P2013R2
Freestanding Language: Optional ::operator new

1. Revision History

1.1. R2

Added words in the design to indicate that the declarations in <new> are not changing.

Mentioning that pointer safety remains unchanged.

1.2. R1

Added discussion on feature test macro.

Added discussion on not fixing virtual destructors.

Declaring that constexpr new must continue to work.

Added wording.

Wording includes changes to library clauses, so added LEWG to the audience.

1.3. R0

The proposed solution is different than the one proposed for P1105R1, but the motivation is the same. The solution from P1105R1 is still listed as a design alternative.

2. What is changing

As a consequence of the above, coroutines that are relying on the global allocation functions will be ill-formed so long as those global allocation functions are not present.

No other core language features require ::operator new. basic.stc.dynamic.allocation

::operator delete will be implementable as a no-op function on implementations that do not provide a default ::operator new.

3. What is staying the same

Calling ::operator delete on a non-null pointer that did not come from ::operator new is still undefined behavior new.delete.single new.delete.array. Calling delete on an object or base that didn’t come from new is still undefined behavior expr.delete. This is what makes a no-op ::operator delete a valid strategy on implementations without a global ::operator new.

The replaceable allocation functions will still be implicitly declared at global scope in each translation unit basic.stc.dynamic. Non-ODR-uses of the replaceable allocation functions are still permitted (e.g. inside of uninstantiated templates). The declarations of ::operator new in the <new> header are still required to be present. Implementations of the replaceable allocation functions can be performed by linking in an extra translation-unit with the definitions of the functions. Since this replacement typically happens at link time, ODR-uses of missing replaceable allocation functions usually won’t be diagnosable at compile time.

"constexpr new" is still required to work, even when the replaceable allocation functions are not present. This requires some tweaking of standardese.

Non-allocating placement ::operator new (colloquially "placement new") and ::operator delete (colloquially "placement delete") are still required to be present in freestanding implementations.

Core language concepts of pointer safety remain unchanged. Note that the pointer safety library facilities util.dynamic.safety are not required to be present in freestanding implementations, and the author is not aware of any papers to make the pointer safety library facilities required in freestanding implementations.

Hosted implementations are unchanged. Users of freestanding implementations can still provide implementations of the replaceable allocation and deallocation functions. The behavior of virtual destructors is unchanged. The behavior of class specific operator new and operator delete overloads is unchanged. The requirements on user-provided ::operator new and ::operator delete overloads remains the same, particularly those requirements involving error behaviors. Coroutines will behave the same so long as promise-specific allocators are used. The storage for exception objects will remain unspecified.

4. Why?

4.1. No allocations allowed

FreeRTOS allows for both static and dynamic allocation of OS constructs [FreeRTOS_StaticVDynamic]. Static allocation in conjunction with a missing ::operator new can help avoid overhead and eliminate accidental usage.

THREADX [THREADX] does not consider dynamic allocation a core service, and can be built without support for dynamic allocation in order to reduce application size. THREADX also distinguishes between byte allocation (general purpose) vs. block allocation (no-fragmentation elements of fixed size in a pool).

Also, by allowing a no-op ::operator delete implementation, these space constrained applications can save code-size. No code needs to be present for ::operator delete synchronization, free block coalescing, or free block searching.

4.2. No right way to allocate memory

As an example, in the Microsoft Windows kernel environment, there are two leading choices about where to get dynamic memory [MSPools]. Users can get memory from the non-paged pool, which is a safe, but scarce resource; or users can get memory from the paged pool, which is plentiful, but not accessible in many common kernel operations. Non-paged pool must be used any time the allocated memory needs to be accessible from an interrupt or from a "high IRQL" context. The author has had experience with both paged pool and non-paged pool as defaults, with the predictable outcome of crashes with paged pool defaults and OOM with non-paged pool defaults. The implementer of the C++ toolchain is not in a good position to make this choice for the user.

