "cabal-cache",
          "toolchain"
+       ]
      },
      "dependencies": [],
 -    "image": "registry.gitlab.haskell.org/ghc/ci-images/x86_64-linux-fedora42:$DOCKER_REV",
 +    "image": "registry.gitlab.haskell.org/ghc/ci-images/x86_64-linux-fedora43:$DOCKER_REV",
      "needs": [
+       {
          "artifacts": false,
@@ -7069,7 +7134,7 @@
      ],
      "rules": [
+       {
 -        "if": "((($ONLY_JOBS) && ($ONLY_JOBS =~ /.*\\bx86_64-linux-fedora42-release(\\s|$).*/)) || (($ONLY_JOBS == null) && ((\"true\" == \"true\")))) && ($RELEASE_JOB != \"yes\") && ($NIGHTLY == null)",
 +        "if": "((($ONLY_JOBS) && ($ONLY_JOBS =~ /.*\\bx86_64-linux-fedora43-release(\\s|$).*/)) || (($ONLY_JOBS == null) && ((\"true\" == \"true\")))) && ($RELEASE_JOB != \"yes\") && ($NIGHTLY == null)",
          "when": "on_success"
+       }
      ],
@@ -7086,15 +7151,15 @@
      ],
      "variables": {
        "BIGNUM_BACKEND": "gmp",
 -      "BIN_DIST_NAME": "ghc-x86_64-linux-fedora42-release",
 +      "BIN_DIST_NAME": "ghc-x86_64-linux-fedora43-release",
        "BUILD_FLAVOUR": "release",
        "CONFIGURE_ARGS": "--enable-strict-ghc-toolchain-check",
        "INSTALL_CONFIGURE_ARGS": "--enable-strict-ghc-toolchain-check",
        "RUNTEST_ARGS": "",
 -      "TEST_ENV": "x86_64-linux-fedora42-release"
 +      "TEST_ENV": "x86_64-linux-fedora43-release"
+     }
    },
 -  "x86_64-linux-fedora42-release-hackage": {
 +  "x86_64-linux-fedora43-release-hackage": {
      "after_script": [
        ".gitlab/ci.sh save_cache",
        ".gitlab/ci.sh save_test_output",
@@ -7105,7 +7170,7 @@
      "artifacts": {
        "expire_in": "2 weeks",
        "paths": [
 -        "ghc-x86_64-linux-fedora42-release.tar.xz",
 +        "ghc-x86_64-linux-fedora43-release.tar.xz",
          "junit.xml",
          "unexpected-test-output.tar.gz"
        ],
@@ -7115,14 +7180,14 @@
        "when": "always"
      },
      "cache": {
 -      "key": "x86_64-linux-fedora42-$CACHE_REV",
 +      "key": "x86_64-linux-fedora43-$CACHE_REV",
        "paths": [
          "cabal-cache",
          "toolchain"
+       ]
      },
      "dependencies": [],
 -    "image": "registry.gitlab.haskell.org/ghc/ci-images/x86_64-linux-fedora42:$DOCKER_REV",
 +    "image": "registry.gitlab.haskell.org/ghc/ci-images/x86_64-linux-fedora43:$DOCKER_REV",
      "needs": [
+       {
          "artifacts": false,
@@ -7131,7 +7196,7 @@
      ],
      "rules": [
+       {
 -        "if": "((($ONLY_JOBS) && ($ONLY_JOBS =~ /.*\\bx86_64-linux-fedora42-release(\\s|$).*/)) || (($ONLY_JOBS == null) && (\"disabled\" != \"disabled\"))) && ($RELEASE_JOB != \"yes\") && ($NIGHTLY == null)",
 +        "if": "((($ONLY_JOBS) && ($ONLY_JOBS =~ /.*\\bx86_64-linux-fedora43-release(\\s|$).*/)) || (($ONLY_JOBS == null) && (\"disabled\" != \"disabled\"))) && ($RELEASE_JOB != \"yes\") && ($NIGHTLY == null)",
          "when": "on_success"
+       }
      ],
@@ -7148,16 +7213,16 @@
      ],
      "variables": {
        "BIGNUM_BACKEND": "gmp",
 -      "BIN_DIST_NAME": "ghc-x86_64-linux-fedora42-release",
 +      "BIN_DIST_NAME": "ghc-x86_64-linux-fedora43-release",
        "BUILD_FLAVOUR": "release",
        "CONFIGURE_ARGS": "--enable-strict-ghc-toolchain-check",
        "HADRIAN_ARGS": "--haddock-for-hackage",
        "INSTALL_CONFIGURE_ARGS": "--enable-strict-ghc-toolchain-check",
        "RUNTEST_ARGS": "",
 -      "TEST_ENV": "x86_64-linux-fedora42-release"
 +      "TEST_ENV": "x86_64-linux-fedora43-release"
+     }
    },
 -  "x86_64-linux-fedora42-validate": {
 +  "x86_64-linux-fedora43-validate": {
      "after_script": [
        ".gitlab/ci.sh save_cache",
        ".gitlab/ci.sh save_test_output",
@@ -7168,7 +7233,7 @@
      "artifacts": {
        "expire_in": "2 weeks",
        "paths": [
 -        "ghc-x86_64-linux-fedora42-validate.tar.xz",
 +        "ghc-x86_64-linux-fedora43-validate.tar.xz",
          "junit.xml",
          "unexpected-test-output.tar.gz"
        ],
@@ -7178,14 +7243,14 @@
        "when": "always"
      },
      "cache": {
 -      "key": "x86_64-linux-fedora42-$CACHE_REV",
 +      "key": "x86_64-linux-fedora43-$CACHE_REV",
        "paths": [
          "cabal-cache",
          "toolchain"
+       ]
      },
      "dependencies": [],
 -    "image": "registry.gitlab.haskell.org/ghc/ci-images/x86_64-linux-fedora42:$DOCKER_REV",
 +    "image": "registry.gitlab.haskell.org/ghc/ci-images/x86_64-linux-fedora43:$DOCKER_REV",
      "needs": [
+       {
          "artifacts": false,
@@ -7194,7 +7259,7 @@
      ],
      "rules": [
+       {
 -        "if": "((($ONLY_JOBS) && ($ONLY_JOBS =~ /.*\\bx86_64-linux-fedora42-validate(\\s|$).*/)) || (($ONLY_JOBS == null) && (\"disabled\" != \"disabled\"))) && ($RELEASE_JOB != \"yes\") && ($NIGHTLY == null)",
 +        "if": "((($ONLY_JOBS) && ($ONLY_JOBS =~ /.*\\bx86_64-linux-fedora43-validate(\\s|$).*/)) || (($ONLY_JOBS == null) && (\"disabled\" != \"disabled\"))) && ($RELEASE_JOB != \"yes\") && ($NIGHTLY == null)",
          "when": "on_success"
+       }
      ],
