Doc. No.: | WG21/N2670 J16/08-0180 |
||
---|---|---|---|
Date: | 2008-06-13 | ||
Revision of: | WG21/N2586 J16/08-0096 |
||
Reply to: | Hans-J. Boehm | Mike Spertus | Clark Nelson |
Phone: | +1-650-857-3406 | ||
Email: | Hans.Boehm@hp.com | mike_spertus@symantec.com | clark.nelson@intel.com |
Its purpose is to support both garbage collected implementations and reachability-based leak detectors. This is done by giving undefined behavior to programs that "hide a pointer" by, for example, xor-ing it with another value, and then later turn it back into an ordinary pointer and dereference it. Such programs may currently produce incorrect results with conservative garbage collectors, since an object referenced only by such a "hidden pointer" may be prematurely collected. For the same reason, reachability-based leak detectors may erroneously report that such programs leak memory.
Note that for programs using the quick_exit() facility ( N2440, voted into the working paper at the Kona meeting), reachability-based leak detectors are arguably the only viable form of leak detection.
For a more general discussion, and the reasons to support transparent garbage collection, please see N2585 and N2310.
Change paragraph 3.9.2p3:3.7.3.3 Safely-derived pointers [basic.stc.dynamic.safety]
A traceable pointer object is:
- an object of pointer-to-object type,
- an object of an integral type that is at least as large as std::intptr_t, or
- a sequence of elements in an array of character type, where the size and alignment of the sequence match that of some pointer-to-object type.
A pointer value is a safely-derived pointer to a dynamic object only if it has pointer-to-object type and it is:
- the value returned by a call to the C++ standard library implementation of
::operator new(std::size_t)
; [ Footnote: This section does not impose restrictions on dereferencing pointers to memory not allocated by::operator new
. This maintains the ability of many C++ implementations to use binary libraries and components written in other languages. In particular, this applies to C binaries, because dereferencing pointers to memory allocated bymalloc
is not restricted. — end footnote ]- the result of taking the address of a subobject of an lvalue resulting from dereferencing a safely-derived pointer value;
- the result of well-defined pointer arithmetic using a safely-derived pointer value;
- the result of a well-defined pointer conversion of a safely-derived pointer value;
- the result of a reinterpret_cast of a safely-derived pointer value;
- the result of a reinterpret_cast of an integer representation of a safely-derived pointer value;
- the value of an object whose value was copied from a traceable pointer object, where at the time of the copy the source object contained a copy of a safely-derived pointer value.
An integer value is an integer representation of a safely-derived pointer only if its type is at least as large as
std::intptr_t
and it is:
- the result of a reinterpret_cast of a safely-derived pointer value;
- the result of a valid conversion of an integer representation of a safely-derived pointer value;
- the value of an object whose value was copied from a traceable pointer object, where at the time of the copy the source object contained an integer representation of a safely-derived pointer value; or
- the result of an additive or bitwise operation, one of whose operands is an integer representation of a safely-derived pointer value P, if that result converted by reinterpret_cast<void *> would compare equal to a safely-derived pointer computable from
reinterpret_cast<void *>(P)
.If a pointer value that is not a safely-derived pointer value is dereferenced or deallocated, and the referenced complete object is of dynamic storage duration and has not previously been declared reachable ([util.declare_reachable]), the behavior is undefined. [ Note: This is true even if the unsafely-derived pointer value might compare equal to some safely-derived pointer value. — end note ]
[...] A valid value of an object pointer type represents either the address of a byte in memory (1.7) or a null pointer (4.10). If an object of typeT
is located at an addressA
, a pointer of type cvT*
whose value is the addressA
is said to point to that object, regardless of how the value was obtained. [ Note:forFor instance, the address one past the end of an array (5.7) would be considered to point to an unrelated object of the array's element type that might be located at that address. There are further restrictions on pointers to objects with dynamic storage duration; see [basic.stc.dynamic.safety]. —end note ] [...]
T *p = new ...; intptr_t x = reinterpret_cast<intptr_t>(p) ^ 0x555; a: T *q = reinterpret_cast<T *>(x ^ 0x555); T y = *q;The newly allocated object N referenced by p is always reachable by the N2310 definition. But at the label a, p is dead, and is quite likely to no longer be visible to the garbage collector, since the register containing p may well have been reused, possibly to hold x. This means that if a garbage collection occurs at point a, N may not appear to be reachable, and thus may be collected anyway.
Objects constructed by the standard library that may hold a user-supplied pointer value, or an integer of type intptr_t, shall store them in a traceable pointer location (see 3.7.3.3). [Note: Other libraries are strongly encouraged to do the same, since not doing so may result in accidental use of pointers that are not safely derived. Libraries that store pointers outside the user's address space should make it appear that they are stored and retrieved from a traceable pointer location. --end note]
Add, possibly between 20.6.7 and 20.6.8:
void declare_reachable( void* p )
- Effects:
- If p is not null, the complete object referenced by p is subsequently declared reachable (see 3.7.3.3).
