| blob | d6e6293066ef38b18256d3d8b803e921a02b2c1a |
1 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
2 /* vim: set ts=8 sts=2 et sw=2 tw=80: */
3 /* This Source Code Form is subject to the terms of the Mozilla Public
4 * License, v. 2.0. If a copy of the MPL was not distributed with this
5 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
7 /* Implementations of various class and method modifier attributes. */
9 #ifndef mozilla_Attributes_h
10 #define mozilla_Attributes_h
14 /*
15 * MOZ_ALWAYS_INLINE is a macro which expands to tell the compiler that the
16 * method decorated with it must be inlined, even if the compiler thinks
17 * otherwise. This is only a (much) stronger version of the inline hint:
18 * compilers are not guaranteed to respect it (although they're much more likely
19 * to do so).
20 *
21 * The MOZ_ALWAYS_INLINE_EVEN_DEBUG macro is yet stronger. It tells the
22 * compiler to inline even in DEBUG builds. It should be used very rarely.
23 */
24 #if defined(_MSC_VER)
25 # define MOZ_ALWAYS_INLINE_EVEN_DEBUG __forceinline
26 #elif defined(__GNUC__)
27 # define MOZ_ALWAYS_INLINE_EVEN_DEBUG __attribute__((always_inline)) inline
28 #else
29 # define MOZ_ALWAYS_INLINE_EVEN_DEBUG inline
30 #endif
32 #if !defined(DEBUG)
33 # define MOZ_ALWAYS_INLINE MOZ_ALWAYS_INLINE_EVEN_DEBUG
34 #elif defined(_MSC_VER) && !defined(__cplusplus)
35 # define MOZ_ALWAYS_INLINE __inline
36 #else
37 # define MOZ_ALWAYS_INLINE inline
38 #endif
40 #if defined(_MSC_VER)
41 /*
42 * g++ requires -std=c++0x or -std=gnu++0x to support C++11 functionality
43 * without warnings (functionality used by the macros below). These modes are
44 * detectable by checking whether __GXX_EXPERIMENTAL_CXX0X__ is defined or, more
45 * standardly, by checking whether __cplusplus has a C++11 or greater value.
46 * Current versions of g++ do not correctly set __cplusplus, so we check both
47 * for forward compatibility.
48 */
49 # define MOZ_HAVE_NEVER_INLINE __declspec(noinline)
50 # define MOZ_HAVE_NORETURN __declspec(noreturn)
51 #elif defined(__clang__)
52 /*
53 * Per Clang documentation, "Note that marketing version numbers should not
54 * be used to check for language features, as different vendors use different
55 * numbering schemes. Instead, use the feature checking macros."
56 */
57 # ifndef __has_extension
58 # define __has_extension \
60 # endif
61 # if __has_attribute(noinline)
62 # define MOZ_HAVE_NEVER_INLINE __attribute__((noinline))
63 # endif
64 # if __has_attribute(noreturn)
65 # define MOZ_HAVE_NORETURN __attribute__((noreturn))
66 # endif
67 #elif defined(__GNUC__)
68 # define MOZ_HAVE_NEVER_INLINE __attribute__((noinline))
69 # define MOZ_HAVE_NORETURN __attribute__((noreturn))
70 # define MOZ_HAVE_NORETURN_PTR __attribute__((noreturn))
71 #endif
73 #if defined(__clang__)
74 # if __has_attribute(no_stack_protector)
75 # define MOZ_HAVE_NO_STACK_PROTECTOR __attribute__((no_stack_protector))
76 # endif
77 #elif defined(__GNUC__)
78 # define MOZ_HAVE_NO_STACK_PROTECTOR __attribute__((no_stack_protector))
79 #endif
81 /*
82 * When built with clang analyzer (a.k.a scan-build), define MOZ_HAVE_NORETURN
83 * to mark some false positives
84 */
85 #ifdef __clang_analyzer__
86 # if __has_extension(attribute_analyzer_noreturn)
87 # define MOZ_HAVE_ANALYZER_NORETURN __attribute__((analyzer_noreturn))
88 # endif
89 #endif
91 /*
92 * MOZ_NEVER_INLINE is a macro which expands to tell the compiler that the
93 * method decorated with it must never be inlined, even if the compiler would
94 * otherwise choose to inline the method. Compilers aren't absolutely
95 * guaranteed to support this, but most do.
96 */
97 #if defined(MOZ_HAVE_NEVER_INLINE)
98 # define MOZ_NEVER_INLINE MOZ_HAVE_NEVER_INLINE
99 #else
101 #endif
103 /*
104 * MOZ_NEVER_INLINE_DEBUG is a macro which expands to MOZ_NEVER_INLINE
105 * in debug builds, and nothing in opt builds.
106 */
107 #if defined(DEBUG)
108 # define MOZ_NEVER_INLINE_DEBUG MOZ_NEVER_INLINE
109 #else
111 #endif
112 /*
113 * MOZ_NORETURN, specified at the start of a function declaration, indicates
114 * that the given function does not return. (The function definition does not
115 * need to be annotated.)
116 *
117 * MOZ_NORETURN void abort(const char* msg);
118 *
119 * This modifier permits the compiler to optimize code assuming a call to such a
120 * function will never return. It also enables the compiler to avoid spurious
121 * warnings about not initializing variables, or about any other seemingly-dodgy
122 * operations performed after the function returns.
123 *
124 * There are two variants. The GCC version of NORETURN may be applied to a
125 * function pointer, while for MSVC it may not.
126 *
127 * This modifier does not affect the corresponding function's linking behavior.
