Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use compile-time bounds checking when possible #137

Merged
merged 2 commits into from
Nov 28, 2023

Conversation

tcbrindle
Copy link
Owner

We know that the compiler, when optimising, can remove runtime bounds checks when it can prove that they will never fail.

If would be nice if we could have the converse as well: if the compiler can prove that a "runtime" bounds check is certain to fail, then that should be a compile error.

And that's what this PR does. It uses GCC's __builtin_constant_p to ask whether the index and size parameters are known constants, and if they are (and the bounds check fails) it tries to call the flux::static_bound_check_failed() function. This function is undefined, but more importantly it's marked with the [[gnu::error]] attribute, meaning that we'll get a compile error rather than a linker error, hopefully with a nice backtrace.

This works with GCC and Clang, at -O1 or above (presumably, when enough constant-folding happens in the front end). Otherwise, we'll get a runtime error as normal.

The extra checks can be disabled by defining FLUX_DISABLE_STATIC_BOUNDS_CHECKING before #include-ing Flux.

Thanks to @mattkretz for showing me this trick and suggesting I use it in Flux!

We know that the compiler, when optimising, can remove runtime bounds checks when it can prove that they will never fail.

If would be nice if we could have the converse as well: if the compiler can prove that a "runtime" bounds check is certain to fail, then that should be a compile error.

And that's what this PR does. It uses GCC's __builtin_constant_p to ask whether the index and size parameters are known constants, and if they are (and the bounds check fails) it tries to call the flux::static_bound_check_failed() function. This function is undefined, but more importantly it's marked with the [[gnu::error]] attribute, meaning that we'll get a compile error rather than a linker error, hopefully with a nice backtrace.

This works with GCC and Clang,  at -O1 or above (presumably, when enough constant-folding happens in the front end). Otherwise, we'll get a runtime error as normal.

The extra checks can be disabled by defining `FLUX_DISABLE_STATIC_BOUNDS_CHECKING` before #include-ing Flux.

Thanks to @mattkretz for showing me this trick and suggesting I use it in Flux!
Copy link

codecov bot commented Nov 28, 2023

Codecov Report

All modified and coverable lines are covered by tests ✅

Comparison is base (7b4cdf6) 97.70% compared to head (78cef5f) 97.71%.
Report is 1 commits behind head on main.

Additional details and impacted files
@@           Coverage Diff           @@
##             main     #137   +/-   ##
=======================================
  Coverage   97.70%   97.71%           
=======================================
  Files          67       67           
  Lines        2400     2402    +2     
=======================================
+ Hits         2345     2347    +2     
  Misses         55       55           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

...otherwise trying to test our bounds checks fails to compile in release mode. Things working a bit too well...
@tcbrindle tcbrindle merged commit fbd10d1 into main Nov 28, 2023
27 checks passed
@tcbrindle tcbrindle deleted the pr/static_bounds_checks branch December 8, 2023 16:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant