[Feature Request] Memory sanitiser poisoning idiom which works with static analyser.
- Dominant language
- LLVM
- Stars
- 40.5k
- Forks
- 18.7k
- PR merge metrics
- PR metrics pending
Description
In order to both initialise a variable with a known value, but also assert to the static analyser and to MSAN that I _still_ don't know what it should be, I was trying to do make an idiom like this work:
```c++
int x = provisional(-1);
// ...
if (foo) x = 10;
// ...
f(x);
```
So that the code could be diagnosed as erroneous when `foo` is false.
Or:
```c++
ErrorCode function(ResultType& result, int argument) {
result = provisional(ResultType{});
if (argument == derpyderp) {
return DerpyError;
}
// ...
result = sensible_value;
// ...
if (ActuallyNevermind) {
result = provisional(ResultType{});
return AhhhForgetIt;
}
// ...
return OK;
}
```
(alternatively `provisional(-1)` with smart defaults like `provisional(double init = signalling_NaN)`)
And it looks like as far as MSAN is concerned this does work (with huge caveats):
```c++
template
[[gnu::always_inline]] T provisional(T init) {
T tmp{init};
#if __has_feature(memory_sanitizer)
__msan_poison(&tmp, sizeof(tmp));
#endif
return tmp;
}
```
But this can only raise errors at run time, iff you have adequate test coverage. While it actually _blocks_ compile-time diagnosis of faulty code.
There needs to be a construct that lets all the tools produce the best outcomes achievable for each of them. Where static analysis stills regards the variable as uninitialised, where MSAN does the same, and where release code has a known safe value inserted as a predictable backstop (a value the developer has clearly never tested, but at least it's not a leak!).
C++26 adds `[[indeterminate]]` but that's very much the opposite -- taking away the safe default without asking the other tools to watch the variable more closely.
Does this need to be a compiler extension?
Contributor guide
Research direction
The issue provides no repository files, tests, or entry points; begin by reviewing the provisional example, MemorySanitizer poisoning behavior, static-analyser expectations, and C++26 [[indeterminate]]. Done would require a clearly scoped, agreed compiler or language change that addresses the requested interaction between compile-time diagnosis, MSAN, and a safe release value.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- compilers
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100