Add support for safety checks for pointers from cpp1

filipsajdak · filipsajdak · commit 020e78180e32 · 2022-12-10T22:21:40.000+01:00
diff --git a/include/cpp2util.h b/include/cpp2util.h
@@ -203,6 +203,7 @@
     #include <cstddef>
     #include <utility>
     #include <cstdio>
+    #include <span>
 
     #if defined(CPP2_USE_SOURCE_LOCATION)
         #include <source_location>
@@ -498,6 +499,135 @@ class out {
 }(PARAM1)
 //--------------------------------------------------------------------
 
+//-----------------------------------------------------------------------
+//
+//  cpp2::safety_check() ensures that cpp1 pointers are also covered by safetychecks
+//
+//-----------------------------------------------------------------------
+//
+template <typename... Ts>
+inline constexpr auto program_violates_lifetime_safety_guarantee = sizeof...(Ts) < 0;
+
+template <typename T>
+    requires std::is_pointer_v<T>
+class safetychecked_pointer {
+    T ptr;
+public:
+
+    constexpr safetychecked_pointer(T ptr) : ptr{ptr} {}
+
+    constexpr operator T&() noexcept { return ptr; }
+
+    template <typename... Ts> void operator+  () const {static_assert(program_violates_lifetime_safety_guarantee<Ts...>, "pointer arithmetic is illegal - use std::span or gsl::span instead");}
+    template <typename... Ts> void operator-  () const {static_assert(program_violates_lifetime_safety_guarantee<Ts...>, "pointer arithmetic is illegal - use std::span or gsl::span instead");}
+    template <typename X> void operator+  (X) const {static_assert(program_violates_lifetime_safety_guarantee<X>, "pointer arithmetic is illegal - use std::span or gsl::span instead");}
+    template <typename X> void operator-  (X) const {static_assert(program_violates_lifetime_safety_guarantee<X>, "pointer arithmetic is illegal - use std::span or gsl::span instead");}
+    template <typename X> void operator*  (X) const {static_assert(program_violates_lifetime_safety_guarantee<X>, "pointer arithmetic is illegal - use std::span or gsl::span instead");}
+    template <typename X> void operator/  (X) const {static_assert(program_violates_lifetime_safety_guarantee<X>, "pointer arithmetic is illegal - use std::span or gsl::span instead");}
+    template <typename X> void operator%  (X) const {static_assert(program_violates_lifetime_safety_guarantee<X>, "pointer bitwise manipulation is illegal - use std::bit_cast to convert to raw bytes first");}
+    template <typename X> void operator^  (X) const {static_assert(program_violates_lifetime_safety_guarantee<X>, "pointer bitwise manipulation is illegal - use std::bit_cast to convert to raw bytes first");}
+    template <typename X> void operator&  (X) const {static_assert(program_violates_lifetime_safety_guarantee<X>, "pointer bitwise manipulation is illegal - use std::bit_cast to convert to raw bytes first");}
+    template <typename X> void operator|  (X) const {static_assert(program_violates_lifetime_safety_guarantee<X>, "pointer bitwise manipulation is illegal - use std::bit_cast to convert to raw bytes first");}
+
+    template <typename... Ts> void operator++ (Ts...) const {static_assert(program_violates_lifetime_safety_guarantee<Ts...>, "pointer arithmetic is illegal - use std::span or gsl::span instead");}
+    template <typename... Ts> void operator-- (Ts...) const {static_assert(program_violates_lifetime_safety_guarantee<Ts...>, "pointer arithmetic is illegal - use std::span or gsl::span instead");}
