Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

P3471R4 Standard library hardening #7703

Merged
merged 1 commit into from
Mar 15, 2025
Merged

P3471R4 Standard library hardening #7703

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
82 changes: 50 additions & 32 deletions source/containers.tex
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1879,6 +1879,10 @@
\result
\tcode{reference; const_reference} for constant \tcode{a}.

\pnum
\hardexpects
\tcode{a.empty()} is \tcode{false}.

\pnum
\returns
\tcode{*a.begin()}
Expand All @@ -1904,6 +1908,10 @@
\result
\tcode{reference; const_reference} for constant \tcode{a}.

\pnum
\hardexpects
\tcode{a.empty()} is \tcode{false}.

\pnum
\effects
Equivalent to:
Expand Down Expand Up @@ -2168,7 +2176,7 @@
\keyword{void}

\pnum
\expects
\hardexpects
\tcode{a.empty()} is \tcode{false}.

\pnum
Expand All @@ -2193,7 +2201,7 @@
\keyword{void}

\pnum
\expects
\hardexpects
\tcode{a.empty()} is \tcode{false}.

\pnum
Expand All @@ -2219,6 +2227,10 @@
\result
\tcode{reference; const_reference} for constant \tcode{a}.

\pnum
\hardexpects
\tcode{n < a.size()} is \tcode{true}.

\pnum
\effects
Equivalent to: \tcode{return *(a.begin() + n);}
Expand Down Expand Up @@ -19233,11 +19245,13 @@
\begin{itemize}
\item \range{first}{first + count} is a valid range.
\item \tcode{It} models \libconcept{contiguous_iterator}.
\item
If \tcode{extent} is not equal to \tcode{dynamic_extent},
then \tcode{count} is equal to \tcode{extent}.
\end{itemize}

\pnum
\hardexpects
If \tcode{extent} is not equal to \tcode{dynamic_extent},
then \tcode{count == extent} is \tcode{true}.

\pnum
\effects
Initializes \exposid{data_} with \tcode{to_address(first)} and
Expand Down Expand Up @@ -19273,14 +19287,16 @@
\pnum
\expects
\begin{itemize}
\item
If \tcode{extent} is not equal to \tcode{dynamic_extent},
then \tcode{last - first} is equal to \tcode{extent}.
\item \range{first}{last} is a valid range.
\item \tcode{It} models \libconcept{contiguous_iterator}.
\item \tcode{End} models \tcode{\libconcept{sized_sentinel_for}<It>}.
\end{itemize}

\pnum
\hardexpects
If \tcode{extent} is not equal to \tcode{dynamic_extent},
then \tcode{(last - first) == extent} is \tcode{true}.

\pnum
\effects
Initializes \exposid{data_} with \tcode{to_address(first)} and
Expand Down Expand Up @@ -19351,14 +19367,17 @@
\pnum
\expects
\begin{itemize}
\item If \tcode{extent} is not equal to \tcode{dynamic_extent},
then \tcode{ranges::size(r)} is equal to \tcode{extent}.
\item \tcode{R} models \tcode{ranges::\libconcept{contiguous_range}} and
\tcode{ranges::\libconcept{sized_range}}.
\item If \tcode{is_const_v<element_type>} is \tcode{false},
\tcode{R} models \tcode{ranges::\libconcept{borrowed_range}}.
\end{itemize}

\pnum
\hardexpects
If \tcode{extent} is not equal to \tcode{dynamic_extent},
then \tcode{ranges::size(r) == extent} is \tcode{true}.

\pnum
\effects
Initializes \exposid{data_} with \tcode{ranges::data(r)} and
Expand All @@ -19380,9 +19399,9 @@
\tcode{is_const_v<element_type>} is \tcode{true}.

\pnum
\expects
If \tcode{extent} is not equal to \tcode{dynamic_extent}, then
\tcode{il.size()} is equal to \tcode{extent}.
\hardexpects
If \tcode{extent} is not equal to \tcode{dynamic_extent},
then \tcode{il.size() == extent} is \tcode{true}.

\pnum
\effects
Expand Down Expand Up @@ -19420,9 +19439,9 @@
\end{itemize}

\pnum
\expects
\hardexpects
If \tcode{extent} is not equal to \tcode{dynamic_extent},
then \tcode{s.size()} is equal to \tcode{extent}.
then \tcode{s.size() == extent} is \tcode{true}.

\pnum
\effects
Expand Down Expand Up @@ -19492,7 +19511,7 @@
\tcode{Count <= Extent} is \tcode{true}.

\pnum
\expects
\hardexpects
\tcode{Count <= size()} is \tcode{true}.

