What does zero-length array mean at file scope?

What does zero-length array mean at file scope?

[Dave Korn]

    Hi everyone,

  I found something rather odd in testcase gcc.c-torture/execute/20030811-1.c:

> /* Origin: PR target/11535 from H. J. Lu <hjl@lucon.org> */
> 
> void vararg (int i, ...)
> {
>   (void) i;
> }
> 
> int i0[0], i1;

  Huh?

> void test1 (void)
> {
>   int a = (int) (long long) __builtin_return_address (0);
>   vararg (0, a);
> }
> 
> void test2 (void)
> {
>   i0[0] = (int) (long long) __builtin_return_address (0);
> }

  Nasal demons?

> void test3 (void)
> {
>   i1 = (int) (long long) __builtin_return_address (0);
> }
> 
> void test4 (void)
> {
>   volatile long long a = (long long) __builtin_return_address (0);
>   i0[0] = (int) a;
> }

  And again.

  ELF GAS/LD seem happy enough when presented with a ".comm foo,0" directive,
but PE does rather literally what you asked, and gives you no data object,
leading to i0 in the above being an undefined reference at link time.

  What is supposed to happen here?  How much space is the compiler meant to
allocate to i0?  Where does the data go when it gets stored to i0[0]?

  I've read http://gcc.gnu.org/onlinedocs/gcc/Zero-Length.html about six times
and can't see anywhere it even hints that you can use this syntax anywhere
except as the trailing member of a struct.  When I look at the original
PR11535, the testcases in there are all similar but have array size [1] and
try to assign the builtin_return_address result to array[0] - that's clearly
valid, and quite different from how this testcase ended up.

  So, is the testcase invalid, and should the compiler be warning about this
declaration?  I couldn't get any complaint out of it even with "-W -Wall
-Wextra -pedantic -std=c89"?  Or should the linker be allocating some space
for this zero-sized common?

    cheers,
      DaveK

Re: What does zero-length array mean at file scope?

[Dave Korn]

Dave Korn wrote:

>   ELF GAS/LD seem happy enough when presented with a ".comm foo,0" directive,
> but PE does rather literally what you asked, and gives you no data object,
> leading to i0 in the above being an undefined reference at link time.

  After a bit further digging, it turns out that this is because PE uses the
same representation for an external symbol as would represent a common of size
0, so if you define such a common, it magically becomes an undefined external
symbol instead!

  Owing to lack of support for alignment of common symbols in PE, we've been
rounding all sizes up to a multiple of 16 until now, including zero, which has
hidden this problem from arising.  In the patch I just posted at

    http://gcc.gnu.org/ml/gcc-patches/2009-05/msg01528.html

we can now align common symbols, so we don't round any more - and thus get an
actual zero-sized symbol definition passed to the assembler for the first time.

  I do think we probably ought to be erroring about this on both platforms,
shouldn't we?  I can always hack the output routine to (for example) use one
unit of the alignment size as the minimum to work around this problem and let
the testcase run, but I wonder if a warning is getting lost somewhere owing to
array->pointer flattening?

    cheers,
      DaveK

Re: What does zero-length array mean at file scope?

[Dave Korn]

Dave Korn wrote:
> Dave Korn wrote:
> 
>>   ELF GAS/LD seem happy enough when presented with a ".comm foo,0" directive,
>> but PE does rather literally what you asked, and gives you no data object,
>> leading to i0 in the above being an undefined reference at link time.
> 
>   After a bit further digging, it turns out that this is because PE uses the
> same representation for an external symbol as would represent a common of size
> 0, so if you define such a common, it magically becomes an undefined external
> symbol instead!

  And testing it on Linux, I see that the linker goes ahead and assigns zero
bytes of the common area to i0, then assigns four bytes of common space to i1
at the same address, so writing to i0[0] aliases and alters i1.  That
certainly sounds like undefined behaviour to me!

    cheers,
      DaveK

Re: What does zero-length array mean at file scope?

[Andrew Haley]

Dave Korn wrote:
> Dave Korn wrote:
>> Dave Korn wrote:
>>
>>>   ELF GAS/LD seem happy enough when presented with a ".comm foo,0" directive,
>>> but PE does rather literally what you asked, and gives you no data object,
>>> leading to i0 in the above being an undefined reference at link time.
>>   After a bit further digging, it turns out that this is because PE uses the
>> same representation for an external symbol as would represent a common of size
>> 0, so if you define such a common, it magically becomes an undefined external
>> symbol instead!

