{"thread":{"id":"39167","subject":"[PATCH v2] git-compat-util.h: implement a different ARRAY_SIZE macro for for safely deriving the size of array","startedAt":"2015-04-27T13:11:09Z","lastAt":"2015-04-28T05:42:37Z","messageCount":4,"participants":["Elia Pinto","Junio C Hamano","Jeff King"],"isPatch":true,"patchVersion":2,"patchTotal":null},"messages":[{"id":"260056","messageId":"1430140269-11784-1-git-send-email-gitter.spiros@gmail.com","threadId":"39167","inReplyTo":null,"subject":"[PATCH v2] git-compat-util.h: implement a different ARRAY_SIZE macro for for safely deriving the size of array","fromName":"Elia Pinto","fromEmail":"gitter.spiros@gmail.com","sentAt":"2015-04-27T13:11:09Z","receivedAt":"2015-04-27T13:11:09Z","isPatch":true,"sender":{"key":"gitter.spiros@gmail.com","avatar":"https://avatars.githubusercontent.com/u/158490?v=4"},"body":"To get number of elements in an array git use the ARRAY_SIZE macro defined as:\n\n       #define ARRAY_SIZE(x) (sizeof(x)/sizeof((x)[0]))\n\nThe problem with it is a possibility of mistakenly passing to it a\npointer instead an array. The ARRAY_SIZE macro as conventionally\ndefined does not provide good type-safety and the open-coded approach\nis more fragile, more verbose and provides no improvement in type-safety.\n\nUse instead a different but compatible ARRAY_SIZE() macro,\nwhich will also break compile if you try to\nuse it on a pointer. This implemention revert to the original code if\nthe compiler doesn't know the typeof and __builtin_types_compatible_p\nGCC extensions.\n\nThis can ensure our code is robust to changes, without\nneeding a gratuitous macro or constant. A similar\nARRAY_SIZE implementation also exists in the linux kernel.\n\nCredits to Rusty Russell and his ccan library.\n\nSigned-off-by: Elia Pinto <gitter.spiros@gmail.com>\n---\n Makefile          |  7 +++++++\n configure.ac      | 24 ++++++++++++++++++++++++\n git-compat-util.h | 36 +++++++++++++++++++++++++++++++++++-\n 3 files changed, 66 insertions(+), 1 deletion(-)\n\nThis is the second version of this patch. \nIt had not been discussed before. In the second version, I just tried to clarify \nthe comment in the commit. I resend it just in case you missed\n\ndiff --git a/Makefile b/Makefile\nindex 5f3987f..cb2a044 100644\n--- a/Makefile\n+++ b/Makefile\n@@ -359,6 +359,9 @@ all::\n # compiler is detected to support it.\n #\n # Define HAVE_BSD_SYSCTL if your platform has a BSD-compatible sysctl function.\n+#\n+# Define SUPPORT__BUILTIN_TYPES_COMPATIBLE_P if your compiler support\n+# the builtin function __builtin_types_compatible_\n \n GIT-VERSION-FILE: FORCE\n \t@$(SHELL_PATH) ./GIT-VERSION-GEN\n@@ -1437,6 +1440,10 @@ ifdef HAVE_BSD_SYSCTL\n \tBASIC_CFLAGS += -DHAVE_BSD_SYSCTL\n endif\n \n+ifdef SUPPORT__BUILTIN_TYPES_COMPATIBLE_P\n+\tBASIC_CFLAGS += -DSUPPORT__BUILTIN_TYPES_COMPATIBLE_P\n+endif\n+\n ifeq ($(TCLTK_PATH),)\n NO_TCLTK = NoThanks\n endif\ndiff --git a/configure.ac b/configure.ac\nindex bbdde85..151864d 100644\n--- a/configure.ac\n+++ b/configure.ac\n@@ -139,6 +139,28 @@ if test -n \"$1\"; then\n fi\n ])\n \n+AC_DEFUN([GIT_FUNC_TYPES_COMPATIBLE_P], [\n+\tAC_CACHE_CHECK([if compiler has __builtin_types_compatible_p function],\n+\t\t[cc_cv_func_types_compatible_p],\n+\t\t[ac_save_CFLAGS=\"$CFLAGS\"\n+\t\tCFLAGS=\"$CFLAGS -Werror\"\n+\t\tAC_COMPILE_IFELSE([AC_LANG_SOURCE(\n+\t\t\t[int some_function();\n+\t\t\tint some_function() {\n+\t\t\treturn __builtin_types_compatible_p(char *, int) ? 1 : 0;\n+\t\t\t}])],\n+\t\t\t[cc_cv_func_types_compatible_p=yes],\n+\t\t\t[cc_cv_func_types_compatible_p=no])\n+\t\tCFLAGS=\"$ac_save_CFLAGS\"\n+\t])\n+\n+\tAS_IF([test \"x$cc_cv_func_types_compatible_p\" = \"xyes\"],\n+\t\t[GIT_CONF_SUBST([SUPPORT__BUILTIN_TYPES_COMPATIBLE_P], [YesPlease])],\n+\t\t[$2])\n+])\n+\n+\n+\n ## Configure body starts here.\n \n AC_PREREQ(2.59)\n@@ -910,6 +932,8 @@ else\n fi\n GIT_CONF_SUBST([NEEDS_MODE_TRANSLATION])\n \n+GIT_FUNC_TYPES_COMPATIBLE_P\n+\n \n ## Checks for library functions.