From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-yb1-xb2b.google.com (mail-yb1-xb2b.google.com [IPv6:2607:f8b0:4864:20::b2b]) by sourceware.org (Postfix) with ESMTPS id 748243858D28 for ; Tue, 23 Nov 2021 12:45:38 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.1 sourceware.org 748243858D28 Received: by mail-yb1-xb2b.google.com with SMTP id v203so22761975ybe.6 for ; Tue, 23 Nov 2021 04:45:38 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=alqncD+Y0NY+sB70gb2didqY0/ZAPpiFGL3FlRE2dtc=; b=nZeX26P0v/B865hPc9XR6D/gEBrnS1AffpwRO+Qsy8rVYsUNc71HcrJhtegqklbWiv dYMvPRI0svC5N5rjzbR8XrWCq+2CTAeUExDHLV9lA06QSKKCnR/oaLcN90UakYBC7TfU +HyvMMNnRJla3bryCsFR9sQuZnMAaPlyaK1b7tpEeIYHttPLguaLNq6R1Yc7BLpwdWgr HWD/+TyQ/gYOoxzbZvcIj/RSE0b06gV5Vq9ngUa0Pb2qNdunqgK3jWtYjE2oAfAxTB9a NRt7w2DevV3FlJBmL4S7PZ+A16Idycs8JKAJrgFw6g2+Sh3Orvl/+18uwgxTkv/X+QSD AjEw== X-Gm-Message-State: AOAM5313Gze4DNva2g93ZiEQoU02qJRO+Md8r5h+Cz1YmuDH+yaxXtV5 /AU07KZC+C/6UWKewDL1jGKkRtzrhyqvGnNEwlE= X-Google-Smtp-Source: ABdhPJwUaw2H5mw3i+oTbiuISXla5adVPIzeTrYx4cSyLB0YoK3fSyYASmTFTT1TNqh+pigm/aTEiqtAw7zV73vvt9s= X-Received: by 2002:a25:2342:: with SMTP id j63mr5729629ybj.22.1637671537934; Tue, 23 Nov 2021 04:45:37 -0800 (PST) MIME-Version: 1.0 References: <56a1a945-608e-0e5e-7610-c35481abb980@gmail.com> <4883fa8c-2d99-2611-a8e2-6c7612283da4@gmail.com> <93576cba-19f8-8cf6-6597-7377bda9647f@gmail.com> In-Reply-To: <93576cba-19f8-8cf6-6597-7377bda9647f@gmail.com> From: Dmitri Gribenko Date: Tue, 23 Nov 2021 13:45:11 +0100 Message-ID: Subject: Re: [cfe-dev] ISO C3X proposal: nonnull qualifier To: "Alejandro Colomar (man-pages)" Cc: Joseph Myers , gcc@gcc.gnu.org, cfe-dev Content-Type: text/plain; charset="UTF-8" X-Spam-Status: No, score=0.8 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_FROM, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS, TXREP autolearn=ham autolearn_force=no version=3.4.4 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on server2.sourceware.org X-BeenThere: gcc@gcc.gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Gcc mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Nov 2021 12:45:41 -0000 Hi Alejandro, On Tue, Nov 23, 2021 at 12:45 PM Alejandro Colomar (man-pages) wrote: > > Hi Dmitry, > > On 11/23/21 12:17, Dmitri Gribenko wrote: > > Hi Alejandro, > > > > On Tue, Nov 16, 2021 at 1:34 PM Alejandro Colomar (man-pages) via > > cfe-dev wrote: > >> First of all, > >> I see unnecessary (probably over-engineered) qualifiers: > >> > >> - _Null_unspecified seems to me the same as nothing. > >> If I didn't specify its nullability, > >> it's by definition unspecified. Right? > >> > >> - _Nullable seems to me also the same as nothing. > >> The language allows for a pointer to be NULL, > >> so if you don't specify if it can or not be null, > >> you better stay on the safe side and consider it as nullable. > > > > _Nullable is used in conjunction with the `#pragma clang > > assume_nonnull begin/end` pragma that flips the default: > > > > ``` > > #pragma clang assume_nonnull begin > > int *global_int_ptr; // implicitly _Nonnull > > #pragma clang assume_nonnull end > > ``` > > > > Within these pragma brackets, you need to use _Nullable to get the > > opposite behavior. > > > > The pragma itself is useful because it reduces the amount of noise the > > annotations introduce. When these annotations were adopted in Apple > > SDKs, it was found that in practice most pointers are non-nullable. So > > if we only had _Nonnull, we would have to annotate most pointers. > > Instead, Apple's SDKs bracket every header contents with this pragma, > > and instead annotate nullable pointers, significantly reducing the > > amount of annotations. > > That's interesting. Most of my functions also tipically are full of > [[gnu::nonnull]], so the _Nonnull default seems the best thing. > > However, would that be viable in old code that relies on standard C? > I think that it would, but maybe you have more experience. Do you agree > with the following? > > Let's imagine a scenario where C3X specifies that non-qualified pointers > are nonnull. And there's only a qualifier, _Nullable, to allow NULL. > Asigning _Nullable to nonnull would issue a diagnostic. I think C3X specifying that non-qualified pointers are nonnnull would be a showstopper, I don't think it is likely to happen given how the users and the committee value backward compatibility that C has offered throughout the decades. If I were to speculate what would happen if C3X did flip the default, I think it would be treated by the community as a language fork. Pre-C3X headers won't work correctly when included in C3X programs, making incremental adoption of C3X syntax, as it was intended to be used, impossible. Projects would likely invent a NULLABLE macro, which would expand to _Nullable in C3X and nothing in earlier versions, to enable an incremental transition. That's why Clang introduced the pragma, enabling new rules to be adopted incrementally. > Also, do you have any experience in avoiding to diagnose a _Nullable to > nonnull assignment _after_ explicitly comparing to NULL? I.e., allow > the following: > > int *_Nullable p; > int *q; > > if (!p) > q = p; Internally at Google we have a checker based on the dataflow analysis framework (https://lists.llvm.org/pipermail/cfe-dev/2021-October/069098.html) that diagnoses usages of std::optional::value() not guarded by has_value(). We are planning to upstream it after we finish upstreaming the dataflow framework itself. Ensuring guarded usage of std::optional::value() is very similar to diagnosing dereferences of nullable pointers. I think a lot of the experience is transferable. However, we haven't attempted to implement a pointer nullability check yet, so I don't yet understand all corner cases that arise in real world software. However, fundamentally, there are a few questions that you need to answer: - does _Nullable create a distinct type or not? It is extremely important when you consider C++. - do you want nullability-related diagnostics to be mandatory, or optional? For example, a compiler is not required to issue a diagnostic about a program that violates the constraints of `restrict`. If _Nullable does not create a distinct type, and `T*` is the same type as `T* _Nullable`, then we can't rely on the regular type system mechanisms to issue diagnostics. If _Nullable creates a distinct type, then according to regular C type checking rules, you would get a warning on the `q = p` assignment regardless of the `if (!p)` check. That's how the C type system works, it is not flow-sensitive. If we want the diagnostics to be fllow-sensitive like in your example (I think it would be the best choice), then we need to add a new flow-sensitive component to the C type system. I don't think there is a precedent for this in C right now. I'm not sure how the committee or implementors would react to such a proposal. Dmitri -- main(i,j){for(i=2;;i++){for(j=2;j*/