+    template <typename... Ts> void operator[] (Ts...) const {static_assert(program_violates_lifetime_safety_guarantee<Ts...>, "pointer arithmetic is illegal - use std::span or gsl::span instead");}
+    template <typename X> void operator+= (X) const {static_assert(program_violates_lifetime_safety_guarantee<X>, "pointer arithmetic is illegal - use std::span or gsl::span instead");}
+    template <typename X> void operator-= (X) const {static_assert(program_violates_lifetime_safety_guarantee<X>, "pointer arithmetic is illegal - use std::span or gsl::span instead");}
+    template <typename X> void operator*= (X) const {static_assert(program_violates_lifetime_safety_guarantee<X>, "pointer arithmetic is illegal - use std::span or gsl::span instead");}
+    template <typename X> void operator/= (X) const {static_assert(program_violates_lifetime_safety_guarantee<X>, "pointer arithmetic is illegal - use std::span or gsl::span instead");}
+
+    template <typename... Ts> void operator~  ()  const {static_assert(program_violates_lifetime_safety_guarantee<Ts...>, "pointer bitwise manipulation is illegal - use std::bit_cast to convert to raw bytes first");}
+    template <typename    X > void operator%= (X) const {static_assert(program_violates_lifetime_safety_guarantee<X>, "pointer bitwise manipulation is illegal - use std::bit_cast to convert to raw bytes first");}
+    template <typename    X > void operator^= (X) const {static_assert(program_violates_lifetime_safety_guarantee<X>, "pointer bitwise manipulation is illegal - use std::bit_cast to convert to raw bytes first");}
+    template <typename    X > void operator&= (X) const {static_assert(program_violates_lifetime_safety_guarantee<X>, "pointer bitwise manipulation is illegal - use std::bit_cast to convert to raw bytes first");}
+    template <typename    X > void operator|= (X) const {static_assert(program_violates_lifetime_safety_guarantee<X>, "pointer bitwise manipulation is illegal - use std::bit_cast to convert to raw bytes first");}
+    template <typename    X > void operator<<=(X) const {static_assert(program_violates_lifetime_safety_guarantee<X>, "pointer bitwise manipulation is illegal - use std::bit_cast to convert to raw bytes first");}
+    template <typename    X > void operator>>=(X) const {static_assert(program_violates_lifetime_safety_guarantee<X>, "pointer bitwise manipulation is illegal - use std::bit_cast to convert to raw bytes first");}
+    template <typename    X > void operator<< (X) const {static_assert(program_violates_lifetime_safety_guarantee<X>, "pointer bitwise manipulation is illegal - use std::bit_cast to convert to raw bytes first");}
+    template <typename    X > void operator>> (X) const {static_assert(program_violates_lifetime_safety_guarantee<X>, "pointer bitwise manipulation is illegal - use std::bit_cast to convert to raw bytes first");}
+
+    template <typename X > friend void operator+ (X, const safetychecked_pointer&)  {static_assert(program_violates_lifetime_safety_guarantee<X>, "pointer arithmetic is illegal - use std::span or gsl::span instead");}
+    template <typename X > friend void operator- (X, const safetychecked_pointer&)  {static_assert(program_violates_lifetime_safety_guarantee<X>, "pointer arithmetic is illegal - use std::span or gsl::span instead");}
+    template <typename X > friend void operator* (X, const safetychecked_pointer&)  {static_assert(program_violates_lifetime_safety_guarantee<X>, "pointer arithmetic is illegal - use std::span or gsl::span instead");}
