{"thread":{"id":"49704","subject":"[PATCH] sequencer: clarify intention to break out of loop","startedAt":"2018-10-28T15:32:33Z","lastAt":"2018-10-31T18:42:13Z","messageCount":8,"participants":["Martin Ågren","Eric Sunshine","Junio C Hamano","Johannes Schindelin"],"isPatch":true,"patchVersion":1,"patchTotal":null},"messages":[{"id":"361841","messageId":"20181028153145.25734-1-martin.agren@gmail.com","threadId":"49704","inReplyTo":null,"subject":"[PATCH] sequencer: clarify intention to break out of loop","fromName":"Martin Ågren","fromEmail":"martin.agren@gmail.com","sentAt":"2018-10-28T15:31:45Z","receivedAt":"2018-10-28T15:32:33Z","isPatch":true,"sender":{"key":"martin.agren@gmail.com","avatar":null},"body":"When we find a space, we set `len = i`, which gives us the answer we are\nlooking for, but which also breaks out of the loop through these steps:\n\n  1. `len = i`\n\n  2. `i = i + 1`\n\n  3. Is `i < len`? No, so break out.\n\nSince `i` is signed, step 2 is undefined if `i` has the value `INT_MAX`.\nIt can't actually have that value, but that doesn't stop my copy of gcc\n7.3.0 from throwing the following:\n\n> sequencer.c:2853:3: error: assuming signed overflow does not occur when\n> assuming that (X + c) < X is always false [-Werror=strict-overflow]\n>    for (i = 0; i < len; i++)\n>    ^~~\n\nThat is, the compiler has realized that the code is essentially\nevaluating \"(len + 1) < len\" and that for `len = INT_MAX`, this is\nundefined behavior. What it hasn't figured out is that if `i` and `len`\nare both `INT_MAX` after step 1, then `len` must have had a value larger\nthan `INT_MAX` before that step, which it can't have had.\n\nLet's be explicit about breaking out of the loop. This helps the\ncompiler grok our intention. As a bonus, it might make it (even) more\nobvious to human readers that the loop stops at the first space.\n\nWhile at it, reduce the scope of `i`.\n\nSigned-off-by: Martin Ågren <martin.agren@gmail.com>\n---\n sequencer.c | 10 +++++++---\n 1 file changed, 7 insertions(+), 3 deletions(-)\n\ndiff --git a/sequencer.c b/sequencer.c\nindex 0c164d5f98..a351638ad9 100644\n--- a/sequencer.c\n+++ b/sequencer.c\n@@ -2829,7 +2829,7 @@ static int do_reset(const char *name, int len, struct replay_opts *opts)\n \tstruct tree_desc desc;\n \tstruct tree *tree;\n \tstruct unpack_trees_options unpack_tree_opts;\n-\tint ret = 0, i;\n+\tint ret = 0;\n \n \tif (hold_locked_index(&lock, LOCK_REPORT_ON_ERROR) < 0)\n \t\treturn -1;\n@@ -2849,10 +2849,14 @@ static int do_reset(const char *name, int len, struct replay_opts *opts)\n \t\t}\n \t\toidcpy(&oid, &opts->squash_onto);\n \t} else {\n+\t\tint i;\n \t\t/* Determine the length of the label */\n-\t\tfor (i = 0; i < len; i++)\n-\t\t\tif (isspace(name[i]))\n+\t\tfor (i = 0; i < len; i++) {\n+\t\t\tif (isspace(name[i])) {\n \t\t\t\tlen = i;\n+\t\t\t\tbreak;\n+\t\t\t}\n+\t\t}\n \n \t\tstrbuf_addf(&ref_name, \"refs/rewritten/%.*s\", len, name);\n \t\tif (get_oid(ref_name.buf, &oid) &&\n-- \n2.19.1.593.gc670b1f876.dirty\n\n"},{"id":"361844","messageId":"CAPig+cR28OBA0rwy=X6XU0cjstAguvUiLU9Zxjvg2X7=UsB5qw@mail.gmail.com","threadId":"49704","inReplyTo":"20181028153145.25734-1-martin.agren@gmail.com","subject":"Re: [PATCH] sequencer: clarify intention to break out of loop","fromName":"Eric Sunshine","fromEmail":"sunshine@sunshineco.com","sentAt":"2018-10-28T19:01:16Z","receivedAt":"2018-10-28T19:01:30Z","isPatch":true,"sender":{"key":"sunshine@sunshineco.com","avatar":"https://avatars.githubusercontent.com/u/163641?v=4"},"body":"On Sun, Oct 28, 2018 at 11:32 AM Martin Ågren <martin.agren@gmail.com> wrote:\n> [...]