mfbt/Attributes.h

   1 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
   2 /* vim: set ts=8 sts=2 et sw=2 tw=80: */
   3 /* This Source Code Form is subject to the terms of the Mozilla Public
   4  * License, v. 2.0. If a copy of the MPL was not distributed with this
   5  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
   6
   7 /* Implementations of various class and method modifier attributes. */
   8
   9 #ifndef mozilla_Attributes_h
  10 #define mozilla_Attributes_h
  11
  12 #include "mozilla/Compiler.h"
  13
  14 /*
  15  * MOZ_ALWAYS_INLINE is a macro which expands to tell the compiler that the
  16  * method decorated with it must be inlined, even if the compiler thinks
  17  * otherwise.  This is only a (much) stronger version of the inline hint:
  18  * compilers are not guaranteed to respect it (although they're much more likely
  19  * to do so).
  20  *
  21  * The MOZ_ALWAYS_INLINE_EVEN_DEBUG macro is yet stronger. It tells the
  22  * compiler to inline even in DEBUG builds. It should be used very rarely.
  23  */
  24 #if defined(_MSC_VER)
  25 #  define MOZ_ALWAYS_INLINE_EVEN_DEBUG __forceinline
  26 #elif defined(__GNUC__)
  27 #  define MOZ_ALWAYS_INLINE_EVEN_DEBUG __attribute__((always_inline)) inline
  28 #else
  29 #  define MOZ_ALWAYS_INLINE_EVEN_DEBUG inline
  30 #endif
  31
  32 #if !defined(DEBUG)
  33 #  define MOZ_ALWAYS_INLINE MOZ_ALWAYS_INLINE_EVEN_DEBUG
  34 #elif defined(_MSC_VER) && !defined(__cplusplus)
  35 #  define MOZ_ALWAYS_INLINE __inline
  36 #else
  37 #  define MOZ_ALWAYS_INLINE inline
  38 #endif
  39
  40 #if defined(_MSC_VER)
  41 /*
  42  * g++ requires -std=c++0x or -std=gnu++0x to support C++11 functionality
  43  * without warnings (functionality used by the macros below).  These modes are
  44  * detectable by checking whether __GXX_EXPERIMENTAL_CXX0X__ is defined or, more
  45  * standardly, by checking whether __cplusplus has a C++11 or greater value.
  46  * Current versions of g++ do not correctly set __cplusplus, so we check both
  47  * for forward compatibility.
  48  */
  49 #  define MOZ_HAVE_NEVER_INLINE __declspec(noinline)
  50 #  define MOZ_HAVE_NORETURN __declspec(noreturn)
  51 #elif defined(__clang__)
  52 /*
  53  * Per Clang documentation, "Note that marketing version numbers should not
  54  * be used to check for language features, as different vendors use different
  55  * numbering schemes. Instead, use the feature checking macros."
  56  */
  57 #  ifndef __has_extension
  58 #    define __has_extension \
  59       __has_feature /* compatibility, for older versions of clang */
  60 #  endif
  61 #  if __has_attribute(noinline)
  62 #    define MOZ_HAVE_NEVER_INLINE __attribute__((noinline))
  63 #  endif
  64 #  if __has_attribute(noreturn)
  65 #    define MOZ_HAVE_NORETURN __attribute__((noreturn))
  66 #  endif
  67 #elif defined(__GNUC__)
  68 #  define MOZ_HAVE_NEVER_INLINE __attribute__((noinline))
  69 #  define MOZ_HAVE_NORETURN __attribute__((noreturn))
  70 #  define MOZ_HAVE_NORETURN_PTR __attribute__((noreturn))
  71 #endif
  72
  73 #if defined(__clang__)
  74 #  if __has_attribute(no_stack_protector)
  75 #    define MOZ_HAVE_NO_STACK_PROTECTOR __attribute__((no_stack_protector))
  76 #  endif
  77 #elif defined(__GNUC__)
  78 #  define MOZ_HAVE_NO_STACK_PROTECTOR __attribute__((no_stack_protector))
  79 #endif
  80
  81 /*
  82  * When built with clang analyzer (a.k.a scan-build), define MOZ_HAVE_NORETURN
  83  * to mark some false positives
  84  */
  85 #ifdef __clang_analyzer__
  86 #  if __has_extension(attribute_analyzer_noreturn)
  87 #    define MOZ_HAVE_ANALYZER_NORETURN __attribute__((analyzer_noreturn))
  88 #  endif
  89 #endif
  90
  91 #if defined(__GNUC__) || \
  92     (defined(__clang__) && __has_attribute(no_profile_instrument_function))
  93 #  define MOZ_NOPROFILE __attribute__((no_profile_instrument_function))
  94 #else
  95 #  define MOZ_NOPROFILE
  96 #endif
  97
  98 #if defined(__GNUC__) || \
  99     (defined(__clang__) && __has_attribute(no_instrument_function))
 100 #  define MOZ_NOINSTRUMENT __attribute__((no_instrument_function))
 101 #else
 102 #  define MOZ_NOINSTRUMENT
 103 #endif
 104
 105 /*
 106  * MOZ_NAKED tells the compiler that the function only contains assembly and
 107  * that it should not try to inject code that may mess with the assembly in it.
 108  *
 109  * See https://github.com/llvm/llvm-project/issues/74573 for the interaction
 110  * between naked and no_profile_instrument_function.
 111  */
 112 #define MOZ_NAKED __attribute__((naked)) MOZ_NOPROFILE MOZ_NOINSTRUMENT
 113
 114 /**
 115  * Per clang's documentation:
 116  *
 117  * If a statement is marked nomerge and contains call expressions, those call
 118  * expressions inside the statement will not be merged during optimization. This
 119  * attribute can be used to prevent the optimizer from obscuring the source
 120  * location of certain calls.
 121  *
 122  * This is useful to have clearer information on assertion failures.
 123  */
 124 #if defined(__clang__) && __has_attribute(nomerge)
 125 #  define MOZ_NOMERGE __attribute__((nomerge))
 126 #else
 127 #  define MOZ_NOMERGE
 128 #endif
 129
 130 /*
 131  * MOZ_NEVER_INLINE is a macro which expands to tell the compiler that the
 132  * method decorated with it must never be inlined, even if the compiler would
 133  * otherwise choose to inline the method.  Compilers aren't absolutely
 134  * guaranteed to support this, but most do.
 135  */
 136 #if defined(MOZ_HAVE_NEVER_INLINE)
 137 #  define MOZ_NEVER_INLINE MOZ_HAVE_NEVER_INLINE
 138 #else
 139 #  define MOZ_NEVER_INLINE /* no support */
 140 #endif
 141
 142 /*
 143  * MOZ_NEVER_INLINE_DEBUG is a macro which expands to MOZ_NEVER_INLINE
 144  * in debug builds, and nothing in opt builds.
 145  */
 146 #if defined(DEBUG)
 147 #  define MOZ_NEVER_INLINE_DEBUG MOZ_NEVER_INLINE
 148 #else
 149 #  define MOZ_NEVER_INLINE_DEBUG /* don't inline in opt builds */
 150 #endif
 151 /*
 152  * MOZ_NORETURN, specified at the start of a function declaration, indicates
 153  * that the given function does not return.  (The function definition does not
 154  * need to be annotated.)
 155  *
 156  *   MOZ_NORETURN void abort(const char* msg);
 157  *
 158  * This modifier permits the compiler to optimize code assuming a call to such a
 159  * function will never return.  It also enables the compiler to avoid spurious
 160  * warnings about not initializing variables, or about any other seemingly-dodgy
 161  * operations performed after the function returns.
