9

This is going to be a long, language lawyerish question, so I'd like to quickly state why I find it relevant. I am working on a project where strict standard compliance is crucial (writing a language that compiles to C). The example I am going to give seems like a standard violation on the part of clang, and so, if this is the case, I'd like to confirm it.

gcc says that a conditional with a pointer to a restrict qualified pointer can not co-inhabit a conditional statement with a void pointer. On the other hand, clang compiles such things fine. Here is an example program:

#include <stdlib.h>

int main(void){
   int* restrict* A = malloc(8);
   A ? A : malloc(8);
   return 0;
   }

For gcc, the options -std=c11 and -pedantic may be included or not in any combination, likewise for clang and the options -std=c11 and -Weverything. In any case, clang compiles with no errors, and gcc gives the following:

tem-2.c: In function ‘main’:
tem-2.c:7:2: error: invalid use of ‘restrict’
  A ? A : malloc(8);
  ^

The c11 standard says the following with regard to conditional statements, emphasis added:

6.5.15 Conditional operator

...

  1. One of the following shall hold for the second and third operands:

— both operands have arithmetic type;

— both operands have the same structure or union type;

— both operands have void type;

— both operands are pointers to qualified or unqualified versions of compatible types;

— one operand is a pointer and the other is a null pointer constant; or

one operand is a pointer to an object type and the other is a pointer to a qualified or unqualified version of void.

...

  1. If both the second and third operands are pointers or one is a null pointer constant and the other is a pointer, the result type is a pointer to a type qualified with all the type qualifiers of the types referenced by both operands. Furthermore, if both operands are pointers to compatible types or to differently qualified versions of compatible types, the result type is a pointer to an appropriately qualified version of the composite type; if one operand is a null pointer constant, the result has the type of the other operand; otherwise, one operand is a pointer to void or a qualified version of void, in which case the result type is a pointer to an appropriately qualified version of void.

...

The way I see it, the first bold portion above says that the two types can go together, and the second bold portion defines the result to be a pointer to a restrict qualified version of void. However, as the following states, this type can not exist, and so the expression is correctly identified as erroneous by gcc:

6.7.3 Type qualifiers, paragraph 2

Types other than pointer types whose referenced type is an object type shall not be restrict-qualified.

Now, the problem is that a "shall not" condition is violated by this example program, and so is required to produce an error, by the following:

5.1.1.3 Diagnostics, paragraph 1

A conforming implementation shall produce at least one diagnostic message (identified in an implementation-defined manner) if a preprocessing translation unit or translation unit contains a violation of any syntax rule or constraint, even if the behavior is also explicitly specified as undefined or implementation-defined. Diagnostic messages need not be produced in other circumstances.

It seems clang is not standard compliant by treating an erroneous type silently. That makes me wonder what else clang does silently.

I am using gcc version 5.4.0 and clang version 3.8.0, on an x86-64 Ubuntu machine.

3
  • You might be right... but if you cast the result of the malloc() in the conditional so that the third operand is no longer a pointer to void, the error disappears.
    – Dmitri
    Commented Jul 28, 2016 at 21:06
  • If I were you, I would be inclined to avoid using restrict in the C code emitted by my project's to-C compiler. How much additional optimization could be enabled via restrict qualification, how much would actually be performed by any given compiler, and how much more performant the result might be are all unclear. On the other hand, by using restrict qualifiers, your code takes on additional obligations that it must satisfy to avoid undefined behavior, and not all of these can be checked by the compiler. I just don't see the reward, if any, justifying the risk. Commented Jul 28, 2016 at 22:02
  • @JohnBollinger, the language is very performance oriented, so I do think it would probably be unacceptable to take the performance hit. I have written a formal model of an exact way to use a subset of C for the emitted code which, together with constraints defined for the language, formally proves adherence to the definition of restrict in the C standard. In other words, requiring this small list of rules for the programmer allows the compiler to do all else to ensure correctness. You are right about the extra obligations though, it has been a lot of work!
    – Kyle
    Commented Jul 28, 2016 at 22:16

2 Answers 2

6

Yes it looks like a bug.