\n> Let's be explicit about breaking out of the loop. This helps the\n> compiler grok our intention. As a bonus, it might make it (even) more\n> obvious to human readers that the loop stops at the first space.\n\nThis did come up in review[1,2]. I had a hard time understanding the\nloop because it looked idiomatic but wasn't (and we have preconceived\nnotions about behavior of things which look idiomatic).\n\n[1]: https://public-inbox.org/git/CAPig+cQbG2s-LrAo9+7C7=dXifbWFJ3SzuNa-QePHDk7egK=jg@mail.gmail.com/\n[2]: https://public-inbox.org/git/CAPig+cRjU6niXpT2FrDWZ0x1HmGf1ojVZj3uk2qXEGe-S7i_HQ@mail.gmail.com/\n\n> Signed-off-by: Martin Ågren <martin.agren@gmail.com>\n> ---\n> diff --git a/sequencer.c b/sequencer.c\n> @@ -2849,10 +2849,14 @@ static int do_reset(const char *name, int len, struct replay_opts *opts)\n>                 /* Determine the length of the label */\n> +               for (i = 0; i < len; i++) {\n> +                       if (isspace(name[i])) {\n>                                 len = i;\n> +                               break;\n> +                       }\n> +               }\n>                 strbuf_addf(&ref_name, \"refs/rewritten/%.*s\", len, name);\n\nAt least for me, this would be more idiomatic if it was coded like this:\n\n    for (i = 0; i < len; i++)\n        if (isspace(name[i]))\n            break;\n    strbuf_addf(..., i, name);\n\nor, perhaps (less concise):\n\n    for (i = 0; i < len; i++)\n        if (isspace(name[i]))\n            break;\n    len = i;\n    strbuf_addf(..., len, name);\n"},{"id":"361845","messageId":"CAN0heSpiVUj1LK9RFkJ5VWGVZs=mheYwYjut3YXzMfVYhtU+8A@mail.gmail.com","threadId":"49704","inReplyTo":"CAPig+cR28OBA0rwy=X6XU0cjstAguvUiLU9Zxjvg2X7=UsB5qw@mail.gmail.com","subject":"Re: [PATCH] sequencer: clarify intention to break out of loop","fromName":"Martin Ågren","fromEmail":"martin.agren@gmail.com","sentAt":"2018-10-28T20:37:27Z","receivedAt":"2018-10-28T20:37:56Z","isPatch":true,"sender":{"key":"martin.agren@gmail.com","avatar":null},"body":"On Sun, 28 Oct 2018 at 20:01, Eric Sunshine <sunshine@sunshineco.com> wrote:\n>\n> On Sun, Oct 28, 2018 at 11:32 AM Martin Ågren <martin.agren@gmail.com> wrote:\n> > [...]\n> > Let's be explicit about breaking out of the loop. This helps the\n> > compiler grok our intention. As a bonus, it might make it (even) more\n> > obvious to human readers that the loop stops at the first space.\n>\n> This did come up in review[1,2]. I had a hard time understanding the\n> loop because it looked idiomatic but wasn't (and we have preconceived\n> notions about behavior of things which look idiomatic).\n>\n> [1]: https://public-inbox.org/git/CAPig+cQbG2s-LrAo9+7C7=dXifbWFJ3SzuNa-QePHDk7egK=jg@mail.gmail.com/\n> [2]: https://public-inbox.org/git/CAPig+cRjU6niXpT2FrDWZ0x1HmGf1ojVZj3uk2qXEGe-S7i_HQ@mail.gmail.com/\n\nHmm, I should have been able to dig those up myself. Thanks for the\npointers.\n\n> >                 /* Determine the length of the label */\n> > +               for (i = 0; i < len; i++) {\n> > +                       if (isspace(name[i])) {\n> >                                 len = i;\n> > +                               break;\n> > +                       }\n> > +               }\n> >                 strbuf_addf(&ref_name, \"refs/rewritten/%.