 162  *
 163  * There are two variants. The GCC version of NORETURN may be applied to a
 164  * function pointer, while for MSVC it may not.
 165  *
 166  * This modifier does not affect the corresponding function's linking behavior.
 167  */
 168 #if defined(MOZ_HAVE_NORETURN)
 169 #  define MOZ_NORETURN MOZ_HAVE_NORETURN
 170 #else
 171 #  define MOZ_NORETURN /* no support */
 172 #endif
 173 #if defined(MOZ_HAVE_NORETURN_PTR)
 174 #  define MOZ_NORETURN_PTR MOZ_HAVE_NORETURN_PTR
 175 #else
 176 #  define MOZ_NORETURN_PTR /* no support */
 177 #endif
 178
 179 /**
 180  * MOZ_COLD tells the compiler that a function is "cold", meaning infrequently
 181  * executed. This may lead it to optimize for size more aggressively than speed,
 182  * or to allocate the body of the function in a distant part of the text segment
 183  * to help keep it from taking up unnecessary icache when it isn't in use.
 184  *
 185  * Place this attribute at the very beginning of a function definition. For
 186  * example, write
 187  *
 188  *   MOZ_COLD int foo();
 189  *
 190  * or
 191  *
 192  *   MOZ_COLD int foo() { return 42; }
 193  */
 194 #if defined(__GNUC__) || defined(__clang__)
 195 #  define MOZ_COLD __attribute__((cold))
 196 #else
 197 #  define MOZ_COLD
 198 #endif
 199
 200 /**
 201  * MOZ_NONNULL tells the compiler that some of the arguments to a function are
 202  * known to be non-null. The arguments are a list of 1-based argument indexes
 203  * identifying arguments which are known to be non-null.
 204  *
 205  * Place this attribute at the very beginning of a function definition. For
 206  * example, write
 207  *
 208  *   MOZ_NONNULL(1, 2) int foo(char *p, char *q);
 209  */
 210 #if defined(__GNUC__) || defined(__clang__)
 211 #  define MOZ_NONNULL(...) __attribute__((nonnull(__VA_ARGS__)))
 212 #else
 213 #  define MOZ_NONNULL(...)
 214 #endif
 215
 216 /**
 217  * MOZ_NONNULL_RETURN tells the compiler that the function's return value is
 218  * guaranteed to be a non-null pointer, which may enable the compiler to
 219  * optimize better at call sites.
 220  *
 221  * Place this attribute at the end of a function declaration. For example,
 222  *
 223  *   char* foo(char *p, char *q) MOZ_NONNULL_RETURN;
 224  */
 225 #if defined(__GNUC__) || defined(__clang__)
 226 #  define MOZ_NONNULL_RETURN __attribute__((returns_nonnull))
 227 #else
 228 #  define MOZ_NONNULL_RETURN
 229 #endif
 230
 231 /*
 232  * MOZ_PRETEND_NORETURN_FOR_STATIC_ANALYSIS, specified at the end of a function
 233  * declaration, indicates that for the purposes of static analysis, this
 234  * function does not return.  (The function definition does not need to be
 235  * annotated.)
 236  *
 237  * MOZ_ReportCrash(const char* s, const char* file, int ln)
 238  *   MOZ_PRETEND_NORETURN_FOR_STATIC_ANALYSIS
 239  *
 240  * Some static analyzers, like scan-build from clang, can use this information
 241  * to eliminate false positives.  From the upstream documentation of scan-build:
 242  * "This attribute is useful for annotating assertion handlers that actually
 243  * can return, but for the purpose of using the analyzer we want to pretend
 244  * that such functions do not return."
 245  *
 246  */
 247 #if defined(MOZ_HAVE_ANALYZER_NORETURN)
 248 #  define MOZ_PRETEND_NORETURN_FOR_STATIC_ANALYSIS MOZ_HAVE_ANALYZER_NORETURN
 249 #else
 250 #  define MOZ_PRETEND_NORETURN_FOR_STATIC_ANALYSIS /* no support */
 251 #endif
 252
 253 /*
 254  * MOZ_ASAN_IGNORE is a macro to tell AddressSanitizer (a compile-time
 255  * instrumentation shipped with Clang and GCC) to not instrument the annotated
 256  * function. Furthermore, it will prevent the compiler from inlining the
 257  * function because inlining currently breaks the blocklisting mechanism of
 258  * AddressSanitizer.
 259  */
 260 #if defined(__has_feature)
 261 #  if __has_feature(address_sanitizer)
 262 #    define MOZ_HAVE_ASAN_IGNORE
 263 #  endif
 264 #elif defined(__GNUC__)
 265 #  if defined(__SANITIZE_ADDRESS__)
 266 #    define MOZ_HAVE_ASAN_IGNORE
 267 #  endif
 268 #endif
 269
 270 #if defined(MOZ_HAVE_ASAN_IGNORE)
 271 #  define MOZ_ASAN_IGNORE MOZ_NEVER_INLINE __attribute__((no_sanitize_address))
 272 #else
 273 #  define MOZ_ASAN_IGNORE /* nothing */
 274 #endif
 275
 276 /*
 277  * MOZ_TSAN_IGNORE is a macro to tell ThreadSanitizer (a compile-time
 278  * instrumentation shipped with Clang) to not instrument the annotated function.
 279  * Furthermore, it will prevent the compiler from inlining the function because
 280  * inlining currently breaks the blocklisting mechanism of ThreadSanitizer.
 281  */
 282 #if defined(__has_feature)
 283 #  if __has_feature(thread_sanitizer)
 284 #    define MOZ_TSAN_IGNORE MOZ_NEVER_INLINE __attribute__((no_sanitize_thread))
 285 #  else
 286 #    define MOZ_TSAN_IGNORE /* nothing */
 287 #  endif
 288 #else
 289 #  define MOZ_TSAN_IGNORE /* nothing */
 290 #endif
 291
 292 #if defined(__has_attribute)
 293 #  if __has_attribute(no_sanitize)
 294 #    define MOZ_HAVE_NO_SANITIZE_ATTR
 295 #  endif
 296 #endif
 297
 298 #ifdef __clang__
 299 #  ifdef MOZ_HAVE_NO_SANITIZE_ATTR
 300 #    define MOZ_HAVE_UNSIGNED_OVERFLOW_SANITIZE_ATTR
 301 #    define MOZ_HAVE_SIGNED_OVERFLOW_SANITIZE_ATTR
 302 #  endif
 303 #endif
 304
 305 /*
 306  * MOZ_NO_SANITIZE_UNSIGNED_OVERFLOW disables *un*signed integer overflow
 307  * checking on the function it annotates, in builds configured to perform it.
 308  * (Currently this is only Clang using -fsanitize=unsigned-integer-overflow, or
 309  * via --enable-unsigned-overflow-sanitizer in Mozilla's build system.)  It has
 310  * no effect in other builds.
 311  *
 312  * Place this attribute at the very beginning of a function declaration.
 313  *
 314  * Unsigned integer overflow isn't *necessarily* a bug.  It's well-defined in
 315  * C/C++, and code may reasonably depend upon it.  For example,
 316  *
 317  *   MOZ_NO_SANITIZE_UNSIGNED_OVERFLOW inline bool
 318  *   IsDecimal(char aChar)
 319  *   {
 320  *     // For chars less than '0', unsigned integer underflow occurs, to a value
 321  *     // much greater than 10, so the overall test is false.