- Throws:
- May throw std::bad_alloc if the system cannot allocate additional memory that may be required to track objects declared reachable.
- Requires:
- The argument p shall be a safely derived pointer.
template < typename T > T* undeclare_reachable( T* p )
- Returns:
- A safely derived copy of p. The result will compare equal to p.
- Effects:
- Once the number of calls to undeclare_reachable(p) equals the number of calls to declare_reachable(p) for all non-null p referencing the argument is no longer declared reachable (see [above section]). When this happens, pointers to the object referenced by p may not be subsequently dereferenced. [Note: Since the returned pointer is safely derived, it may be used to access the referenced object, even if previously no safely derived pointer existed. -- end note]
- Throws:
- no exceptions
- Requires:
- If p is not null, declare_reachable(p) was previously called, and shall be live from the time of the call until the last undeclare_reachable(p) call on the object.
[Note: It is expected that calls to declare_reachable(p) will consume a small amount of memory until the matching call to undeclare_reachable(p) is encountered. In addition, the referenced object cannot be deallocated during this period, and garbage collecting implementations will not be able to collect the object while it is declared reachable. Long running programs should arrange that calls are matched. -- end note.]
void declare_no_pointers( char* p, size_t n )
- Effects:
- The n bytes starting at p no longer contain traceable pointer locations, independent of their type. Hence pointers located there may not be dereferenced if the object they point to was created by global operator new and not previously declared reachable. [Note: This may be used to inform a garbage collector or leak detector that this region of memory need not be traced.]
- Throws:
- Throws no exceptions. [Note: Under some conditions implementations may need to allocate memory. However the request can be ignored if memory allocation fails. -- end note]
- Requires:
- No bytes in the specified range may have been previously registered with declare_no_pointers(). If the specified range is in an allocated object, then it must be entirely within a single allocated object. The object must be live until the corresponding undeclare_no_pointers() call. [Note: In a garbage-collecting implementation, the fact that a region in an object is registered with declare_no_pointers() should not prevent the object from being collected. --end note]
void undeclare_no_pointers( char* p, size_t n )
- Effects:
- Unregisters a range registered with declare_no_pointers() for destruction. It must be called before the lifetime of the object ends.
- Throws:
- no exceptions
- Requires:
- The same range must previously have been passed to declare_no_pointers().
namespace std { enum class pointer_safety { relaxed, preferred, strict }; }pointer_safety get_pointer_safety()
- Returns:
- Returns an enumeration value indicating the implementation's treatment of pointers that are not safely derived (See 3.7.3.3). Returns pointer_safety::relaxed if pointers that are not safely derived will be treated the same as pointers that are safely derived for the duration of the program. (See 3.7.3.3) Returns pointer_safety::preferred if pointers that are not safely derived will be treated the same as pointers that are safely derived for the duration of the program but allows the implementation to hint that it could be desirable to avoid dereferencing pointers that are not safely derived as described in 3.7.3.3. [Example: pointer_safety::preferred might be returned to detect if a leak detector is running to avoid spurious leak reports.--end example] Returns pointer_safety::strict if pointers that are not safely derived might be treated differently than pointers that are safely derived.
- Throws:
- no exceptions
Add to 20.6.8, between paragraphs 4 and 5:
Storage allocated directly with malloc(), calloc(), or realloc() is implicitly declared reachable (see 3.7.3.3) on allocation, ceases to be declared reachable on deallocation, and may not cease to be declared reachable as the result of an undeclare_reachable() call. [Note: This allows existing C libraries to remain unaffected by restrictions on pointers that are not safely derived, at the expense of providing far fewer garbage collection and leak detection options for malloc()-allocated objects. It also allows malloc() to be implemented with a separate allocation arena, bypassing the normal declare_reachable() implementation. The above functions should never intentionally be used as a replacement for declare_reachable(), and newly written code is strongly encouraged to treat memory allocated with these functions as though it were allocated with operator new. --end note]
Our current implementation strategy is to have declare_no_pointers() simply record its arguments in a data structure that allows efficient lookup of these ranges by address. When an address range is scanned, this data structure can be consulted. For large address ranges the added cost should be minimal, since it is amortized by other scanning overhead. We expect that when scanning small ranges during garbage collection in production code, it may be too expensive to always consult this data structure. In the initial implementation, we will ignore declare_no_pointers calls made on small objects. A better long term strategy would be, for example, to consider the information only on every nth garbage collection. This might cause objects accidentally "referenced" by pointers in such regions to be temporarily retained in spite of the declare_no_pointers calls. But they would not be retained for an unbounded period of time.