\pnum
Expand All @@ -19512,7 +19531,7 @@
\tcode{Count <= Extent} is \tcode{true}.

\pnum
\expects
\hardexpects
\tcode{Count <= size()} is \tcode{true}.

\pnum
Expand All @@ -19536,7 +19555,7 @@
is \tcode{true}.

\pnum
\expects
\hardexpects
\begin{codeblock}
Offset <= size() && (Count == dynamic_extent || Count <= size() - Offset)
\end{codeblock}
Expand Down Expand Up @@ -19567,7 +19586,7 @@

\begin{itemdescr}
\pnum
\expects
\hardexpects
\tcode{count <= size()} is \tcode{true}.

\pnum
Expand All @@ -19582,7 +19601,7 @@

\begin{itemdescr}
\pnum
\expects
\hardexpects
\tcode{count <= size()} is \tcode{true}.

\pnum
Expand All @@ -19598,7 +19617,7 @@

\begin{itemdescr}
\pnum
\expects
\hardexpects
\begin{codeblock}
offset <= size() && (count == dynamic_extent || count <= size() - offset)
\end{codeblock}
Expand Down Expand Up @@ -19656,7 +19675,7 @@

\begin{itemdescr}
\pnum
\expects
\hardexpects
\tcode{idx < size()} is \tcode{true}.

\pnum
Expand Down Expand Up @@ -19690,7 +19709,7 @@

\begin{itemdescr}
\pnum
\expects
\hardexpects
\tcode{empty()} is \tcode{false}.

\pnum
Expand All @@ -19709,7 +19728,7 @@

\begin{itemdescr}
\pnum
\expects
\hardexpects
\tcode{empty()} is \tcode{false}.

\pnum
Expand Down Expand Up @@ -23876,17 +23895,16 @@

\pnum
\expects
\begin{itemize}
\item
For each rank index \tcode{r} of \tcode{extents_type},
\tcode{static_extent(r) == dynamic_extent || static_extent(r) == other.extent(r)}
is \tcode{true}.
\item
$[0, \tcode{\exposid{map_}.required_span_size()})$ is
an accessible range of \exposid{ptr_} and \exposid{acc_}
for values of \exposid{ptr_}, \exposid{map_}, and \exposid{acc_}
after the invocation of this constructor.
\end{itemize}

\pnum
\hardexpects
For each rank index \tcode{r} of \tcode{extents_type},
\tcode{static_extent(r) == dynamic_extent || static_extent(r) == other.extent(r)}
is \tcode{true}.

\pnum
\effects
Expand Down Expand Up @@ -23932,7 +23950,7 @@
Let \tcode{I} be \tcode{extents_type::\exposid{index-cast}(std::move(indices))}.

\pnum
\expects
\hardexpects
\tcode{I} is a multidimensional index in \tcode{extents()}.
\begin{note}
This implies that
Expand Down
12 changes: 11 additions & 1 deletion source/intro.tex
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -833,7 +833,8 @@
\indextext{conformance requirements!library|)}

\pnum
Two kinds of implementations are defined: a \defnadj{hosted}{implementation} and a
An implementation is either a
\defnadj{hosted}{implementation} or a
\defnadj{freestanding}{implementation}.
A freestanding
implementation is one in which execution may take place without the benefit of
Comment on lines 839 to 840
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not your doing (from existing text), but wanted to point out that this is where the \defnadj for "freestanding implementation" should be (not above) since this is the definition. Same for "hosted implementation" in the sentence below.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we want the defnadj to be on the first occurrence of the term.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I respectfully disagree - suppose the introduction of the term came paragraphs before the actual definition, yet in the same section? I'd say we always want the definition to be at the actual definition.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@jwakely what if we fixed it up like this, which seems like it would make both of you happy?

\pnum
A \defnadj{freestanding}{implementation}
is one in which % ...
A \defnadj{hosted}{implementation}
supports % ...
An implementation is either a
hosted implementation or a freestanding implementation.

Copy link
Contributor Author

@Eisenwave Eisenwave Mar 9, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actually I think this change is an absolute must anyway because [library] currently states whether an implementation is hosted or freestanding (it's impldef). This is way too late; core wording like [intro.multithread] already refers to freestanding.

If the \impldef for hardened implementations is in [intro], then so should the \impldef for hosted vs. freestanding. This is also about mirroring changes and getting rid of the "there are two kinds of implementations" wording. See a7a861a

Copy link
Member

@jensmaurer jensmaurer Mar 9, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These might all be good ideas, but (because changing existing, unchanged text) feel out-of-scope for the pull request that applies an approved paper from the motions. And it most certainly not a "fixup".

