Staticlib hide internal symbols by cezarbbb · Pull Request #155338 · rust-lang/rust

cezarbbb · 2026-04-15T12:16:07Z

According to issue #104707, when building a staticlib, all Rust internal symbols — mangled symbols, #[rustc_std_internal_symbol] items, allocator shims, etc. — leak out of the static archive. In contrast, cdylib correctly exports only #[no_mangle] symbols via a linker version script.

-Zstaticlib-hide-internal-symbols directly post-processes ELF object files in the archive: parsing the SHT_SYMTAB sections and setting STV_HIDDEN visibility on any GLOBAL/WEAK defined symbol that is not in the exported symbol set, without changing the binding. This is an in-place modification (only writing the st_other byte per matching entry), with zero overhead.

Supported on ELF targets (Linux, BSD, etc.) and Apple targets (macOS, iOS, etc.). On unsupported targets (Windows), a warning is emitted and the flag has no effect.

Update: The rename counterpart (-Zstaticlib-rename-internal-symbols) is in #156950.

The test code are as follows:

1.a std rust staticlib:

use std::collections::HashMap;use std::panic::{catch_unwind,AssertUnwindSafe};#[no_mangle]pubextern"C"fnmy_add(a:i32,b:i32) -> i32{ a + b }#[no_mangle]pubextern"C"fnmy_hash_lookup(key:u64) -> u64{letmut map = HashMap::new();for i in0..100u64{ map.insert(i, i.wrapping_mul(2654435761));}*map.get(&key).unwrap_or(&0)}pubfninternal_reverse(s:&str) -> String{ s.chars().rev().collect()}#[no_mangle]pubextern"C"fnmy_format_number(n:i32) -> i32{let s = format!("number: {}", n); s.len()asi32}#[no_mangle]pubextern"C"fnmy_safe_div(a:i32,b:i32) -> i32{matchcatch_unwind(AssertUnwindSafe(|| {if b == 0{panic!("division by zero!");}
a / b
})){Ok(result) => result,Err(_) => -1,}}#[no_mangle]pubextern"C"fnmy_uncaught_panic(){panic!("uncaught panic across FFI");}

1.b downstream c program:

externintmy_add(inta, intb);
externunsigned longmy_hash_lookup(unsigned longkey);
externintmy_format_number(intn);
externintmy_safe_div(inta, intb);
externvoidmy_uncaught_panic(void);
intmain() {
intfailures=0;
if (my_add(10, 20) !=30) failures++;
if (my_hash_lookup(5) !=5UL*2654435761UL) failures++;
if (my_format_number(42) !=10) failures++;
if (my_safe_div(100, 5) !=20) failures++;
if (my_safe_div(100, 0) !=-1) failures++;
pid_tpid=fork();
if (pid==0) { alarm(5); my_uncaught_panic(); _exit(0); }
else { waitpid(pid, &status, 0); }
returnfailures;
}

The test results with different compiler flags(which might cause binary size reduction) are as follows:
1.c result with -Zstaticlib-hide-internal-symbols

 settings OFF ON -Zsave ALL OFF.dynsym ON.dynsym ------------------------------------------------------------------------
default 1.7M 1.5M 204K (12%) 1735 5 1730
lto_thin 616K 584K 33K (5%) 246 5 241
lto_fat 525K 525K 0 (0%) 6 5 1
opt_s 1.7M 1.5M 204K (12%) 1735 5 1730
opt_z 1.7M 1.5M 204K (12%) 1735 5 1730
lto_thin_z 602K 570K 32K (5%) 246 5 241
lto_fat_z 514K 514K 0 (0%) 6 5 1
full 514K 514K 0 (0%) 6 5 1

1.d result with -Zstaticlib-hide-internal-symbols + -Zstaticlib-rename-internal-symbols

 settings OFF ON -Zsave ALL OFF.dynsym ON.dynsym ------------------------------------------------------------------------
default 1.7M 1.5M 162K (9%) 1735 5 1730
lto_thin 616K 599K 18K (2%) 246 5 241
lto_fat 525K 535K -1% (-1%) 6 5 1
opt_s 1.7M 1.5M 162K (9%) 1735 5 1730
opt_z 1.7M 1.5M 162K (9%) 1735 5 1730
lto_thin_z 602K 585K 18K (2%) 246 5 241
lto_fat_z 514K 524K -1% (-1%) 6 5 1
full 514K 523K -1% (-1%) 6 5 1