 322  *     // For chars greater than '0', no overflow occurs, and only '0' to '9'
 323  *     // pass the overall test.
 324  *     return static_cast<unsigned int>(aChar) - '0' < 10;
 325  *   }
 326  *
 327  * But even well-defined unsigned overflow often causes bugs when it occurs, so
 328  * it should be restricted to functions annotated with this attribute.
 329  *
 330  * The compiler instrumentation to detect unsigned integer overflow has costs
 331  * both at compile time and at runtime.  Functions that are repeatedly inlined
 332  * at compile time will also implicitly inline the necessary instrumentation,
 333  * increasing compile time.  Similarly, frequently-executed functions that
 334  * require large amounts of instrumentation will also notice significant runtime
 335  * slowdown to execute that instrumentation.  Use this attribute to eliminate
 336  * those costs -- but only after carefully verifying that no overflow can occur.
 337  */
 338 #ifdef MOZ_HAVE_UNSIGNED_OVERFLOW_SANITIZE_ATTR
 339 #  define MOZ_NO_SANITIZE_UNSIGNED_OVERFLOW \
 340     __attribute__((no_sanitize("unsigned-integer-overflow")))
 341 #else
 342 #  define MOZ_NO_SANITIZE_UNSIGNED_OVERFLOW /* nothing */
 343 #endif
 344
 345 /*
 346  * MOZ_NO_SANITIZE_SIGNED_OVERFLOW disables *signed* integer overflow checking
 347  * on the function it annotates, in builds configured to perform it.  (Currently
 348  * this is only Clang using -fsanitize=signed-integer-overflow, or via
 349  * --enable-signed-overflow-sanitizer in Mozilla's build system.  GCC support
 350  * will probably be added in the future.)  It has no effect in other builds.
 351  *
 352  * Place this attribute at the very beginning of a function declaration.
 353  *
 354  * Signed integer overflow is undefined behavior in C/C++: *anything* can happen
 355  * when it occurs.  *Maybe* wraparound behavior will occur, but maybe also the
 356  * compiler will assume no overflow happens and will adversely optimize the rest
 357  * of your code.  Code that contains signed integer overflow needs to be fixed.
 358  *
 359  * The compiler instrumentation to detect signed integer overflow has costs both
 360  * at compile time and at runtime.  Functions that are repeatedly inlined at
 361  * compile time will also implicitly inline the necessary instrumentation,
 362  * increasing compile time.  Similarly, frequently-executed functions that
 363  * require large amounts of instrumentation will also notice significant runtime
 364  * slowdown to execute that instrumentation.  Use this attribute to eliminate
 365  * those costs -- but only after carefully verifying that no overflow can occur.
 366  */
 367 #ifdef MOZ_HAVE_SIGNED_OVERFLOW_SANITIZE_ATTR
 368 #  define MOZ_NO_SANITIZE_SIGNED_OVERFLOW \
 369     __attribute__((no_sanitize("signed-integer-overflow")))
 370 #else
 371 #  define MOZ_NO_SANITIZE_SIGNED_OVERFLOW /* nothing */
 372 #endif
 373
 374 #undef MOZ_HAVE_NO_SANITIZE_ATTR
 375
 376 /**
 377  * MOZ_ALLOCATOR tells the compiler that the function it marks returns either a
 378  * "fresh", "pointer-free" block of memory, or nullptr. "Fresh" means that the
 379  * block is not pointed to by any other reachable pointer in the program.
 380  * "Pointer-free" means that the block contains no pointers to any valid object
 381  * in the program. It may be initialized with other (non-pointer) values.
 382  *
 383  * Placing this attribute on appropriate functions helps GCC analyze pointer
 384  * aliasing more accurately in their callers.
 385  *
 386  * GCC warns if a caller ignores the value returned by a function marked with
 387  * MOZ_ALLOCATOR: it is hard to imagine cases where dropping the value returned
 388  * by a function that meets the criteria above would be intentional.
 389  *
 390  * Place this attribute after the argument list and 'this' qualifiers of a
 391  * function definition. For example, write
 392  *
 393  *   void *my_allocator(size_t) MOZ_ALLOCATOR;
 394  *
 395  * or
 396  *
 397  *   void *my_allocator(size_t bytes) MOZ_ALLOCATOR { ... }
 398  */
 399 #if defined(__GNUC__) || defined(__clang__)
 400 #  define MOZ_ALLOCATOR __attribute__((malloc, warn_unused_result))
 401 #  define MOZ_INFALLIBLE_ALLOCATOR \
 402     __attribute__((malloc, warn_unused_result, returns_nonnull))
 403 #else
 404 #  define MOZ_ALLOCATOR
 405 #  define MOZ_INFALLIBLE_ALLOCATOR
 406 #endif
 407
 408 /**
 409  * MOZ_MAYBE_UNUSED suppresses compiler warnings about functions that are
 410  * never called (in this build configuration, at least).
 411  *
 412  * Place this attribute at the very beginning of a function declaration. For
 413  * example, write
 414  *
 415  *   MOZ_MAYBE_UNUSED int foo();
 416  *
 417  * or
 418  *
 419  *   MOZ_MAYBE_UNUSED int foo() { return 42; }
 420  */
 421 #if defined(__GNUC__) || defined(__clang__)
 422 #  define MOZ_MAYBE_UNUSED __attribute__((__unused__))
 423 #elif defined(_MSC_VER)
 424 #  define MOZ_MAYBE_UNUSED __pragma(warning(suppress : 4505))
 425 #else
 426 #  define MOZ_MAYBE_UNUSED
 427 #endif
 428
 429 /*
 430  * MOZ_NO_STACK_PROTECTOR, specified at the start of a function declaration,
 431  * indicates that the given function should *NOT* be instrumented to detect
 432  * stack buffer overflows at runtime. (The function definition does not need to
 433  * be annotated.)
 434  *
 435  *   MOZ_NO_STACK_PROTECTOR int foo();
 436  *
 437  * Detecting stack buffer overflows at runtime is a security feature. This
 438  * modifier should thus only be used on functions which are provably exempt of
 439  * stack buffer overflows, for example because they do not use stack buffers.
 440  *
 441  * This modifier does not affect the corresponding function's linking behavior.
 442  */
 443 #if defined(MOZ_HAVE_NO_STACK_PROTECTOR)
 444 #  define MOZ_NO_STACK_PROTECTOR MOZ_HAVE_NO_STACK_PROTECTOR
 445 #else
 446 #  define MOZ_NO_STACK_PROTECTOR /* no support */
 447 #endif
 448
 449 /**
 450  * MOZ_LIFETIME_BOUND indicates that objects that are referred to by that
 451  * parameter may also be referred to by the return value of the annotated
 452  * function (or, for a parameter of a constructor, by the value of the
 453  * constructed object).
 454  * See: https://clang.llvm.org/docs/AttributeReference.html#lifetimebound
 455  */
 456 #if defined(__clang__) && defined(__has_cpp_attribute)
 457 #  if __has_cpp_attribute(clang::lifetimebound)
 458 #    define MOZ_LIFETIME_BOUND [[clang::lifetimebound]]
 459 #  else
 460 #    define MOZ_LIFETIME_BOUND /* nothing */
 461 #  endif
 462 #else
 463 #  define MOZ_LIFETIME_BOUND /* nothing */
 464 #endif
 465
 466 #ifdef __cplusplus
 467
 468 /**
 469  * C++11 lets unions contain members that have non-trivial special member
 470  * functions (default/copy/move constructor, copy/move assignment operator,
 471  * destructor) if the user defines the corresponding functions on the union.