@@ -7211,15 +7276,15 @@
      ],
      "variables": {
        "BIGNUM_BACKEND": "gmp",
 -      "BIN_DIST_NAME": "ghc-x86_64-linux-fedora42-validate",
 +      "BIN_DIST_NAME": "ghc-x86_64-linux-fedora43-validate",
        "BUILD_FLAVOUR": "validate",
        "CONFIGURE_ARGS": "--enable-strict-ghc-toolchain-check",
        "INSTALL_CONFIGURE_ARGS": "--enable-strict-ghc-toolchain-check",
        "RUNTEST_ARGS": "",
 -      "TEST_ENV": "x86_64-linux-fedora42-validate"
 +      "TEST_ENV": "x86_64-linux-fedora43-validate"
+     }
    },
 -  "x86_64-linux-fedora42-validate+debug_info": {
 +  "x86_64-linux-fedora43-validate+debug_info": {
      "after_script": [
        ".gitlab/ci.sh save_cache",
        ".gitlab/ci.sh save_test_output",
@@ -7230,7 +7295,7 @@
      "artifacts": {
        "expire_in": "2 weeks",
        "paths": [
 -        "ghc-x86_64-linux-fedora42-validate+debug_info.tar.xz",
 +        "ghc-x86_64-linux-fedora43-validate+debug_info.tar.xz",
          "junit.xml",
          "unexpected-test-output.tar.gz"
        ],
@@ -7240,14 +7305,14 @@
        "when": "always"
      },
      "cache": {
 -      "key": "x86_64-linux-fedora42-$CACHE_REV",
 +      "key": "x86_64-linux-fedora43-$CACHE_REV",
        "paths": [
          "cabal-cache",
          "toolchain"
+       ]
      },
      "dependencies": [],
 -    "image": "registry.gitlab.haskell.org/ghc/ci-images/x86_64-linux-fedora42:$DOCKER_REV",
 +    "image": "registry.gitlab.haskell.org/ghc/ci-images/x86_64-linux-fedora43:$DOCKER_REV",
      "needs": [
+       {
          "artifacts": false,
@@ -7256,7 +7321,7 @@
      ],
      "rules": [
+       {
 -        "if": "((($ONLY_JOBS) && ($ONLY_JOBS =~ /.*\\bx86_64-linux-fedora42-validate\\+debug_info(\\s|$).*/)) || (($ONLY_JOBS == null) && (\"disabled\" != \"disabled\"))) && ($RELEASE_JOB != \"yes\") && ($NIGHTLY == null)",
 +        "if": "((($ONLY_JOBS) && ($ONLY_JOBS =~ /.*\\bx86_64-linux-fedora43-validate\\+debug_info(\\s|$).*/)) || (($ONLY_JOBS == null) && (\"disabled\" != \"disabled\"))) && ($RELEASE_JOB != \"yes\") && ($NIGHTLY == null)",
          "when": "on_success"
+       }
      ],
@@ -7273,12 +7338,76 @@
      ],
      "variables": {
        "BIGNUM_BACKEND": "gmp",
 -      "BIN_DIST_NAME": "ghc-x86_64-linux-fedora42-validate+debug_info",
 +      "BIN_DIST_NAME": "ghc-x86_64-linux-fedora43-validate+debug_info",
        "BUILD_FLAVOUR": "validate+debug_info",
        "CONFIGURE_ARGS": "--enable-strict-ghc-toolchain-check",
        "INSTALL_CONFIGURE_ARGS": "--enable-strict-ghc-toolchain-check",
        "RUNTEST_ARGS": "",
 -      "TEST_ENV": "x86_64-linux-fedora42-validate+debug_info"
 +      "TEST_ENV": "x86_64-linux-fedora43-validate+debug_info"
 +    }
 +  },
 +  "x86_64-linux-fedora43-validate+debug_info+ubsan": {
 +    "after_script": [
 +      ".gitlab/ci.sh save_cache",
 +      ".gitlab/ci.sh save_test_output",
 +      ".gitlab/ci.sh clean",
 +      "cat ci_timings.txt"
 +    ],
 +    "allow_failure": false,
 +    "artifacts": {
 +      "expire_in": "2 weeks",
 +      "paths": [
 +        "ghc-x86_64-linux-fedora43-validate+debug_info+ubsan.tar.xz",
 +        "junit.xml",
 +        "unexpected-test-output.tar.gz"
 +      ],
 +      "reports": {
 +        "junit": "junit.xml"
 +      },
 +      "when": "always"
 +    },
 +    "cache": {
 +      "key": "x86_64-linux-fedora43-$CACHE_REV",
 +      "paths": [
 +        "cabal-cache",
 +        "toolchain"
 +      ]
 +    },
 +    "dependencies": [],
 +    "image": "registry.gitlab.haskell.org/ghc/ci-images/x86_64-linux-fedora43:$DOCKER_REV",
 +    "needs": [
 +      {
 +        "artifacts": false,
 +        "job": "hadrian-ghc-in-ghci"
 +      }
 +    ],
 +    "rules": [
 +      {
 +        "if": "((($ONLY_JOBS) && ($ONLY_JOBS =~ /.*\\bx86_64-linux-fedora43-validate\\+debug_info\\+ubsan(\\s|$).*/)) || (($ONLY_JOBS == null) && ((($CI_MERGE_REQUEST_LABELS =~ /.*full-ci.*/) || ($CI_MERGE_REQUEST_LABELS =~ /.*marge_bot_batch_merge_job.*/) || ($CI_COMMIT_BRANCH == \"master\") || ($CI_COMMIT_BRANCH =~ /ghc-[0-9]+\\.[0-9]+/))))) && ($RELEASE_JOB != \"yes\") && ($NIGHTLY == null)",
 +        "when": "on_success"
 +      }
 +    ],
 +    "script": [
 +      "sudo chown ghc:ghc -R .",
 +      ".gitlab/ci.sh setup",
 +      ".gitlab/ci.sh configure",
 +      ".gitlab/ci.sh build_hadrian",
 +      ".gitlab/ci.sh test_hadrian"
 +    ],
 +    "stage": "full-build",
 +    "tags": [
 +      "x86_64-linux"
 +    ],
 +    "variables": {
 +      "BIGNUM_BACKEND": "gmp",
 +      "BIN_DIST_NAME": "ghc-x86_64-linux-fedora43-validate+debug_info+ubsan",
 +      "BUILD_FLAVOUR": "validate+debug_info+ubsan",
 +      "CONFIGURE_ARGS": "--enable-strict-ghc-toolchain-check",
 +      "HADRIAN_ARGS": "--docs=none",
 +      "INSTALL_CONFIGURE_ARGS": "--enable-strict-ghc-toolchain-check",
 +      "RUNTEST_ARGS": "",
 +      "TEST_ENV": "x86_64-linux-fedora43-validate+debug_info+ubsan",
 +      "UBSAN_OPTIONS": "suppressions=$CI_PROJECT_DIR/rts/.ubsan-suppressions"
+     }
    },
    "x86_64-linux-rocky8-validate": {