2.a no_std rust staticlib

#![no_std]#![feature(core_intrinsics)]use core::panic::PanicInfo;#[panic_handler]fnpanic(_info:&PanicInfo) -> ! {loop{}}#[no_mangle]pubextern"C"fnembedded_add(a:i32,b:i32) -> i32{ a.wrapping_add(b)}#[no_mangle]pubextern"C"fnembedded_checksum(data:*constu8,len:usize) -> u8{if data.is_null(){return0;}let slice = unsafe{ core::slice::from_raw_parts(data, len)};letmut sum:u8 = 0;for&byte in slice { sum = sum.wrapping_add(byte);}
sum
}fninternal_helper() -> i32{42}#[no_mangle]pubextern"C"fncall_internal() -> i32{internal_helper()}#[no_mangle]pubextern"C"fnembedded_trigger_abort(){ core::intrinsics::abort();}

2.b downstream c program

externintembedded_add(inta, intb);
externunsigned charembedded_checksum(constunsigned char*data, unsigned longlen);
externintcall_internal(void);
externvoidembedded_trigger_abort(void);
intmain() {
intfailures=0;
if (embedded_add(10, 20) !=30) failures++;
unsigned chardata[] = {1, 2, 3};
if (embedded_checksum(data, 3) !=6) failures++;
if (call_internal() !=42) failures++;
pid_tpid=fork();
if (pid==0) { embedded_trigger_abort(); _exit(0); }
else { waitpid(pid, &status, 0); }
returnfailures;
}

The test results with different compiler flags(which might cause binary size reduction) are as follows:
2.c result with -Zstaticlib-hide-internal-symbols

 settings OFF ON -Zsave ALL OFF.dynsym ON.dynsym ------------------------------------------------------------------------
default 485K 429K 56K (11%) 490 4 486
lto_thin 180K 180K 0 (0%) 4 4 0
lto_fat 179K 179K 0 (0%) 4 4 0
opt_s 485K 429K 56K (11%) 490 4 486
opt_z 485K 429K 56K (11%) 490 4 486
lto_thin_z 180K 180K 0 (0%) 4 4 0
lto_fat_z 179K 179K 0 (0%) 4 4 0
full 179K 179K 0 (0%) 4 4 0

2.d result with -Zstaticlib-hide-internal-symbols + -Zstaticlib-rename-internal-symbols

 settings OFF ON -Zsave ALL OFF.dynsym ON.dynsym ------------------------------------------------------------------------
default 485K 447K 39K (7%) 490 4 486
lto_thin 180K 189K -5% (-5%) 4 4 0
lto_fat 179K 189K -5% (-5%) 4 4 0
opt_s 485K 448K 38K (7%) 490 4 486
opt_z 485K 448K 38K (7%) 490 4 486
lto_thin_z 180K 189K -5% (-5%) 4 4 0
lto_fat_z 179K 189K -5% (-5%) 4 4 0
full 179K 189K -5% (-5%) 4 4 0

Test results show that this compiler option is beneficial for scenarios where LTO cannot be enabled.

r? @bjorn3 @petrochenkov

rustbot · 2026-04-15T12:16:14Z

r? @petrochenkov

rustbot has assigned @petrochenkov.
They will have a look at your PR within the next two weeks and either review your PR or reassign to another reviewer.

Use r? to explicitly pick a reviewer

Why was this reviewer chosen?

The reviewer was selected based on:

Owners of files modified in this PR: codegen, compiler
codegen, compiler expanded to 69 candidates
Random selection from 16 candidates

bjorn3 · 2026-04-15T12:24:07Z

This would also need to rename symbols to avoid conflicts between two rust staticlibs ending up getting linked together, right?

bjorn3 · 2026-04-15T12:27:57Z

The rust_eh_personality symbol is always kept visible to ensure .eh_frame unwinding works correctly for C consumers.

Why exactly is that the case? rust_eh_personality is actually the symbol that is most likely to cause conflicts as it is the only one whose name doesn't get mangled depending on the rustc version.

cezarbbb · 2026-04-15T12:42:34Z

This would also need to rename symbols to avoid conflicts between two rust staticlibs ending up getting linked together, right?

My primary goal right now is to reduce binary size, so I don't have immediate plans to implement symbol renaming. This means that linking multiple Rust staticlibs together can still result in multiple definition errors. Would you like me to address that in this PR as well? It seems feasible to implement — for example, by rehashing symbols and updating their references accordingly.

cezarbbb · 2026-04-15T12:50:03Z

The rust_eh_personality symbol is always kept visible to ensure .eh_frame unwinding works correctly for C consumers.
Why exactly is that the case? rust_eh_personality is actually the symbol that is most likely to cause conflicts as it is the only one whose name doesn't get mangled depending on the rustc version.

