ci: Further tweaks to building NSS

.github/actions/nss/action.yml

@@ -1,19 +1,53 @@
 name: Fetch and build NSS
 
+inputs:
+  type:
+    description: 'Whether to do a debug or release build of NSS'
+    required: true
+    default: 'Debug'
+
+# This step might be removed if the distro included a recent enough
+# version of NSS.  Ubuntu 20.04 only has 3.49, which is far too old.
+# (neqo-crypto/build.rs would also need to query pkg-config to get the
+# right build flags rather than building NSS.)
+#
+# Also see https://github.com/mozilla/neqo/issues/1711
+
 runs:
   using: composite
   steps:
-    - name: Fetch and build NSS
+    - name: Checkout NSPR
+      uses: actions/checkout@v4
+      with:
+        repository: 'nss-dev/nspr'
+        path: ${{ github.workspace }}/nspr
+
+    - name: Checkout NSS
+      uses: actions/checkout@v4
+      with:
+        repository: 'nss-dev/nss'
+        path: ${{ github.workspace }}/nss
+
+    - name: Build
       shell: bash
       run: |
-        git clone --depth=1 https://github.com/nss-dev/nspr "$NSPR_DIR"
-        git clone --depth=1 https://github.com/nss-dev/nss "$NSS_DIR"
-        $NSS_DIR/build.sh -g -Ddisable_tests=1 -o
+        # We want to do an optimized build for accurate CPU profiling, but
+        # we also want debug symbols for that, which the normal optimized NSS
+        # build process doesn't provide.
+        [ "${{ runner.os }}" != "Windows" ] && export CFLAGS=-ggdb3
+        if [ "${{ inputs.type }}" != "Debug" ]; then
+          export OPT="-o"
+          export NSS_TARGET=Release
+        else
+          export NSS_TARGET=Debug
+        fi
+        $NSS_DIR/build.sh -g -Ddisable_tests=1 $OPT --static
+        echo "NSS_TARGET=$NSS_TARGET" >> "$GITHUB_ENV"
+        export NSS_OUT="$NSS_DIR/../dist/$NSS_TARGET"
+        echo "LD_LIBRARY_PATH=$NSS_OUT/lib" >> "$GITHUB_ENV"
+        echo "DYLD_FALLBACK_LIBRARY_PATH=$NSS_OUT/lib" >> "$GITHUB_ENV"
+        echo "$NSS_OUT/lib" >> "$GITHUB_PATH"
         echo "NSS_DIR=$NSS_DIR" >> "$GITHUB_ENV"
-        echo "NSPR_DIR=$NSPR_DIR" >> "$GITHUB_ENV"
-        echo "LD_LIBRARY_PATH=$NSS_DIR/../dist/Release/lib" >> "$GITHUB_ENV"
-        echo "DYLD_FALLBACK_LIBRARY_PATH=$NSS_DIR/../dist/Release/lib" >> "$GITHUB_ENV"
-        echo "$NSS_DIR/../dist/Release/lib" >> "$GITHUB_PATH"
       env:
         NSS_DIR: ${{ github.workspace }}/nss
         NSPR_DIR: ${{ github.workspace }}/nspr

.github/actions/rust/action.yml

@@ -1,5 +1,4 @@
 name: Install Rust
-description: Install Rust and sccache
 
 inputs:
   version:
@@ -38,4 +37,3 @@ runs:
       uses: Swatinem/rust-cache@v2
       with:
         cache-all-crates: "true"
-        cache-directories: "${{ github.workspace }}/dist"

.github/workflows/bench.yml

@@ -8,8 +8,8 @@ env:
   CARGO_TERM_COLOR: always
   RUST_BACKTRACE: 1
   TOOLCHAIN: nightly
-  RUSTFLAGS: -C link-arg=-fuse-ld=lld -C link-arg=-Wl,--no-rosegment
-  PERF_CMD: record -o perf.data -F997 --call-graph lbr -g
+  RUSTFLAGS: -C link-arg=-fuse-ld=lld -C link-arg=-Wl,--no-rosegment, -Cforce-frame-pointers=yes
+  PERF_CMD: record -o perf.data -F997 --call-graph fp -g
 
 jobs:
   bench:
@@ -34,6 +34,8 @@ jobs:
 