128 */
129 #if defined(MOZ_HAVE_NORETURN)
130 # define MOZ_NORETURN MOZ_HAVE_NORETURN
131 #else
133 #endif
134 #if defined(MOZ_HAVE_NORETURN_PTR)
135 # define MOZ_NORETURN_PTR MOZ_HAVE_NORETURN_PTR
136 #else
138 #endif
140 /**
141 * MOZ_COLD tells the compiler that a function is "cold", meaning infrequently
142 * executed. This may lead it to optimize for size more aggressively than speed,
143 * or to allocate the body of the function in a distant part of the text segment
144 * to help keep it from taking up unnecessary icache when it isn't in use.
145 *
146 * Place this attribute at the very beginning of a function definition. For
147 * example, write
148 *
149 * MOZ_COLD int foo();
150 *
151 * or
152 *
153 * MOZ_COLD int foo() { return 42; }
154 */
155 #if defined(__GNUC__) || defined(__clang__)
156 # define MOZ_COLD __attribute__((cold))
157 #else
158 # define MOZ_COLD
159 #endif
161 /**
162 * MOZ_NONNULL tells the compiler that some of the arguments to a function are
163 * known to be non-null. The arguments are a list of 1-based argument indexes
164 * identifying arguments which are known to be non-null.
165 *
166 * Place this attribute at the very beginning of a function definition. For
167 * example, write
168 *
169 * MOZ_NONNULL(1, 2) int foo(char *p, char *q);
170 */
171 #if defined(__GNUC__) || defined(__clang__)
172 # define MOZ_NONNULL(...) __attribute__((nonnull(__VA_ARGS__)))
173 #else
174 # define MOZ_NONNULL(...)
175 #endif
177 /**
178 * MOZ_NONNULL_RETURN tells the compiler that the function's return value is
179 * guaranteed to be a non-null pointer, which may enable the compiler to
180 * optimize better at call sites.
181 *
182 * Place this attribute at the end of a function declaration. For example,
183 *
184 * char* foo(char *p, char *q) MOZ_NONNULL_RETURN;
185 */
186 #if defined(__GNUC__) || defined(__clang__)
187 # define MOZ_NONNULL_RETURN __attribute__((returns_nonnull))
188 #else
189 # define MOZ_NONNULL_RETURN
190 #endif
192 /*
193 * MOZ_PRETEND_NORETURN_FOR_STATIC_ANALYSIS, specified at the end of a function
194 * declaration, indicates that for the purposes of static analysis, this
195 * function does not return. (The function definition does not need to be
196 * annotated.)
197 *
198 * MOZ_ReportCrash(const char* s, const char* file, int ln)
199 * MOZ_PRETEND_NORETURN_FOR_STATIC_ANALYSIS
200 *
201 * Some static analyzers, like scan-build from clang, can use this information
202 * to eliminate false positives. From the upstream documentation of scan-build:
203 * "This attribute is useful for annotating assertion handlers that actually
204 * can return, but for the purpose of using the analyzer we want to pretend
205 * that such functions do not return."
206 *
207 */
208 #if defined(MOZ_HAVE_ANALYZER_NORETURN)
209 # define MOZ_PRETEND_NORETURN_FOR_STATIC_ANALYSIS MOZ_HAVE_ANALYZER_NORETURN
210 #else
212 #endif
214 /*
215 * MOZ_ASAN_IGNORE is a macro to tell AddressSanitizer (a compile-time
216 * instrumentation shipped with Clang and GCC) to not instrument the annotated
217 * function. Furthermore, it will prevent the compiler from inlining the
218 * function because inlining currently breaks the blocklisting mechanism of
219 * AddressSanitizer.
220 */
221 #if defined(__has_feature)
222 # if __has_feature(address_sanitizer)
223 # define MOZ_HAVE_ASAN_IGNORE
224 # endif
225 #elif defined(__GNUC__)
226 # if defined(__SANITIZE_ADDRESS__)
227 # define MOZ_HAVE_ASAN_IGNORE
228 # endif
229 #endif
231 #if defined(MOZ_HAVE_ASAN_IGNORE)
232 # define MOZ_ASAN_IGNORE MOZ_NEVER_INLINE __attribute__((no_sanitize_address))
233 #else
235 #endif
237 /*
238 * MOZ_TSAN_IGNORE is a macro to tell ThreadSanitizer (a compile-time
239 * instrumentation shipped with Clang) to not instrument the annotated function.
240 * Furthermore, it will prevent the compiler from inlining the function because
241 * inlining currently breaks the blocklisting mechanism of ThreadSanitizer.
242 */
243 #if defined(__has_feature)
244 # if __has_feature(thread_sanitizer)
245 # define MOZ_TSAN_IGNORE MOZ_NEVER_INLINE __attribute__((no_sanitize_thread))
246 # else
248 # endif
249 #else
251 #endif
253 #if defined(__has_attribute)
254 # if __has_attribute(no_sanitize)
255 # define MOZ_HAVE_NO_SANITIZE_ATTR
256 # endif
257 #endif
259 #ifdef __clang__
260 # ifdef MOZ_HAVE_NO_SANITIZE_ATTR
261 # define MOZ_HAVE_UNSIGNED_OVERFLOW_SANITIZE_ATTR
262 # define MOZ_HAVE_SIGNED_OVERFLOW_SANITIZE_ATTR
263 # endif
264 #endif
266 /*
267 * MOZ_NO_SANITIZE_UNSIGNED_OVERFLOW disables *un*signed integer overflow
268 * checking on the function it annotates, in builds configured to perform it.