+    template <typename X > friend void operator/ (X, const safetychecked_pointer&)  {static_assert(program_violates_lifetime_safety_guarantee<X>, "pointer arithmetic is illegal - use std::span or gsl::span instead");}
+    template <typename X > friend void operator% (X, const safetychecked_pointer&)  {static_assert(program_violates_lifetime_safety_guarantee<X>, "pointer bitwise manipulation is illegal - use std::bit_cast to convert to raw bytes first");}
+    template <typename X > friend void operator^ (X, const safetychecked_pointer&)  {static_assert(program_violates_lifetime_safety_guarantee<X>, "pointer bitwise manipulation is illegal - use std::bit_cast to convert to raw bytes first");}
+    template <typename X > friend void operator& (X, const safetychecked_pointer&)  {static_assert(program_violates_lifetime_safety_guarantee<X>, "pointer bitwise manipulation is illegal - use std::bit_cast to convert to raw bytes first");}
+    template <typename X > friend void operator| (X, const safetychecked_pointer&)  {static_assert(program_violates_lifetime_safety_guarantee<X>, "pointer bitwise manipulation is illegal - use std::bit_cast to convert to raw bytes first");}
+
+
+    template <typename X>
+        requires (std::is_same_v<T,X> || std::is_base_of_v<T, X>)
+    constexpr safetychecked_pointer& operator=(X lhs) noexcept {
+        ptr = lhs;
+        return *this;
+    }
+
+    template <typename X>
+        requires std::is_same_v<std::nullptr_t,X>
+    constexpr void operator=(X lhs) noexcept { static_assert(program_violates_lifetime_safety_guarantee<X>, "pointer assignment from null is illegal"); }
+
+    template <typename X>
+        requires std::is_integral_v<X>
+    constexpr void operator=(X lhs) noexcept { static_assert(program_violates_lifetime_safety_guarantee<X>, "pointer assignment from integer is illegal"); }
+
+    bool operator!() const { return !ptr; }
+
+    constexpr safetychecked_pointer<T*> operator&() noexcept { return &ptr; }
+
+    constexpr auto operator*() noexcept {
+        if constexpr (std::is_pointer_v<CPP2_TYPEOF(*ptr)>) {
+            return safetychecked_pointer<CPP2_TYPEOF(*ptr)>(*ptr);
+        } else {
+            return *ptr;
+        }
+    }
+
+    constexpr T operator->() const noexcept { return ptr; }
+};
+
+template <typename X>
+    requires ( !std::is_pointer_v<std::remove_cvref_t<X>>
+               && std::is_copy_constructible_v<X> )
+inline constexpr auto safety_check(X const& x) {
+    return x;
+}
+
+template <typename R, typename... Args>
+inline constexpr auto safety_check(R (&x)(Args...)) {
+    return x;
+}
+
+template <typename X>
+    requires std::is_rvalue_reference_v<X>
+inline constexpr decltype(auto) safety_check(X&& x) {
+    return std::forward<X>(x);
+}
+
+template <typename X>
+    requires (std::is_pointer_v<std::remove_cvref_t<X>> && !std::is_bounded_array_v<X>)
+inline constexpr auto safety_check(X const& x) {
+    return safetychecked_pointer(x);
+}
+
+template <typename X>
+    requires (!std::is_pointer_v<std::remove_cvref_t<X>> && !std::is_function_v<X> && !std::is_bounded_array_v<X>)
+inline constexpr auto& safety_check(X& x) {
+    return x;
+}
+
+template <typename X>
+    requires (!std::is_copy_constructible_v<X>)
+inline constexpr auto safety_check(X&& x) {
+    return std::forward<X>(x);
+}
+
+template <typename X>
+    requires std::is_bounded_array_v<X>
+inline constexpr auto safety_check(X const& x) {
+    return std::span(x);
+}
 
