1 /* Compile-time assert-like macros. 2 3 Copyright (C) 2005-2006, 2009-2021 Free Software Foundation, Inc. 4 5 This program is free software: you can redistribute it and/or modify 6 it under the terms of the GNU General Public License as published by 7 the Free Software Foundation; either version 3 of the License, or 8 (at your option) any later version. 9 10 This program is distributed in the hope that it will be useful, 11 but WITHOUT ANY WARRANTY; without even the implied warranty of 12 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 13 GNU General Public License for more details. 14 15 You should have received a copy of the GNU General Public License 16 along with this program. If not, see <https://www.gnu.org/licenses/>. */ 17 18 /* Written by Paul Eggert, Bruno Haible, and Jim Meyering. */ 19 20 #ifndef _GL_VERIFY_H 21 #define _GL_VERIFY_H 22 23 24 /* Define _GL_HAVE__STATIC_ASSERT to 1 if _Static_assert (R, DIAGNOSTIC) 25 works as per C11. This is supported by GCC 4.6.0 and later, in C 26 mode, and by clang (also in C++ mode). 27 28 Define _GL_HAVE__STATIC_ASSERT1 to 1 if _Static_assert (R) works as 29 per C2X. This is supported by GCC 9.1 and later, and by clang in 30 C++1z mode. 31 32 Define _GL_HAVE_STATIC_ASSERT1 if static_assert (R) works as per 33 C++17. This is supported by GCC 9.1 and later, and by clang in 34 C++1z mode. 35 36 Support compilers claiming conformance to the relevant standard, 37 and also support GCC when not pedantic. If we were willing to slow 38 'configure' down we could also use it with other compilers, but 39 since this affects only the quality of diagnostics, why bother? */ 40 #ifndef __cplusplus 41 # if (201112L <= __STDC_VERSION__ \ 42 || (!defined __STRICT_ANSI__ \ 43 && (4 < __GNUC__ + (6 <= __GNUC_MINOR__) || 4 <= __clang_major__))) 44 # define _GL_HAVE__STATIC_ASSERT 1 45 # endif 46 # if (202000L <= __STDC_VERSION__ \ 47 || (!defined __STRICT_ANSI__ && 9 <= __GNUC__)) 48 # define _GL_HAVE__STATIC_ASSERT1 1 49 # endif 50 #else 51 # if 4 <= __clang_major__ 52 # define _GL_HAVE__STATIC_ASSERT 1 53 # endif 54 # if 4 <= __clang_major__ && 201411 <= __cpp_static_assert 55 # define _GL_HAVE__STATIC_ASSERT1 1 56 # endif 57 # if 201703L <= __cplusplus \ 58 || 9 <= __GNUC__ \ 59 || (4 <= __clang_major__ && 201411 <= __cpp_static_assert) 60 # define _GL_HAVE_STATIC_ASSERT1 1 61 # endif 62 #endif 63 64 /* FreeBSD 9.1 <sys/cdefs.h>, included by <stddef.h> and lots of other 65 system headers, defines a conflicting _Static_assert that is no 66 better than ours; override it. */ 67 #ifndef _GL_HAVE__STATIC_ASSERT 68 # include <stddef.h> 69 # undef _Static_assert 70 #endif 71 72 /* Each of these macros verifies that its argument R is nonzero. To 73 be portable, R should be an integer constant expression. Unlike 74 assert (R), there is no run-time overhead. 75 76 If _Static_assert works, verify (R) uses it directly. Similarly, 77 _GL_VERIFY_TRUE works by packaging a _Static_assert inside a struct 78 that is an operand of sizeof. 79 80 The code below uses several ideas for C++ compilers, and for C 81 compilers that do not support _Static_assert: 82 83 * The first step is ((R) ? 1 : -1). Given an expression R, of 84 integral or boolean or floating-point type, this yields an 85 expression of integral type, whose value is later verified to be 86 constant and nonnegative. 87 88 * Next this expression W is wrapped in a type 89 struct _gl_verify_type { 90 unsigned int _gl_verify_error_if_negative: W; 91 }. 92 If W is negative, this yields a compile-time error. No compiler can 93 deal with a bit-field of negative size. 94 95 One might think that an array size check would have the same 96 effect, that is, that the type struct { unsigned int dummy[W]; } 97 would work as well. However, inside a function, some compilers 98 (such as C++ compilers and GNU C) allow local parameters and 99 variables inside array size expressions. With these compilers, 100 an array size check would not properly diagnose this misuse of 101 the verify macro: 102 103 void function (int n) { verify (n < 0); } 104 105 * For the verify macro, the struct _gl_verify_type will need to 106 somehow be embedded into a declaration. To be portable, this 107 declaration must declare an object, a constant, a function, or a 108 typedef name. If the declared entity uses the type directly, 109 such as in 110 111 struct dummy {...}; 112 typedef struct {...} dummy; 113 extern struct {...