.gitlab/rel_eng/fetch-gitlab-artifacts/fetch_gitlab.py

@@ -23,26 +23,26 @@ def job_triple(job_name):
          'release-x86_64-linux-ubuntu22_04-release': 'x86_64-ubuntu22_04-linux',
          'release-x86_64-linux-ubuntu20_04-release': 'x86_64-ubuntu20_04-linux',
          'release-x86_64-linux-ubuntu18_04-release': 'x86_64-ubuntu18_04-linux',
 -        'release-x86_64-linux-fedora42-release': 'x86_64-fedora42-linux',
 -        'release-x86_64-linux-fedora42-release+debug_info': 'x86_64-fedora42-linux-dwarf',
 +        'release-x86_64-linux-fedora43-release': 'x86_64-fedora43-linux',
 +        'release-x86_64-linux-fedora43-release+debug_info': 'x86_64-fedora43-linux-dwarf',
          'release-x86_64-linux-deb12-release': 'x86_64-deb12-linux',
          'release-x86_64-linux-deb11-release': 'x86_64-deb11-linux',
          'release-x86_64-linux-deb10-release+debug_info': 'x86_64-deb10-linux-dwarf',
          'release-x86_64-linux-deb10-release': 'x86_64-deb10-linux',
          'release-x86_64-linux-deb9-release': 'x86_64-deb9-linux',
          'release-x86_64-linux-alpine3_12-release+fully_static+no_split_sections': 'x86_64-alpine3_12-linux-static',
 -        'release-x86_64-linux-alpine3_22-release+no_split_sections': 'x86_64-alpine3_22-linux',
 +        'release-x86_64-linux-alpine3_23-release+no_split_sections': 'x86_64-alpine3_23-linux',
          'release-x86_64-linux-alpine3_12-int_native-release+fully_static': 'x86_64-alpine3_12-linux-static-int_native',
          'release-x86_64-darwin-release': 'x86_64-apple-darwin',
          'release-i386-linux-deb12-release': 'i386-deb12-linux',
          'release-i386-linux-deb10-release': 'i386-deb10-linux',
          'release-i386-linux-deb9-release': 'i386-deb9-linux',
 -        'release-i386-linux-alpine3_22-release+no_split_sections': 'i386-alpine3_22-linux',
 +        'release-i386-linux-alpine3_23-release+no_split_sections': 'i386-alpine3_23-linux',
          'release-armv7-linux-deb10-release': 'armv7-deb10-linux',
          'release-aarch64-linux-deb10-release': 'aarch64-deb10-linux',
          'release-aarch64-linux-deb11-release': 'aarch64-deb11-linux',
          'release-aarch64-linux-deb12-release': 'aarch64-deb12-linux',
 -        'release-aarch64-linux-alpine3_22-release+no_split_sections': 'aarch64-alpine3_22-linux',
 +        'release-aarch64-linux-alpine3_23-release+no_split_sections': 'aarch64-alpine3_23-linux',
          'release-aarch64-darwin-release': 'aarch64-apple-darwin',
          'source-tarball': 'src',

