Use clang's nullability instead of nonnull.
http://clang.llvm.org/docs/AttributeReference.html#nonnull
_Nonnull is similar to the nonnull attribute in that it will instruct
compilers to warn the user if it can prove that a null argument is
being passed. Unlike the nonnull attribute, this annotation indicated
that a value *should not* be null, not that it *cannot* be null, or
even that the behavior is undefined. The important distinction is that
the optimizer will perform surprising optimizations like the
following:
void foo(void*) __attribute__(nonnull, 1);
int bar(int* p) {
foo(p);
// The following null check will be elided because nonnull
// attribute means that, since we call foo with p, p can be
// assumed to not be null. Thus this will crash if we are called
// with a null pointer.
if (src != NULL) {
return *p;
}
return 0;
}
int main() {
return bar(NULL);
}
Note that by doing this we are no longer attaching any sort of
attribute for GCC (GCC doesn't support attaching nonnull directly to a
parameter, only to the function and naming the arguments
positionally). This means we won't be getting a warning for this case
from GCC any more. People that listen to warnings tend to use clang
anyway, and we're quickly moving toward that as the default, so this
seems to be an acceptable tradeoff.
Change-Id: Ie05fe7cec2f19a082c1defb303f82bcf9241b88d
diff --git a/libc/include/sys/cdefs.h b/libc/include/sys/cdefs.h
index 3fcf163..7b06967 100644
--- a/libc/include/sys/cdefs.h
+++ b/libc/include/sys/cdefs.h
@@ -159,6 +159,38 @@
#define __nonnull(args) __attribute__((__nonnull__ args))
+/*
+ * _Nonnull is similar to the nonnull attribute in that it will instruct
+ * compilers to warn the user if it can prove that a null argument is being
+ * passed. Unlike the nonnull attribute, this annotation indicated that a value
+ * *should not* be null, not that it *cannot* be null, or even that the behavior
+ * is undefined. The important distinction is that the optimizer will perform
+ * surprising optimizations like the following:
+ *
+ * void foo(void*) __attribute__(nonnull, 1);
+ *
+ * int bar(int* p) {
+ * foo(p);
+ *
+ * // The following null check will be elided because nonnull attribute
+ * // means that, since we call foo with p, p can be assumed to not be
+ * // null. Thus this will crash if we are called with a null pointer.
+ * if (src != NULL) {
+ * return *p;
+ * }
+ * return 0;
+ * }
+ *
+ * int main() {
+ * return bar(NULL);
+ * }
+ *
+ * http://clang.llvm.org/docs/AttributeReference.html#nonnull
+ */
+#if !(defined(__clang__) && __has_feature(nullability))
+#define _Nonnull
+#endif
+
#define __printflike(x, y) __attribute__((__format__(printf, x, y))) __nonnull((x))
#define __scanflike(x, y) __attribute__((__format__(scanf, x, y))) __nonnull((x))
diff --git a/libc/include/sys/signalfd.h b/libc/include/sys/signalfd.h
index 5b67822..084a528 100644
--- a/libc/include/sys/signalfd.h
+++ b/libc/include/sys/signalfd.h
@@ -35,7 +35,7 @@
__BEGIN_DECLS
-extern int signalfd(int fd, const sigset_t* mask, int flags) __nonnull((2)) __INTRODUCED_IN(21);
+extern int signalfd(int fd, const sigset_t* _Nonnull mask, int flags) __INTRODUCED_IN(21);
__END_DECLS
diff --git a/libc/include/sys/statvfs.h b/libc/include/sys/statvfs.h
index e12f069..1f00b9d 100644
--- a/libc/include/sys/statvfs.h
+++ b/libc/include/sys/statvfs.h
@@ -59,12 +59,12 @@
#define ST_NODIRATIME 0x0800
#define ST_RELATIME 0x1000
-extern int statvfs(const char* __restrict, struct statvfs* __restrict) __nonnull((1, 2))
+extern int statvfs(const char* __restrict _Nonnull, struct statvfs* __restrict _Nonnull)
__INTRODUCED_IN(21);
-extern int statvfs64(const char* __restrict, struct statvfs64* __restrict) __nonnull((1, 2))
+extern int statvfs64(const char* __restrict _Nonnull, struct statvfs64* __restrict _Nonnull)
__INTRODUCED_IN(21);
-extern int fstatvfs(int, struct statvfs*) __nonnull((2)) __INTRODUCED_IN(21);
-extern int fstatvfs64(int, struct statvfs64*) __nonnull((2)) __INTRODUCED_IN(21);
+extern int fstatvfs(int, struct statvfs* _Nonnull) __INTRODUCED_IN(21);
+extern int fstatvfs64(int, struct statvfs64* _Nonnull) __INTRODUCED_IN(21);
__END_DECLS
diff --git a/libc/include/sys/swap.h b/libc/include/sys/swap.h
index b1f9295..fe14a30 100644
--- a/libc/include/sys/swap.h
+++ b/libc/include/sys/swap.h
@@ -38,8 +38,8 @@
#define SWAP_FLAG_PRIO_MASK 0x7fff
#define SWAP_FLAG_PRIO_SHIFT 0
-extern int swapon(const char*, int) __nonnull((1)) __INTRODUCED_IN(21);
-extern int swapoff(const char*) __nonnull((1)) __INTRODUCED_IN(21);
+extern int swapon(const char* _Nonnull, int) __INTRODUCED_IN(21);
+extern int swapoff(const char* _Nonnull) __INTRODUCED_IN(21);
__END_DECLS
diff --git a/libc/include/sys/vfs.h b/libc/include/sys/vfs.h
index 9f04b28..bf094dc 100644
--- a/libc/include/sys/vfs.h
+++ b/libc/include/sys/vfs.h
@@ -137,10 +137,10 @@
#define XENIX_SUPER_MAGIC 0x012FF7B4
#define XFS_SUPER_MAGIC 0x58465342
-extern int statfs(const char*, struct statfs*) __nonnull((1, 2));
-extern int statfs64(const char*, struct statfs64*) __nonnull((1, 2)) __INTRODUCED_IN(21);
-extern int fstatfs(int, struct statfs*) __nonnull((2));
-extern int fstatfs64(int, struct statfs64*) __nonnull((2)) __INTRODUCED_IN(21);
+extern int statfs(const char* _Nonnull, struct statfs* _Nonnull);
+extern int statfs64(const char* _Nonnull, struct statfs64* _Nonnull) __INTRODUCED_IN(21);
+extern int fstatfs(int, struct statfs* _Nonnull);
+extern int fstatfs64(int, struct statfs64* _Nonnull) __INTRODUCED_IN(21);
__END_DECLS