 472  * (Such user-defined functions must rely on external knowledge about which arm
 473  * is active to be safe.  Be extra-careful defining these functions!)
 474  *
 475  * MSVC unfortunately warns/errors for this bog-standard C++11 pattern.  Use
 476  * these macro-guards around such member functions to disable the warnings:
 477  *
 478  *   union U
 479  *   {
 480  *     std::string s;
 481  *     int x;
 482  *
 483  *     MOZ_PUSH_DISABLE_NONTRIVIAL_UNION_WARNINGS
 484  *
 485  *     // |U| must have a user-defined default constructor because |std::string|
 486  *     // has a non-trivial default constructor.
 487  *     U() ... { ... }
 488  *
 489  *     // |U| must have a user-defined destructor because |std::string| has a
 490  *     // non-trivial destructor.
 491  *     ~U() { ... }
 492  *
 493  *     MOZ_POP_DISABLE_NONTRIVIAL_UNION_WARNINGS
 494  *   };
 495  */
 496 #  if defined(_MSC_VER)
 497 #    define MOZ_PUSH_DISABLE_NONTRIVIAL_UNION_WARNINGS          \
 498       __pragma(warning(push)) __pragma(warning(disable : 4582)) \
 499           __pragma(warning(disable : 4583))
 500 #    define MOZ_POP_DISABLE_NONTRIVIAL_UNION_WARNINGS __pragma(warning(pop))
 501 #  else
 502 #    define MOZ_PUSH_DISABLE_NONTRIVIAL_UNION_WARNINGS /* nothing */
 503 #    define MOZ_POP_DISABLE_NONTRIVIAL_UNION_WARNINGS  /* nothing */
 504 #  endif
 505
 506 /*
 507  * The following macros are attributes that support the static analysis plugin
 508  * included with Mozilla, and will be implemented (when such support is enabled)
 509  * as C++11 attributes. Since such attributes are legal pretty much everywhere
 510  * and have subtly different semantics depending on their placement, the
 511  * following is a guide on where to place the attributes.
 512  *
 513  * Attributes that apply to a struct or class precede the name of the class:
 514  * (Note that this is different from the placement of final for classes!)
 515  *
 516  *   class MOZ_CLASS_ATTRIBUTE SomeClass {};
 517  *
 518  * Attributes that apply to functions follow the parentheses and const
 519  * qualifiers but precede final, override and the function body:
 520  *
 521  *   void DeclaredFunction() MOZ_FUNCTION_ATTRIBUTE;
 522  *   void SomeFunction() MOZ_FUNCTION_ATTRIBUTE {}
 523  *   void PureFunction() const MOZ_FUNCTION_ATTRIBUTE = 0;
 524  *   void OverriddenFunction() MOZ_FUNCTION_ATTIRBUTE override;
 525  *
 526  * Attributes that apply to variables or parameters follow the variable's name:
 527  *
 528  *   int variable MOZ_VARIABLE_ATTRIBUTE;
 529  *
 530  * Attributes that apply to types follow the type name:
 531  *
 532  *   typedef int MOZ_TYPE_ATTRIBUTE MagicInt;
 533  *   int MOZ_TYPE_ATTRIBUTE someVariable;
 534  *   int* MOZ_TYPE_ATTRIBUTE magicPtrInt;
 535  *   int MOZ_TYPE_ATTRIBUTE* ptrToMagicInt;
 536  *
 537  * Attributes that apply to statements precede the statement:
 538  *
 539  *   MOZ_IF_ATTRIBUTE if (x == 0)
 540  *   MOZ_DO_ATTRIBUTE do { } while (0);
 541  *
 542  * Attributes that apply to labels precede the label:
 543  *
 544  *   MOZ_LABEL_ATTRIBUTE target:
 545  *     goto target;
 546  *   MOZ_CASE_ATTRIBUTE case 5:
 547  *   MOZ_DEFAULT_ATTRIBUTE default:
 548  *
 549  * The static analyses that are performed by the plugin are as follows:
 550  *
 551  * MOZ_CAN_RUN_SCRIPT: Applies to functions which can run script. Callers of
 552  *   this function must also be marked as MOZ_CAN_RUN_SCRIPT, and all refcounted
 553  *   arguments must be strongly held in the caller. Note that MOZ_CAN_RUN_SCRIPT
 554  *   should only be applied to function declarations, not definitions. If you
 555  *   need to apply it to a definition (eg because both are generated by a macro)
 556  *   use MOZ_CAN_RUN_SCRIPT_FOR_DEFINITION.
 557  *
 558  *   MOZ_CAN_RUN_SCRIPT can be applied to XPIDL-generated declarations by
 559  *   annotating the method or attribute as [can_run_script] in the .idl file.
 560  *
 561  * MOZ_CAN_RUN_SCRIPT_FOR_DEFINITION: Same as MOZ_CAN_RUN_SCRIPT, but usable on
 562  *   a definition. If the declaration is in a header file, users of that header
 563  *   file may not see the annotation.
 564  * MOZ_CAN_RUN_SCRIPT_BOUNDARY: Applies to functions which need to call
 565  *   MOZ_CAN_RUN_SCRIPT functions, but should not themselves be considered
 566  *   MOZ_CAN_RUN_SCRIPT. This should generally be avoided but can be used in
 567  *   two cases:
 568  *     1) As a temporary measure to limit the scope of changes when adding
 569  *        MOZ_CAN_RUN_SCRIPT.  Such a use must be accompanied by a follow-up bug
 570  *        to replace the MOZ_CAN_RUN_SCRIPT_BOUNDARY with MOZ_CAN_RUN_SCRIPT and
 571  *        a comment linking to that bug.
 572  *     2) If we can reason that the MOZ_CAN_RUN_SCRIPT callees of the function
 573  *        do not in fact run script (for example, because their behavior depends
 574  *        on arguments and we pass the arguments that don't allow script
 575  *        execution).  Such a use must be accompanied by a comment that explains
 576  *        why it's OK to have the MOZ_CAN_RUN_SCRIPT_BOUNDARY, as well as
 577  *        comments in the callee pointing out that if its behavior changes the
 578  *        caller might need adjusting.  And perhaps also a followup bug to
 579  *        refactor things so the "script" and "no script" codepaths do not share
 580  *        a chokepoint.
 581  *   Importantly, any use MUST be accompanied by a comment explaining why it's
 582  *   there, and should ideally have an action plan for getting rid of the
 583  *   MOZ_CAN_RUN_SCRIPT_BOUNDARY annotation.
 584  * MOZ_MUST_OVERRIDE: Applies to all C++ member functions. All immediate
 585  *   subclasses must provide an exact override of this method; if a subclass
 586  *   does not override this method, the compiler will emit an error. This
 587  *   attribute is not limited to virtual methods, so if it is applied to a
 588  *   nonvirtual method and the subclass does not provide an equivalent
 589  *   definition, the compiler will emit an error.
 590  * MOZ_STATIC_CLASS: Applies to all classes. Any class with this annotation is
 591  *   expected to live in static memory, so it is a compile-time error to use
 592  *   it, or an array of such objects, as the type of a variable declaration, or
 593  *   as a temporary object, or as the type of a new expression (unless
 594  *   placement new is being used). If a member of another class uses this
 595  *   class, or if another class inherits from this class, then it is considered
 596  *   to be a static class as well, although this attribute need not be provided
 597  *   in such cases.
