Re: [PATCH v2] setup: don't die if realpath(3) fails on getcwd(3)

From: Elijah Newren <newren@gmail.com>
Date: May 28, 2022, 01:27 UTC
Message-ID: <CABPp-BEd9bRuh9ruaDN32RUUT8ZtdQGPefVmiB+HM-gFCdnZ7A@mail.gmail.com>
In-Reply-To: <220527.865ylr4d4g.gmgdl@evledraar.gmail.com>

On Fri, May 27, 2022 at 1:02 AM Ævar Arnfjörð Bjarmason <avarab@gmail.com> wrote:

Show 18 quoted lines

>
>
> On Tue, May 24 2022, Elijah Newren wrote:
>
> > [...] So, I think the signature of free() is just
> > wrong: it should have taken a const void* all along.  Unfortunately,
> > the wrong type signature sadly makes people feel like they have to
> > choose between (a) dropping the added safety of const that the
> > compiler can enforce for you during the lifetime of the variable, or
> > (b) leaking memory you no longer need.
>
> Hrm, don't you mean that it would be better as:
>
>         void free(void *const ptr);
>
> Not:
>
>         void free(const void *ptr);

Nope, I definitely meant the latter; the stuff pointed to is const, not the pointer itself.

In fact, I don't see any point at all in the former; with the free() that exists today:

    void free(void *ptr)

I can pass it a "void * const myptr" already without problems, because free's ptr parameter will be a copy of myptr, and thus modifying ptr cannot affect myptr. So such a call signature change could not possibly provide any benefit to the outside caller. But that call signature change could hinder the actual implementation of free() for some folks (particularly if a given implementation of free() keeps extra data near the allocated block with information about the size of the block and the next allocated block in the list).

In contrast, I cannot pass a "const void *myptr" or "const char *myptr" to free(), but only because of the current type signature; free() doesn't actually modify any of the contents the pointer points to. (And if you want to claim that free effectively does modify what myptr points to because someone else could allocate that same memory, remember that use-after-free is undefined regardless of whether the data pointed to is const or not, and thus you cannot access that data after free with or without the const.) So, free()'s real type that it acts on is a const void *. Sadly, the declared type signature is rather void *, which unnecessarily forces users to cast their types when calling.