Copy link
Contributor Author

@Eisenwave Eisenwave Mar 9, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The reason I still feel like it should be included here is that the paper intentionally removes "two kinds of implementation" wording. It seems like an obvious oversight that this wasn't also done in [library], and like something that this paper (and therefore this PR) should do. If we merged without the fix, then we'd need to fix up the knowingly incorrect state we've created later anyway.

Would it be fine to split up the commit that just mirrors the changes in [library] and append the remaining stylistic improvements as a non-fixup?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When applying papers, the contents of the primary paper application commit should be what the paper says, plus punctuation and typo fixes.

If there are additional fixes that are editorial and directly triggered by the paper, they should be in a separate commit, with the usual "[label] title" description.

If, beyond that, there is a reason to clean up the wording even further, I'd prefer to have a separate editorial pull request that can be considered on its own merits. Just because the outcome of a paper application is a bit suboptimal doesn't mean we should rewrite the entire surrounding words; presumably, the applied paper was peer-reviewed by LWG and/or CWG.

Expand All @@ -845,6 +846,15 @@
described in \ref{lex} through \ref{\lastcorechapter} and
the subset of the library facilities described in \ref{compliance}.

\pnum
It is
\impldef{whether the implementation is a hardened implementation}
whether the implementation is a
\defnadj{hardened}{implementation}.
If it is a hardened implementation,
violating a hardened precondition
results in a contract violation\iref{structure.specifications}.

\pnum
An implementation is encouraged to document its limitations in
the size or complexity of the programs it can successfully process,
Expand Down
37 changes: 32 additions & 5 deletions source/lib-intro.tex
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -370,15 +370,33 @@

\item
\expects
the conditions
that the function assumes to hold whenever it is called;
conditions that the function assumes to hold whenever it is called;
violation of any preconditions results in undefined behavior.
\begin{example}
An implementation can express some such conditions
via the use of a contract assertion,
such as a precondition assertion\iref{dcl.contract.func}.
\end{example}

\item
\hardexpects
conditions that the function assumes to hold whenever it is called.
\begin{itemize}
\item
When invoking the function in a hardened implementation,
prior to any other observable side effects of the function,
one or more contract assertions
whose predicates are as described in the hardened precondition
are evaluated with a checking semantic\iref{basic.contract.eval}.
If any of these assertions is evaluated with a non-terminating semantic
and the contract-violation handler returns,
the program has undefined behavior.
\item
When invoking the function in a non-hardened implementation,
if any hardened precondition is violated,
the program has undefined behavior.
\end{itemize}

\item
\effects
the actions performed by the function.
Expand Down Expand Up @@ -434,9 +452,18 @@
If \tcode{F}'s semantics specifies any \Fundescx{Constraints} or \Fundescx{Mandates} elements,
then those requirements are logically imposed prior to the \term{equivalent-to} semantics.
Next, the semantics of the code sequence are determined by the
\Fundescx{Constraints}, \Fundescx{Mandates}, \Fundescx{Preconditions}, \Fundescx{Effects},
\Fundescx{Synchronization}, \Fundescx{Postconditions}, \Fundescx{Returns}, \Fundescx{Throws},
\Fundescx{Complexity}, \Fundescx{Remarks}, and \Fundescx{Error conditions}
\Fundescx{Constraints},
\Fundescx{Mandates},
\Fundescx{Preconditions},
\Fundescx{Hardened preconditions},
\Fundescx{Effects},
\Fundescx{Synchronization},
\Fundescx{Postconditions},
\Fundescx{Returns},
\Fundescx{Throws},
\Fundescx{Complexity},
\Fundescx{Remarks}, and
\Fundescx{Error conditions}
specified for the function invocations contained in the code sequence.
The value returned from \tcode{F} is specified by \tcode{F}'s \Fundescx{Returns} element,
or if \tcode{F} has no \Fundescx{Returns} element,
Expand Down
1 change: 1 addition & 0 deletions source/macros.tex
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -366,6 +366,7 @@
\newcommand{\constraints}{\Fundesc{Constraints}}
\newcommand{\mandates}{\Fundesc{Mandates}}
\newcommand{\expects}{\Fundesc{Preconditions}}
\newcommand{\hardexpects}{\Fundesc{Hardened preconditions}}
\newcommand{\effects}{\Fundesc{Effects}}
\newcommand{\ensures}{\Fundesc{Postconditions}}
\newcommand{\returns}{\Fundesc{Returns}}
Expand Down
2 changes: 1 addition & 1 deletion source/numerics.tex
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7581,7 +7581,7 @@

\begin{itemdescr}
\pnum
\expects
\hardexpects
\tcode{n < size()} is \tcode{true}.

\pnum
Expand Down
Loading