[Bug c/116193] New: enhancement: type attribute that causes overflow for unsigned integer types to trap

[Bug c/116193] New: enhancement: type attribute that causes overflow for unsigned integer types to trap

[uecker at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=116193

            Bug ID: 116193
           Summary: enhancement: type attribute that causes overflow for
                    unsigned integer types to trap
           Product: gcc
           Version: unknown
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: uecker at gcc dot gnu.org
  Target Milestone: ---

It would be nice to have an attribute that one can add to an unsigned integer
type that makes overflow trap.

typedef unsigned int __attribute__ ((__overflow__)) positive_int;

[Bug c/116193] enhancement: type attribute that causes overflow for unsigned integer types to trap

[uecker at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=116193

uecker at gcc dot gnu.org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Severity|normal                      |enhancement

[Bug c/116193] enhancement: type attribute that causes overflow for unsigned integer types to trap

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=116193

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2024-08-02
             Status|UNCONFIRMED                 |WAITING
     Ever confirmed|0                           |1

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Huh? Is this thinking about being added to the C standard?
I suspect this will be abused just as clang's "unsigned overflow" ubsan has
been abused and incorrect bug reports to library developers has happened (e.g.
one to libstdc++ for some psedu-random code where it uses wrapping).

[Bug c/116193] enhancement: type attribute that causes overflow for unsigned integer types to trap

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=116193

--- Comment #2 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
That opens the door of issues how you can actually subtract those things
validly.
Would x - y and x + (-y) then behave differently for it?

[Bug c/116193] enhancement: type attribute that causes overflow for unsigned integer types to trap

[uecker at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=116193

--- Comment #3 from uecker at gcc dot gnu.org ---

It came up  as a possibility in various discussions, including on the kernel
mailing list or inside WG14.   I personally use signed type if I want to detect
overflow and unsigned only if I want modulo behavior, and I am relatively happy
with this.  But others like to  (or have code that does) use unsigned types
also for positive numbers such as sizes or indices where wraparound often leads
to bugs.

I don't see the risk of misuse as much as with the sanitizer, as it would be
opt-in for specific types, so can be introduced on where it is clear that
wraparound is not intended.

I would say x - y would be different than x + (-y) and the later should trap.
Although I guess (-y) could already be diagnosed in the FE, so for middle end
this would not matter.

[Bug c/116193] enhancement: type attribute that causes overflow for unsigned integer types to trap

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=116193

--- Comment #4 from Richard Biener <rguenth at gcc dot gnu.org> ---
-y is OK when y == 0

I hope you are not suggesting that it's UB to overflow though.  The attribute
should make the frontend to lower operations according to semantics and leave
everything in the middle-end unaffected.

[Bug c/116193] enhancement: type attribute that causes overflow for unsigned integer types to trap

[muecker at gwdg dot de]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=116193

Martin Uecker <muecker at gwdg dot de> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |muecker at gwdg dot de

--- Comment #5 from Martin Uecker <muecker at gwdg dot de> ---

I agree this could be done completely in the FE.