269 * (Currently this is only Clang using -fsanitize=unsigned-integer-overflow, or
270 * via --enable-unsigned-overflow-sanitizer in Mozilla's build system.) It has
271 * no effect in other builds.
272 *
273 * Place this attribute at the very beginning of a function declaration.
274 *
275 * Unsigned integer overflow isn't *necessarily* a bug. It's well-defined in
276 * C/C++, and code may reasonably depend upon it. For example,
277 *
278 * MOZ_NO_SANITIZE_UNSIGNED_OVERFLOW inline bool
279 * IsDecimal(char aChar)
280 * {
281 * // For chars less than '0', unsigned integer underflow occurs, to a value
282 * // much greater than 10, so the overall test is false.
283 * // For chars greater than '0', no overflow occurs, and only '0' to '9'
284 * // pass the overall test.
285 * return static_cast<unsigned int>(aChar) - '0' < 10;
286 * }
287 *
288 * But even well-defined unsigned overflow often causes bugs when it occurs, so
289 * it should be restricted to functions annotated with this attribute.
290 *
291 * The compiler instrumentation to detect unsigned integer overflow has costs
292 * both at compile time and at runtime. Functions that are repeatedly inlined
293 * at compile time will also implicitly inline the necessary instrumentation,
294 * increasing compile time. Similarly, frequently-executed functions that
295 * require large amounts of instrumentation will also notice significant runtime
296 * slowdown to execute that instrumentation. Use this attribute to eliminate
297 * those costs -- but only after carefully verifying that no overflow can occur.
298 */
299 #ifdef MOZ_HAVE_UNSIGNED_OVERFLOW_SANITIZE_ATTR
300 # define MOZ_NO_SANITIZE_UNSIGNED_OVERFLOW \
302 #else
304 #endif
306 /*
307 * MOZ_NO_SANITIZE_SIGNED_OVERFLOW disables *signed* integer overflow checking
308 * on the function it annotates, in builds configured to perform it. (Currently
309 * this is only Clang using -fsanitize=signed-integer-overflow, or via
310 * --enable-signed-overflow-sanitizer in Mozilla's build system. GCC support
311 * will probably be added in the future.) It has no effect in other builds.
312 *
313 * Place this attribute at the very beginning of a function declaration.
314 *
315 * Signed integer overflow is undefined behavior in C/C++: *anything* can happen
316 * when it occurs. *Maybe* wraparound behavior will occur, but maybe also the
317 * compiler will assume no overflow happens and will adversely optimize the rest
318 * of your code. Code that contains signed integer overflow needs to be fixed.
319 *
320 * The compiler instrumentation to detect signed integer overflow has costs both
321 * at compile time and at runtime. Functions that are repeatedly inlined at
322 * compile time will also implicitly inline the necessary instrumentation,
323 * increasing compile time. Similarly, frequently-executed functions that
324 * require large amounts of instrumentation will also notice significant runtime
325 * slowdown to execute that instrumentation. Use this attribute to eliminate
326 * those costs -- but only after carefully verifying that no overflow can occur.
327 */
328 #ifdef MOZ_HAVE_SIGNED_OVERFLOW_SANITIZE_ATTR
329 # define MOZ_NO_SANITIZE_SIGNED_OVERFLOW \
331 #else
333 #endif
335 #undef MOZ_HAVE_NO_SANITIZE_ATTR
337 /**
338 * MOZ_ALLOCATOR tells the compiler that the function it marks returns either a
339 * "fresh", "pointer-free" block of memory, or nullptr. "Fresh" means that the
340 * block is not pointed to by any other reachable pointer in the program.
341 * "Pointer-free" means that the block contains no pointers to any valid object
342 * in the program. It may be initialized with other (non-pointer) values.
343 *
344 * Placing this attribute on appropriate functions helps GCC analyze pointer
345 * aliasing more accurately in their callers.
346 *
347 * GCC warns if a caller ignores the value returned by a function marked with
348 * MOZ_ALLOCATOR: it is hard to imagine cases where dropping the value returned
349 * by a function that meets the criteria above would be intentional.
350 *
351 * Place this attribute after the argument list and 'this' qualifiers of a
352 * function definition. For example, write
353 *
354 * void *my_allocator(size_t) MOZ_ALLOCATOR;
355 *
356 * or
357 *
358 * void *my_allocator(size_t bytes) MOZ_ALLOCATOR { ... }
359 */
360 #if defined(__GNUC__) || defined(__clang__)
361 # define MOZ_ALLOCATOR __attribute__((malloc, warn_unused_result))
362 # define MOZ_INFALLIBLE_ALLOCATOR \
363 __attribute__((malloc, warn_unused_result, returns_nonnull))
364 #else
365 # define MOZ_ALLOCATOR
366 # define MOZ_INFALLIBLE_ALLOCATOR
367 #endif
369 /**
370 * MOZ_MAYBE_UNUSED suppresses compiler warnings about functions that are
371 * never called (in this build configuration, at least).
372 *
373 * Place this attribute at the very beginning of a function declaration. For
374 * example, write
375 *
376 * MOZ_MAYBE_UNUSED int foo();
377 *
378 * or
379 *
380 * MOZ_MAYBE_UNUSED int foo() { return 42; }
381 */
382 #if defined(__GNUC__) || defined(__clang__)
383 # define MOZ_MAYBE_UNUSED __attribute__((__unused__))
384 #elif defined(_MSC_VER)
385 # define MOZ_MAYBE_UNUSED __pragma(warning(suppress : 4505))
386 #else
387 # define MOZ_MAYBE_UNUSED
388 #endif
390 /*
391 * MOZ_NO_STACK_PROTECTOR, specified at the start of a function declaration,
392 * indicates that the given function should *NOT* be instrumented to detect
393 * stack buffer overflows at runtime. (The function definition does not need to
394 * be annotated.)