 //-----------------------------------------------------------------------
 //
diff --git a/regression-tests/test-results/pure2-intro-example-hello-2022.cpp b/regression-tests/test-results/pure2-intro-example-hello-2022.cpp
@@ -19,7 +19,7 @@ auto println(auto const& x, auto const& len) -> void;
     std::span view { vec }; 
 
     for ( auto&& cpp2_range = view;  auto& str : cpp2_range ) {
-        auto len { decorate(str) }; 
+        auto len { cpp2::safety_check(decorate(str)) }; 
         println(str, len);
     }
 }
diff --git a/regression-tests/test-results/pure2-stdio.cpp b/regression-tests/test-results/pure2-stdio.cpp
@@ -16,7 +16,7 @@
 //
 [[nodiscard]] auto main() -> int{
     std::string s { "Fred" }; 
-    auto myfile { fopen("xyzzy", "w") }; 
+    auto myfile { cpp2::safety_check(fopen("xyzzy", "w")) }; 
     CPP2_UFCS(fprintf, myfile, "Hello %s with UFCS!", CPP2_UFCS_0(c_str, s));
     CPP2_UFCS_0(fclose, myfile);
 }
diff --git a/source/cppfront.cpp b/source/cppfront.cpp
@@ -621,6 +621,7 @@ class cppfront
     bool violates_bounds_safety          = false;
     bool violates_initialization_safety  = false;
     bool suppress_move_from_last_use     = false;
+    bool needs_safetycheck               = false;
 
     //  For lowering
     //
@@ -1091,7 +1092,7 @@ class cppfront
 
         in_definite_init = is_definite_initialization(n.identifier);
         if (!in_definite_init && !in_parameter_list) {
-            if (auto decl = sema.get_local_declaration_of(*n.identifier);
+            if (auto decl = sema.get_declaration_of(*n.identifier);
                 is_local_name &&
                 decl &&
                 //  note pointer equality: if we're not in the actual declaration of n.identifier
@@ -1564,10 +1565,10 @@ class cppfront
             return true;
 
         if (decl->declaration->dereference) {
-            auto deref = sema.get_local_declaration_of(*decl->declaration->dereference);
+            auto deref = sema.get_declaration_of(*decl->declaration->dereference);
             return is_it_pointer_declaration(deref, deref_cnt+decl->declaration->dereference_cnt, addr_cnt);
         } else if (decl->declaration->address_of) {
-            auto addr = sema.get_local_declaration_of(*decl->declaration->address_of);
+            auto addr = sema.get_declaration_of(*decl->declaration->address_of);
             return is_it_pointer_declaration(addr, deref_cnt, addr_cnt+1);
         }
 
@@ -1590,6 +1591,7 @@ class cppfront
     {
         assert(n.expr);
         last_postfix_expr_was_pointer = false;
+        bool add_safetycheck = false;
 
         //  Check that this isn't pointer arithmentic
         //      (initial partial implementation)
@@ -1601,7 +1603,7 @@ class cppfront
             {
                 auto& unqual = std::get<id_expression_node::unqualified>(id->id);
                 assert(unqual);
-                auto decl = sema.get_local_declaration_of(*unqual->identifier);
+                auto decl = sema.get_declaration_of(*unqual->identifier, true);
 
                 bool is_pointer = false;
                 if (decl && decl->declaration) {
@@ -1612,8 +1614,8 @@ class cppfront
                     }
                 }
 
-                //  TODO: Generalize this -- for now we detect only multi-level cases of the form "p: ***int = ...;"
-                //        We don't recognize pointer types that are deduced or from Cpp1
+                // if initialized by something suspicious (that we have no information about) we need to add cpp1 safety checks
+                add_safetycheck = !decl && needs_safetycheck;
                 if (is_it_pointer_declaration(decl) || !unqual->pointer_declarators.empty() || is_pointer) {
                     if (n.ops.empty()) {
                         last_postfix_expr_was_pointer = true;
@@ -1641,6 +1643,16 @@ class cppfront
             }
         }
 
+        std::shared_ptr<void> _on_return;
+
+        if (add_safetycheck) {
+            needs_safetycheck = false;
+            printer.print_cpp2("cpp2::safety_check(", n.position());
+            _on_return = [](auto l) { return std::shared_ptr<void>(nullptr, l); }([&](auto){
+                printer.print_cpp2(")", n.position());
+            });
+        }
+
         //  Simple case: If there are no .ops, just emit the expression
         if (n.ops.empty()) {
             emit(*n.expr);
@@ -2592,7 +2604,9 @@ class cppfront
 
                 push_need_expression_list_parens(false);
                 assert( n.initializer );
+                needs_safetycheck = n.initializer->suspicious_initialization;
                 emit( *n.initializer, false );
+                needs_safetycheck = false;
                 pop_need_expression_list_parens();
 
                 printer.print_cpp2( " }", n.position() );
diff --git a/source/parse.h b/source/parse.h
@@ -693,6 +693,7 @@ struct statement_node
 {
     token const*                                     let;
     std::unique_ptr<parameter_declaration_list_node> let_params;
+    token const*                                     suspicious_initialization = nullptr;
 
     enum active { expression=0, compound, selection, declaration, return_, iteration, contract, inspect };
     std::variant<
@@ -2880,6 +2881,8 @@ class parser
                 }
             }
 
