Security

Best Practices

Runtime assertions

Unopt builds use FML_DCHECK to enable assertion checks across the engine repository. Assertions on dependencies like Dart VM or Skia are not enabled because local and CI builds would be extremely slow. Unopt builds are not published or consumed by the flutter/flutter CI to run integration tests or benchmarks.

Sanitizers

flutter/engine supports thread, address, memory, undefined behavior and leak sanitizers. Sanitizers are not enabled by default but they can be enabled on local builds following the sanitizers with the flutter engine instructions.

Builds with sanitizers, and tests with assertions enabled

flutter/engine runs automated builds with sanitizers and testing with assertions. Testing with assertions is enabled in all the supported platforms and sanitizers are enabled only on the Linux platform. Sanitizer builds:

• Linux unopt

Tests with assertions enabled:

• Linux unopt
• Mac unopt
• Windows unopt