.gitlab/rel_eng/mk-ghcup-metadata/mk_ghcup_metadata.py

@@ -200,13 +200,13 @@ def mk_new_yaml(release_mode, version, date, pipeline_type, job_map):
      ubuntu2204 = mk(ubuntu("22_04"))
      ubuntu2404 = mk(ubuntu("24_04"))
      rocky8 = mk(rocky("8"))
 -    fedora42 = mk(fedora(42))
 +    fedora43 = mk(fedora(43))
      darwin_x86 = mk(darwin("x86_64"))
      darwin_arm64 = mk(darwin("aarch64"))
      windows = mk(windowsArtifact)
 -    alpine3_22 = mk(alpine("3_22"))
 -    alpine3_22_arm64 = mk(alpine("3_22", arch='aarch64'))
 -    alpine3_22_i386 = mk(alpine("3_22", arch='i386'))
 +    alpine3_23 = mk(alpine("3_23"))
 +    alpine3_23_arm64 = mk(alpine("3_23", arch='aarch64'))
 +    alpine3_23_i386 = mk(alpine("3_23", arch='i386'))
      deb9 = mk(debian(9, "x86_64"))
      deb10 = mk(debian(10, "x86_64"))
      deb11 = mk(debian(11, "x86_64"))
@@ -239,13 +239,13 @@ def mk_new_yaml(release_mode, version, date, pipeline_type, job_map):
                               , "unknown_versioning": ubuntu2004 }
            , "Linux_CentOS"  : { "( >= 8 && < 9 )" : rocky8
                                , "unknown_versioning" : rocky8  }
 -          , "Linux_Fedora"  : { ">= 42": fedora42
 +          , "Linux_Fedora"  : { ">= 43": fedora43
                                , "unknown_versioning": rocky8 }
            , "Linux_RedHat"  : { "unknown_versioning": rocky8 }
            , "Linux_UnknownLinux" : { "unknown_versioning": rocky8 }
            , "Darwin" : { "unknown_versioning" : darwin_x86 }
            , "Windows" : { "unknown_versioning" :  windows }
 -          , "Linux_Alpine" : { "unknown_versioning": alpine3_22 }
 +          , "Linux_Alpine" : { "unknown_versioning": alpine3_23 }
+           }
      a32 = { "Linux_Debian": { "( >= 10 && < 12 )": deb10_i386
@@ -253,12 +253,12 @@ def mk_new_yaml(release_mode, version, date, pipeline_type, job_map):
                              , "unknown_versioning": deb10_i386 }
            , "Linux_Ubuntu": { "unknown_versioning": deb10_i386 }
            , "Linux_Mint" : { "unknown_versioning": deb10_i386 }
 -          , "Linux_Alpine" : { "unknown_versioning": alpine3_22_i386 }
 +          , "Linux_Alpine" : { "unknown_versioning": alpine3_23_i386 }
            , "Linux_UnknownLinux" : { "unknown_versioning": deb10_i386 }
+           }
      arm64 = { "Linux_UnknownLinux": { "unknown_versioning": deb10_arm64 }
 -            , "Linux_Alpine" : { "unknown_versioning": alpine3_22_arm64 }
 +            , "Linux_Alpine" : { "unknown_versioning": alpine3_23_arm64 }
              , "Linux_Debian": { "( >= 10 && < 12 )": deb10_arm64
                                , "( >= 12 )": deb12_arm64
                                , "unknown_versioning": deb10_arm64

configure.ac

@@ -526,7 +526,7 @@ AC_SUBST(InstallNameToolCmd)
  # versions of LLVM simultaneously, but that stopped working around
  # 3.5/3.6 release of LLVM.
  LlvmMinVersion=13  # inclusive
 -LlvmMaxVersion=21  # not inclusive
 +LlvmMaxVersion=22  # not inclusive
  AC_SUBST([LlvmMinVersion])
  AC_SUBST([LlvmMaxVersion])

hadrian/doc/flavours.md

@@ -238,6 +238,10 @@ The supported transformers are listed below:
          <td><code>thread_sanitizer</code></td>
          <td>Build the runtime system with ThreadSanitizer support</td>
      </tr>
 +    <tr>
 +        <td><code>ubsan</code></td>
 +        <td>Build all stage1+ C/C++ code with UndefinedBehaviorSanitizer support</td>
 +    </tr>
      <tr>
          <td><code>llvm</code></td>
          <td>Use GHC's LLVM backend (`-fllvm`) for all stage1+ compilation.</td>