*s\", len, name);\n>\n> At least for me, this would be more idiomatic if it was coded like this:\n>\n>     for (i = 0; i < len; i++)\n>         if (isspace(name[i]))\n>             break;\n>     strbuf_addf(..., i, name);\n>\n> or, perhaps (less concise):\n>\n>     for (i = 0; i < len; i++)\n>         if (isspace(name[i]))\n>             break;\n>     len = i;\n>     strbuf_addf(..., len, name);\n\nThis second one is more true to the original in that it updates `len` to\nthe new, shorter length. Which actually seems to be needed -- towards\nthe very end of the function, `len` is used, so the first of these\nsuggestions would change the behavior.\n\nThanks a lot for a review. I'll wait for any additional comments and\nwill try a v2 with your second suggestion.\n\nMartin\n"},{"id":"361865","messageId":"xmqqva5l76zs.fsf@gitster-ct.c.googlers.com","threadId":"49704","inReplyTo":"CAPig+cR28OBA0rwy=X6XU0cjstAguvUiLU9Zxjvg2X7=UsB5qw@mail.gmail.com","subject":"Re: [PATCH] sequencer: clarify intention to break out of loop","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2018-10-29T03:43:19Z","receivedAt":"2018-10-29T03:43:24Z","isPatch":true,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Eric Sunshine <sunshine@sunshineco.com> writes:\n\n>> diff --git a/sequencer.c b/sequencer.c\n>> @@ -2849,10 +2849,14 @@ static int do_reset(const char *name, int len, struct replay_opts *opts)\n>>                 /* Determine the length of the label */\n>> +               for (i = 0; i < len; i++) {\n>> +                       if (isspace(name[i])) {\n>>                                 len = i;\n>> +                               break;\n>> +                       }\n>> +               }\n>>                 strbuf_addf(&ref_name, \"refs/rewritten/%.*s\", len, name);\n>\n> At least for me, this would be more idiomatic if it was coded like this:\n>\n>     for (i = 0; i < len; i++)\n>         if (isspace(name[i]))\n>             break;\n>     strbuf_addf(..., i, name);\n>\n> or, perhaps (less concise):\n>\n>     for (i = 0; i < len; i++)\n>         if (isspace(name[i]))\n>             break;\n>     len = i;\n>     strbuf_addf(..., len, name);\n\nYup, the former is more idiomatic between these two; the latter is\nalso fine.\n\nThe result of Martin's patch shares the same \"Huh?\" factor as the\noriginal that mucks with the \"supposedly constant\" side of the\ntermination condition, and from that point of view, it is not that\nmuch of a readability improvement, I would think.\n\n"},{"id":"361971","messageId":"20181030080937.11118-1-martin.agren@gmail.com","threadId":"49704","inReplyTo":"xmqqva5l76zs.fsf@gitster-ct.c.googlers.com","subject":"[PATCH v2] sequencer: break out of loop explicitly","fromName":"Martin Ågren","fromEmail":"martin.agren@gmail.com","sentAt":"2018-10-30T08:09:37Z","receivedAt":"2018-10-30T08:10:04Z","isPatch":true,"sender":{"key":"martin.agren@gmail.com","avatar":null},"body":"It came up in review [1, 2] that this non-idiomatic loop is a bit tricky.\nWhen we find a space, we set `len = i`, which gives us the answer we are\nlooking for, but which also breaks out of the loop.\n\nIt turns out that this loop can confuse compilers as well. My copy of\ngcc 7.3.0 realizes that we are essentially evaluating `(len + 1) < len`\nand warns that the behavior is undefined if `len` is `INT_MAX`. (Because\nthe assignment `len = i` is guaranteed to decrease `len`, such undefined\nbehavior is not actually possible.)