 598  * MOZ_STATIC_LOCAL_CLASS: Applies to all classes. Any class with this
 599  *   annotation is expected to be a static local variable, so it is
 600  *   a compile-time error to use it, or an array of such objects, or as a
 601  *   temporary object, or as the type of a new expression. If another class
 602  *   inherits from this class then it is considered to be a static local
 603  *   class as well, although this attribute need not be provided in such cases.
 604  *   It is also a compile-time error for any class with this annotation to have
 605  *   a non-trivial destructor.
 606  * MOZ_STACK_CLASS: Applies to all classes. Any class with this annotation is
 607  *   expected to live on the stack, so it is a compile-time error to use it, or
 608  *   an array of such objects, as a global or static variable, or as the type of
 609  *   a new expression (unless placement new is being used). If a member of
 610  *   another class uses this class, or if another class inherits from this
 611  *   class, then it is considered to be a stack class as well, although this
 612  *   attribute need not be provided in such cases.
 613  * MOZ_NONHEAP_CLASS: Applies to all classes. Any class with this annotation is
 614  *   expected to live on the stack or in static storage, so it is a compile-time
 615  *   error to use it, or an array of such objects, as the type of a new
 616  *   expression. If a member of another class uses this class, or if another
 617  *   class inherits from this class, then it is considered to be a non-heap
 618  *   class as well, although this attribute need not be provided in such cases.
 619  * MOZ_HEAP_CLASS: Applies to all classes. Any class with this annotation is
 620  *   expected to live on the heap, so it is a compile-time error to use it, or
 621  *   an array of such objects, as the type of a variable declaration, or as a
 622  *   temporary object. If a member of another class uses this class, or if
 623  *   another class inherits from this class, then it is considered to be a heap
 624  *   class as well, although this attribute need not be provided in such cases.
 625  * MOZ_NON_TEMPORARY_CLASS: Applies to all classes. Any class with this
 626  *   annotation is expected not to live in a temporary. If a member of another
 627  *   class uses this class or if another class inherits from this class, then it
 628  *   is considered to be a non-temporary class as well, although this attribute
 629  *   need not be provided in such cases.
 630  * MOZ_TEMPORARY_CLASS: Applies to all classes. Any class with this annotation
 631  *   is expected to only live in a temporary. If another class inherits from
 632  *   this class, then it is considered to be a temporary class as well, although
 633  *   this attribute need not be provided in such cases.
 634  * MOZ_RAII: Applies to all classes. Any class with this annotation is assumed
 635  *   to be a RAII guard, which is expected to live on the stack in an automatic
 636  *   allocation. It is prohibited from being allocated in a temporary, static
 637  *   storage, or on the heap. This is a combination of MOZ_STACK_CLASS and
 638  *   MOZ_NON_TEMPORARY_CLASS.
 639  * MOZ_ONLY_USED_TO_AVOID_STATIC_CONSTRUCTORS: Applies to all classes that are
 640  *   intended to prevent introducing static initializers.  This attribute
 641  *   currently makes it a compile-time error to instantiate these classes
 642  *   anywhere other than at the global scope, or as a static member of a class.
 643  *   In non-debug mode, it also prohibits non-trivial constructors and
 644  *   destructors.
 645  * MOZ_TRIVIAL_CTOR_DTOR: Applies to all classes that must have both a trivial
 646  *   or constexpr constructor and a trivial destructor. Setting this attribute
 647  *   on a class makes it a compile-time error for that class to get a
 648  *   non-trivial constructor or destructor for any reason.
 649  * MOZ_ALLOW_TEMPORARY: Applies to constructors. This indicates that using the
 650  *   constructor is allowed in temporary expressions, if it would have otherwise
 651  *   been forbidden by the type being a MOZ_NON_TEMPORARY_CLASS. Useful for
 652  *   constructors like Maybe(Nothing).
 653  * MOZ_HEAP_ALLOCATOR: Applies to any function. This indicates that the return
 654  *   value is allocated on the heap, and will as a result check such allocations
 655  *   during MOZ_STACK_CLASS and MOZ_NONHEAP_CLASS annotation checking.
 656  * MOZ_IMPLICIT: Applies to constructors. Implicit conversion constructors
 657  *   are disallowed by default unless they are marked as MOZ_IMPLICIT. This
 658  *   attribute must be used for constructors which intend to provide implicit
 659  *   conversions.
 660  * MOZ_IS_REFPTR: Applies to class declarations of ref pointer to mark them as
 661  *   such for use with static-analysis.
 662  *   A ref pointer is an object wrapping a pointer and automatically taking care
 663  *   of its refcounting upon construction/destruction/transfer of ownership.
 664  *   This annotation implies MOZ_IS_SMARTPTR_TO_REFCOUNTED.
 665  * MOZ_IS_SMARTPTR_TO_REFCOUNTED: Applies to class declarations of smart
 666  *   pointers to ref counted classes to mark them as such for use with
 667  *   static-analysis.
 668  * MOZ_NO_ARITHMETIC_EXPR_IN_ARGUMENT: Applies to functions. Makes it a compile
 669  *   time error to pass arithmetic expressions on variables to the function.
 670  * MOZ_OWNING_REF: Applies to declarations of pointers to reference counted
 671  *   types.  This attribute tells the compiler that the raw pointer is a strong
 672  *   reference, where ownership through methods such as AddRef and Release is
 673  *   managed manually.  This can make the compiler ignore these pointers when
 674  *   validating the usage of pointers otherwise.
 675  *
 676  *   Example uses include owned pointers inside of unions, and pointers stored
 677  *   in POD types where a using a smart pointer class would make the object
 678  *   non-POD.
 679  * MOZ_NON_OWNING_REF: Applies to declarations of pointers to reference counted
 680  *   types.  This attribute tells the compiler that the raw pointer is a weak
 681  *   reference, which is ensured to be valid by a guarantee that the reference
 682  *   will be nulled before the pointer becomes invalid.  This can make the
 683  *   compiler ignore these pointers when validating the usage of pointers
 684  *   otherwise.
 685  *
 686  *   Examples include an mOwner pointer, which is nulled by the owning class's
 687  *   destructor, and is null-checked before dereferencing.
 688  * MOZ_UNSAFE_REF: Applies to declarations of pointers to reference counted
 689  *   types.  Occasionally there are non-owning references which are valid, but
 690  *   do not take the form of a MOZ_NON_OWNING_REF.  Their safety may be
 691  *   dependent on the behaviour of API consumers.  The string argument passed
 692  *   to this macro documents the safety conditions.  This can make the compiler
 693  *   ignore these pointers when validating the usage of pointers elsewhere.
 694  *
 695  *   Examples include an nsAtom* member which is known at compile time to point
 696  *   to a static atom which is valid throughout the lifetime of the program, or
 697  *   an API which stores a pointer, but doesn't take ownership over it, instead
 698  *   requiring the API consumer to correctly null the value before it becomes
 699  *   invalid.
 700  *
 701  *   Use of this annotation is discouraged when a strong reference or one of
 702  *   the above two annotations can be used instead.
 703  * MOZ_NO_ADDREF_RELEASE_ON_RETURN: Applies to function declarations.  Makes it
 704  *   a compile time error to call AddRef or Release on the return value of a
 705  *   function.  This is intended to be used with operator->() of our smart
 706  *   pointer classes to ensure that the refcount of an object wrapped in a
 707  *   smart pointer is not manipulated directly.
