Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.std.c > #1648

Re: Second draft, "Safe arrays and pointers for C"

Show all headers | View raw

Am 30.08.2012 21:48, schrieb John Nagle:
> In response to all the comments above under "Initial draft proposal:
> Safe arrays and pointers for C", I have a new revision for
> discussion.
> 
> http://www.animats.com/papers/languages/safearraysforc41.pdf
> 
> Major changes:
> 
> - It's made clearer that non-strict code can call strict code
>   and vice versa, and that function prototypes can be written
>   in strict style and called from both strict code (with
>   checking) and non-strict code (without checking).  Thus,
>   there's a clear migration path to strict code - start
>   with the low level libraries and work up.
> 
> - The proposed generic functions have been removed. Instead,
>   it is proposed to import the "decltype" feature from C++.
>   This allows writing the generic functions needed for
>   making "malloc" allocation type-safe as C macros.
> 
> - The proposal is written relative to N1570.
> 
> - Run time subscript and size checking action is
>   as specified in N1570, Annex K.
> 
> - The relationship with C variable length arrays is discussed.
> 
> - The problem of forward-referenced formal parameters
>   (where the declaration of an array is followed by
>   a parameter with its size) is addressed, using the
>   GCC forward declaration extension.
> 
> - The restrictions on array length expressions needed
>   for consistency between call and definition are made
>   explicit.
> 
> - Implications for this feature in C++ are briefly discussed,
>   the intent being to avoid divergence from C++.  The issue of
>   how C++ style "name mangling" and variable length array
>   parameters could coexist is addressed.  This
>   proposal is now potentially compatible with C++ as
>   well as C.
> 
> Please comment, as before.  I would particularly like to hear
> from people involved with GCC as to how difficult a job it
> would be to implement this in GCC as an extension.  Then
> we could get some experience with this approach.

I see that you worked well through the objections that had been
presented, great. Your new proposal is certainly much closer to how
things are usually seen in C.

I still think that you push things too far. I completely understand
your motivation, that you want to have usable and doable version in
one go, but I still think that it would be far easier acceptable if
you'd present a series of additions to the standard that each would be
relatively easy to follow. (A serious of patches, if you like).

In the meantime, I have implement part of what you proposed as macros
for C. P99 now has a set of macros with prefix "P99_CA_" (CA for check
arguments) that allow to "automatically" wrap function calls such that
the arguments are checked for their size. This all works with pointers
to VLA, not references since they simply don't exist. And as always
for such macro approaches the declaration/definition part is not too
pretty, but the usage side looks just a normal function call and the
checking is done behind the scenes.

The only assumption for VM types as parameters that has to be done is
that any function prototypes that uses them have exactly the same size
expressions as their definitions. (Should be obvious that you have to
expose the size expressions to the caller.)

All this to show that parameter size checking within the idiom of
pointers to VLA is already possible. The usage pattern of (*A)[i][j]
is obviously not too comfortable, so adding simple reference in a
later stage would probably a good move.

As I also see from your proposal, there is a loophole in the existing
standard that is opened by "malloc" and friends. The language
currently simply has not much possibilities to assert that an untyped
pointer represents an object of a certain size. So there would be need
for an extension of the language that makes some guarantees. I would
be more conservative than you, and just asking to implement a
macro/function/operator that guarantees allocation and returns the
proper type. (Failure of such an operator should be handle as a
runtime constraint violation.)

I am currently working that P99_MALLOC(X) (currently just expands to
malloc(sizeof(X))) returns a pointer to the correct type on platforms
where such a thing is possible.

Jens

Back to comp.std.c | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Second draft, "Safe arrays and pointers for C" John Nagle <nagle@animats.com> - 2012-08-30 12:48 -0700
  Re: Second draft, "Safe arrays and pointers for C" pacman@kosh.dhis.org (Alan Curry) - 2012-08-31 22:17 +0000
    Re: Second draft, "Safe arrays and pointers for C" John Nagle <nagle@animats.com> - 2012-08-31 17:26 -0700
      Re: Second draft, "Safe arrays and pointers for C" Hans-Bernhard Bröker <HBBroeker@t-online.de> - 2012-09-02 22:20 +0200
        Re: Second draft, "Safe arrays and pointers for C" BGB <cr88192@hotmail.com> - 2012-09-03 10:55 -0500
          Re: Second draft, "Safe arrays and pointers for C" Ike Naar <ike@iceland.freeshell.org> - 2012-09-03 16:39 +0000
            Re: Second draft, "Safe arrays and pointers for C" BGB <cr88192@hotmail.com> - 2012-09-03 13:18 -0500
  Re: Second draft, "Safe arrays and pointers for C" Jens Gustedt <jens.gustedt@loria.fr> - 2012-09-02 10:52 +0200
  Re: Second draft, "Safe arrays and pointers for C" Per <per.mathisen@gmail.com> - 2012-09-28 06:49 -0700
    Re: Second draft, "Safe arrays and pointers for C" John Nagle <nagle@animats.com> - 2012-09-28 11:36 -0700
      Re: Second draft, "Safe arrays and pointers for C" Per <per.mathisen@gmail.com> - 2012-10-01 09:38 -0700
        Re: Second draft, "Safe arrays and pointers for C" John Nagle <nagle@animats.com> - 2012-10-01 11:38 -0700
      Re: Second draft, "Safe arrays and pointers for C" Shao Miller <sha0.miller@gmail.com> - 2012-12-17 09:11 -0500
        Re: Second draft, "Safe arrays and pointers for C" Keith Thompson <kst-u@mib.org> - 2012-12-17 10:18 -0800
          Re: Second draft, "Safe arrays and pointers for C" Shao Miller <sha0.miller@gmail.com> - 2012-12-17 18:24 -0500
            Re: Second draft, "Safe arrays and pointers for C" Shao Miller <sha0.miller@gmail.com> - 2012-12-17 18:32 -0500
            Re: Second draft, "Safe arrays and pointers for C" Keith Thompson <kst-u@mib.org> - 2012-12-17 15:44 -0800

csiph-web