       - name: Fetch and build NSS and NSPR
         uses: ./.github/actions/nss
+        with:
+          type: Release
 
       - name: Build
         run: |
@@ -81,8 +83,6 @@ jobs:
             taskset -c 0 nice -n -20 \
             cargo +$TOOLCHAIN flamegraph -v -c "$PERF_CMD" \
               --bin neqo-server -- --db ../test-fixture/db $HOST:4433 || true; } &
-          # Give the server time to start.
-          sleep 3
           mkdir client; \
             cd client; \
             time taskset -c 1 nice -n -20 \

.github/workflows/check.yml

@@ -32,6 +32,7 @@ jobs:
             type: release
     env:
       BUILD_TYPE: ${{ matrix.type == 'release' && '--release' || '' }}
+      BUILD_DIR: ${{ matrix.type == 'release' && 'release' || 'debug' }}
     runs-on: ${{ matrix.os }}
     defaults:
       run:
@@ -98,10 +99,6 @@ jobs:
           # See https://github.com/ilammy/msvc-dev-cmd#name-conflicts-with-shell-bash
           rm /usr/bin/link.exe
 
-      # This step might be removed if the distro included a recent enough
-      # version of NSS.  Ubuntu 20.04 only has 3.49, which is far too old.
-      # (neqo-crypto/build.rs would also need to query pkg-config to get the
-      # right build flags rather than building NSS.)
       - name: Fetch and build NSS and NSPR
         uses: ./.github/actions/nss
 
@@ -111,16 +108,16 @@ jobs:
       - name: Run tests and determine coverage
         run: |
           cargo +${{ matrix.rust-toolchain }} llvm-cov nextest $BUILD_TYPE --all-targets --features ci --no-fail-fast --lcov --output-path lcov.info
-          cargo +${{ matrix.rust-toolchain }} bench --features bench --no-run
+          find $NSS_DIR/../dist
+          cargo +${{ matrix.rust-toolchain }} bench --features bench --no-run || find $NSS_DIR/../dist
+
 
       - name: Run client/server transfer
         run: |
           cargo +${{ matrix.rust-toolchain }} build $BUILD_TYPE --bin neqo-client --bin neqo-server
-          cargo +${{ matrix.rust-toolchain }} run $BUILD_TYPE --bin neqo-server -- $HOST:4433 &
+          target/$BUILD_DIR/neqo-server $HOST:4433 &
           PID=$!
-          # Give the server time to start.
-          sleep 3
-          cargo +${{ matrix.rust-toolchain }} run $BUILD_TYPE --bin neqo-client -- --output-dir . https://$HOST:4433/$SIZE
+          target/$BUILD_DIR/neqo-client --output-dir . https://$HOST:4433/$SIZE
           kill $PID
           [ "$(wc -c <"$SIZE")" -eq "$SIZE" ] || exit 1
         env:

neqo-crypto/build.rs

@@ -50,9 +50,10 @@ struct Bindings {
 }
 
 fn is_debug() -> bool {
-    env::var("DEBUG")
-        .map(|d| d.parse::<bool>().unwrap_or(false))
-        .unwrap_or(false)
+    // Check the build profile and not whether debug symbols are enabled (i.e.,
+    // `env::var("DEBUG")`), because we enable those for benchmarking/profiling and still want
+    // to build NSS in release mode.
+    env::var("PROFILE").unwrap_or_default() == "debug"
 }
 
 // bindgen needs access to libclang.
@@ -147,10 +148,9 @@ fn build_nss(dir: PathBuf) {
     let mut build_nss = vec![
         String::from("./build.sh"),
         String::from("-Ddisable_tests=1"),
+        String::from("--static"),
     ];
-    if is_debug() {
-        build_nss.push(String::from("--static"));
-    } else {
+    if !is_debug() {
         build_nss.push(String::from("-o"));
     }
     if let Ok(d) = env::var("NSS_JOBS") {