 708  * MOZ_NEEDS_NO_VTABLE_TYPE: Applies to template class declarations.  Makes it
 709  *   a compile time error to instantiate this template with a type parameter
 710  *   which has a VTable.
 711  * MOZ_NON_MEMMOVABLE: Applies to class declarations for types that are not safe
 712  *   to be moved in memory using memmove().
 713  * MOZ_NEEDS_MEMMOVABLE_TYPE: Applies to template class declarations where the
 714  *   template arguments are required to be safe to move in memory using
 715  *   memmove().  Passing MOZ_NON_MEMMOVABLE types to these templates is a
 716  *   compile time error.
 717  * MOZ_NEEDS_MEMMOVABLE_MEMBERS: Applies to class declarations where each member
 718  *   must be safe to move in memory using memmove().  MOZ_NON_MEMMOVABLE types
 719  *   used in members of these classes are compile time errors.
 720  * MOZ_NO_DANGLING_ON_TEMPORARIES: Applies to method declarations which return
 721  *   a pointer that is freed when the destructor of the class is called. This
 722  *   prevents these methods from being called on temporaries of the class,
 723  *   reducing risks of use-after-free.
 724  *   This attribute cannot be applied to && methods.
 725  *   In some cases, adding a deleted &&-qualified overload is too restrictive as
 726  *   this method should still be callable as a non-escaping argument to another
 727  *   function. This annotation can be used in those cases.
 728  * MOZ_INHERIT_TYPE_ANNOTATIONS_FROM_TEMPLATE_ARGS: Applies to template class
 729  *   declarations where an instance of the template should be considered, for
 730  *   static analysis purposes, to inherit any type annotations (such as
 731  *   MOZ_STACK_CLASS) from its template arguments.
 732  * MOZ_INIT_OUTSIDE_CTOR: Applies to class member declarations. Occasionally
 733  *   there are class members that are not initialized in the constructor,
 734  *   but logic elsewhere in the class ensures they are initialized prior to use.
 735  *   Using this attribute on a member disables the check that this member must
 736  *   be initialized in constructors via list-initialization, in the constructor
 737  *   body, or via functions called from the constructor body.
 738  * MOZ_IS_CLASS_INIT: Applies to class method declarations. Occasionally the
 739  *   constructor doesn't initialize all of the member variables and another
 740  *   function is used to initialize the rest. This marker is used to make the
 741  *   static analysis tool aware that the marked function is part of the
 742  *   initialization process and to include the marked function in the scan
 743  *   mechanism that determines which member variables still remain
 744  *   uninitialized.
 745  * MOZ_NON_PARAM: Applies to types. Makes it compile time error to use the type
 746  *   in parameter without pointer or reference.
 747  * MOZ_NON_AUTOABLE: Applies to class declarations. Makes it a compile time
 748  *   error to use `auto` in place of this type in variable declarations.  This
 749  *   is intended to be used with types which are intended to be implicitly
 750  *   constructed into other other types before being assigned to variables.
 751  * MOZ_REQUIRED_BASE_METHOD: Applies to virtual class method declarations.
 752  *   Sometimes derived classes override methods that need to be called by their
 753  *   overridden counterparts. This marker indicates that the marked method must
 754  *   be called by the method that it overrides.
 755  * MOZ_MUST_RETURN_FROM_CALLER_IF_THIS_IS_ARG: Applies to method declarations.
 756  *   Callers of the annotated method must return from that function within the
 757  *   calling block using an explicit `return` statement if the "this" value for
 758  *   the call is a parameter of the caller.  Only calls to Constructors,
 759  *   references to local and member variables, and calls to functions or
 760  *   methods marked as MOZ_MAY_CALL_AFTER_MUST_RETURN may be made after the
 761  *   MOZ_MUST_RETURN_FROM_CALLER_IF_THIS_IS_ARG call.
 762  * MOZ_MAY_CALL_AFTER_MUST_RETURN: Applies to function or method declarations.
 763  *   Calls to these methods may be made in functions after calls a
 764  *   MOZ_MUST_RETURN_FROM_CALLER_IF_THIS_IS_ARG method.
 765  * MOZ_UNANNOTATED/MOZ_ANNOTATED: Applies to Mutexes/Monitors and variations on
 766  *   them. MOZ_UNANNOTATED indicates that the Mutex/Monitor/etc hasn't been
 767  *   examined and annotated using macros from mfbt/ThreadSafety --
 768  *   MOZ_GUARDED_BY()/REQUIRES()/etc. MOZ_ANNOTATED is used in rare cases to
 769  *   indicate that is has been looked at, but it did not need any
 770  *   MOZ_GUARDED_BY()/REQUIRES()/etc (and thus static analysis knows it can
 771  * ignore this Mutex/Monitor/etc)
 772  */
 773
 774 // gcc emits a nuisance warning -Wignored-attributes because attributes do not
 775 // affect mangled names, and therefore template arguments do not propagate
 776 // their attributes. It is rare that this would affect anything in practice,
 777 // and most compilers are silent about it. Similarly, -Wattributes complains
 778 // about attributes being ignored during template instantiation.
 779 //
 780 // Be conservative and only suppress the warning when running in a
 781 // configuration where it would be emitted, namely when compiling with the
 782 // XGILL_PLUGIN for the rooting hazard analysis (which runs under gcc.) If we
 783 // end up wanting these attributes in general GCC builds, change this to
 784 // something like
 785 //
 786 //     #if defined(__GNUC__) && ! defined(__clang__)
 787 //
 788 #  ifdef XGILL_PLUGIN
 789 #    pragma GCC diagnostic ignored "-Wignored-attributes"
 790 #    pragma GCC diagnostic ignored "-Wattributes"
 791 #  endif
 792
 793 #  if defined(MOZ_CLANG_PLUGIN) || defined(XGILL_PLUGIN)
 794 #    define MOZ_CAN_RUN_SCRIPT __attribute__((annotate("moz_can_run_script")))
 795 #    define MOZ_CAN_RUN_SCRIPT_FOR_DEFINITION         \
 796       __attribute__((annotate("moz_can_run_script"))) \
 797       __attribute__((annotate("moz_can_run_script_for_definition")))
 798 #    define MOZ_CAN_RUN_SCRIPT_BOUNDARY \
 799       __attribute__((annotate("moz_can_run_script_boundary")))
 800 #    define MOZ_MUST_OVERRIDE __attribute__((annotate("moz_must_override")))
 801 #    define MOZ_STATIC_CLASS __attribute__((annotate("moz_global_class")))
 802 #    define MOZ_STATIC_LOCAL_CLASS                        \
 803       __attribute__((annotate("moz_static_local_class"))) \
 804       __attribute__((annotate("moz_trivial_dtor")))
 805 #    define MOZ_STACK_CLASS __attribute__((annotate("moz_stack_class")))
 806 #    define MOZ_NONHEAP_CLASS __attribute__((annotate("moz_nonheap_class")))
 807 #    define MOZ_HEAP_CLASS __attribute__((annotate("moz_heap_class")))
 808 #    define MOZ_NON_TEMPORARY_CLASS \
 809       __attribute__((annotate("moz_non_temporary_class")))
 810 #    define MOZ_TEMPORARY_CLASS __attribute__((annotate("moz_temporary_class")))
 811 #    define MOZ_TRIVIAL_CTOR_DTOR \
 812       __attribute__((annotate("moz_trivial_ctor_dtor")))
 813 #    define MOZ_ALLOW_TEMPORARY __attribute__((annotate("moz_allow_temporary")))