395 *
396 * MOZ_NO_STACK_PROTECTOR int foo();
397 *
398 * Detecting stack buffer overflows at runtime is a security feature. This
399 * modifier should thus only be used on functions which are provably exempt of
400 * stack buffer overflows, for example because they do not use stack buffers.
401 *
402 * This modifier does not affect the corresponding function's linking behavior.
403 */
404 #if defined(MOZ_HAVE_NO_STACK_PROTECTOR)
405 # define MOZ_NO_STACK_PROTECTOR MOZ_HAVE_NO_STACK_PROTECTOR
406 #else
408 #endif
410 #ifdef __cplusplus
412 /**
413 * C++11 lets unions contain members that have non-trivial special member
414 * functions (default/copy/move constructor, copy/move assignment operator,
415 * destructor) if the user defines the corresponding functions on the union.
416 * (Such user-defined functions must rely on external knowledge about which arm
417 * is active to be safe. Be extra-careful defining these functions!)
418 *
419 * MSVC unfortunately warns/errors for this bog-standard C++11 pattern. Use
420 * these macro-guards around such member functions to disable the warnings:
421 *
422 * union U
423 * {
424 * std::string s;
425 * int x;
426 *
427 * MOZ_PUSH_DISABLE_NONTRIVIAL_UNION_WARNINGS
428 *
429 * // |U| must have a user-defined default constructor because |std::string|
430 * // has a non-trivial default constructor.
431 * U() ... { ... }
432 *
433 * // |U| must have a user-defined destructor because |std::string| has a
434 * // non-trivial destructor.
435 * ~U() { ... }
436 *
437 * MOZ_POP_DISABLE_NONTRIVIAL_UNION_WARNINGS
438 * };
439 */
440 # if defined(_MSC_VER)
441 # define MOZ_PUSH_DISABLE_NONTRIVIAL_UNION_WARNINGS \
442 __pragma(warning(push)) __pragma(warning(disable : 4582)) \
443 __pragma(warning(disable : 4583))
444 # define MOZ_POP_DISABLE_NONTRIVIAL_UNION_WARNINGS __pragma(warning(pop))
445 # else
448 # endif
450 /*
451 * The following macros are attributes that support the static analysis plugin
452 * included with Mozilla, and will be implemented (when such support is enabled)
453 * as C++11 attributes. Since such attributes are legal pretty much everywhere
454 * and have subtly different semantics depending on their placement, the
455 * following is a guide on where to place the attributes.
456 *
457 * Attributes that apply to a struct or class precede the name of the class:
458 * (Note that this is different from the placement of final for classes!)
459 *
460 * class MOZ_CLASS_ATTRIBUTE SomeClass {};
461 *
462 * Attributes that apply to functions follow the parentheses and const
463 * qualifiers but precede final, override and the function body:
464 *
465 * void DeclaredFunction() MOZ_FUNCTION_ATTRIBUTE;
466 * void SomeFunction() MOZ_FUNCTION_ATTRIBUTE {}
467 * void PureFunction() const MOZ_FUNCTION_ATTRIBUTE = 0;
468 * void OverriddenFunction() MOZ_FUNCTION_ATTIRBUTE override;
469 *
470 * Attributes that apply to variables or parameters follow the variable's name:
471 *
472 * int variable MOZ_VARIABLE_ATTRIBUTE;
473 *
474 * Attributes that apply to types follow the type name:
475 *
476 * typedef int MOZ_TYPE_ATTRIBUTE MagicInt;
477 * int MOZ_TYPE_ATTRIBUTE someVariable;
478 * int* MOZ_TYPE_ATTRIBUTE magicPtrInt;
479 * int MOZ_TYPE_ATTRIBUTE* ptrToMagicInt;
480 *
481 * Attributes that apply to statements precede the statement:
482 *
483 * MOZ_IF_ATTRIBUTE if (x == 0)
484 * MOZ_DO_ATTRIBUTE do { } while (0);
485 *
486 * Attributes that apply to labels precede the label:
487 *
488 * MOZ_LABEL_ATTRIBUTE target:
489 * goto target;
490 * MOZ_CASE_ATTRIBUTE case 5:
491 * MOZ_DEFAULT_ATTRIBUTE default:
492 *
493 * The static analyses that are performed by the plugin are as follows:
494 *
495 * MOZ_CAN_RUN_SCRIPT: Applies to functions which can run script. Callers of
496 * this function must also be marked as MOZ_CAN_RUN_SCRIPT, and all refcounted
497 * arguments must be strongly held in the caller. Note that MOZ_CAN_RUN_SCRIPT
498 * should only be applied to function declarations, not definitions. If you
499 * need to apply it to a definition (eg because both are generated by a macro)
500 * use MOZ_CAN_RUN_SCRIPT_FOR_DEFINITION.
501 *
502 * MOZ_CAN_RUN_SCRIPT can be applied to XPIDL-generated declarations by
503 * annotating the method or attribute as [can_run_script] in the .idl file.
504 *
505 * MOZ_CAN_RUN_SCRIPT_FOR_DEFINITION: Same as MOZ_CAN_RUN_SCRIPT, but usable on
506 * a definition. If the declaration is in a header file, users of that header
507 * file may not see the annotation.
