4 ms·

It is possible that the compiler simply rejects any definition of a function that has a use after free, which would both uphold the compiler's claim and also no

It is possible that the compiler simply rejects any definition of a function that has a use after free, which would both uphold the compiler's claim and also not prove or disprove the goldbach conjecture.

WalterBright 7y ago
Which it does, if such use is on any control flow path after the free(). For example, bool first = true; while (f()) { if (first) free(p); first = false; } is rejected as double-free.
- deleted 7y ago
  [deleted]
- bonzini 7y ago
  What about while (f()) { free(p); p = NULL; }
  - WalterBright 7y ago
    It'll compile because although free(p) consumes p and p is undefined immediately afterwards, p then becomes defined again via the assignment and so the while loop always enters with a defined value for p.
anchpop 7y ago
If that is the case then his approach has false negatives, because a function that is never called cannot introduce memory unsafety but would incorrectly be flagged as unsafe
- WalterBright 7y ago
  > incorrectly be flagged as unsafe It depends on what that means. For example, one can write perfectly correct code in a block of code marked "unsafe", it's just that the compiler cannot check it. In D, these are marked with the @system attribute. We actually had a discussion about what to call such unsafe blocks. Other languages call them "unsafe", but I didn't care for that as it implied the blocks were actually broken. Hence we call such code "system" code. There aren't false negatives by the design of the rules. This is different from what linters do, as linters issue warnings for code that is acceptable by the language rules.
  - exiled13 7y ago
    > Other languages call them "unsafe", but I didn't care for that as it implied the blocks were actually broken. Climbing a ladder on a table is unsafe. Does that imply the ladder or table is broken? No.
- jjnoakes 7y ago
  Now you're entering a bit of a philosophical or subjective area in my opinion - I personally would want any code which is incorrect by construction to fail to compile (if possible) even if it was impossible to reach the code in question at runtime. A "false negative" like that is a feature IMO.

WalterBright 7y ago

Which it does, if such use is on any control flow path after the free(). For example, bool first = true; while (f()) { if (first) free(p); first = false; } is rejected as double-free.

deleted 7y ago
[deleted]
bonzini 7y ago
What about while (f()) { free(p); p = NULL; }
- WalterBright 7y ago
  It'll compile because although free(p) consumes p and p is undefined immediately afterwards, p then becomes defined again via the assignment and so the while loop always enters with a defined value for p.

anchpop 7y ago

If that is the case then his approach has false negatives, because a function that is never called cannot introduce memory unsafety but would incorrectly be flagged as unsafe

WalterBright 7y ago
> incorrectly be flagged as unsafe It depends on what that means. For example, one can write perfectly correct code in a block of code marked "unsafe", it's just that the compiler cannot check it. In D, these are marked with the @system attribute. We actually had a discussion about what to call such unsafe blocks. Other languages call them "unsafe", but I didn't care for that as it implied the blocks were actually broken. Hence we call such code "system" code. There aren't false negatives by the design of the rules. This is different from what linters do, as linters issue warnings for code that is acceptable by the language rules.
- exiled13 7y ago
  > Other languages call them "unsafe", but I didn't care for that as it implied the blocks were actually broken. Climbing a ladder on a table is unsafe. Does that imply the ladder or table is broken? No.
jjnoakes 7y ago
Now you're entering a bit of a philosophical or subjective area in my opinion - I personally would want any code which is incorrect by construction to fail to compile (if possible) even if it was impossible to reach the code in question at runtime. A "false negative" like that is a feature IMO.