Skip to content

[spec/function] Specify null dereference behavior for @safe code #4239

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[spec/function] Specify null dereference behavior for @safe code #4239

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 19 additions & 3 deletions spec/function.dd
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4069,15 +4069,15 @@ $(H3 $(LNAME2 safe-values, Safe Values))

$(P A pointer is a safe value when it is one of:)
$(OL
$(LI `null`)
$(LI `null` - $(RELATIVE_LINK2 null-dereferences, see below))
$(LI it points to a memory object that is live and
the pointed to value in that memory object is safe.)
)
$(P Examples:)
$(SPEC_RUNNABLE_EXAMPLE_RUN
---
int* n = null; /* n is safe because dereferencing null is a well-defined
crash. */
int* n = null; /* n is safe because dereferencing null must either crash
or abort. */
int* x = cast(int*) 0xDEADBEEF; /* x is (most likely) unsafe because it
is not a valid pointer and cannot be dereferenced. */

Expand Down Expand Up @@ -4169,6 +4169,22 @@ $(H3 $(LNAME2 safe-values, Safe Values))
expected by the function.)
)

$(H3 $(LNAME2 null-dereferences, Null Dereferences))

$(P When generating `@safe` code, a compliant implementation:)

- Must not assume that a null dereference will not occur. Optimizations
that require that assumption cannot be used for `@safe` functions.
- Must generate code that will detect and abort execution:
- When a null dereference occurs on systems that by default do not protect
access to the first page of memory addresses. (Note that e.g. calling
[`mprotect`](https://pubs.opengroup.org/onlinepubs/007904875/functions/mprotect.html)
is `@system`).
- On all systems when an expression causes a null pointer to be indexed,
causing a memory access that is not prevented by the system.
$(RED Warning:) $(TT dmd)
[has not implemented](https://github.com/dlang/dmd/issues/17776) this yet.

$(H3 $(LNAME2 safe-aliasing, Safe Aliasing))

$(P When one memory location is accessible with two different types, that
Expand Down