508 * MOZ_CAN_RUN_SCRIPT_BOUNDARY: Applies to functions which need to call
509 * MOZ_CAN_RUN_SCRIPT functions, but should not themselves be considered
510 * MOZ_CAN_RUN_SCRIPT. This should generally be avoided but can be used in
511 * two cases:
512 * 1) As a temporary measure to limit the scope of changes when adding
513 * MOZ_CAN_RUN_SCRIPT. Such a use must be accompanied by a follow-up bug
514 * to replace the MOZ_CAN_RUN_SCRIPT_BOUNDARY with MOZ_CAN_RUN_SCRIPT and
515 * a comment linking to that bug.
516 * 2) If we can reason that the MOZ_CAN_RUN_SCRIPT callees of the function
517 * do not in fact run script (for example, because their behavior depends
518 * on arguments and we pass the arguments that don't allow script
519 * execution). Such a use must be accompanied by a comment that explains
520 * why it's OK to have the MOZ_CAN_RUN_SCRIPT_BOUNDARY, as well as
521 * comments in the callee pointing out that if its behavior changes the
522 * caller might need adjusting. And perhaps also a followup bug to
523 * refactor things so the "script" and "no script" codepaths do not share
524 * a chokepoint.
525 * Importantly, any use MUST be accompanied by a comment explaining why it's
526 * there, and should ideally have an action plan for getting rid of the
527 * MOZ_CAN_RUN_SCRIPT_BOUNDARY annotation.
528 * MOZ_MUST_OVERRIDE: Applies to all C++ member functions. All immediate
529 * subclasses must provide an exact override of this method; if a subclass
530 * does not override this method, the compiler will emit an error. This
531 * attribute is not limited to virtual methods, so if it is applied to a
532 * nonvirtual method and the subclass does not provide an equivalent
533 * definition, the compiler will emit an error.
534 * MOZ_STATIC_CLASS: Applies to all classes. Any class with this annotation is
535 * expected to live in static memory, so it is a compile-time error to use
536 * it, or an array of such objects, as the type of a variable declaration, or
537 * as a temporary object, or as the type of a new expression (unless
538 * placement new is being used). If a member of another class uses this
539 * class, or if another class inherits from this class, then it is considered
540 * to be a static class as well, although this attribute need not be provided
541 * in such cases.
542 * MOZ_STATIC_LOCAL_CLASS: Applies to all classes. Any class with this
543 * annotation is expected to be a static local variable, so it is
544 * a compile-time error to use it, or an array of such objects, or as a
545 * temporary object, or as the type of a new expression. If another class
546 * inherits from this class then it is considered to be a static local
547 * class as well, although this attribute need not be provided in such cases.
548 * It is also a compile-time error for any class with this annotation to have
549 * a non-trivial destructor.
550 * MOZ_STACK_CLASS: Applies to all classes. Any class with this annotation is
551 * expected to live on the stack, so it is a compile-time error to use it, or
552 * an array of such objects, as a global or static variable, or as the type of
553 * a new expression (unless placement new is being used). If a member of
554 * another class uses this class, or if another class inherits from this
555 * class, then it is considered to be a stack class as well, although this
556 * attribute need not be provided in such cases.
557 * MOZ_NONHEAP_CLASS: Applies to all classes. Any class with this annotation is
558 * expected to live on the stack or in static storage, so it is a compile-time
559 * error to use it, or an array of such objects, as the type of a new
560 * expression. If a member of another class uses this class, or if another
561 * class inherits from this class, then it is considered to be a non-heap
562 * class as well, although this attribute need not be provided in such cases.
563 * MOZ_HEAP_CLASS: Applies to all classes. Any class with this annotation is
564 * expected to live on the heap, so it is a compile-time error to use it, or
565 * an array of such objects, as the type of a variable declaration, or as a
566 * temporary object. If a member of another class uses this class, or if
567 * another class inherits from this class, then it is considered to be a heap
568 * class as well, although this attribute need not be provided in such cases.
569 * MOZ_NON_TEMPORARY_CLASS: Applies to all classes. Any class with this
570 * annotation is expected not to live in a temporary. If a member of another
571 * class uses this class or if another class inherits from this class, then it
572 * is considered to be a non-temporary class as well, although this attribute
573 * need not be provided in such cases.
574 * MOZ_TEMPORARY_CLASS: Applies to all classes. Any class with this annotation
575 * is expected to only live in a temporary. If another class inherits from
576 * this class, then it is considered to be a non-temporary class as well,
577 * although this attribute need not be provided in such cases.
578 * MOZ_RAII: Applies to all classes. Any class with this annotation is assumed
579 * to be a RAII guard, which is expected to live on the stack in an automatic
580 * allocation. It is prohibited from being allocated in a temporary, static
581 * storage, or on the heap. This is a combination of MOZ_STACK_CLASS and
582 * MOZ_NON_TEMPORARY_CLASS.
583 * MOZ_ONLY_USED_TO_AVOID_STATIC_CONSTRUCTORS: Applies to all classes that are
584 * intended to prevent introducing static initializers. This attribute
585 * currently makes it a compile-time error to instantiate these classes
586 * anywhere other than at the global scope, or as a static member of a class.
587 * In non-debug mode, it also prohibits non-trivial constructors and
588 * destructors.
589 * MOZ_TRIVIAL_CTOR_DTOR: Applies to all classes that must have both a trivial
590 * or constexpr constructor and a trivial destructor. Setting this attribute
591 * on a class makes it a compile-time error for that class to get a
592 * non-trivial constructor or destructor for any reason.