hadrian/src/Flavour.hs

@@ -7,6 +7,7 @@ module Flavour
    , addArgs
    , splitSections
    , enableThreadSanitizer
 +  , enableUBSan
    , enableLateCCS
    , enableHashUnitIds
    , enableDebugInfo, enableTickyGhc
@@ -33,6 +34,9 @@ import Data.Either
  import Data.Map (Map)
  import qualified Data.Map as M
  import qualified Data.Set as Set
 +import GHC.Platform.ArchOS
 +import Oracles.Flag
 +import Oracles.Setting
  import Packages
  import Flavour.Type
  import Settings.Parser
@@ -53,6 +57,7 @@ flavourTransformers = M.fromList
      , "no_split_sections" =: noSplitSections
      , "thread_sanitizer" =: enableThreadSanitizer False
      , "thread_sanitizer_cmm" =: enableThreadSanitizer True
 +    , "ubsan"            =: enableUBSan
      , "llvm"             =: viaLlvmBackend
      , "profiled_ghc"     =: enableProfiledGhc
      , "no_dynamic_ghc"   =: disableDynamicGhcPrograms
@@ -258,6 +263,51 @@ enableThreadSanitizer instrumentCmm = addArgs $ notStage0 ? mconcat
+         ]
+     ]
 +-- | Whether or not -shared-libsan should be passed to clang at
 +-- link-time.
 +--
 +-- See
 +-- https://github.com/llvm/llvm-project/blob/llvmorg-21.1.7/clang/lib/Driver/SanitizerArgs.cpp#L1008,
 +-- clang defaults to -shared-libsan on darwin/windows and
 +-- -static-libsan on linux. In general, -static-libsan is incredibly
 +-- problematic when multiple copies of the sanitizer runtimes coexist
 +-- in the same address space due to being linked into multiple Haskell
 +-- libraries. So we should explicitly specify `-shared-libsan` if
 +-- needed.
 +--
 +-- A small downside of -shared-libsan is the clang-specific sanitizer
 +-- runtime shared library path needs to be manually specified via
 +-- @export LD_LIBRARY_PATH=$(dirname $(clang -print-libgcc-file-name -rtlib=compiler-rt))@
 +-- for ld.so to find it at runtime.
 +needSharedLibSAN :: Action Bool
 +needSharedLibSAN = do
 +  is_clang <- flag CcLlvmBackend
 +  is_default_shared_libsan <- anyTargetOs [OSDarwin, OSMinGW32]
 +  pure $ is_clang && not is_default_shared_libsan
++
 +-- | Build all stage1+ C/C++ code with UndefinedBehaviorSanitizer
 +-- support:
 +-- https://clang.llvm.org/docs/UndefinedBehaviorSanitizer.html
 +enableUBSan :: Flavour -> Flavour
 +enableUBSan =
 +  addArgs $
 +    notStage0
 +      ? mconcat
 +        [ package rts
 +            ? builder (Cabal Flags)
 +            ? arg "+ubsan"
 +            <> (needSharedLibSAN ? arg "+shared-libsan"),
 +          builder (Ghc CompileHs) ? arg "-optc-fsanitize=undefined",
 +          builder (Ghc CompileCWithGhc) ? arg "-optc-fsanitize=undefined",
 +          builder (Ghc CompileCppWithGhc) ? arg "-optcxx-fsanitize=undefined",
 +          builder (Ghc LinkHs)
 +            ? arg "-optc-fsanitize=undefined"
 +            <> arg "-optl-fsanitize=undefined"
 +            <> (needSharedLibSAN ? arg "-optl-shared-libsan"),
 +          builder (Cc CompileC) ? arg "-fsanitize=undefined",
 +          builder Testsuite ? arg "--config=have_ubsan=True"
 +        ]
++
  -- | Use the LLVM backend in stages 1 and later.
  viaLlvmBackend :: Flavour -> Flavour
  viaLlvmBackend = addArgs $ notStage0 ? builder Ghc ? arg "-fllvm"

rts/.ubsan-suppressions

 +# libraries/text/cbits/measure_off.c:50:39: runtime left shift of 1 by 31 places cannot be represented in type 'int'
 +shift-base:libraries/text/cbits/measure_off.c
++
 +# "runtime call to function foo through pointer to incorrect function
 +# type" is unfortunately pretty common (e.g. evac_fn in rts) and
 +# impact the signal to noise ratio of UBSan warnings. gcc doesn't
 +# implement this instrumentation though.
 +function:*