\n\nRewrite the loop to a more idiomatic variant which doesn't muck with\n`len` in the loop body. That should help compilers and human readers\nfigure out what is going on here. But do note that we need to update\n`len` since it is not only used just after this loop (where we could\nhave used `i` directly), but also later in this function.\n\nWhile at it, reduce the scope of `i`.\n\n[1] https://public-inbox.org/git/CAPig+cQbG2s-LrAo9+7C7=dXifbWFJ3SzuNa-QePHDk7egK=jg@mail.gmail.com/\n\n[2] https://public-inbox.org/git/CAPig+cRjU6niXpT2FrDWZ0x1HmGf1ojVZj3uk2qXEGe-S7i_HQ@mail.gmail.com/\n\nHelped-by: Eric Sunshine <sunshine@sunshineco.com>\nSigned-off-by: Martin Ågren <martin.agren@gmail.com>\n---\n Thanks for the comments on v1. Based on them, I decided to go for\n Eric's option 2, and to make the log message less technical in favor of\n \"compilers and humans alike can get this wrong\".\n\n sequencer.c | 7 +++++--\n 1 file changed, 5 insertions(+), 2 deletions(-)\n\ndiff --git a/sequencer.c b/sequencer.c\nindex 0c164d5f98..e7aa4d5020 100644\n--- a/sequencer.c\n+++ b/sequencer.c\n@@ -2829,7 +2829,7 @@ static int do_reset(const char *name, int len, struct replay_opts *opts)\n \tstruct tree_desc desc;\n \tstruct tree *tree;\n \tstruct unpack_trees_options unpack_tree_opts;\n-\tint ret = 0, i;\n+\tint ret = 0;\n \n \tif (hold_locked_index(&lock, LOCK_REPORT_ON_ERROR) < 0)\n \t\treturn -1;\n@@ -2849,10 +2849,13 @@ static int do_reset(const char *name, int len, struct replay_opts *opts)\n \t\t}\n \t\toidcpy(&oid, &opts->squash_onto);\n \t} else {\n+\t\tint i;\n+\n \t\t/* Determine the length of the label */\n \t\tfor (i = 0; i < len; i++)\n \t\t\tif (isspace(name[i]))\n-\t\t\t\tlen = i;\n+\t\t\t\tbreak;\n+\t\tlen = i;\n \n \t\tstrbuf_addf(&ref_name, \"refs/rewritten/%.*s\", len, name);\n \t\tif (get_oid(ref_name.buf, &oid) &&\n-- \n2.19.1.593.gc670b1f876.dirty\n\n"},{"id":"362111","messageId":"nycvar.QRO.7.76.6.1810311553480.4546@tvgsbejvaqbjf.bet","threadId":"49704","inReplyTo":"20181030080937.11118-1-martin.agren@gmail.com","subject":"Re: [PATCH v2] sequencer: break out of loop explicitly","fromName":"Johannes Schindelin","fromEmail":"johannes.schindelin@gmx.de","sentAt":"2018-10-31T14:54:03Z","receivedAt":"2018-10-31T14:54:10Z","isPatch":true,"sender":{"key":"johannes.schindelin@gmx.de","avatar":"https://avatars.githubusercontent.com/u/127790?v=4"},"body":"Hi Martin,\n\nOn Tue, 30 Oct 2018, Martin Ågren wrote:\n\n> It came up in review [1, 2] that this non-idiomatic loop is a bit tricky.\n> When we find a space, we set `len = i`, which gives us the answer we are\n> looking for, but which also breaks out of the loop.\n> \n> It turns out that this loop can confuse compilers as well. My copy of\n> gcc 7.3.0 realizes that we are essentially evaluating `(len + 1) < len`\n> and warns that the behavior is undefined if `len` is `INT_MAX`. (Because\n> the assignment `len = i` is guaranteed to decrease `len`, such undefined\n> behavior is not actually possible.)\n> \n> Rewrite the loop to a more idiomatic variant which doesn't muck with\n> `len` in the loop body. That should help compilers and human readers\n> figure out what is going on here. But do note that we need to update\n> `len` since it is not only used just after this loop (where we could\n> have used `i` directly), but also later in this function.\n> \n> While at it, reduce the scope of `i`.