593 * MOZ_ALLOW_TEMPORARY: Applies to constructors. This indicates that using the
594 * constructor is allowed in temporary expressions, if it would have otherwise
595 * been forbidden by the type being a MOZ_NON_TEMPORARY_CLASS. Useful for
596 * constructors like Maybe(Nothing).
597 * MOZ_HEAP_ALLOCATOR: Applies to any function. This indicates that the return
598 * value is allocated on the heap, and will as a result check such allocations
599 * during MOZ_STACK_CLASS and MOZ_NONHEAP_CLASS annotation checking.
600 * MOZ_IMPLICIT: Applies to constructors. Implicit conversion constructors
601 * are disallowed by default unless they are marked as MOZ_IMPLICIT. This
602 * attribute must be used for constructors which intend to provide implicit
603 * conversions.
604 * MOZ_IS_REFPTR: Applies to class declarations of ref pointer to mark them as
605 * such for use with static-analysis.
606 * A ref pointer is an object wrapping a pointer and automatically taking care
607 * of its refcounting upon construction/destruction/transfer of ownership.
608 * This annotation implies MOZ_IS_SMARTPTR_TO_REFCOUNTED.
609 * MOZ_IS_SMARTPTR_TO_REFCOUNTED: Applies to class declarations of smart
610 * pointers to ref counted classes to mark them as such for use with
611 * static-analysis.
612 * MOZ_NO_ARITHMETIC_EXPR_IN_ARGUMENT: Applies to functions. Makes it a compile
613 * time error to pass arithmetic expressions on variables to the function.
614 * MOZ_OWNING_REF: Applies to declarations of pointers to reference counted
615 * types. This attribute tells the compiler that the raw pointer is a strong
616 * reference, where ownership through methods such as AddRef and Release is
617 * managed manually. This can make the compiler ignore these pointers when
618 * validating the usage of pointers otherwise.
619 *
620 * Example uses include owned pointers inside of unions, and pointers stored
621 * in POD types where a using a smart pointer class would make the object
622 * non-POD.
623 * MOZ_NON_OWNING_REF: Applies to declarations of pointers to reference counted
624 * types. This attribute tells the compiler that the raw pointer is a weak
625 * reference, which is ensured to be valid by a guarantee that the reference
626 * will be nulled before the pointer becomes invalid. This can make the
627 * compiler ignore these pointers when validating the usage of pointers
628 * otherwise.
629 *
630 * Examples include an mOwner pointer, which is nulled by the owning class's
631 * destructor, and is null-checked before dereferencing.
632 * MOZ_UNSAFE_REF: Applies to declarations of pointers to reference counted
633 * types. Occasionally there are non-owning references which are valid, but
634 * do not take the form of a MOZ_NON_OWNING_REF. Their safety may be
635 * dependent on the behaviour of API consumers. The string argument passed
636 * to this macro documents the safety conditions. This can make the compiler
637 * ignore these pointers when validating the usage of pointers elsewhere.
638 *
639 * Examples include an nsAtom* member which is known at compile time to point
640 * to a static atom which is valid throughout the lifetime of the program, or
641 * an API which stores a pointer, but doesn't take ownership over it, instead
642 * requiring the API consumer to correctly null the value before it becomes
643 * invalid.
644 *
645 * Use of this annotation is discouraged when a strong reference or one of
646 * the above two annotations can be used instead.
647 * MOZ_NO_ADDREF_RELEASE_ON_RETURN: Applies to function declarations. Makes it
648 * a compile time error to call AddRef or Release on the return value of a
649 * function. This is intended to be used with operator->() of our smart
650 * pointer classes to ensure that the refcount of an object wrapped in a
651 * smart pointer is not manipulated directly.
652 * MOZ_NEEDS_NO_VTABLE_TYPE: Applies to template class declarations. Makes it
653 * a compile time error to instantiate this template with a type parameter
654 * which has a VTable.
655 * MOZ_NON_MEMMOVABLE: Applies to class declarations for types that are not safe
656 * to be moved in memory using memmove().
657 * MOZ_NEEDS_MEMMOVABLE_TYPE: Applies to template class declarations where the
658 * template arguments are required to be safe to move in memory using
659 * memmove(). Passing MOZ_NON_MEMMOVABLE types to these templates is a
660 * compile time error.
661 * MOZ_NEEDS_MEMMOVABLE_MEMBERS: Applies to class declarations where each member
662 * must be safe to move in memory using memmove(). MOZ_NON_MEMMOVABLE types
663 * used in members of these classes are compile time errors.
664 * MOZ_NO_DANGLING_ON_TEMPORARIES: Applies to method declarations which return
665 * a pointer that is freed when the destructor of the class is called. This
666 * prevents these methods from being called on temporaries of the class,
667 * reducing risks of use-after-free.
668 * This attribute cannot be applied to && methods.
669 * In some cases, adding a deleted &&-qualified overload is too restrictive as
670 * this method should still be callable as a non-escaping argument to another
671 * function. This annotation can be used in those cases.
672 * MOZ_INHERIT_TYPE_ANNOTATIONS_FROM_TEMPLATE_ARGS: Applies to template class
673 * declarations where an instance of the template should be considered, for
674 * static analysis purposes, to inherit any type annotations (such as
675 * MOZ_STACK_CLASS) from its template arguments.
676 * MOZ_INIT_OUTSIDE_CTOR: Applies to class member declarations. Occasionally
677 * there are class members that are not initialized in the constructor,
678 * but logic elsewhere in the class ensures they are initialized prior to use.
679 * Using this attribute on a member disables the check that this member must
680 * be initialized in constructors via list-initialization, in the constructor
681 * body, or via functions called from the constructor body.
