llvm / llvm/llvm-project

[Feature Request] Memory sanitiser poisoning idiom which works with static analyser.

Open
#158,548 5 comments 0 reactions 0 assignees View on GitHub
clang:frontend clang:static analyzer
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

In order to both initialise a variable with a known value, but also assert to the static analyser and to MSAN that I _still_ don't know what it should be, I was trying to do make an idiom like this work:

```c++
int x = provisional(-1);
// ...
if (foo) x = 10;
// ...
f(x);
```

So that the code could be diagnosed as erroneous when `foo` is false.

Or:

```c++
ErrorCode function(ResultType& result, int argument) {
result = provisional(ResultType{});
if (argument == derpyderp) {
return DerpyError;
}
// ...
result = sensible_value;
// ...
if (ActuallyNevermind) {
result = provisional(ResultType{});
return AhhhForgetIt;
}
// ...
return OK;
}
```

(alternatively `provisional(-1)` with smart defaults like `provisional(double init = signalling_NaN)`)

And it looks like as far as MSAN is concerned this does work (with huge caveats):
```c++
template
[[gnu::always_inline]] T provisional(T init) {
T tmp{init};
#if __has_feature(memory_sanitizer)
__msan_poison(&tmp, sizeof(tmp));
#endif
return tmp;
}
```

But this can only raise errors at run time, iff you have adequate test coverage. While it actually _blocks_ compile-time diagnosis of faulty code.

There needs to be a construct that lets all the tools produce the best outcomes achievable for each of them. Where static analysis stills regards the variable as uninitialised, where MSAN does the same, and where release code has a known safe value inserted as a predictable backstop (a value the developer has clearly never tested, but at least it's not a leak!).

C++26 adds `[[indeterminate]]` but that's very much the opposite -- taking away the safe default without asking the other tools to watch the variable more closely.

Does this need to be a compiler extension?

Contributor guide

Open the contributing guide

Research direction

The issue provides no repository files, tests, or entry points; begin by reviewing the provisional example, MemorySanitizer poisoning behavior, static-analyser expectations, and C++26 [[indeterminate]]. Done would require a clearly scoped, agreed compiler or language change that addresses the requested interaction between compile-time diagnosis, MSAN, and a safe release value.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
compilers
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.