abseil-cpp/FAQ.md

# Abseil FAQ

## Is Abseil the right home for my utility library?

Most often the answer to the question is "no." As both the
[About Abseil](https://abseil.io/about/) page and our
[contributing guidelines](https://github.com/abseil/abseil-cpp/blob/master/CONTRIBUTING.md#contribution-guidelines)
explain, Abseil contains a variety of core C++ library code that is widely used
at [Google](https://www.google.com/). As such, Abseil's primary purpose is to be
used as a dependency by Google's open source C++ projects. While we do hope that
Abseil is also useful to the C++ community at large, this added constraint also
means that we are unlikely to accept a contribution of utility code that isn't
already widely used by Google.

## How do I set the C++ dialect used to build Abseil?

The short answer is that whatever mechanism you choose, you need to make sure
that you set this option consistently at the global level for your entire
project. If, for example, you want to set the C++ dialect to C++17, with
[Bazel](https://bazel.build/) as the build system and `gcc` or `clang` as the
compiler, there are several ways to do this: * Pass `--cxxopt=-std=c++17` on the
command line (for example, `bazel build --cxxopt=-std=c++17 ...`) * Set the
environment variable `BAZEL_CXXOPTS` (for example, `BAZEL_CXXOPTS=-std=c++17`) *
Add `build --cxxopt=-std=c++17` to your
[`.bazelrc` file](https://docs.bazel.build/versions/master/guide.html#bazelrc)

If you are using CMake as the build system, you'll need to add a line like
`set(CMAKE_CXX_STANDARD 17)` to your top level `CMakeLists.txt` file. If you are
developing a library designed to be used by other clients, you should instead
leave `CMAKE_CXX_STANDARD` unset and configure the minimum C++ standard required
by each of your library targets via `target_compile_features`. See the
[CMake build instructions](https://github.com/abseil/abseil-cpp/blob/master/CMake/README.md)
for more information.

For a longer answer to this question and to understand why some other approaches
don't work, see the answer to ["What is ABI and why don't you recommend using a
pre-compiled version of
Abseil?"](#what-is-abi-and-why-dont-you-recommend-using-a-pre-compiled-version-of-abseil)

## What is ABI and why don't you recommend using a pre-compiled version of Abseil?

For the purposes of this discussion,
[ABI](https://en.wikipedia.org/wiki/Application_binary_interface) refers to the
compiled representation of code interfaces. This contrasts with
[API](https://en.wikipedia.org/wiki/Application_programming_interface), which
refers to the interfaces defined in the source code. [Abseil has a strong
promise of API compatibility, but does not make any promise of ABI
compatibility](https://abseil.io/about/compatibility). Let's take a look at what
this means in practice.

You might be tempted to do something like this in a
[Bazel](https://bazel.build/) `BUILD` file:

```
# DON'T DO THIS!!!
cc_library(
    name = "my_library",
    srcs = ["my_library.cc"],
    copts = ["-std=c++17"],  # May create a mixed-mode compile!
    deps = ["@com_google_absl//absl/strings"],
)
```

Applying `-std=c++17` to an individual target in your `BUILD` file is going to
compile that specific target in C++17 mode, but it isn't going to ensure the
Abseil library is built in C++17 mode, since the Abseil library itself is a
different build target. If your code includes an Abseil header, then your
program may contain conflicting definitions of the same
class/function/variable/enum, etc. As a rule, all compile options that affect
the ABI of a program need to be applied to the entire build on a global basis.

C++ has something called the
[One Definition Rule](https://en.wikipedia.org/wiki/One_Definition_Rule) (ODR).
C++ doesn't allow multiple definitions of the same class/function/variable/enum,
etc. ODR violations sometimes result in linker errors, but linkers do not always
catch violations. Uncaught ODR violations can result in strange runtime
behaviors or crashes that can be hard to debug.

If you build the Abseil library and your code using different compile options
that affect ABI, there is a good chance you will run afoul of the One Definition
Rule. Examples of GCC compile options that affect ABI include (but aren't
limited to) language dialect (e.g. `-std=`), optimization level (e.g. `-O2`),
code generation flags (e.g. `-fexceptions`), and preprocessor defines (e.g.
`-DNDEBUG`).

If you use a pre-compiled version of Abseil, (for example, from your Linux
distribution package manager or from something like
[vcpkg](https://github.com/microsoft/vcpkg)) you have to be very careful to
ensure ABI compatibility across the components of your program. The only way you
can be sure your program is going to be correct regarding ABI is to ensure
you've used the exact same compile options as were used to build the
pre-compiled library. This does not mean that Abseil cannot work as part of a
Linux distribution since a knowledgeable binary packager will have ensured that
all packages have been built with consistent compile options. This is one of the
reasons we warn against - though do not outright reject - using Abseil as a
pre-compiled library.

Another possible way that you might run afoul of ABI issues is if you
accidentally include two versions of Abseil in your program. Multiple versions
of Abseil can end up within the same binary if your program uses the Abseil
library and another library also transitively depends on Abseil (resulting in
what is sometimes called the diamond dependency problem). In cases such as this
you must structure your build so that all libraries use the same version of
Abseil.
[Abseil's strong promise of API compatibility between releases](https://abseil.io/about/compatibility)
means the latest "HEAD" release of Abseil is almost certainly the right choice
if you are doing as we recommend and building all of your code from source.

For these reasons we recommend you avoid pre-compiled code and build the Abseil
library yourself in a consistent manner with the rest of your code.