I previously assumed this symbol needed to remain externally visible to support scenarios requiring cross-language exception propagation. Do you think we should also set rust_eh_personality as hidden?

bjorn3 · 2026-04-15T12:51:20Z

If it isn't too hard it would be nice to do symbol renaming too. I think doing in-place modification isn't going to work for that though. Adding a unique suffix would require growing the size of the string table.

bjorn3 · 2026-04-15T12:52:52Z

I previously assumed this symbol needed to remain externally visible to support scenarios requiring cross-language exception propagation. Do you think we should also set rust_eh_personality as hidden?

rust_eh_personality is only meant to be referenced by the .eh_frame section of rust object files. The only reason it's name isn't mangled is because LLVM hard codes the name to determine the exception table format to emit.

cezarbbb · 2026-04-15T12:58:28Z

If it isn't too hard it would be nice to do symbol renaming too. I think doing in-place modification isn't going to work for that though. Adding a unique suffix would require growing the size of the string table.

Got it. I will first fix the rust_eh_personality issue, and then try to implement symbol renaming.

SparrowLii · 2026-04-16T03:55:52Z

@bors delegate=try

rust-bors · 2026-04-16T03:55:55Z

✌️ @cezarbbb, you can now perform try builds on this pull request!

You can now post @bors try to start a try build.

cezarbbb · 2026-04-16T04:38:38Z

@bors try

`-Zstaticlib-hide-internal-symbols`: Hide non-exported internal symbols from staticlibs

rust-bors · 2026-04-16T06:48:19Z

☀️ Try build successful (CI)
Build commit: a9431d3 (a9431d37da1d0346038257cec9d94f2783997621, parent: e8e4541ff19649d95afab52fdde2c2eaa6829965)

cezarbbb · 2026-04-16T06:50:43Z

@bors try jobs=x86_64-*

rust-bors · 2026-06-05T08:58:35Z

This pull request was unapproved.

This PR was contained in a rollup (#157464), which was unapproved.

View changes since this unapproval

cezarbbb · 2026-06-05T09:28:24Z

It appears that unsigned long is 32-bit on i686 and 64-bit on x86_64, but u64 is 64-bit, hence the error on i686. This has been fixed; unsigned long was changed to uint64_t in main.c.

cezarbbb · 2026-06-05T09:29:24Z

@bors try jobs=i686-*

Staticlib hide internal symbols try-job: i686-*

petrochenkov · 2026-06-05T09:54:34Z

Yeah, it's not good to rely on specific sizes for C types.
The reliable way is to either use stdint.h types on C side, or std::ffi types on Rust side.

rust-bors · 2026-06-05T12:49:16Z

☀️ Try build successful (CI)
Build commit: b480660 (b4806607a4f4f014e606e6033274a8cd3f9fdfb0, parent: 3179a47d67719a92b4d3c3689aca391c40ff1a04)

petrochenkov · 2026-06-05T12:52:05Z

@bors r+

rust-bors · 2026-06-05T12:52:08Z

📌 Commit e5d8cdf has been approved by petrochenkov

It is now in the queue for this repository.