rts/Interpreter.c

@@ -274,12 +274,21 @@ See also Note [Width of parameters] for some more motivation.
  #define W64_TO_WDS(n) ((n * sizeof(StgWord64) / sizeof(StgWord)))
 +// Returns a pointer to the stack location.
 +#define SafeSpWP(n)      \
 +  ( ((WITHIN_CAP_CHUNK_BOUNDS_W(n)) ? Sp_plusW(n) : slow_spw(Sp, cap->r.rCurrentTSO->stackobj, n)))
 +#define SafeSpBP(off_w)      \
 +  ( (WITHIN_CAP_CHUNK_BOUNDS_W((1+(off_w))/sizeof(StgWord))) ? \
 +        Sp_plusB(off_w) : \
 +        (void*)((ptrdiff_t)((ptrdiff_t)(off_w) % (ptrdiff_t)sizeof(StgWord)) + (StgWord8*)slow_spw(Sp, cap->r.rCurrentTSO->stackobj, (off_w)/sizeof(StgWord))) \
 +    )
++
  // Always safe to use - Return the value at the address
  #define ReadSpW(n)       (*((StgWord*)   SafeSpWP(n)))
  //Argument is offset in multiples of word64
  #define ReadSpW64(n)     (*((StgWord64*) SafeSpWP(W64_TO_WDS(n))))
  // Perhaps confusingly this still reads a full word, merely the offset is in bytes.
 -#define ReadSpB(n)       (*((StgWord*)   SafeSpBP(n)))
 +#define ReadSpB(n)       (*((StgUnalignedWord*)   SafeSpBP(n)))
  /* Note [PUSH_L underflow]
     ~~~~~~~~~~~~~~~~~~~~~~~
@@ -326,15 +335,6 @@ See ticket #25750
  */
 -// Returns a pointer to the stack location.
 -#define SafeSpWP(n)      \
 -  ( ((WITHIN_CAP_CHUNK_BOUNDS_W(n)) ? Sp_plusW(n) : slow_spw(Sp, cap->r.rCurrentTSO->stackobj, n)))
 -#define SafeSpBP(off_w)      \
 -  ( (WITHIN_CAP_CHUNK_BOUNDS_W((1+(off_w))/sizeof(StgWord))) ? \
 -        Sp_plusB(off_w) : \
 -        (void*)((ptrdiff_t)((ptrdiff_t)(off_w) % (ptrdiff_t)sizeof(StgWord)) + (StgWord8*)slow_spw(Sp, cap->r.rCurrentTSO->stackobj, (off_w)/sizeof(StgWord))) \
 -    )
+-
  /* Note [Interpreter subword primops]
@@ -2904,57 +2904,106 @@ run_BCO:
          NEXT_INSTRUCTION;                                              \
+     }
 +/* Note [Cmm arithmetic in interpretBCO]
 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
++
 +interpretBCO implements Cmm arithmetic primops by loading operands
 +from the stack as C integers, applying C arithmetic operation, then
 +storing the result back to the stack. But there are subtle differences
 +in Cmm and C arithmetic operations:
++
 +- The Cmm type system only tracks operand sizes for integer types, and
 +  doesn't track signedness (#20652)
 +- Cmm arithmetic operations are allowed to overflow based on two's
 +  complement wrap-around semantics
++
 +Meanwhile in C:
++
 +- The C type system tracks signedness
 +- Signed overflow is undefined behavior
 +- Subword operands are implicitly promoted to int
++
 +Consider an example where we do an `MO_Mul W16` on both 0xFFFF.
 +Previously we would load each operand as a word, cast to a subword and
 +do the multiplication. But C actually does multiplication on int,
 +which is 32-bit on most platforms, and now a signed overflow occurs!
++
 +To perform Cmm arithmetic without tripping on C undefined behavior, we
 +now:
++
 +- Always specify unsigned C operand type for the Cmm primop, unless
 +  signed operand is absolutely needed for correctness (e.g. signed
 +  comparison or right shift)
 +- Explicitly promote operands to a C type no smaller than a host word,
 +  so either StgInt or StgWord, depending on the signedness of ty,
 +  hence the TYPE_IS_SIGNED macro
 +*/
++
 +#define TYPE_IS_SIGNED(ty) ((ty)-1 < (ty)1)
++
  // op :: ty -> ty -> ty
  #define SIZED_BIN_OP(op,ty)                                                     \
          {                                                                       \
              if(sizeof(ty) == 8) {                                               \
 -                ty r = ((ty) ReadSpW64(0)) op ((ty) ReadSpW64(1));                  \
 +                ty r = ((ty) ReadSpW64(0)) op ((ty) ReadSpW64(1));              \
                  Sp_addW64(1);                                                   \
                  SpW64(0) = (StgWord64) r;                                       \
 +            } else if (TYPE_IS_SIGNED(ty)) {                                    \
 +                ty r = ((StgInt)(ty)ReadSpW(0)) op ((StgInt)(ty)ReadSpW(1));    \
 +                Sp_addW(1);                                                     \
 +                SpW(0) = (StgWord) r;                                           \
              } else {                                                            \
 -                ty r = ((ty) ReadSpW(0)) op ((ty) ReadSpW(1));                  \
 +                ty r = ((StgWord)(ty)ReadSpW(0)) op ((StgWord)(ty)ReadSpW(1));  \
                  Sp_addW(1);                                                     \
                  SpW(0) = (StgWord) r;                                           \
              };                                                                  \
 -            NEXT_INSTRUCTION;                                                      \
 +            NEXT_INSTRUCTION;                                                   \
+         }
  // op :: ty -> Int -> ty
 -#define SIZED_BIN_OP_TY_INT(op,ty)                                      \
 -{                                                                       \
 -    if(sizeof(ty) > sizeof(StgWord)) {                                  \
 -        ty r = ((ty) ReadSpW64(0)) op ((StgInt) ReadSpW(2));                \
 -        Sp_addW(1);                                                     \
 -        SpW64(0) = (StgWord64) r;                                       \
 -    } else {                                                            \
 -        ty r = ((ty) ReadSpW(0)) op ((StgInt) ReadSpW(1));                  \
 -        Sp_addW(1);                                                     \
 -        SpW(0) = (StgWord) r;                                           \
 -    };                                                                  \
 -    NEXT_INSTRUCTION;                                                      \
 +#define SIZED_BIN_OP_TY_INT(op,ty)                                  \
 +{                                                                   \
 +    if(sizeof(ty) > sizeof(StgWord)) {                              \
 +        ty r = ((ty) ReadSpW64(0)) op ((StgInt) ReadSpW(2));        \
 +        Sp_addW(1);                                                 \
 +        SpW64(0) = (StgWord64) r;                                   \
 +    } else if (TYPE_IS_SIGNED(ty)) {                                \
 +        ty r = ((StgInt)(ty) ReadSpW(0)) op ((StgInt) ReadSpW(1));  \
 +        Sp_addW(1);                                                 \
 +        SpW(0) = (StgWord) r;                                       \
 +    } else {                                                        \
 +        ty r = ((StgWord)(ty) ReadSpW(0)) op ((StgInt) ReadSpW(1)); \
 +        Sp_addW(1);                                                 \
 +        SpW(0) = (StgWord) r;                                       \
 +    };                                                              \
 +    NEXT_INSTRUCTION;                                               \
+ }
  // op :: ty -> ty -> Int
 -#define SIZED_BIN_OP_TY_TY_INT(op,ty)                                   \
 -{                                                                       \
 -    if(sizeof(ty) > sizeof(StgWord)) {                                  \
 -        ty r = ((ty) ReadSpW64(0)) op ((ty) ReadSpW64(1));              \
 -        Sp_addW(3);                                                     \