I don't see what the big deal is here: just allocate one byte to a statically-
allocated zero-length array.

>   And testing it on Linux, I see that the linker goes ahead and assigns zero
> bytes of the common area to i0, then assigns four bytes of common space to i1
> at the same address, so writing to i0[0] aliases and alters i1.  That
> certainly sounds like undefined behaviour to me!

Sure, but in that case it's clearly the user's fault: they're writing beyond
the bounds of an  array.

Andrew.

Re: What does zero-length array mean at file scope?

[Dave Korn]

Andrew Haley wrote:
> Dave Korn wrote:
>> Dave Korn wrote:
>>> Dave Korn wrote:
>>> 
>>>> ELF GAS/LD seem happy enough when presented with a ".comm foo,0"
>>>> directive, but PE does rather literally what you asked, and gives you
>>>> no data object, leading to i0 in the above being an undefined
>>>> reference at link time.
>>> After a bit further digging, it turns out that this is because PE uses
>>> the same representation for an external symbol as would represent a
>>> common of size 0, so if you define such a common, it magically becomes
>>> an undefined external symbol instead!
> 
> I don't see what the big deal is here: just allocate one byte to a
> statically- allocated zero-length array.

  The "big deal" is that this is blatantly and trivially invalid code, and we
silently accept it and generate nonsensical assembler output without the least
hint of any kind of a diagnostic.

"  6.7.5.2 Array declarators
Constraints
1 In addition to optional type qualifiers and the keyword static, the [ and
] may delimit an expression or *. If they delimit an expression (which
specifies the size of an array), the expression shall have an integer type. If
the expression is a constant expression, it shall have a value greater than
zero.  "

> Sure, but in that case it's clearly the user's fault: they're writing
> beyond the bounds of an  array.

  But how, as a user, would you attempt to write /within/ the bounds of such
an array?  Exactly.  So why should we let the user create this meaningless
construct in the first place?

    cheers,
      DaveK

Re: What does zero-length array mean at file scope?

[Andrew Haley]

Dave Korn wrote:
> Andrew Haley wrote:
>> Dave Korn wrote:
>>> Dave Korn wrote:
>>>> Dave Korn wrote:
>>>>
>>>>> ELF GAS/LD seem happy enough when presented with a ".comm foo,0"
>>>>> directive, but PE does rather literally what you asked, and gives you
>>>>> no data object, leading to i0 in the above being an undefined
>>>>> reference at link time.
>>>> After a bit further digging, it turns out that this is because PE uses
>>>> the same representation for an external symbol as would represent a
>>>> common of size 0, so if you define such a common, it magically becomes
>>>> an undefined external symbol instead!

>> I don't see what the big deal is here: just allocate one byte to a
>> statically- allocated zero-length array.
> 
>   The "big deal" is that this is blatantly and trivially invalid code, and we
> silently accept it and generate nonsensical assembler output without the least
> hint of any kind of a diagnostic.

Of course we have to fix the assembler output.  For ant two declarations
a and b, &a != &b, even when a is a zero-length array.  So, you have to
allocate at least one byte.

> "  6.7.5.2 Array declarators
> Constraints
> 1 In addition to optional type qualifiers and the keyword static, the [ and
> ] may delimit an expression or *. If they delimit an expression (which
> specifies the size of an array), the expression shall have an integer type. If
> the expression is a constant expression, it shall have a value greater than
> zero.  "

But zero-length arrays are a gcc extension.  There's nothing that limits
them to the last member of a struct.  zero-length arrays must be rejected
with -pedantic, but not otherwise.

>> Sure, but in that case it's clearly the user's fault: they're writing
>> beyond the bounds of an  array.
> 
>   But how, as a user, would you attempt to write /within/ the bounds of such
> an array?

You can't.

> Exactly.  So why should we let the user create this meaningless
> construct in the first place?

Because it's a documented gcc extension.

Andrew.

Re: What does zero-length array mean at file scope?

[Dave Korn]

Dave Korn wrote:
> I've read http://gcc.gnu.org/onlinedocs/gcc/Zero-Length.html about six
> times and can't see anywhere it even hints that you can use this syntax
> anywhere except as the trailing member of a struct.

Andrew Haley wrote:
> But zero-length arrays are a gcc extension.  There's nothing that limits
> them to the last member of a struct.  zero-length arrays must be rejected
> with -pedantic, but not otherwise.

> Because it's a documented gcc extension.