 814 #    ifdef DEBUG
 815 /* in debug builds, these classes do have non-trivial constructors. */
 816 #      define MOZ_ONLY_USED_TO_AVOID_STATIC_CONSTRUCTORS \
 817         __attribute__((annotate("moz_global_class")))
 818 #    else
 819 #      define MOZ_ONLY_USED_TO_AVOID_STATIC_CONSTRUCTORS \
 820         __attribute__((annotate("moz_global_class"))) MOZ_TRIVIAL_CTOR_DTOR
 821 #    endif
 822 #    define MOZ_IMPLICIT __attribute__((annotate("moz_implicit")))
 823 #    define MOZ_IS_SMARTPTR_TO_REFCOUNTED \
 824       __attribute__((annotate("moz_is_smartptr_to_refcounted")))
 825 #    define MOZ_IS_REFPTR MOZ_IS_SMARTPTR_TO_REFCOUNTED
 826 #    define MOZ_NO_ARITHMETIC_EXPR_IN_ARGUMENT \
 827       __attribute__((annotate("moz_no_arith_expr_in_arg")))
 828 #    define MOZ_OWNING_REF __attribute__((annotate("moz_owning_ref")))
 829 #    define MOZ_NON_OWNING_REF __attribute__((annotate("moz_non_owning_ref")))
 830 #    define MOZ_UNSAFE_REF(reason) __attribute__((annotate("moz_unsafe_ref")))
 831 #    define MOZ_NO_ADDREF_RELEASE_ON_RETURN \
 832       __attribute__((annotate("moz_no_addref_release_on_return")))
 833 #    define MOZ_NEEDS_NO_VTABLE_TYPE \
 834       __attribute__((annotate("moz_needs_no_vtable_type")))
 835 #    define MOZ_NON_MEMMOVABLE __attribute__((annotate("moz_non_memmovable")))
 836 #    define MOZ_NEEDS_MEMMOVABLE_TYPE \
 837       __attribute__((annotate("moz_needs_memmovable_type")))
 838 #    define MOZ_NEEDS_MEMMOVABLE_MEMBERS \
 839       __attribute__((annotate("moz_needs_memmovable_members")))
 840 #    define MOZ_NO_DANGLING_ON_TEMPORARIES \
 841       __attribute__((annotate("moz_no_dangling_on_temporaries")))
 842 #    define MOZ_INHERIT_TYPE_ANNOTATIONS_FROM_TEMPLATE_ARGS \
 843       __attribute__((                                       \
 844           annotate("moz_inherit_type_annotations_from_template_args")))
 845 #    define MOZ_NON_AUTOABLE __attribute__((annotate("moz_non_autoable")))
 846 #    define MOZ_INIT_OUTSIDE_CTOR
 847 #    define MOZ_IS_CLASS_INIT
 848 #    define MOZ_NON_PARAM __attribute__((annotate("moz_non_param")))
 849 #    define MOZ_REQUIRED_BASE_METHOD \
 850       __attribute__((annotate("moz_required_base_method")))
 851 #    define MOZ_MUST_RETURN_FROM_CALLER_IF_THIS_IS_ARG \
 852       __attribute__((annotate("moz_must_return_from_caller_if_this_is_arg")))
 853 #    define MOZ_MAY_CALL_AFTER_MUST_RETURN \
 854       __attribute__((annotate("moz_may_call_after_must_return")))
 855 #    define MOZ_KNOWN_LIVE __attribute__((annotate("moz_known_live")))
 856 #    ifndef XGILL_PLUGIN
 857 #      define MOZ_UNANNOTATED __attribute__((annotate("moz_unannotated")))
 858 #      define MOZ_ANNOTATED __attribute__((annotate("moz_annotated")))
 859 #    else
 860 #      define MOZ_UNANNOTATED /* nothing */
 861 #      define MOZ_ANNOTATED   /* nothing */
 862 #    endif
 863
 864 /*
 865  * It turns out that clang doesn't like void func() __attribute__ {} without a
 866  * warning, so use pragmas to disable the warning.
 867  */
 868 #    ifdef __clang__
 869 #      define MOZ_HEAP_ALLOCATOR                                 \
 870         _Pragma("clang diagnostic push")                         \
 871             _Pragma("clang diagnostic ignored \"-Wgcc-compat\"") \
 872                 __attribute__((annotate("moz_heap_allocator")))  \
 873                 _Pragma("clang diagnostic pop")
 874 #    else
 875 #      define MOZ_HEAP_ALLOCATOR __attribute__((annotate("moz_heap_allocator")))
 876 #    endif
 877 #  else
 878 #    define MOZ_CAN_RUN_SCRIPT                              /* nothing */
 879 #    define MOZ_CAN_RUN_SCRIPT_FOR_DEFINITION               /* nothing */
 880 #    define MOZ_CAN_RUN_SCRIPT_BOUNDARY                     /* nothing */
 881 #    define MOZ_MUST_OVERRIDE                               /* nothing */
 882 #    define MOZ_STATIC_CLASS                                /* nothing */
 883 #    define MOZ_STATIC_LOCAL_CLASS                          /* nothing */
 884 #    define MOZ_STACK_CLASS                                 /* nothing */
 885 #    define MOZ_NONHEAP_CLASS                               /* nothing */
 886 #    define MOZ_HEAP_CLASS                                  /* nothing */
 887 #    define MOZ_NON_TEMPORARY_CLASS                         /* nothing */
 888 #    define MOZ_TEMPORARY_CLASS                             /* nothing */
 889 #    define MOZ_TRIVIAL_CTOR_DTOR                           /* nothing */
 890 #    define MOZ_ALLOW_TEMPORARY                             /* nothing */
 891 #    define MOZ_ONLY_USED_TO_AVOID_STATIC_CONSTRUCTORS      /* nothing */
 892 #    define MOZ_IMPLICIT                                    /* nothing */
 893 #    define MOZ_IS_SMARTPTR_TO_REFCOUNTED                   /* nothing */
 894 #    define MOZ_IS_REFPTR                                   /* nothing */
 895 #    define MOZ_NO_ARITHMETIC_EXPR_IN_ARGUMENT              /* nothing */
 896 #    define MOZ_HEAP_ALLOCATOR                              /* nothing */
 897 #    define MOZ_OWNING_REF                                  /* nothing */
 898 #    define MOZ_NON_OWNING_REF                              /* nothing */
 899 #    define MOZ_UNSAFE_REF(reason)                          /* nothing */
 900 #    define MOZ_NO_ADDREF_RELEASE_ON_RETURN                 /* nothing */
 901 #    define MOZ_NEEDS_NO_VTABLE_TYPE                        /* nothing */
 902 #    define MOZ_NON_MEMMOVABLE                              /* nothing */
 903 #    define MOZ_NEEDS_MEMMOVABLE_TYPE                       /* nothing */
 904 #    define MOZ_NEEDS_MEMMOVABLE_MEMBERS                    /* nothing */
 905 #    define MOZ_NO_DANGLING_ON_TEMPORARIES                  /* nothing */
 906 #    define MOZ_INHERIT_TYPE_ANNOTATIONS_FROM_TEMPLATE_ARGS /* nothing */
 907 #    define MOZ_INIT_OUTSIDE_CTOR                           /* nothing */
 908 #    define MOZ_IS_CLASS_INIT                               /* nothing */
 909 #    define MOZ_NON_PARAM                                   /* nothing */
 910 #    define MOZ_NON_AUTOABLE                                /* nothing */
 911 #    define MOZ_REQUIRED_BASE_METHOD                        /* nothing */
 912 #    define MOZ_MUST_RETURN_FROM_CALLER_IF_THIS_IS_ARG      /* nothing */
 913 #    define MOZ_MAY_CALL_AFTER_MUST_RETURN                  /* nothing */
 914 #    define MOZ_KNOWN_LIVE                                  /* nothing */
 915 #    define MOZ_UNANNOTATED                                 /* nothing */
 916 #    define MOZ_ANNOTATED                                   /* nothing */
 917 #  endif /* defined(MOZ_CLANG_PLUGIN) || defined(XGILL_PLUGIN) */
 918
 919 #  define MOZ_RAII MOZ_NON_TEMPORARY_CLASS MOZ_STACK_CLASS
 920
 921 // XGILL_PLUGIN is used for the GC rooting hazard analysis, which compiles with
 922 // gcc. gcc has different rules governing __attribute__((...)) placement, so
 923 // some attributes will error out when used in the source code where clang
 924 // expects them to be. Remove the problematic annotations when needed.