 -        SpW(0) = (StgWord) r;                                       \
 -    } else {                                                            \
 -        ty r = ((ty) ReadSpW(0)) op ((ty) ReadSpW(1));                  \
 -        Sp_addW(1);                                                     \
 -        SpW(0) = (StgWord) r;                                           \
 -    };                                                                  \
 -    NEXT_INSTRUCTION;                                                      \
 +#define SIZED_BIN_OP_TY_TY_INT(op,ty)                                        \
 +{                                                                            \
 +    if(sizeof(ty) > sizeof(StgWord)) {                                       \
 +        StgInt r = ((ty) ReadSpW64(0)) op ((ty) ReadSpW64(1));               \
 +        Sp_addW(3);                                                          \
 +        SpW(0) = (StgWord) r;                                                \
 +    } else if (TYPE_IS_SIGNED(ty)) {                                         \
 +        StgInt r = ((StgInt)(ty) ReadSpW(0)) op ((StgInt)(ty) ReadSpW(1));   \
 +        Sp_addW(1);                                                          \
 +        SpW(0) = (StgWord) r;                                                \
 +    } else {                                                                 \
 +        StgInt r = ((StgWord)(ty) ReadSpW(0)) op ((StgWord)(ty) ReadSpW(1)); \
 +        Sp_addW(1);                                                          \
 +        SpW(0) = (StgWord) r;                                                \
 +    };                                                                       \
 +    NEXT_INSTRUCTION;                                                        \
+ }
 -        INSTRUCTION(bci_OP_ADD_64): SIZED_BIN_OP(+, StgInt64)
 -        INSTRUCTION(bci_OP_SUB_64): SIZED_BIN_OP(-, StgInt64)
 -        INSTRUCTION(bci_OP_AND_64): SIZED_BIN_OP(&, StgInt64)
 -        INSTRUCTION(bci_OP_XOR_64): SIZED_BIN_OP(^, StgInt64)
 -        INSTRUCTION(bci_OP_OR_64):  SIZED_BIN_OP(|, StgInt64)
 -        INSTRUCTION(bci_OP_MUL_64): SIZED_BIN_OP(*, StgInt64)
 +        INSTRUCTION(bci_OP_ADD_64): SIZED_BIN_OP(+, StgWord64)
 +        INSTRUCTION(bci_OP_SUB_64): SIZED_BIN_OP(-, StgWord64)
 +        INSTRUCTION(bci_OP_AND_64): SIZED_BIN_OP(&, StgWord64)
 +        INSTRUCTION(bci_OP_XOR_64): SIZED_BIN_OP(^, StgWord64)
 +        INSTRUCTION(bci_OP_OR_64):  SIZED_BIN_OP(|, StgWord64)
 +        INSTRUCTION(bci_OP_MUL_64): SIZED_BIN_OP(*, StgWord64)
          INSTRUCTION(bci_OP_SHL_64): SIZED_BIN_OP_TY_INT(<<, StgWord64)
          INSTRUCTION(bci_OP_LSR_64): SIZED_BIN_OP_TY_INT(>>, StgWord64)
          INSTRUCTION(bci_OP_ASR_64): SIZED_BIN_OP_TY_INT(>>, StgInt64)
@@ -2972,15 +3021,15 @@ run_BCO:
          INSTRUCTION(bci_OP_S_LE_64): SIZED_BIN_OP_TY_TY_INT(<=, StgInt64)
          INSTRUCTION(bci_OP_NOT_64): UN_SIZED_OP(~, StgWord64)
 -        INSTRUCTION(bci_OP_NEG_64): UN_SIZED_OP(-, StgInt64)
 +        INSTRUCTION(bci_OP_NEG_64): UN_SIZED_OP(-, StgWord64)
 -        INSTRUCTION(bci_OP_ADD_32): SIZED_BIN_OP(+, StgInt32)
 -        INSTRUCTION(bci_OP_SUB_32): SIZED_BIN_OP(-, StgInt32)
 -        INSTRUCTION(bci_OP_AND_32): SIZED_BIN_OP(&, StgInt32)
 -        INSTRUCTION(bci_OP_XOR_32): SIZED_BIN_OP(^, StgInt32)
 -        INSTRUCTION(bci_OP_OR_32):  SIZED_BIN_OP(|, StgInt32)
 -        INSTRUCTION(bci_OP_MUL_32): SIZED_BIN_OP(*, StgInt32)
 +        INSTRUCTION(bci_OP_ADD_32): SIZED_BIN_OP(+, StgWord32)
 +        INSTRUCTION(bci_OP_SUB_32): SIZED_BIN_OP(-, StgWord32)
 +        INSTRUCTION(bci_OP_AND_32): SIZED_BIN_OP(&, StgWord32)
 +        INSTRUCTION(bci_OP_XOR_32): SIZED_BIN_OP(^, StgWord32)
 +        INSTRUCTION(bci_OP_OR_32):  SIZED_BIN_OP(|, StgWord32)
 +        INSTRUCTION(bci_OP_MUL_32): SIZED_BIN_OP(*, StgWord32)
          INSTRUCTION(bci_OP_SHL_32): SIZED_BIN_OP_TY_INT(<<, StgWord32)
          INSTRUCTION(bci_OP_LSR_32): SIZED_BIN_OP_TY_INT(>>, StgWord32)
          INSTRUCTION(bci_OP_ASR_32): SIZED_BIN_OP_TY_INT(>>, StgInt32)
@@ -2998,15 +3047,15 @@ run_BCO:
          INSTRUCTION(bci_OP_S_LE_32): SIZED_BIN_OP_TY_TY_INT(<=, StgInt32)
          INSTRUCTION(bci_OP_NOT_32): UN_SIZED_OP(~, StgWord32)
 -        INSTRUCTION(bci_OP_NEG_32): UN_SIZED_OP(-, StgInt32)
 +        INSTRUCTION(bci_OP_NEG_32): UN_SIZED_OP(-, StgWord32)
 -        INSTRUCTION(bci_OP_ADD_16): SIZED_BIN_OP(+, StgInt16)
 -        INSTRUCTION(bci_OP_SUB_16): SIZED_BIN_OP(-, StgInt16)
 -        INSTRUCTION(bci_OP_AND_16): SIZED_BIN_OP(&, StgInt16)
 -        INSTRUCTION(bci_OP_XOR_16): SIZED_BIN_OP(^, StgInt16)
 -        INSTRUCTION(bci_OP_OR_16):  SIZED_BIN_OP(|, StgInt16)
 -        INSTRUCTION(bci_OP_MUL_16): SIZED_BIN_OP(*, StgInt16)
 +        INSTRUCTION(bci_OP_ADD_16): SIZED_BIN_OP(+, StgWord16)
 +        INSTRUCTION(bci_OP_SUB_16): SIZED_BIN_OP(-, StgWord16)
 +        INSTRUCTION(bci_OP_AND_16): SIZED_BIN_OP(&, StgWord16)
 +        INSTRUCTION(bci_OP_XOR_16): SIZED_BIN_OP(^, StgWord16)
 +        INSTRUCTION(bci_OP_OR_16):  SIZED_BIN_OP(|, StgWord16)
 +        INSTRUCTION(bci_OP_MUL_16): SIZED_BIN_OP(*, StgWord16)
          INSTRUCTION(bci_OP_SHL_16): SIZED_BIN_OP_TY_INT(<<, StgWord16)
          INSTRUCTION(bci_OP_LSR_16): SIZED_BIN_OP_TY_INT(>>, StgWord16)
          INSTRUCTION(bci_OP_ASR_16): SIZED_BIN_OP_TY_INT(>>, StgInt16)
@@ -3024,15 +3073,15 @@ run_BCO:
          INSTRUCTION(bci_OP_S_LE_16): SIZED_BIN_OP(<=, StgInt16)
          INSTRUCTION(bci_OP_NOT_16): UN_SIZED_OP(~, StgWord16)
 -        INSTRUCTION(bci_OP_NEG_16): UN_SIZED_OP(-, StgInt16)
 +        INSTRUCTION(bci_OP_NEG_16): UN_SIZED_OP(-, StgWord16)
 -        INSTRUCTION(bci_OP_ADD_08): SIZED_BIN_OP(+, StgInt8)
 -        INSTRUCTION(bci_OP_SUB_08): SIZED_BIN_OP(-, StgInt8)
 -        INSTRUCTION(bci_OP_AND_08): SIZED_BIN_OP(&, StgInt8)
 -        INSTRUCTION(bci_OP_XOR_08): SIZED_BIN_OP(^, StgInt8)
 -        INSTRUCTION(bci_OP_OR_08):  SIZED_BIN_OP(|, StgInt8)
 -        INSTRUCTION(bci_OP_MUL_08): SIZED_BIN_OP(*, StgInt8)
 +        INSTRUCTION(bci_OP_ADD_08): SIZED_BIN_OP(+, StgWord8)
 +        INSTRUCTION(bci_OP_SUB_08): SIZED_BIN_OP(-, StgWord8)
 +        INSTRUCTION(bci_OP_AND_08): SIZED_BIN_OP(&, StgWord8)
 +        INSTRUCTION(bci_OP_XOR_08): SIZED_BIN_OP(^, StgWord8)
 +        INSTRUCTION(bci_OP_OR_08):  SIZED_BIN_OP(|, StgWord8)
 +        INSTRUCTION(bci_OP_MUL_08): SIZED_BIN_OP(*, StgWord8)
          INSTRUCTION(bci_OP_SHL_08): SIZED_BIN_OP_TY_INT(<<, StgWord8)
          INSTRUCTION(bci_OP_LSR_08): SIZED_BIN_OP_TY_INT(>>, StgWord8)
          INSTRUCTION(bci_OP_ASR_08): SIZED_BIN_OP_TY_INT(>>, StgInt8)
@@ -3050,7 +3099,7 @@ run_BCO:
          INSTRUCTION(bci_OP_S_LE_08): SIZED_BIN_OP_TY_TY_INT(<=, StgInt8)
          INSTRUCTION(bci_OP_NOT_08): UN_SIZED_OP(~, StgWord8)
 -        INSTRUCTION(bci_OP_NEG_08): UN_SIZED_OP(-, StgInt8)
 +        INSTRUCTION(bci_OP_NEG_08): UN_SIZED_OP(-, StgWord8)
          INSTRUCTION(bci_OP_INDEX_ADDR_64):
+         {
@@ -3130,7 +3179,7 @@ run_BCO:
              StgPtr p;
              W_ ret[2];                  // max needed
              W_ *arguments[stk_offset];  // max needed
 -            void *argptrs[nargs];
 +            void *argptrs[nargs > 0 ? nargs : 1]; // the size of a variable length array must be positive
              void (*fn)(void);
              if (cif->rtype == &ffi_type_void) {

