3 ms·

This RFC recognizes that, and does not require additional annotation. It's important to recognize that in plain C the above is simply an aid to someone looking

by olliej 3y ago

This RFC recognizes that, and does not require additional annotation. It's important to recognize that in plain C the above is simply an aid to someone looking at the header and is no different from void foo(size_t elem_count, int elems[]); As such int j; foo(20, &j); is fine. Under this RFC this is an error and the call site would trap at runtime (if not picked up a compile time). The RFC also comments on (and handles) void foo(int elems[] __counted_by(elem_count), size_t elem_count); Look for references to "delayed parsing". It also handles similar in structs.

uecker 3y ago
While most C compilers ignore this the size in C can definitely be used for checking and this is intended, e.g. see the C2X charter: https://www.open-std.org/jtc1/sc22/wg14/www/docs/n2086.htm https://www.open-std.org/jtc1/sc22/wg14/www/docs/n2086.htm And compilers do this already to some degree: https://godbolt.org/z/c7xdazKrd https://godbolt.org/z/c7xdazKrd
- olliej 3y ago
  The moment the size isn't trivially available the warnings cease. I was using that example just to keep the code brief. This is a problem because it's trivially easy to have code along the lines of void foo(int size, int buffer[size]) { ... int new_base = some_math; int new_size = some_other_math; foo(new_size, buffer+new_base); ... } That computes the size or base incorrectly, and the compiler will do nothing to stop you walking off the ends. Obviously this RFC just uses the existing syntax if it's there and doesn't need explicit annotations, but the existing syntax requires the size parameter first which many APIs don't have. gcc has an extension to pre-declare a parameter name and type but you can't just use macros to make that work in other or older compilers. They also don't support sizes that aren't just a direct reference to a parameter (e.g. you can't make void some_matrix_func(int size, float matrix[size*size])).
  - uecker 3y ago
    That the size is information is used more for checking is generally ongoing work. Inside a function it can be propagated by the compiler. The old GCC extension can also be hidden behind a macro, so this is backwards compatible: void foo(HIDE(int x;) char buf[HIDE(x)], int x);

by olliej 3y ago

uecker 3y ago

While most C compilers ignore this the size in C can definitely be used for checking and this is intended, e.g. see the C2X charter: https://www.open-std.org/jtc1/sc22/wg14/www/docs/n2086.htm https://www.open-std.org/jtc1/sc22/wg14/www/docs/n2086.htm And compilers do this already to some degree: https://godbolt.org/z/c7xdazKrd https://godbolt.org/z/c7xdazKrd

olliej 3y ago
The moment the size isn't trivially available the warnings cease. I was using that example just to keep the code brief. This is a problem because it's trivially easy to have code along the lines of void foo(int size, int buffer[size]) { ... int new_base = some_math; int new_size = some_other_math; foo(new_size, buffer+new_base); ... } That computes the size or base incorrectly, and the compiler will do nothing to stop you walking off the ends. Obviously this RFC just uses the existing syntax if it's there and doesn't need explicit annotations, but the existing syntax requires the size parameter first which many APIs don't have. gcc has an extension to pre-declare a parameter name and type but you can't just use macros to make that work in other or older compilers. They also don't support sizes that aren't just a direct reference to a parameter (e.g. you can't make void some_matrix_func(int size, float matrix[size*size])).
- uecker 3y ago
  That the size is information is used more for checking is generally ongoing work. Inside a function it can be propagated by the compiler. The old GCC extension can also be hidden behind a macro, so this is backwards compatible: void foo(HIDE(int x;) char buf[HIDE(x)], int x);