  Obviously I can't see for looking; can you please point me to the precise
chapter/page/paragraph/line that I should have found earlier?

    cheers,
      DaveK

Re: What does zero-length array mean at file scope?

[Dave Korn]

Dave Korn wrote:
> Dave Korn wrote:
>> I've read http://gcc.gnu.org/onlinedocs/gcc/Zero-Length.html about six
>> times and can't see anywhere it even hints that you can use this syntax
>> anywhere except as the trailing member of a struct.
> 
> Andrew Haley wrote:
>> But zero-length arrays are a gcc extension.  There's nothing that limits
>> them to the last member of a struct.  zero-length arrays must be rejected
>> with -pedantic, but not otherwise.
> 
>> Because it's a documented gcc extension.
> 
>   Obviously I can't see for looking; can you please point me to the precise
> chapter/page/paragraph/line that I should have found earlier?

  (I honestly mean that, no sarcasm intended; it was late at night and I was
tired, I could easily have misread or overlooked something.)  I did find this
comment in varasm.c:assemble_noswitch_variable() that says we need to handle
this case:

  /* Don't allocate zero bytes of common,
     since that means "undefined external" in the linker.  */
  if (size == 0)
    rounded = 1;

... so I guess it counts as a backend bug if the backend still emits a zero in
the .comm directive, and that the documentation of ASM_OUTPUT.*COMMON should
probably be improved to warn of the danger that size may be zero.

    cheers,
      DaveK

Re: What does zero-length array mean at file scope?

[Andrew Haley]

Dave Korn wrote:
> Dave Korn wrote:
>> Dave Korn wrote:
>>> I've read http://gcc.gnu.org/onlinedocs/gcc/Zero-Length.html about six
>>> times and can't see anywhere it even hints that you can use this syntax
>>> anywhere except as the trailing member of a struct.
>> Andrew Haley wrote:
>>> But zero-length arrays are a gcc extension.  There's nothing that limits
>>> them to the last member of a struct.  zero-length arrays must be rejected
>>> with -pedantic, but not otherwise.
>>> Because it's a documented gcc extension.
>>   Obviously I can't see for looking; can you please point me to the precise
>> chapter/page/paragraph/line that I should have found earlier?

"Zero-length arrays are allowed in GNU C.  They are very useful as the
last element of a structure ..."

That doesn't in any way imply that the last element of a struct is the only
circumstance in which you may use a zero-length array.

>   (I honestly mean that, no sarcasm intended; it was late at night and I was
> tired, I could easily have misread or overlooked something.)  I did find this
> comment in varasm.c:assemble_noswitch_variable() that says we need to handle
> this case:
> 
>   /* Don't allocate zero bytes of common,
>      since that means "undefined external" in the linker.  */
>   if (size == 0)
>     rounded = 1;
> 
> ... so I guess it counts as a backend bug if the backend still emits a zero in
> the .comm directive, and that the documentation of ASM_OUTPUT.*COMMON should
> probably be improved to warn of the danger that size may be zero.

Yes.  That's what is usually done: all you have to do is fix the back end.

Andrew.

Re: What does zero-length array mean at file scope?

[Dave Korn]

Andrew Haley wrote:

>>>   Obviously I can't see for looking; can you please point me to the precise
>>> chapter/page/paragraph/line that I should have found earlier?
> 
> "Zero-length arrays are allowed in GNU C.  They are very useful as the
> last element of a structure ..."
> 
> That doesn't in any way imply that the last element of a struct is the only
> circumstance in which you may use a zero-length array.

  *boggle* Yes, I must have been tired!  I repeatedly scanned that as

"Zero-length arrays are allowed in GNU C [ ... eyes or perhaps brain go blurry
about here ... ] as the last element of a structure which is really a header
for a variable-length object"

> Yes.  That's what is usually done: all you have to do is fix the back end.

  :) Just to be helpful, I added a few extra words to the documentation for
ASM_OUTPUT_COMMON in my revised patch.

http://gcc.gnu.org/ml/gcc-patches/2009-05/msg01545.html

    cheers,
      DaveK

Re: What does zero-length array mean at file scope?

[Joseph S. Myers]

On Sun, 24 May 2009, Andrew Haley wrote:

> Of course we have to fix the assembler output.  For ant two declarations
> a and b, &a != &b, even when a is a zero-length array.  So, you have to
> allocate at least one byte.

I don't think this is necessarily part of the semantics for the GNU 
extensions of zero-length arrays and empty structures.  Certainly when 
they are used in the middle of a structure they are not expected to take 
up any space (so their address may be the same as that of the next 
member).