Your question more briefly: can void be restrict qualified? Since void is clearly not a pointer type, the answer is no. Because this violates a constraint, the compiler should give a diagnostic.

I was able to trick clang to confess its sins by using a _Generic expression

puts(_Generic(A ? A : malloc(8), void* : "void*"));

and clang tells me

static.c:24:18: error: controlling expression type 'restrict void *' not compatible with any generic association type
     puts(_Generic(A ? A : malloc(8), void* : "void*"));

which shows that clang here really tries to match a nonsense type restrict void*.

Please file them a bug report.

1
  • Thanks, I filed a bug report.
    – Kyle
    Commented Jul 28, 2016 at 21:51
0

While a compiler could satisfy all obligations surrounding restrict by ignoring the qualifier altogether, a compiler which wants to keep track of what it is or is not allowed to do needs to keep track of which pointers hold copies of restrict pointers. Given something like:

int *foo;
int *bar;
int wow(int *restrict p)
{
  foo = p;
  ...
  *p = 123;
  *foo = 456;
  *p++;
  *bar = 890;
  return *p;
}

since foo is derived from p, a compiler must allow for accesses made via foo to alias accesses via p. A compiler need not make such allowances for accesses made via bar, since that is known not to hold an address derived from p.

The rules surrounding restrict get murky in cases where a pointer may or may not be derived from another. A compiler would certainly be allowed to simply ignore a restrict qualifier in cases where it can't track all of the pointers derived from a pointer; I'm not sure if any such cases would invoke UB even if nothing ever modifies the storage identified by the pointer. If a syntactic construct is structurally guaranteed to invoke UB, having a compiler squawk may be more useful than having it act in an arbitrary fashion (though having a compiler simply ignore any restrict qualifiers it can't fully handle might be more useful yet).

16
  • Thanks for your response, but I'm not sure I understand. The problem is that the standard requires a diagnostic message in the case of a violation of syntax, which includes the use of an explicitly disallowed type. Clang does not provide that message. No compliant approach to the restrict qualifier alleviates the implementation of the responsibility of providing that message. In other words, the qualifier can be ignored by the implementation, but only when used in syntactically correct settings; incorrect uses would need to be reported even by an implementation that ignores the qualifier.
    – Kyle
    Commented Aug 3, 2016 at 4:50
  • @Kyle: An "int*" is an object, as is an int* restrict the phrase "pointer types whose referenced type is an object type" essentially means "pointer that is not a function pointer", and an int* restrict clearly meets that requirement. The return from malloc is a void*. The conditional operator is being used on a pointer to an object (of type int *restrict) and a void*. I really don't see anything syntactically wrong here. The Standard lacks the terminology to say what I think the authors intended, which would be that...
    – supercat
    Commented Aug 3, 2016 at 14:22
  • ...implementations have no obligation to process programs that use restrict in any fashion other than what's mandated by the Standard, and must issue a diagnostic if a syntax violation would prevent the implementation from processing the source file as defined by the Standard, but need not issue a diagnostic if restrict poses no impediment to processing. From what I can tell, the authors of the Standard wanted restrict to only impose a burden on compilers that could benefit from it, with other implementations being free to essentially ignore it.
    – supercat
    Commented Aug 3, 2016 at 14:29
  • The standard requires that all syntactic errors produce a diagnostic, I do not see anything in the standard supporting that they need not issue a diagnostic for syntactic errors which do not impede processing. In my example, the error is an expression with an invalid type. Perhaps one reason for this is that two implementations might not agree on what impedes processing, and so standard compliance fails to be well defined if a diagnostic is not required. For example, I could compile with Clang and think I have a compliant program, but when someone tries to compile it with gcc, it won't work.
    – Kyle
    Commented Aug 3, 2016 at 16:11
  • 1
    @Kyle: I think I see the issue. 6.5.15 says that the ? :operator must yield an "appropriately-qualified" pointer, but I don't know that anything indicates that restrict would be inherited in this scenario, especially given that applying restrict to the target of void* would be inappropriate.
    – supercat
    Commented Aug 3, 2016 at 18:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.