@bjorn3

… r=petrochenkov Staticlib hide internal symbols According to issue rust-lang#104707, when building a staticlib, all Rust internal symbols — mangled symbols, `#[rustc_std_internal_symbol]` items, allocator shims, etc. — leak out of the static archive. In contrast, cdylib correctly exports only `#[no_mangle]` symbols via a linker version script. `-Zstaticlib-hide-internal-symbols` directly post-processes ELF object files in the archive: parsing the `SHT_SYMTAB` sections and setting `STV_HIDDEN` visibility on any `GLOBAL/WEAK` defined symbol that is not in the exported symbol set, without changing the binding. This is an in-place modification (only writing the st_other byte per matching entry), with zero overhead. Supported on ELF targets (Linux, BSD, etc.) and Apple targets (macOS, iOS, etc.). On unsupported targets (Windows), a warning is emitted and the flag has no effect. **Update**: The rename counterpart (`-Zstaticlib-rename-internal-symbols`) is in rust-lang#156950. The test code are as follows: 1.a std rust staticlib: ```rust use std::collections::HashMap; use std::panic::{catch_unwind, AssertUnwindSafe}; #[no_mangle] pub extern "C" fn my_add(a: i32, b: i32) -> i32 { a + b } #[no_mangle] pub extern "C" fn my_hash_lookup(key: u64) -> u64 { let mut map = HashMap::new(); for i in 0..100u64 { map.insert(i, i.wrapping_mul(2654435761)); } *map.get(&key).unwrap_or(&0) } pub fn internal_reverse(s: &str) -> String { s.chars().rev().collect() } #[no_mangle] pub extern "C" fn my_format_number(n: i32) -> i32 { let s = format!("number: {}", n); s.len() as i32 } #[no_mangle] pub extern "C" fn my_safe_div(a: i32, b: i32) -> i32 { match catch_unwind(AssertUnwindSafe(|| { if b == 0 { panic!("division by zero!"); } a / b })) { Ok(result) => result, Err(_) => -1, } } #[no_mangle] pub extern "C" fn my_uncaught_panic() { panic!("uncaught panic across FFI"); } ``` 1.b downstream c program: ```c extern int my_add(int a, int b); extern unsigned long my_hash_lookup(unsigned long key); extern int my_format_number(int n); extern int my_safe_div(int a, int b); extern void my_uncaught_panic(void); int main() { int failures = 0; if (my_add(10, 20) != 30) failures++; if (my_hash_lookup(5) != 5UL * 2654435761UL) failures++; if (my_format_number(42) != 10) failures++; if (my_safe_div(100, 5) != 20) failures++; if (my_safe_div(100, 0) != -1) failures++; pid_t pid = fork(); if (pid == 0) { alarm(5); my_uncaught_panic(); _exit(0); } else { waitpid(pid, &status, 0); } return failures; } ``` The test results with different compiler flags(which might cause binary size reduction) are as follows: 1.c result with `-Zstaticlib-hide-internal-symbols` ``` settings OFF ON -Zsave ALL OFF.dynsym ON.dynsym ------------------------------------------------------------------------ default 1.7M 1.5M 204K (12%) 1735 5 1730 lto_thin 616K 584K 33K (5%) 246 5 241 lto_fat 525K 525K 0 (0%) 6 5 1 opt_s 1.7M 1.5M 204K (12%) 1735 5 1730 opt_z 1.7M 1.5M 204K (12%) 1735 5 1730 lto_thin_z 602K 570K 32K (5%) 246 5 241 lto_fat_z 514K 514K 0 (0%) 6 5 1 full 514K 514K 0 (0%) 6 5 1 ``` 1.d result with `-Zstaticlib-hide-internal-symbols + -Zstaticlib-rename-internal-symbols` ``` settings OFF ON -Zsave ALL OFF.dynsym ON.dynsym ------------------------------------------------------------------------ default 1.7M 1.5M 162K (9%) 1735 5 1730 lto_thin 616K 599K 18K (2%) 246 5 241 lto_fat 525K 535K -1% (-1%) 6 5 1 opt_s 1.7M 1.5M 162K (9%) 1735 5 1730 opt_z 1.7M 1.5M 162K (9%) 1735 5 1730 lto_thin_z 602K 585K 18K (2%) 246 5 241 lto_fat_z 514K 524K -1% (-1%) 6 5 1 full 514K 523K -1% (-1%) 6 5 1 ``` 2.a no_std rust staticlib ```rust #![no_std] #![feature(core_intrinsics)] use core::panic::PanicInfo; #[panic_handler] fn panic(_info: &PanicInfo) -> ! { loop {} } #[no_mangle] pub extern "C" fn embedded_add(a: i32, b: i32) -> i32 { a.wrapping_add(b) } #[no_mangle] pub extern "C" fn embedded_checksum(data: *const u8, len: usize) -> u8 { if data.is_null() { return 0; } let slice = unsafe { core::slice::from_raw_parts(data, len) }; let mut sum: u8 = 0; for &byte in slice { sum = sum.wrapping_add(byte); } sum } fn internal_helper() -> i32 { 42 } #[no_mangle] pub extern "C" fn call_internal() -> i32 { internal_helper() } #[no_mangle] pub extern "C" fn embedded_trigger_abort() { core::intrinsics::abort(); } ``` 2.b downstream c program ```c extern int embedded_add(int a, int b); extern unsigned char embedded_checksum(const unsigned char *data, unsigned long len); extern int call_internal(void); extern void embedded_trigger_abort(void); int main() { int failures = 0; if (embedded_add(10, 20) != 30) failures++; unsigned char data[] = {1, 2, 3}; if (embedded_checksum(data, 3) != 6) failures++; if (call_internal() != 42) failures++; pid_t pid = fork(); if (pid == 0) { embedded_trigger_abort(); _exit(0); } else { waitpid(pid, &status, 0); } return failures; } ``` The test results with different compiler flags(which might cause binary size reduction) are as follows: 2.c result with `-Zstaticlib-hide-internal-symbols` ``` settings OFF ON -Zsave ALL OFF.dynsym ON.dynsym ------------------------------------------------------------------------ default 485K 429K 56K (11%) 490 4 486 lto_thin 180K 180K 0 (0%) 4 4 0 lto_fat 179K 179K 0 (0%) 4 4 0 opt_s 485K 429K 56K (11%) 490 4 486 opt_z 485K 429K 56K (11%) 490 4 486 lto_thin_z 180K 180K 0 (0%) 4 4 0 lto_fat_z 179K 179K 0 (0%) 4 4 0 full 179K 179K 0 (0%) 4 4 0 ``` 2.d result with `-Zstaticlib-hide-internal-symbols + -Zstaticlib-rename-internal-symbols` ``` settings OFF ON -Zsave ALL OFF.dynsym ON.dynsym ------------------------------------------------------------------------ default 485K 447K 39K (7%) 490 4 486 lto_thin 180K 189K -5% (-5%) 4 4 0 lto_fat 179K 189K -5% (-5%) 4 4 0 opt_s 485K 448K 38K (7%) 490 4 486 opt_z 485K 448K 38K (7%) 490 4 486 lto_thin_z 180K 189K -5% (-5%) 4 4 0 lto_fat_z 179K 189K -5% (-5%) 4 4 0 full 179K 189K -5% (-5%) 4 4 0 ``` Test results show that this compiler option is beneficial for scenarios where LTO cannot be enabled. r? @bjorn3 @petrochenkov