682 * MOZ_IS_CLASS_INIT: Applies to class method declarations. Occasionally the
683 * constructor doesn't initialize all of the member variables and another
684 * function is used to initialize the rest. This marker is used to make the
685 * static analysis tool aware that the marked function is part of the
686 * initialization process and to include the marked function in the scan
687 * mechanism that determines which member variables still remain
688 * uninitialized.
689 * MOZ_NON_PARAM: Applies to types. Makes it compile time error to use the type
690 * in parameter without pointer or reference.
691 * MOZ_NON_AUTOABLE: Applies to class declarations. Makes it a compile time
692 * error to use `auto` in place of this type in variable declarations. This
693 * is intended to be used with types which are intended to be implicitly
694 * constructed into other other types before being assigned to variables.
695 * MOZ_REQUIRED_BASE_METHOD: Applies to virtual class method declarations.
696 * Sometimes derived classes override methods that need to be called by their
697 * overridden counterparts. This marker indicates that the marked method must
698 * be called by the method that it overrides.
699 * MOZ_MUST_RETURN_FROM_CALLER_IF_THIS_IS_ARG: Applies to method declarations.
700 * Callers of the annotated method must return from that function within the
701 * calling block using an explicit `return` statement if the "this" value for
702 * the call is a parameter of the caller. Only calls to Constructors,
703 * references to local and member variables, and calls to functions or
704 * methods marked as MOZ_MAY_CALL_AFTER_MUST_RETURN may be made after the
705 * MOZ_MUST_RETURN_FROM_CALLER_IF_THIS_IS_ARG call.
706 * MOZ_MAY_CALL_AFTER_MUST_RETURN: Applies to function or method declarations.
707 * Calls to these methods may be made in functions after calls a
708 * MOZ_MUST_RETURN_FROM_CALLER_IF_THIS_IS_ARG method.
709 * MOZ_LIFETIME_BOUND: Applies to method declarations.
710 * The result of calling these functions on temporaries may not be returned as
711 * a reference or bound to a reference variable.
712 * MOZ_UNANNOTATED/MOZ_ANNOTATED: Applies to Mutexes/Monitors and variations on
713 * them. MOZ_UNANNOTATED indicates that the Mutex/Monitor/etc hasn't been
714 * examined and annotated using macros from mfbt/ThreadSafety --
715 * MOZ_GUARDED_BY()/REQUIRES()/etc. MOZ_ANNOTATED is used in rare cases to
716 * indicate that is has been looked at, but it did not need any
717 * MOZ_GUARDED_BY()/REQUIRES()/etc (and thus static analysis knows it can
718 * ignore this Mutex/Monitor/etc)
719 */
721 // gcc emits a nuisance warning -Wignored-attributes because attributes do not
722 // affect mangled names, and therefore template arguments do not propagate
723 // their attributes. It is rare that this would affect anything in practice,
724 // and most compilers are silent about it. Similarly, -Wattributes complains
725 // about attributes being ignored during template instantiation.
726 //
727 // Be conservative and only suppress the warning when running in a
728 // configuration where it would be emitted, namely when compiling with the
729 // XGILL_PLUGIN for the rooting hazard analysis (which runs under gcc.) If we
730 // end up wanting these attributes in general GCC builds, change this to
731 // something like
732 //
733 // #if defined(__GNUC__) && ! defined(__clang__)
734 //
735 # ifdef XGILL_PLUGIN
738 # endif
740 # if defined(MOZ_CLANG_PLUGIN) || defined(XGILL_PLUGIN)
742 # define MOZ_CAN_RUN_SCRIPT_FOR_DEFINITION \
745 # define MOZ_CAN_RUN_SCRIPT_BOUNDARY \
749 # define MOZ_STATIC_LOCAL_CLASS \
755 # define MOZ_NON_TEMPORARY_CLASS \
758 # define MOZ_TRIVIAL_CTOR_DTOR \
761 # ifdef DEBUG
762 /* in debug builds, these classes do have non-trivial constructors. */
763 # define MOZ_ONLY_USED_TO_AVOID_STATIC_CONSTRUCTORS \
765 # else
766 # define MOZ_ONLY_USED_TO_AVOID_STATIC_CONSTRUCTORS \
768 # endif
770 # define MOZ_IS_SMARTPTR_TO_REFCOUNTED \
772 # define MOZ_IS_REFPTR MOZ_IS_SMARTPTR_TO_REFCOUNTED
773 # define MOZ_NO_ARITHMETIC_EXPR_IN_ARGUMENT \
778 # define MOZ_NO_ADDREF_RELEASE_ON_RETURN \
780 # define MOZ_NEEDS_NO_VTABLE_TYPE \
783 # define MOZ_NEEDS_MEMMOVABLE_TYPE \
785 # define MOZ_NEEDS_MEMMOVABLE_MEMBERS \
787 # define MOZ_NO_DANGLING_ON_TEMPORARIES \
789 # define MOZ_INHERIT_TYPE_ANNOTATIONS_FROM_TEMPLATE_ARGS \
790 __attribute__(( \
793 # define MOZ_INIT_OUTSIDE_CTOR
794 # define MOZ_IS_CLASS_INIT
796 # define MOZ_REQUIRED_BASE_METHOD \
798 # define MOZ_MUST_RETURN_FROM_CALLER_IF_THIS_IS_ARG \
800 # define MOZ_MAY_CALL_AFTER_MUST_RETURN \
804 # ifndef XGILL_PLUGIN
807 # else
810 # endif
812 /*
813 * It turns out that clang doesn't like void func() __attribute__ {} without a
814 * warning, so use pragmas to disable the warning.