+            token const* suspicious_initialization  = nullptr;
+
             if (deduced_type) {
                 if (peek(1)->type() == lexeme::Ampersand) {
                     n->address_of  = &curr();
@@ -2890,13 +2893,19 @@ class parser
                     while(peek(n->dereference_cnt+1)->type() == lexeme::Multiply) {
                         n->dereference_cnt += 1;
                     }
+                } 
+                else if ((peek(1)->type() == lexeme::LeftParen && curr().type() != lexeme::Colon)
+                            || curr().type() == lexeme::Identifier ) {
+                    suspicious_initialization = &curr();
                 }
             }
 
             if (!(n->initializer = statement(semicolon_required, n->equal_sign))) {
                 error("ill-formed initializer");
                 next();
                 return {};
+            } else {
+                n->initializer->suspicious_initialization = suspicious_initialization;
             }
         }
 
diff --git a/source/sema.h b/source/sema.h
@@ -226,9 +226,8 @@ class sema
     {
     }
 
-    //  Get the declaration of t within the same named function
-    //
-    auto get_local_declaration_of(token const& t) -> declaration_sym const*
+
+    auto get_declaration_of(token const& t, bool look_beyond_current_function = false) -> declaration_sym const*
     {
         //  First find the position the query is coming from
         //  and remember its depth
@@ -255,9 +254,11 @@ class sema
                 //  Don't look beyond the start of the current named (has identifier) function
                 //  (an unnamed function is ok to look beyond)
                 assert(decl.declaration);
-                if (decl.declaration->type.index() == declaration_node::function &&
-                    decl.declaration->identifier)
-                {
+                if (
+                    decl.declaration->type.index() == declaration_node::function
+                    && decl.declaration->identifier
+                    && !look_beyond_current_function
+                ) {
                     return nullptr;
                 }
 
@@ -895,7 +896,7 @@ class sema
         {
             //  Put this into the table if it's a use of an object in scope
             //  or it's a 'copy' parameter
-            if (auto decl = get_local_declaration_of(t);
+            if (auto decl = get_declaration_of(t);
                 decl
                 )
             {