-- 
Joseph S. Myers
joseph@codesourcery.com

Re: What does zero-length array mean at file scope?

[Dave Korn]

Joseph S. Myers wrote:
> On Sun, 24 May 2009, Andrew Haley wrote:
> 
>> Of course we have to fix the assembler output.  For ant two declarations
>> a and b, &a != &b, even when a is a zero-length array.  So, you have to
>> allocate at least one byte.
> 
> I don't think this is necessarily part of the semantics for the GNU 
> extensions of zero-length arrays and empty structures.  Certainly when 
> they are used in the middle of a structure they are not expected to take 
> up any space (so their address may be the same as that of the next 
> member).

  But by the time you're outputting an assembler (common or bss) symbol, if
it's still size zero, that's the final size of the whole object.  You may want
internal parts of the object to compare equal, but I think the data object as
a whole shouldn't match any other.

struct {
  char vla1[0];
  char vla2[0];
} a;

struct {
  char vla3[0];
} b;

  We want &a.vla1 == &a.vla2, but we don't want &a == &b.  No?

    cheers,
      DaveK

Re: What does zero-length array mean at file scope?

[Andrew Haley]

Joseph S. Myers wrote:
> On Sun, 24 May 2009, Andrew Haley wrote:
> 
>> Of course we have to fix the assembler output.  For [any] two declarations
>> a and b, &a != &b, even when a is a zero-length array.  So, you have to
>> allocate at least one byte.
> 
> I don't think this is necessarily part of the semantics for the GNU 
> extensions of zero-length arrays and empty structures.  Certainly when 
> they are used in the middle of a structure they are not expected to take 
> up any space (so their address may be the same as that of the next 
> member).

I see.  In that this breaks the semantics of C in a pretty fundamental
way this is pretty bad, but it's been in gcc for a long time.

Andrew.

Re: What does zero-length array mean at file scope?

[Joseph S. Myers]

On Sun, 24 May 2009, Dave Korn wrote:

>   So, is the testcase invalid, and should the compiler be warning about this
> declaration?  I couldn't get any complaint out of it even with "-W -Wall
> -Wextra -pedantic -std=c89"?  Or should the linker be allocating some space
> for this zero-sized common?

I get "warning: ISO C forbids zero-size array 'i0'" with -pedantic.

-- 
Joseph S. Myers
joseph@codesourcery.com

Re: What does zero-length array mean at file scope?

[Dave Korn]

Joseph S. Myers wrote:
> On Sun, 24 May 2009, Dave Korn wrote:
> 
>>   So, is the testcase invalid, and should the compiler be warning about this
>> declaration?  I couldn't get any complaint out of it even with "-W -Wall
>> -Wextra -pedantic -std=c89"?  Or should the linker be allocating some space
>> for this zero-sized common?
> 
> I get "warning: ISO C forbids zero-size array 'i0'" with -pedantic.
> 

  Err.  Yes, so do I now.  It turns out you can't just tack a -W on a
cut-n-pasted command line to cancel out an earlier -w.

    cheers,
      DaveK

Re: What does zero-length array mean at file scope?

[Uros Bizjak]

Hello!

>   I found something rather odd in testcase gcc.c-torture/execute/20030811-1.c:
>
> > /* Origin: PR target/11535 from H. J. Lu <hjl@lucon.org> */
> > 
> > void vararg (int i, ...)
> > {
> >   (void) i;
> > }
> > 
> > int i0[0], i1;
>
>   Huh?
>
> > void test1 (void)
> > {
> >   int a = (int) (long long) __builtin_return_address (0);
> >   vararg (0, a);
> > }
> > 
> > void test2 (void)
> > {
> >   i0[0] = (int) (long long) __builtin_return_address (0);
> > }
>
>   Nasal demons?
>
> > void test3 (void)
> > {
> >   i1 = (int) (long long) __builtin_return_address (0);
> > }
> > 
> > void test4 (void)
> > {
> >   volatile long long a = (long long) __builtin_return_address (0);
> >   i0[0] = (int) a;
> > }
>
>   
>   And testing it on Linux, I see that the linker goes ahead and assigns zero
> bytes of the common area to i0, then assigns four bytes of common space to i1
> at the same address, so writing to i0[0] aliases and alters i1.  That
> certainly sounds like undefined behaviour to me!
>   

It looks like a typo in the testcase to me, but let's add some CCs to be 
sure.

Uros.