815 */
816 # ifdef __clang__
817 # define MOZ_HEAP_ALLOCATOR \
822 # else
824 # endif
825 # else
868 # define MOZ_RAII MOZ_NON_TEMPORARY_CLASS MOZ_STACK_CLASS
870 // XGILL_PLUGIN is used for the GC rooting hazard analysis, which compiles with
871 // gcc. gcc has different rules governing __attribute__((...)) placement, so
872 // some attributes will error out when used in the source code where clang
873 // expects them to be. Remove the problematic annotations when needed.
874 //
875 // The placement of c++11 [[...]] attributes is more flexible and defined by a
876 // spec, so it would be nice to switch to those for the problematic
877 // cases. Unfortunately, the official spec provides *no* way to annotate a
878 // lambda function, which is one source of the difficulty here. It appears that
879 // this will be fixed in c++23: https://github.com/cplusplus/papers/issues/882
881 # ifdef XGILL_PLUGIN
883 # undef MOZ_MUST_OVERRIDE
884 # undef MOZ_CAN_RUN_SCRIPT_FOR_DEFINITION
885 # undef MOZ_CAN_RUN_SCRIPT
886 # undef MOZ_CAN_RUN_SCRIPT_BOUNDARY
892 # endif
896 /**
897 * Printf style formats. MOZ_FORMAT_PRINTF and MOZ_FORMAT_WPRINTF can be used
898 * to annotate a function or method that is "printf/wprintf-like"; this will let
899 * (some) compilers check that the arguments match the template string.
900 *
901 * This macro takes two arguments. The first argument is the argument
902 * number of the template string. The second argument is the argument
903 * number of the '...' argument holding the arguments.
904 *
905 * Argument numbers start at 1. Note that the implicit "this"
906 * argument of a non-static member function counts as an argument.
907 *
908 * So, for a simple case like:
909 * void print_something (int whatever, const char *fmt, ...);
910 * The corresponding annotation would be
911 * MOZ_FORMAT_PRINTF(2, 3)
912 * However, if "print_something" were a non-static member function,
913 * then the annotation would be:
914 * MOZ_FORMAT_PRINTF(3, 4)
915 *
916 * The second argument should be 0 for vprintf-like functions; that
917 * is, those taking a va_list argument.
918 *
919 * Note that the checking is limited to standards-conforming
920 * printf-likes, and in particular this should not be used for
921 * PR_snprintf and friends, which are "printf-like" but which assign
922 * different meanings to the various formats.
923 *
924 * MinGW requires special handling due to different format specifiers
925 * on different platforms. The macro __MINGW_PRINTF_FORMAT maps to
926 * either gnu_printf or ms_printf depending on where we are compiling
927 * to avoid warnings on format specifiers that are legal.
928 *
929 * At time of writing MinGW has no wide equivalent to __MINGW_PRINTF_FORMAT;
930 * therefore __MINGW_WPRINTF_FORMAT has been implemented following the same
931 * pattern seen in MinGW's source.
932 */
933 #ifdef __MINGW32__
934 # define MOZ_FORMAT_PRINTF(stringIndex, firstToCheck) \
935 __attribute__((format(__MINGW_PRINTF_FORMAT, stringIndex, firstToCheck)))
936 # ifndef __MINGW_WPRINTF_FORMAT
937 # if defined(__clang__)
938 # define __MINGW_WPRINTF_FORMAT wprintf
939 # elif defined(_UCRT) || __USE_MINGW_ANSI_STDIO
940 # define __MINGW_WPRINTF_FORMAT gnu_wprintf
941 # else
942 # define __MINGW_WPRINTF_FORMAT ms_wprintf
943 # endif
944 # endif
945 # define MOZ_FORMAT_WPRINTF(stringIndex, firstToCheck) \
946 __attribute__((format(__MINGW_WPRINTF_FORMAT, stringIndex, firstToCheck)))
947 #elif __GNUC__ || __clang__
948 # define MOZ_FORMAT_PRINTF(stringIndex, firstToCheck) \
949 __attribute__((format(printf, stringIndex, firstToCheck)))
950 # define MOZ_FORMAT_WPRINTF(stringIndex, firstToCheck) \
951 __attribute__((format(wprintf, stringIndex, firstToCheck)))
952 #else
953 # define MOZ_FORMAT_PRINTF(stringIndex, firstToCheck)
954 # define MOZ_FORMAT_WPRINTF(stringIndex, firstToCheck)
955 #endif
957 /**
958 * To manually declare an XPCOM ABI-compatible virtual function, the following
959 * macros can be used to handle the non-standard ABI used on Windows for COM
960 * compatibility. E.g.:
961 *
962 * virtual ReturnType MOZ_XPCOM_ABI foo();
963 */
964 #if defined(XP_WIN)
965 # define MOZ_XPCOM_ABI __stdcall
966 #else
967 # define MOZ_XPCOM_ABI
968 #endif
970 /**
971 * MSVC / clang-cl don't optimize empty bases correctly unless we explicitly
972 * tell it to, see:
973 *
974 * https://stackoverflow.com/questions/12701469/why-is-the-empty-base-class-optimization-ebo-is-not-working-in-msvc
975 * https://devblogs.microsoft.com/cppblog/optimizing-the-layout-of-empty-base-classes-in-vs2015-update-2-3/
976 */
977 #if defined(_MSC_VER)
978 # define MOZ_EMPTY_BASES __declspec(empty_bases)
979 #else
980 # define MOZ_EMPTY_BASES
981 #endif