} *dummy; 114 extern void dummy (struct {...} *); 115 extern struct {...} *dummy (void); 116 117 two uses of the verify macro would yield colliding declarations 118 if the entity names are not disambiguated. A workaround is to 119 attach the current line number to the entity name: 120 121 #define _GL_CONCAT0(x, y) x##y 122 #define _GL_CONCAT(x, y) _GL_CONCAT0 (x, y) 123 extern struct {...} * _GL_CONCAT (dummy, __LINE__); 124 125 But this has the problem that two invocations of verify from 126 within the same macro would collide, since the __LINE__ value 127 would be the same for both invocations. (The GCC __COUNTER__ 128 macro solves this problem, but is not portable.) 129 130 A solution is to use the sizeof operator. It yields a number, 131 getting rid of the identity of the type. Declarations like 132 133 extern int dummy [sizeof (struct {...})]; 134 extern void dummy (int [sizeof (struct {...})]); 135 extern int (*dummy (void)) [sizeof (struct {...})]; 136 137 can be repeated. 138 139 * Should the implementation use a named struct or an unnamed struct? 140 Which of the following alternatives can be used? 141 142 extern int dummy [sizeof (struct {...})]; 143 extern int dummy [sizeof (struct _gl_verify_type {...})]; 144 extern void dummy (int [sizeof (struct {...})]); 145 extern void dummy (int [sizeof (struct _gl_verify_type {...})]); 146 extern int (*dummy (void)) [sizeof (struct {...})]; 147 extern int (*dummy (void)) [sizeof (struct _gl_verify_type {...})]; 148 149 In the second and sixth case, the struct type is exported to the 150 outer scope; two such declarations therefore collide. GCC warns 151 about the first, third, and fourth cases. So the only remaining 152 possibility is the fifth case: 153 154 extern int (*dummy (void)) [sizeof (struct {...})]; 155 156 * GCC warns about duplicate declarations of the dummy function if 157 -Wredundant-decls is used. GCC 4.3 and later have a builtin 158 __COUNTER__ macro that can let us generate unique identifiers for 159 each dummy function, to suppress this warning. 160 161 * This implementation exploits the fact that older versions of GCC, 162 which do not support _Static_assert, also do not warn about the 163 last declaration mentioned above. 164 165 * GCC warns if -Wnested-externs is enabled and 'verify' is used 166 within a function body; but inside a function, you can always 167 arrange to use verify_expr instead. 168 169 * In C++, any struct definition inside sizeof is invalid. 170 Use a template type to work around the problem. */ 171 172 /* Concatenate two preprocessor tokens. */ 173 #define _GL_CONCAT(x, y) _GL_CONCAT0 (x, y) 174 #define _GL_CONCAT0(x, y) x##y 175 176 /* _GL_COUNTER is an integer, preferably one that changes each time we 177 use it. Use __COUNTER__ if it works, falling back on __LINE__ 178 otherwise. __LINE__ isn't perfect, but it's better than a 179 constant. */ 180 #if defined __COUNTER__ && __COUNTER__ != __COUNTER__ 181 # define _GL_COUNTER __COUNTER__ 182 #else 183 # define _GL_COUNTER __LINE__ 184 #endif 185 186 /* Generate a symbol with the given prefix, making it unique if 187 possible. */ 188 #define _GL_GENSYM(prefix) _GL_CONCAT (prefix, _GL_COUNTER) 189 190 /* Verify requirement R at compile-time, as an integer constant expression 191 that returns 1. If R is false, fail at compile-time, preferably 192 with a diagnostic that includes the string-literal DIAGNOSTIC. */ 193 194 #define _GL_VERIFY_TRUE(R, DIAGNOSTIC) \ 195 (!!sizeof (_GL_VERIFY_TYPE (R, DIAGNOSTIC))) 196 197 #ifdef __cplusplus 198 # if !GNULIB_defined_struct__gl_verify_type 199 template <int w> 200 struct _gl_verify_type { 201 unsigned int _gl_verify_error_if_negative: w; 202 }; 203 # define GNULIB_defined_struct__gl_verify_type 1 204 # endif 205 # define _GL_VERIFY_TYPE(R, DIAGNOSTIC) \ 206 _gl_verify_type<(R) ? 1 : -1> 207 #elif defined _GL_HAVE__STATIC_ASSERT 208 # define _GL_VERIFY_TYPE(R, DIAGNOSTIC) \ 209 struct { \ 210 _Static_assert (R, DIAGNOSTIC); \ 211 int _gl_dummy; \ 212 } 213 #else 214 # define _GL_VERIFY_TYPE(R, DIAGNOSTIC) \ 215 struct { unsigned int _gl_verify_error_if_negative: (R) ? 1 : -1; } 216 #endif 217 218 /* Verify requirement R at compile-time, as a declaration without a 219 trailing ';'. If R is false, fail at compile-time. 220 221 This macro requires three or more arguments but uses at most the first 222 two, so that the _Static_assert macro optionally defined below supports 223 both the C11 two-argument syntax and the C2X one-argument syntax. 