Re: [PATCH v5] libio: Add nonnull attribute for most FILE * arguments in stdio.h

[Xi Ruoyao <xry111@xry111.site>]

On Mon, 2023-07-10 at 16:55 -0400, Zack Weinberg wrote:
> On Mon, Jul 10, 2023, at 4:33 PM, Jeff Law via Libc-alpha wrote:
> > Essentially up to the point where the UB happens we have to preserve
> > visible side effects.  After the point where UB happens anything goes 
> > and our goal has been mark the paths through the CFG as dying at that 
> > point and forcing an immediate halt of the program (via __buitin_trap()).
> > 
> > There this all gets fuzzy is something like the NULL pointer property 
> > where the fact that a pointer must be non-null can backward propagate. 
> > ie, if a parameter is marked as non-null, then we will mark the 
> > corresponding SSA_NAME in the compiler as non-null.  Thus if there was 
> > some comparison of the SSA_NAME against NULL (perhaps well before the 
> > call), we'll optimize away that comparison.
> 
> Yep, see, that in and of itself is dangerous.
> 
> The bright line I would draw is: optimizations based on the assumption
> that control cannot proceed past the point where UB occurs are OK;
> optimizations based on the assumption that control cannot *reach* the
> point where UB occurs are *not* OK.  Removing a comparison to NULL,
> based on the observation that *later in some execution trace* the
> program will definitely dereference that pointer, falls in the latter
> category, *even if* there are no externally visible side effects in
> between the two points.

Why it's not OK if no externally visible side effects is between the two
points?

So what should we do now?  Remove all __nonnull from the headers?  Or
"some __nonnull are OK but my is not"?!

-- 
Xi Ruoyao <xry111@xry111.site>
School of Aerospace Science and Technology, Xidian University