In the Linux kernel environment, kmalloc [kmalloc] with the GFP_KERNEL should be used when allocating memory within the context of a process and outside of a lock, but GFP_ATOMIC should be used when allocating memory outside the context of a process, such as inside of an interrupt. The implementers of the C++ runtime are in no position to know which is the correct flag to use by default. Using GFP_KERNEL when GFP_ATOMIC is needed will result in crashes from interrupt code and deadlocks. Using GFP_ATOMIC when GFP_KERNEL is appropriate will result in reduced system performance, spurious OOM errors, and premature exhaustion of emergency memory pools.

Freestanding implementations are intended to run without the benefit of an operating system (basic.def.odr). However, the name of the function that supplies dynamic memory is usually an OS-specific detail. The C++ implementation should not (and may not) know the name of the function to request memory. The Windows kernel uses ExAllocatePoolWithTag. In the Linux kernel, kmalloc is the main function to use. In FreeBSD, a function named malloc is present, but it takes different arguments than the C standard library function of the same name. FreeRTOS uses pvPortMalloc, and THREADX uses tx_byte_allocate. Home-grown OSes will likely have other spellings for memory allocation routines.

Today’s C++ implementations don’t provide ::operator new implementations for all possible targets. Doing so isn’t a plausible goal, especially when the home-grown OSes are taken into account. This means that users are already forced into choosing between not having ::operator new support and providing their own implementation. We should acknowledge and standardize this existing practice, especially since we already have the extension point mechanism in place.

4.3. What about allocators?

Allocators are still useful in a less-than-minimal freestanding implementation. In environments with dynamic memory, custom allocators can be written and used with standard containers, assuming that the containers are present in the implementation. This could be done even if a global ::operator new is not present. The author has used stlport::vector<int, PagedLockedAllocator> successfully in these environments.

std::allocator is implemented in terms of global ::operator new. In practice, it would be easy for an implementation to have an implementation of std::allocator in a header / module, and have that header still compile just fine, as it wouldn’t ODR-use ::operator new until it was instantiated. If the user has provided a global ::operator new, then std::allocator would have the same semantics as mandated by the standard. If the global ::operator new is not present, then uses of std::allocator would fail to link, which would still be conforming behavior on a freestanding implementation.

Some facilities in the standard library (e.g. make_unique) are implemented in terms of new, and not an allocator interface. It is useful to make these facilities error when dynamic memory isn’t available, and it is also useful to be able to control which memory pool is used by default.

4.4. virtual destructors

Ideally, if neither new nor delete is ever called, we wouldn’t need an operator delete. This proposal still requires some operator delete to exist, though that operator delete can be a no-op.

4.5. Why not fix virtual destructors, instead of keeping a no-op operator delete?

4.6. No feature test macro

In most toolchains, feature test macros can be exposed directly by the compiler (usually for core language features) and by the library (for library features). The presence or absence of ::operator new is dictated by the runtime though. In some implementations, neither the compiler nor the library headers necessarily know detailed information about the runtime. This hurdle is not intractable, but it is a hurdle nonetheless.

The most likely usage of such a feature test macro is to conditionally define a custom ::operator new iff the implementation did not provide one by default. This is dangerous territory, as it encourages libraries to provide the one-and-only ::operator new definition. If two such libraries do this, then there is an ODR issue.

4.7. Likely misuses and abuses

5. Experience

6. Polling history

6.1. Feb 14, 2020, EWG, Prague

SF/F/N/A/SA

8/10/7/0/0

6.2. Feb 12, 2020, EWGI, Prague

SF/F/N/A/SA

7/6/1/0/0

Is a Feature test macro a valuable addition to this paper?

SF/F/N/A/SA

0/5/5/2/0

Do we believe that P2013 is sufficiently developed to be seen by EWG?

SF/F/N/A/SA

5/8/0/0/0

6.3. Jan 8, 2020 SG14 Telecon

SF/F/N/A/SA

9/10/0/0/0

approves to go to EWG

7. Design Alternatives

7.1. Alternative 0: All-or-nothing allocating ::operator new, no-op default deallocation functions (Proposed above)

7.2. Alternative 1: Optional throwing ::operator news, no-op default deallocation functions

The nothrow_t overloads are specified to forward to an appropriate throwing overload. That implementation would still be fine on a system without dynamic storage available. This alternative was not selected as it is more difficult to teach, and because the target audience would likely be astonished that the nothrow_t overload has a try/catch in it.