rts/include/stg/Types.h

@@ -147,6 +147,8 @@ typedef uint16_t           StgHalfWord;
  #error GHC untested on this architecture: sizeof(void *) != 4 or 8
  #endif
 +typedef StgWord StgUnalignedWord __attribute__((aligned(1)));
++
  #define W_MASK  (sizeof(W_)-1)
  /*

rts/rts.cabal

@@ -91,6 +91,19 @@ flag thread-sanitizer
      in @rts/include/rts/TSANUtils.h@.
    default: False
    manual: True
 +flag ubsan
 +  description:
 +    Link with -fsanitize=undefined, to be enabled when building with
 +    UndefinedBehaviorSanitizer.
 +  default: False
 +  manual: True
 +flag shared-libsan
 +  description:
 +    Link with -shared-libsan, to guarantee only one copy of the
 +    sanitizer runtimes exist in the address space. See
 +    needSharedLibSAN in hadrian/src/Flavour.hs.
 +  default: False
 +  manual: True
  library
      -- rts is a wired in package and
@@ -200,6 +213,12 @@ library
          cc-options: -fsanitize=thread
          ld-options: -fsanitize=thread
 +      if flag(ubsan)
 +        ld-options: -fsanitize=undefined
++
 +      if flag(shared-libsan)
 +        ld-options: -shared-libsan
++
        if os(linux)
           -- the RTS depends upon libc. while this dependency is generally
           -- implicitly added by `cc`, we must explicitly add it here to ensure

testsuite/driver/testglobals.py

@@ -186,6 +186,9 @@ class TestConfig:
          # Are we running in a ThreadSanitizer-instrumented build?
          self.have_thread_sanitizer = False
 +        # Are we running with UndefinedBehaviorSanitizer enabled?
 +        self.have_ubsan = False
++
          # Do symbols use leading underscores?
          self.leading_underscore = False

testsuite/driver/testlib.py

@@ -1090,6 +1090,8 @@ def llvm_build ( ) -> bool:
  def have_thread_sanitizer( ) -> bool:
      return config.have_thread_sanitizer
 +def have_ubsan( ) -> bool:
 +    return config.have_ubsan
  def gcc_as_cmmp() -> bool:
      return config.cmm_cpp_is_gcc