Original file line number	Diff line number	Diff line change
`@@ -19,7 +19,7 @@ auto println(auto const& x, auto const& len) -> void;`
`19`	`19`	`std::span view { vec };`
`20`	`20`
`21`	`21`	`for ( auto&& cpp2_range = view; auto& str : cpp2_range ) {`
`22`		`- auto len { decorate(str) };`
	`22`	`+ auto len { cpp2::safety_check(decorate(str)) };`
`23`	`23`	`println(str, len);`
`24`	`24`	`}`
`25`	`25`	`}`
Original file line number	Diff line number	Diff line change
`@@ -16,7 +16,7 @@`
`16`	`16`	`//`
`17`	`17`	`[[nodiscard]] auto main() -> int{`
`18`	`18`	`std::string s { "Fred" };`
`19`		`- auto myfile { fopen("xyzzy", "w") };`
	`19`	`+ auto myfile { cpp2::safety_check(fopen("xyzzy", "w")) };`
`20`	`20`	`CPP2_UFCS(fprintf, myfile, "Hello %s with UFCS!", CPP2_UFCS_0(c_str, s));`
`21`	`21`	`CPP2_UFCS_0(fclose, myfile);`
`22`	`22`	`}`
Original file line number	Diff line number	Diff line change
`@@ -693,6 +693,7 @@ struct statement_node`
`693`	`693`	`{`
`694`	`694`	`token const* let;`
`695`	`695`	`std::unique_ptr<parameter_declaration_list_node> let_params;`
	`696`	`+ token const* suspicious_initialization = nullptr;`
`696`	`697`
`697`	`698`	`enum active { expression=0, compound, selection, declaration, return_, iteration, contract, inspect };`
`698`	`699`	`std::variant<`
`@@ -2880,6 +2881,8 @@ class parser`
`2880`	`2881`	`}`
`2881`	`2882`	`}`
`2882`	`2883`
	`2884`	`+ token const* suspicious_initialization = nullptr;`
	`2885`	`+`
`2883`	`2886`	`if (deduced_type) {`
`2884`	`2887`	`if (peek(1)->type() == lexeme::Ampersand) {`
`2885`	`2888`	`n->address_of = &curr();`
`@@ -2890,13 +2893,19 @@ class parser`
`2890`	`2893`	`while(peek(n->dereference_cnt+1)->type() == lexeme::Multiply) {`
`2891`	`2894`	`n->dereference_cnt += 1;`
`2892`	`2895`	`}`
	`2896`	`+ }`
	`2897`	`+ else if ((peek(1)->type() == lexeme::LeftParen && curr().type() != lexeme::Colon)`
	`2898`	`+ \|\| curr().type() == lexeme::Identifier ) {`
	`2899`	`+ suspicious_initialization = &curr();`
`2893`	`2900`	`}`
`2894`	`2901`	`}`
`2895`	`2902`
`2896`	`2903`	`if (!(n->initializer = statement(semicolon_required, n->equal_sign))) {`
`2897`	`2904`	`error("ill-formed initializer");`
`2898`	`2905`	`next();`
`2899`	`2906`	`return {};`
	`2907`	`+ } else {`
	`2908`	`+ n->initializer->suspicious_initialization = suspicious_initialization;`
`2900`	`2909`	`}`
`2901`	`2910`	`}`
`2902`	`2911`
Original file line number	Diff line number	Diff line change
`@@ -226,9 +226,8 @@ class sema`
`226`	`226`	`{`
`227`	`227`	`}`
`228`	`228`
`229`		`- // Get the declaration of t within the same named function`
`230`		`- //`
`231`		`- auto get_local_declaration_of(token const& t) -> declaration_sym const*`
	`229`	`+`
	`230`	`+ auto get_declaration_of(token const& t, bool look_beyond_current_function = false) -> declaration_sym const*`
`232`	`231`	`{`
`233`	`232`	`// First find the position the query is coming from`
`234`	`233`	`// and remember its depth`
`@@ -255,9 +254,11 @@ class sema`
`255`	`254`	`// Don't look beyond the start of the current named (has identifier) function`
`256`	`255`	`// (an unnamed function is ok to look beyond)`
`257`	`256`	`assert(decl.declaration);`
`258`		`- if (decl.declaration->type.index() == declaration_node::function &&`
`259`		`- decl.declaration->identifier)`
`260`		`- {`
	`257`	`+ if (`
	`258`	`+ decl.declaration->type.index() == declaration_node::function`
	`259`	`+ && decl.declaration->identifier`
	`260`	`+ && !look_beyond_current_function`
	`261`	`+ ) {`
`261`	`262`	`return nullptr;`
`262`	`263`	`}`
`263`	`264`
`@@ -895,7 +896,7 @@ class sema`
`895`	`896`	`{`
`896`	`897`	`// Put this into the table if it's a use of an object in scope`
`897`	`898`	`// or it's a 'copy' parameter`
`898`		`- if (auto decl = get_local_declaration_of(t);`
	`899`	`+ if (auto decl = get_declaration_of(t);`
`899`	`900`	`decl`
`900`	`901`	`)`
`901`	`902`	`{`