224 225 Unfortunately, unlike C11, this implementation must appear as an 226 ordinary declaration, and cannot appear inside struct { ... }. */ 227 228 #if defined _GL_HAVE__STATIC_ASSERT 229 # define _GL_VERIFY(R, DIAGNOSTIC, ...) _Static_assert (R, DIAGNOSTIC) 230 #else 231 # define _GL_VERIFY(R, DIAGNOSTIC, ...) \ 232 extern int (*_GL_GENSYM (_gl_verify_function) (void)) \ 233 [_GL_VERIFY_TRUE (R, DIAGNOSTIC)] 234 #endif 235 236 /* _GL_STATIC_ASSERT_H is defined if this code is copied into assert.h. */ 237 #ifdef _GL_STATIC_ASSERT_H 238 # if !defined _GL_HAVE__STATIC_ASSERT1 && !defined _Static_assert 239 # define _Static_assert(...) \ 240 _GL_VERIFY (__VA_ARGS__, "static assertion failed", -) 241 # endif 242 # if !defined _GL_HAVE_STATIC_ASSERT1 && !defined static_assert 243 # define static_assert _Static_assert /* C11 requires this #define. */ 244 # endif 245 #endif 246 247 /* @assert.h omit start@ */ 248 249 #if 3 < __GNUC__ + (3 < __GNUC_MINOR__ + (4 <= __GNUC_PATCHLEVEL__)) 250 # define _GL_HAS_BUILTIN_TRAP 1 251 #elif defined __has_builtin 252 # define _GL_HAS_BUILTIN_TRAP __has_builtin (__builtin_trap) 253 #else 254 # define _GL_HAS_BUILTIN_TRAP 0 255 #endif 256 257 #if 4 < __GNUC__ + (5 <= __GNUC_MINOR__) 258 # define _GL_HAS_BUILTIN_UNREACHABLE 1 259 #elif defined __has_builtin 260 # define _GL_HAS_BUILTIN_UNREACHABLE __has_builtin (__builtin_unreachable) 261 #else 262 # define _GL_HAS_BUILTIN_UNREACHABLE 0 263 #endif 264 265 /* Each of these macros verifies that its argument R is nonzero. To 266 be portable, R should be an integer constant expression. Unlike 267 assert (R), there is no run-time overhead. 268 269 There are two macros, since no single macro can be used in all 270 contexts in C. verify_expr (R, E) is for scalar contexts, including 271 integer constant expression contexts. verify (R) is for declaration 272 contexts, e.g., the top level. */ 273 274 /* Verify requirement R at compile-time. Return the value of the 275 expression E. */ 276 277 #define verify_expr(R, E) \ 278 (_GL_VERIFY_TRUE (R, "verify_expr (" #R ", " #E ")") ? (E) : (E)) 279 280 /* Verify requirement R at compile-time, as a declaration without a 281 trailing ';'. verify (R) acts like static_assert (R) except that 282 it is portable to C11/C++14 and earlier, it can issue better 283 diagnostics, and its name is shorter and may be more convenient. */ 284 285 #ifdef __PGI 286 /* PGI barfs if R is long. */ 287 # define verify(R) _GL_VERIFY (R, "verify (...)", -) 288 #else 289 # define verify(R) _GL_VERIFY (R, "verify (" #R ")", -) 290 #endif 291 292 /* Assume that R always holds. Behavior is undefined if R is false, 293 fails to evaluate, or has side effects. 294 295 'assume (R)' is a directive from the programmer telling the 296 compiler that R is true so the compiler needn't generate code to 297 test R. This is why 'assume' is in verify.h: it's related to 298 static checking (in this case, static checking done by the 299 programmer), not dynamic checking. 300 301 'assume (R)' can affect compilation of all the code, not just code 302 that happens to be executed after the assume (R) is "executed". 303 For example, if the code mistakenly does 'assert (R); assume (R);' 304 the compiler is entitled to optimize away the 'assert (R)'. 305 306 Although assuming R can help a compiler generate better code or 307 diagnostics, performance can suffer if R uses hard-to-optimize 308 features such as function calls not inlined by the compiler. 309 310 Avoid Clang's __builtin_assume, as it breaks GNU Emacs master 311 as of 2020-08-23T21:09:49Z!eggert@cs.ucla.edu; see 312 <https://bugs.gnu.org/43152#71>. It's not known whether this breakage 313 is a Clang bug or an Emacs bug; play it safe for now. */ 314 315 #if _GL_HAS_BUILTIN_UNREACHABLE 316 # define assume(R) ((R) ? (void) 0 : __builtin_unreachable ()) 317 #elif 1200 <= _MSC_VER 318 # define assume(R) __assume (R) 319 #elif (defined GCC_LINT || defined lint) && _GL_HAS_BUILTIN_TRAP 320 /* Doing it this way helps various packages when configured with 321 --enable-gcc-warnings, which compiles with -Dlint. It's nicer 322 when 'assume' silences warnings even with older GCCs. */ 323 # define assume(R) ((R) ? (void) 0 : __builtin_trap ()) 324 #else 325 /* Some tools grok NOTREACHED, e.g., Oracle Studio 12.6. */ 326 # define assume(R) ((R) ? (void) 0 : /*NOTREACHED*/ (void) 0) 327 #endif 328 329 /* @assert.h omit end@ */ 330 331 #endif 332