\n ## (in default C library and libraries checked by AC_CHECK_LIB)\ndiff --git a/git-compat-util.h b/git-compat-util.h\nindex bc8fc8c..8e9f6c2 100644\n--- a/git-compat-util.h\n+++ b/git-compat-util.h\n@@ -25,7 +25,41 @@\n #endif\n #endif\n \n-#define ARRAY_SIZE(x) (sizeof(x)/sizeof(x[0]))\n+\n+/*\n+ * BUILD_ASSERT_OR_ZERO - assert a build-time dependency, as an expression.\n+ * @cond: the compile-time condition which must be true.\n+ *\n+ * Your compile will fail if the condition isn't true, or can't be evaluated\n+ * by the compiler.  This can be used in an expression: its value is \"0\".\n+ *\n+ * Example:\n+ *\t#define foo_to_char(foo)\t\t\t\t\t\\\n+ *\t\t ((char *)(foo)\t\t\t\t\t\t\\\n+ *\t\t  + BUILD_ASSERT_OR_ZERO(offsetof(struct foo, string) == 0))\n+ */\n+#define BUILD_ASSERT_OR_ZERO(cond) \\\n+\t(sizeof(char [1 - 2*!(cond)]) - 1)\n+\n+\n+#if SUPPORT__BUILTIN_TYPES_COMPATIBLE_P\n+/* &arr[0] degrades to a pointer: a different type from an array */\n+#define _array_size_chk(arr)\t\t\t\t\t\t\\\n+\tBUILD_ASSERT_OR_ZERO(!__builtin_types_compatible_p(typeof(arr), \\\n+\t\t\t\t\t\t\ttypeof(&(arr)[0])))\n+#else\n+#define _array_size_chk(arr) 0\n+#endif\n+\n+/*\n+ * ARRAY_SIZE - get the number of elements in a visible array\n+ *  <at> x: the array whose size you want.\n+ *\n+ * This does not work on pointers, or arrays declared as [], or\n+ * function parameters.  With correct compiler support, such usage\n+ * will cause a build error (see build_assert).\n+ */\n+#define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]) + _array_size_chk(x))\n #define bitsizeof(x)  (CHAR_BIT * sizeof(x))\n \n #define maximum_signed_value_of_type(a) \\\n-- \n2.1.0\n"},{"id":"260063","messageId":"xmqq1tj5xxo1.fsf@gitster.dls.corp.google.com","threadId":"39167","inReplyTo":"1430140269-11784-1-git-send-email-gitter.spiros@gmail.com","subject":"Re: [PATCH v2] git-compat-util.h: implement a different ARRAY_SIZE macro for for safely deriving the size of array","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2015-04-27T17:56:30Z","receivedAt":"2015-04-27T17:56:30Z","isPatch":true,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Elia Pinto <gitter.spiros@gmail.com> writes:\n\n> This is the second version of this patch.  It had not been\n> discussed before. In the second version, I just tried to clarify\n> the comment in the commit. I resend it just in case you missed\n\nI do not recall seeing it before.  No discussion usually means no\ninterest, so I'll see what happens this time on the list for a few\ndays before picking it up.\n\n> +#if SUPPORT__BUILTIN_TYPES_COMPATIBLE_P\n> +/* &arr[0] degrades to a pointer: a different type from an array */\n> +#define _array_size_chk(arr)\t\t\t\t\t\t\\\n> +\tBUILD_ASSERT_OR_ZERO(!__builtin_types_compatible_p(typeof(arr), \\\n> +\t\t\t\t\t\t\ttypeof(&(arr)[0])))\n> +#else\n> +#define _array_size_chk(arr) 0\n> +#endif\n\nWouldn't there be a more sensible name?  _chk does not tell us\nanything about what is being checked, and the only thing this name\ngives us is \"what uses it\" (i.e. it is some magic used by array-size\nand does not say what it checks and what for).\n\nI think you are checking arr is an array and not a pointer.  Perhaps\n\"#define is_an_array(arr)\" or something along that line may be a\nmore descriptive name for it.\n\nI doubt the leading underscore is particularly a good idea, though.\n\n> +/*\n> + * ARRAY_SIZE - get the number of elements in a visible array\n> + *  <at> x: the array whose size you want.\n> + *\n> + * This does not work on pointers, or arrays declared as [], or\n> + * function parameters.  With correct compiler support, such usage\n> + * will cause a build error (see build_assert).