Use clang's nullability instead of nonnull.
http://clang.llvm.org/docs/AttributeReference.html#nonnull
_Nonnull is similar to the nonnull attribute in that it will instruct
compilers to warn the user if it can prove that a null argument is
being passed. Unlike the nonnull attribute, this annotation indicated
that a value *should not* be null, not that it *cannot* be null, or
even that the behavior is undefined. The important distinction is that
the optimizer will perform surprising optimizations like the
following:
void foo(void*) __attribute__(nonnull, 1);
int bar(int* p) {
foo(p);
// The following null check will be elided because nonnull
// attribute means that, since we call foo with p, p can be
// assumed to not be null. Thus this will crash if we are called
// with a null pointer.
if (src != NULL) {
return *p;
}
return 0;
}
int main() {
return bar(NULL);
}
Note that by doing this we are no longer attaching any sort of
attribute for GCC (GCC doesn't support attaching nonnull directly to a
parameter, only to the function and naming the arguments
positionally). This means we won't be getting a warning for this case
from GCC any more. People that listen to warnings tend to use clang
anyway, and we're quickly moving toward that as the default, so this
seems to be an acceptable tradeoff.
Change-Id: Ie05fe7cec2f19a082c1defb303f82bcf9241b88d
diff --git a/libc/include/sys/cdefs.h b/libc/include/sys/cdefs.h
index 3fcf163..7b06967 100644
--- a/libc/include/sys/cdefs.h
+++ b/libc/include/sys/cdefs.h
@@ -159,6 +159,38 @@
#define __nonnull(args) __attribute__((__nonnull__ args))
+/*
+ * _Nonnull is similar to the nonnull attribute in that it will instruct
+ * compilers to warn the user if it can prove that a null argument is being
+ * passed. Unlike the nonnull attribute, this annotation indicated that a value
+ * *should not* be null, not that it *cannot* be null, or even that the behavior
+ * is undefined. The important distinction is that the optimizer will perform
+ * surprising optimizations like the following:
+ *
+ * void foo(void*) __attribute__(nonnull, 1);
+ *
+ * int bar(int* p) {
+ * foo(p);
+ *
+ * // The following null check will be elided because nonnull attribute
+ * // means that, since we call foo with p, p can be assumed to not be
+ * // null. Thus this will crash if we are called with a null pointer.
+ * if (src != NULL) {
+ * return *p;
+ * }
+ * return 0;
+ * }
+ *
+ * int main() {
+ * return bar(NULL);
+ * }
+ *
+ * http://clang.llvm.org/docs/AttributeReference.html#nonnull
+ */
+#if !(defined(__clang__) && __has_feature(nullability))
+#define _Nonnull
+#endif
+
#define __printflike(x, y) __attribute__((__format__(printf, x, y))) __nonnull((x))
#define __scanflike(x, y) __attribute__((__format__(scanf, x, y))) __nonnull((x))