\n> \n> [1] https://public-inbox.org/git/CAPig+cQbG2s-LrAo9+7C7=dXifbWFJ3SzuNa-QePHDk7egK=jg@mail.gmail.com/\n> \n> [2] https://public-inbox.org/git/CAPig+cRjU6niXpT2FrDWZ0x1HmGf1ojVZj3uk2qXEGe-S7i_HQ@mail.gmail.com/\n> \n> Helped-by: Eric Sunshine <sunshine@sunshineco.com>\n> Signed-off-by: Martin Ågren <martin.agren@gmail.com>\n> ---\n\nACK. Thanks for cleaning up after me,\nDscho\n\n>  Thanks for the comments on v1. Based on them, I decided to go for\n>  Eric's option 2, and to make the log message less technical in favor of\n>  \"compilers and humans alike can get this wrong\".\n> \n>  sequencer.c | 7 +++++--\n>  1 file changed, 5 insertions(+), 2 deletions(-)\n> \n> diff --git a/sequencer.c b/sequencer.c\n> index 0c164d5f98..e7aa4d5020 100644\n> --- a/sequencer.c\n> +++ b/sequencer.c\n> @@ -2829,7 +2829,7 @@ static int do_reset(const char *name, int len, struct replay_opts *opts)\n>  \tstruct tree_desc desc;\n>  \tstruct tree *tree;\n>  \tstruct unpack_trees_options unpack_tree_opts;\n> -\tint ret = 0, i;\n> +\tint ret = 0;\n>  \n>  \tif (hold_locked_index(&lock, LOCK_REPORT_ON_ERROR) < 0)\n>  \t\treturn -1;\n> @@ -2849,10 +2849,13 @@ static int do_reset(const char *name, int len, struct replay_opts *opts)\n>  \t\t}\n>  \t\toidcpy(&oid, &opts->squash_onto);\n>  \t} else {\n> +\t\tint i;\n> +\n>  \t\t/* Determine the length of the label */\n>  \t\tfor (i = 0; i < len; i++)\n>  \t\t\tif (isspace(name[i]))\n> -\t\t\t\tlen = i;\n> +\t\t\t\tbreak;\n> +\t\tlen = i;\n>  \n>  \t\tstrbuf_addf(&ref_name, \"refs/rewritten/%.*s\", len, name);\n>  \t\tif (get_oid(ref_name.buf, &oid) &&\n> -- \n> 2.19.1.593.gc670b1f876.dirty\n> \n> "},{"id":"362115","messageId":"CAPig+cR-W1bQ7wY8k8Zok3hCBxHL8uXmUA2p2Tc9pYYXc7Zr+g@mail.gmail.com","threadId":"49704","inReplyTo":"nycvar.QRO.7.76.6.1810311553480.4546@tvgsbejvaqbjf.bet","subject":"Re: [PATCH v2] sequencer: break out of loop explicitly","fromName":"Eric Sunshine","fromEmail":"sunshine@sunshineco.com","sentAt":"2018-10-31T17:28:34Z","receivedAt":"2018-10-31T17:28:47Z","isPatch":true,"sender":{"key":"sunshine@sunshineco.com","avatar":"https://avatars.githubusercontent.com/u/163641?v=4"},"body":"On Wed, Oct 31, 2018 at 10:54 AM Johannes Schindelin\n<Johannes.Schindelin@gmx.de> wrote:\n> On Tue, 30 Oct 2018, Martin Ågren wrote:\n> > Rewrite the loop to a more idiomatic variant which doesn't muck with\n> > `len` in the loop body. That should help compilers and human readers\n> > figure out what is going on here. But do note that we need to update\n> > `len` since it is not only used just after this loop (where we could\n> > have used `i` directly), but also later in this function.\n> >\n> > Signed-off-by: Martin Ågren <martin.agren@gmail.com>\n> > ---\n>\n> ACK. Thanks for cleaning up after me,\n\nLooks good to me, as well. Thanks for working on it.\n"},{"id":"362119","messageId":"CAN0heSoe+R90F4iT_-jE9iyvtB+M+y=U_n-8cUhHyrAh+zN7ng@mail.gmail.com","threadId":"49704","inReplyTo":"CAPig+cR-W1bQ7wY8k8Zok3hCBxHL8uXmUA2p2Tc9pYYXc7Zr+g@mail.gmail.com","subject":"Re: [PATCH v2] sequencer: break out of loop explicitly","fromName":"Martin Ågren","fromEmail":"martin.agren@gmail.com","sentAt":"2018-10-31T18:41:57Z","receivedAt":"2018-10-31T18:42:13Z","isPatch":true,"sender":{"key":"martin.agren@gmail.com","avatar":null},"body":"On Wed, 31 Oct 2018 at 18:28, Eric Sunshine <sunshine@sunshineco.com> wrote:\n>\n> On Wed, Oct 31, 2018 at 10:54 AM Johannes Schindelin\n> <Johannes.Schindelin@gmx.de> wrote:\n\n> > ACK. Thanks for cleaning up after me,\n>\n> Looks good to me, as well. Thanks for working on it.\n\nThanks, both of you.\n\nMartin\n"}]}