## What is "live at head" and how do I do it?

From Abseil's point-of-view, "live at head" means that every Abseil source
release (which happens on an almost daily basis) is either API compatible with
the previous release, or comes with an automated tool that you can run over code
to make it compatible. In practice, the need to use an automated tool is
extremely rare. This means that upgrading from one source release to another
should be a routine practice that can and should be performed often.

We recommend you update to the
[latest commit in the `master` branch of Abseil](https://github.com/abseil/abseil-cpp/commits/master)
as often as possible. Not only will you pick up bug fixes more quickly, but if
you have good automated testing, you will catch and be able to fix any
[Hyrum's Law](https://www.hyrumslaw.com/) dependency problems on an incremental
basis instead of being overwhelmed by them and having difficulty isolating them
if you wait longer between updates.

If you are using the [Bazel](https://bazel.build/) build system with
[Bzlmod](https://bazel.build/external/overview#bzlmod), you can use a
`git_override` in your `MODULE.bazel` file to track the latest commit.

For example, to update to the latest commit, you would add (or update) the
following snippet in your `MODULE.bazel` file:

```starlark
bazel_dep(name = "abseil-cpp", version = "20260107.1")

git_override(
    module_name = "abseil-cpp",
    remote = "https://github.com/abseil/abseil-cpp.git",
    # Replace the following line with the latest commit.
    commit = "6ec9964c325db0610a376b3cb81de073ea6ada90",
)
```

You can commit the updated `MODULE.bazel` file to your source control every time
you update, and if you have good automated testing, you might even consider
automating this.

## Why do I see strange behaviors when I use Abseil hash tables?

Abseil's hash function uses a random seed.

Many programmers believe incorrectly that this is a defense against
[hash flooding](https://en.wikipedia.org/wiki/Collision_attack#Hash_flooding).
While it does make a hash flooding attack more difficult, Abseil's hash function
prioritizes speed over thorough mixing (and thus is not cryptographically
secure), and the current seed implementation is also not cryptographically
secure. If you are storing a large amount of attacker-controlled data, the most
reliable defense against hash-flooding is to use a container that does not have
`O(n)` worst-case behavior.

The real reason for hash randomization is to prevent
[Hyrum's Law](https://www.hyrumslaw.com/) dependencies on iteration order. This
has allowed us to roll out steady improvements to the implementation without
breaking users who may have otherwise written code that was dependent on
ordering or other characteristics.

The current implementation uses a global seed, which, if linked incorrectly
(e.g., static Abseil in multiple DSOs), can cause the ODR violations. If more
than one seed is linked, different calls to the hash function may return
different values, rendering hash elements inaccessible, causing crashes, or
other arbitrarily bad behaviors.

We are often asked for a knob to disable hash randomization. The answer is a
hard "no", even under test or under a flag, because people will find a way to
force it and allow their code or tests to depend on it. At Google-scale, the
compute costs that are saved by preserving the ability to improve the
implementation far outweigh the inconvenience of learning how to write code
resilient to change.

## How do I use the LLVM Sanitizers with Abseil?

LLVM Sanitizers are a suite of powerful, dynamic analysis tools that
automatically detect various critical bugs during program execution. They work
by instrumenting the compiled binary and linking a runtime library to intercept
operations and report issues.

We receive many incorrect bug reports from users trying to use the sanitizers.
The most common cause of these issues is ODR violations in the form of an
instrumentation mismatch. This happens when users try to link libraries compiled
with sanitizer instrumentation with uninstrumented libraries. It is important
that all code in the application is built with the same sanitizer configuration.

The easiest way to do this is to use [Bazel](https://bazel.build) and pass the
sanitizer options on the commandline, but it is important not to overlook the
importance of avoiding precompiled system libraries, including the C++ standard
library. For instance,
[MemorySanitizer requires an instrumented `libc++`](https://github.com/google/sanitizers/wiki/MemorySanitizerLibcxxHowTo).

Since most users are not going to build `libc++` with Bazel, here is a
MemorySanitizer recipe that currently works (and could easily be tweaked for
ThreadSanitizer and friends):

```shell
# From the root of the LLVM source tree, configure libc++ to be instrumented with MSAN:
cmake -G Ninja -S runtimes -B build_msan -DLLVM_ENABLE_RUNTIMES="libcxx;libcxxabi;libunwind" -DCMAKE_BUILD_TYPE=Release -DCMAKE_INSTALL_PREFIX="${HOME}/llvm-msan" -DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++ -DLLVM_USE_SANITIZER=MemoryWithOrigins -DLLVM_TARGETS_TO_BUILD="host"

# Build and install it into ${HOME}/llvm-msan
ninja -C build_msan install-cxx install-cxxabi install-unwind

# Then build (or test) your code like this:
bazel test --repo_env=CC=clang --repo_env=BAZEL_CXXOPTS=nostdinc++ --repo_env=BAZEL_LINKOPTS=-L${HOME}/llvm-msan/lib:-lc++:-lc++abi:-lgcc_s:-lm:-Wl,-rpath=${HOME}/llvm-msan/lib --repo_env=CPLUS_INCLUDE_PATH=${HOME}/llvm-msan/include/c++/v1 --copt=-fsanitize=memory --linkopt=-fsanitize=memory --linkopt=-fsanitize-link-c++-runtime ...
```

You should consider adding these options to a
[`.bazelrc`](https://bazel.build/run/bazelrc) file to avoid retyping them.