 925 //
 926 // The placement of c++11 [[...]] attributes is more flexible and defined by a
 927 // spec, so it would be nice to switch to those for the problematic
 928 // cases. Unfortunately, the official spec provides *no* way to annotate a
 929 // lambda function, which is one source of the difficulty here. It appears that
 930 // this will be fixed in c++23: https://github.com/cplusplus/papers/issues/882
 931
 932 #  ifdef XGILL_PLUGIN
 933
 934 #    undef MOZ_MUST_OVERRIDE
 935 #    undef MOZ_CAN_RUN_SCRIPT_FOR_DEFINITION
 936 #    undef MOZ_CAN_RUN_SCRIPT
 937 #    undef MOZ_CAN_RUN_SCRIPT_BOUNDARY
 938 #    define MOZ_MUST_OVERRIDE                 /* nothing */
 939 #    define MOZ_CAN_RUN_SCRIPT_FOR_DEFINITION /* nothing */
 940 #    define MOZ_CAN_RUN_SCRIPT                /* nothing */
 941 #    define MOZ_CAN_RUN_SCRIPT_BOUNDARY       /* nothing */
 942
 943 #  endif
 944
 945 #endif /* __cplusplus */
 946
 947 /**
 948  * Printf style formats.  MOZ_FORMAT_PRINTF and MOZ_FORMAT_WPRINTF can be used
 949  * to annotate a function or method that is "printf/wprintf-like"; this will let
 950  * (some) compilers check that the arguments match the template string.
 951  *
 952  * This macro takes two arguments.  The first argument is the argument
 953  * number of the template string.  The second argument is the argument
 954  * number of the '...' argument holding the arguments.
 955  *
 956  * Argument numbers start at 1.  Note that the implicit "this"
 957  * argument of a non-static member function counts as an argument.
 958  *
 959  * So, for a simple case like:
 960  *   void print_something (int whatever, const char *fmt, ...);
 961  * The corresponding annotation would be
 962  *   MOZ_FORMAT_PRINTF(2, 3)
 963  * However, if "print_something" were a non-static member function,
 964  * then the annotation would be:
 965  *   MOZ_FORMAT_PRINTF(3, 4)
 966  *
 967  * The second argument should be 0 for vprintf-like functions; that
 968  * is, those taking a va_list argument.
 969  *
 970  * Note that the checking is limited to standards-conforming
 971  * printf-likes, and in particular this should not be used for
 972  * PR_snprintf and friends, which are "printf-like" but which assign
 973  * different meanings to the various formats.
 974  *
 975  * MinGW requires special handling due to different format specifiers
 976  * on different platforms. The macro __MINGW_PRINTF_FORMAT maps to
 977  * either gnu_printf or ms_printf depending on where we are compiling
 978  * to avoid warnings on format specifiers that are legal.
 979  *
 980  * At time of writing MinGW has no wide equivalent to __MINGW_PRINTF_FORMAT;
 981  * therefore __MINGW_WPRINTF_FORMAT has been implemented following the same
 982  * pattern seen in MinGW's source.
 983  */
 984 #ifdef __MINGW32__
 985 #  define MOZ_FORMAT_PRINTF(stringIndex, firstToCheck) \
 986     __attribute__((format(__MINGW_PRINTF_FORMAT, stringIndex, firstToCheck)))
 987 #  ifndef __MINGW_WPRINTF_FORMAT
 988 #    if defined(__clang__)
 989 #      define __MINGW_WPRINTF_FORMAT wprintf
 990 #    elif defined(_UCRT) || __USE_MINGW_ANSI_STDIO
 991 #      define __MINGW_WPRINTF_FORMAT gnu_wprintf
 992 #    else
 993 #      define __MINGW_WPRINTF_FORMAT ms_wprintf
 994 #    endif
 995 #  endif
 996 #  define MOZ_FORMAT_WPRINTF(stringIndex, firstToCheck) \
 997     __attribute__((format(__MINGW_WPRINTF_FORMAT, stringIndex, firstToCheck)))
 998 #elif __GNUC__ || __clang__
 999 #  define MOZ_FORMAT_PRINTF(stringIndex, firstToCheck) \
1000     __attribute__((format(printf, stringIndex, firstToCheck)))
1001 #  define MOZ_FORMAT_WPRINTF(stringIndex, firstToCheck) \
1002     __attribute__((format(wprintf, stringIndex, firstToCheck)))
1003 #else
1004 #  define MOZ_FORMAT_PRINTF(stringIndex, firstToCheck)
1005 #  define MOZ_FORMAT_WPRINTF(stringIndex, firstToCheck)
1006 #endif
1007
1008 /**
1009  * To manually declare an XPCOM ABI-compatible virtual function, the following
1010  * macros can be used to handle the non-standard ABI used on Windows for COM
1011  * compatibility. E.g.:
1012  *
1013  *   virtual ReturnType MOZ_XPCOM_ABI foo();
1014  */
1015 #if defined(XP_WIN)
1016 #  define MOZ_XPCOM_ABI __stdcall
1017 #else
1018 #  define MOZ_XPCOM_ABI
1019 #endif
1020
1021 /**
1022  * MSVC / clang-cl don't optimize empty bases correctly unless we explicitly
1023  * tell it to, see:
1024  *
1025  * https://stackoverflow.com/questions/12701469/why-is-the-empty-base-class-optimization-ebo-is-not-working-in-msvc
1026  * https://devblogs.microsoft.com/cppblog/optimizing-the-layout-of-empty-base-classes-in-vs2015-update-2-3/
1027  */
1028 #if defined(_MSC_VER)
1029 #  define MOZ_EMPTY_BASES __declspec(empty_bases)
1030 #else
1031 #  define MOZ_EMPTY_BASES
1032 #endif
1033
1034 // XXX: GCC somehow does not allow attributes before lambda return types, while
1035 // clang requires so. See also bug 1627007.
1036 #ifdef __clang__
1037 #  define MOZ_CAN_RUN_SCRIPT_BOUNDARY_LAMBDA MOZ_CAN_RUN_SCRIPT_BOUNDARY
1038 #else
1039 #  define MOZ_CAN_RUN_SCRIPT_BOUNDARY_LAMBDA
1040 #endif
1041
1042 #endif /* mozilla_Attributes_h */