7.3. Alternative 2: No deallocation functions

This alternative has the benefit of being zero overhead and very explicit, but it has troublesome consequences for implementations. There are several language support classes that have virtual destructors, and something would need to be decided for them. Notably, type_info and the exception hierarchy all have virtual destructors. The standard library implementers may be prohibited from providing operator new and operator delete overloads (conforming#member.functions). Alternatively, the facilities that require classes with virtual destructors could all be off-limits until operator delete was made available. This would eliminate many cases with exceptions, dynamic_cast on references, and typeid.

If we were to adopt this alternative, many users would provide a no-op ::operator delete in their code, giving their code the same semantics and trade-offs as the proposed solution.

7.3.1. Experience

7.4. Alternative 3: No deallocation functions and new ODR-used rules for virtual destructors

7.4.1. How could this virtual destructor ODR-use change be implemented?

Existing linkers already have the ability to take multiple identical virtual table implementations and pick one for use in the final binary. A potential implementation strategy is for compilers and linkers to support a new "weaker" linkage. When the default heap is disabled, the compiler would emit a vtable with a nullptr or pure virtual function in the virtual destructor slot. When new is called, a "stronger" linkage vtable would be emitted that has the deleting destructor in the virtual destructor slot. The linker would then select a vtable with the strongest linkage available. Today’s linkage would be considered "stronger". Only partially filled vtables would have "weaker" linkage.

7.4.2. ABI impact

Shared libraries are trickier. Vtables aren’t always emitted into every translation unit. Take shared library "leaf" that has a default heap. It depends upon shared library "root" that does not have a default heap. If a class with a virtual destructor is defined in "root", along with its "key function", then a call to new on the class in "leaf" will generate an object with a partial vtable. Calling delete on that object will cause UB (usually crashes).

Lack of a default heap should generally be considered a trait of the platform. Mixing this configuration shouldn’t be a common occurrence.

7.4.3. Experience

8. Wording

8.1. basic.def.odr

3.1 - A function is named by an expression or conversion if it is the selected member of an overload set (6.5, 12.4, 12.5) in an overload resolution performed as part of forming that expression or conversion, unless it is either:

3.1.1 -- a pure virtual function and either the expression is not an id-expression naming the function with an explicitly qualified name or the expression forms a pointer to member (7.6.2.1) . , or

3.1.2 -- a call to a replaceable global allocation function during the evaluation of a constant expression.

[Note: This covers taking the address of functions (7.3.3, 7.6.2.1), calls to named functions (7.6.1.2), operator overloading (Clause 12), user-defined conversions (11.4.7.2), allocation functions for new-expressions (7.6.2.7), as well as non-default initialization (9.4). A constructor selected to copy or move an object of class type is considered to be named by an expression or conversion even if the call is actually elided by the implementation (11.10.5).— end note]

8.2. basic.stc.dynamic

The On hosted implementations, the library provides default definitions for the global allocation and deallocation functions. Some global allocation and deallocation functions are replaceable (17.6.2). On freestanding implementations, the library provides default definitions for the non-replaceable allocation functions and all the global deallocation functions. It is implementation-defined whether a freestanding implementation’s library provides default definitions for the replaceable global allocation functions. A freestanding implementation’s library shall either provide the definitions for all the replaceable global allocation functions, or none of the replaceable global allocation functions. A C++ program shall provide at most one definition of a replaceable allocation or deallocation function. Any such function definition replaces the default version provided in the library (16.5.4.6). The following allocation and deallocation functions (17.6) are implicitly declared in global scope in each translation unit of a program.

8.3. new.delete

Mandates: These allocation functions are not odr-used ([basic.def.odr]) unless a definition of these allocation functions has been provided. [Note: On hosted implementations, the library provides default definitions of these allocation functions ([basic.stc.dynamic]).- end note]

The above mimics wording in declval. I believe it is compatible with intro.compliance/4.

9. Acknowledgments

Thank you to Daveed Vandevoorde, for providing feedback on the wording.