\n> + */\n> +#define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]) + _array_size_chk(x))\n>  #define bitsizeof(x)  (CHAR_BIT * sizeof(x))\n>  \n>  #define maximum_signed_value_of_type(a) \\\n"},{"id":"260065","messageId":"xmqqsiblwidw.fsf@gitster.dls.corp.google.com","threadId":"39167","inReplyTo":"xmqq1tj5xxo1.fsf@gitster.dls.corp.google.com","subject":"Re: [PATCH v2] git-compat-util.h: implement a different ARRAY_SIZE macro for for safely deriving the size of array","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2015-04-27T18:11:55Z","receivedAt":"2015-04-27T18:11:55Z","isPatch":true,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Junio C Hamano <gitster@pobox.com> writes:\n\n>> +#if SUPPORT__BUILTIN_TYPES_COMPATIBLE_P\n>> +/* &arr[0] degrades to a pointer: a different type from an array */\n>> +#define _array_size_chk(arr)\t\t\t\t\t\t\\\n>> +\tBUILD_ASSERT_OR_ZERO(!__builtin_types_compatible_p(typeof(arr), \\\n>> +\t\t\t\t\t\t\ttypeof(&(arr)[0])))\n>> +#else\n>> +#define _array_size_chk(arr) 0\n>> +#endif\n>\n> Wouldn't there be a more sensible name?  _chk does not tell us\n> anything about what is being checked, and the only thing this name\n> gives us is \"what uses it\" (i.e. it is some magic used by array-size\n> and does not say what it checks and what for).\n>\n> I think you are checking arr is an array and not a pointer.  Perhaps\n> \"#define is_an_array(arr)\" or something along that line may be a\n> more descriptive name for it.\n>\n> I doubt the leading underscore is particularly a good idea, though.\n\nAnd \"is_an_array(arr)\" is probably not quite a good name, as that\nsounds as if it would give 1 and adding it to sizeof(x)/sizeof(x[0])\ndoes not make sense.  barf_if_not_an_array() is what the macro does.\n"},{"id":"260100","messageId":"20150428054237.GI24580@peff.net","threadId":"39167","inReplyTo":"xmqq1tj5xxo1.fsf@gitster.dls.corp.google.com","subject":"Re: [PATCH v2] git-compat-util.h: implement a different ARRAY_SIZE macro for for safely deriving the size of array","fromName":"Jeff King","fromEmail":"peff@peff.net","sentAt":"2015-04-28T05:42:37Z","receivedAt":"2015-04-28T05:42:37Z","isPatch":true,"sender":{"key":"peff@peff.net","avatar":"https://avatars.githubusercontent.com/u/45925?v=4"},"body":"On Mon, Apr 27, 2015 at 10:56:30AM -0700, Junio C Hamano wrote:\n\n> Elia Pinto <gitter.spiros@gmail.com> writes:\n> \n> > This is the second version of this patch.  It had not been\n> > discussed before. In the second version, I just tried to clarify\n> > the comment in the commit. I resend it just in case you missed\n> \n> I do not recall seeing it before.  No discussion usually means no\n> interest, so I'll see what happens this time on the list for a few\n> days before picking it up.\n\nI'm in favor of any method for improving compile-time bug-checking,\nprovided that:\n\n  1. It does not carry a maintenance cost that spreads throughout the\n     code base (e.g., here the cost is localized to making ARRAY_SIZE a\n     bit more complex, but callers do not have to care about the extra\n     checking).\n\n  2. It gracefully degrades when using older compilers (i.e., we can\n     fall back to the existing ARRAY_SIZE definition when the magic\n     builtin is not available).\n\nI think this is OK for both points. It would be nice if we could\nauto-detect the presence of the builtin without using autoconf. I think\nmost git developers do not use autoconf at all, and the feature does not\nhelp much if nobody turns it on. Is there a __GNUC__ or similar\nfeature-test macro we could use for this?\n\n> > +#define _array_size_chk(arr) 0\n> > +#endif\n> \n> Wouldn't there be a more sensible name?  _chk does not tell us\n> anything about what is being checked, and the only thing this name\n> gives us is \"what uses it\" (i.e. it is some magic used by array-size\n> and does not say what it checks and what for).\n> \n> I think you are checking arr is an array and not a pointer.  Perhaps\n> \"#define is_an_array(arr)\" or something along that line may be a\n> more descriptive name for it.\n> \n> I doubt the leading underscore is particularly a good idea, though.\n\nAgreed on the naming (modulo the \"not\" from your follow-on email). Also,\nshould it be in ALL_CAPS like the other added macros? We are slightly\ninconsistent about that in our code-base.\n\n-Peff\n"}]}