Make CooperativeSaveEnabled() async-signal-safe(r).

The static local variable `enabled` in CooperativeSaveEnabled() is not
initialized until the first call to CooperativeSaveEnabled(), per the
C++14 standard, section 6.7 ("Declaration statement"), paragraph 4. This
initialization is thread-safe as of C++11, but it is *not* required to
be async-signal-safe. Use a namespace-scope variable instead, since this
is guaranteed to be zero-initialized before main() by section 3.6.2
("Initialization of non-local variables").

getenv() is technically not async-signal-safe either, hence the hedging
in the change summary line. However, glibc's implementation of getenv()
appears to be async-signal-safe in the absence of calls to setenv().

PiperOrigin-RevId: 228588617
Change-Id: I669f555d1c91352d55c606970bb237ec888fa7ca

test/util/save_util.cc

@@ -27,9 +27,23 @@ namespace gvisor {
 namespace testing {
 namespace {
 
+enum class CooperativeSaveMode {
+  kUnknown = 0,  // cooperative_save_mode is statically-initialized to 0
+  kAvailable,
+  kNotAvailable,
+};
+
+std::atomic<CooperativeSaveMode> cooperative_save_mode;
+
 bool CooperativeSaveEnabled() {
-  static bool enabled = getenv(GVISOR_COOPERATIVE_SAVE_TEST) != nullptr;
-  return enabled;
+  auto mode = cooperative_save_mode.load();
+  if (mode == CooperativeSaveMode::kUnknown) {
+    mode = (getenv(GVISOR_COOPERATIVE_SAVE_TEST) != nullptr)
+               ? CooperativeSaveMode::kAvailable
+               : CooperativeSaveMode::kNotAvailable;
+    cooperative_save_mode.store(mode);
+  }
+  return mode == CooperativeSaveMode::kAvailable;
 }
 
 std::atomic<int> save_disable;