JonathanBrouwer · 2026-06-05T16:43:25Z

💔 I suspect this PR failed tests as part of a rollup
@bors r-

After fixing the problem, consider running a try job for the failed job before re-approving.

Link to failure: #157484 (comment)

rust-bors · 2026-06-05T16:43:31Z

This pull request was unapproved.

This PR was contained in a rollup (#157484), which was unapproved.

View changes since this unapproval

cezarbbb · 2026-06-05T17:01:54Z

Weird. I'll check and fix it on Monday.

cezarbbb · 2026-06-08T00:52:17Z

It seems that the logic for handling prefixe _ in Mach-O format was overlooked when processing reviewer's comments.
@bors try jobs=apple

rust-bors · 2026-06-08T03:28:17Z

☀️ Try build successful (CI)
Build commit: 4013026 (4013026817304e79aacd56f0d7909c134053b307, parent: f20a92ec01483dc5c58e90e246f266bdad822d86)

cezarbbb · 2026-06-08T03:38:15Z

@rustbot ready

petrochenkov · 2026-06-08T06:44:11Z

@bors r+

rust-bors · 2026-06-08T06:44:13Z

📌 Commit 6caae67 has been approved by petrochenkov

It is now in the queue for this repository.

🌲 The tree is currently closed for pull requests below priority 100. This pull request will be tested once the tree is reopened.

JonathanBrouwer · 2026-06-09T06:18:38Z

@rust-timer build 7f76357

rust-timer · 2026-06-09T06:59:28Z

Finished benchmarking commit (7f76357): comparison URL.

Overall result: ✅ improvements - no action needed

Benchmarking means the PR may be perf-sensitive. It's automatically marked not fit for rolling up. Overriding is possible but disadvised: it risks changing compiler perf.

@bors rollup=never
@rustbot label: -S-waiting-on-perf -perf-regression

Instruction count

Our most reliable metric. Used to determine the overall result above. However, even this metric can be noisy.

	mean	range	count
Regressions ❌ (primary)	-	-	0
Regressions ❌ (secondary)	-	-	0
Improvements ✅ (primary)	-0.4%	[-0.4%, -0.3%]	4
Improvements ✅ (secondary)	-0.4%	[-0.9%, -0.2%]	11
All ❌✅ (primary)	-0.4%	[-0.4%, -0.3%]	4

Max RSS (memory usage)

Results (primary 1.7%)

A less reliable metric. May be of interest, but not used to determine the overall result above.

	mean	range	count
Regressions ❌ (primary)	1.7%	[1.7%, 1.7%]	1
Regressions ❌ (secondary)	-	-	0
Improvements ✅ (primary)	-	-	0
Improvements ✅ (secondary)	-	-	0
All ❌✅ (primary)	1.7%	[1.7%, 1.7%]	1

Cycles

Results (secondary -3.5%)

A less reliable metric. May be of interest, but not used to determine the overall result above.

	mean	range	count
Regressions ❌ (primary)	-	-	0
Regressions ❌ (secondary)	-	-	0
Improvements ✅ (primary)	-	-	0
Improvements ✅ (secondary)	-3.5%	[-5.5%, -2.3%]	6
All ❌✅ (primary)	-	-	0