Attributes.h (50472B)
1 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ 2 /* vim: set ts=8 sts=2 et sw=2 tw=80: */ 3 /* This Source Code Form is subject to the terms of the Mozilla Public 4 * License, v. 2.0. If a copy of the MPL was not distributed with this 5 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ 6 7 /* Implementations of various class and method modifier attributes. */ 8 9 #ifndef mozilla_Attributes_h 10 #define mozilla_Attributes_h 11 12 /* 13 * MOZ_ALWAYS_INLINE is a macro which expands to tell the compiler that the 14 * method decorated with it must be inlined, even if the compiler thinks 15 * otherwise. This is only a (much) stronger version of the inline hint: 16 * compilers are not guaranteed to respect it (although they're much more likely 17 * to do so). 18 * 19 * The MOZ_ALWAYS_INLINE_EVEN_DEBUG macro is yet stronger. It tells the 20 * compiler to inline even in DEBUG builds. It should be used very rarely. 21 */ 22 #if defined(_MSC_VER) 23 # define MOZ_ALWAYS_INLINE_EVEN_DEBUG __forceinline 24 #elif defined(__GNUC__) 25 # define MOZ_ALWAYS_INLINE_EVEN_DEBUG __attribute__((always_inline)) inline 26 #else 27 # define MOZ_ALWAYS_INLINE_EVEN_DEBUG inline 28 #endif 29 30 /* [[no_unique_address]] tells the compiler that if the associated class member 31 * as a size of zero, it is not subject to the rule that each object must be 32 * addressable and thus use at lease a byte 33 */ 34 #if defined(_MSC_VER) 35 // FIXME: should be [[no_unique_address]] for everyone in C++20 36 # define MOZ_NO_UNIQUE_ADDRESS [[msvc::no_unique_address]] 37 #else 38 # define MOZ_NO_UNIQUE_ADDRESS [[no_unique_address]] 39 #endif 40 41 #if !defined(DEBUG) 42 # define MOZ_ALWAYS_INLINE MOZ_ALWAYS_INLINE_EVEN_DEBUG 43 #elif defined(_MSC_VER) && !defined(__cplusplus) 44 # define MOZ_ALWAYS_INLINE __inline 45 #else 46 # define MOZ_ALWAYS_INLINE inline 47 #endif 48 49 #if defined(_MSC_VER) 50 /* 51 * g++ requires -std=c++0x or -std=gnu++0x to support C++11 functionality 52 * without warnings (functionality used by the macros below). These modes are 53 * detectable by checking whether __GXX_EXPERIMENTAL_CXX0X__ is defined or, more 54 * standardly, by checking whether __cplusplus has a C++11 or greater value. 55 * Current versions of g++ do not correctly set __cplusplus, so we check both 56 * for forward compatibility. 57 */ 58 # define MOZ_HAVE_NEVER_INLINE __declspec(noinline) 59 #elif defined(__clang__) 60 /* 61 * Per Clang documentation, "Note that marketing version numbers should not 62 * be used to check for language features, as different vendors use different 63 * numbering schemes. Instead, use the feature checking macros." 64 */ 65 # ifndef __has_extension 66 # define __has_extension \ 67 __has_feature /* compatibility, for older versions of clang */ 68 # endif 69 # if __has_attribute(noinline) 70 # define MOZ_HAVE_NEVER_INLINE __attribute__((noinline)) 71 # endif 72 #elif defined(__GNUC__) 73 # define MOZ_HAVE_NEVER_INLINE __attribute__((noinline)) 74 # define MOZ_HAVE_NORETURN_PTR __attribute__((noreturn)) 75 #endif 76 77 #if defined(__clang__) 78 # if __has_attribute(no_stack_protector) 79 # define MOZ_HAVE_NO_STACK_PROTECTOR __attribute__((no_stack_protector)) 80 # endif 81 #elif defined(__GNUC__) 82 # define MOZ_HAVE_NO_STACK_PROTECTOR __attribute__((no_stack_protector)) 83 #endif 84 85 /* if defined(__clang__) && __has_attribute (attr) may not be portable */ 86 #if defined(__clang__) 87 # define MOZ_HAS_CLANG_ATTRIBUTE(attr) __has_attribute(attr) 88 #else 89 # define MOZ_HAS_CLANG_ATTRIBUTE(attr) 0 90 #endif 91 92 /* 93 * When built with clang analyzer (a.k.a scan-build), define MOZ_HAVE_NORETURN 94 * to mark some false positives 95 */ 96 #ifdef __clang_analyzer__ 97 # if __has_extension(attribute_analyzer_noreturn) 98 # define MOZ_HAVE_ANALYZER_NORETURN __attribute__((analyzer_noreturn)) 99 # endif 100 #endif 101 102 #if defined(__GNUC__) || MOZ_HAS_CLANG_ATTRIBUTE(no_profile_instrument_function) 103 # define MOZ_NOPROFILE __attribute__((no_profile_instrument_function)) 104 #else 105 # define MOZ_NOPROFILE 106 #endif 107 108 #if defined(__GNUC__) || (MOZ_HAS_CLANG_ATTRIBUTE(no_instrument_function)) 109 # define MOZ_NOINSTRUMENT __attribute__((no_instrument_function)) 110 #else 111 # define MOZ_NOINSTRUMENT 112 #endif 113 114 /* 115 * MOZ_NAKED tells the compiler that the function only contains assembly and 116 * that it should not try to inject code that may mess with the assembly in it. 117 * 118 * See https://github.com/llvm/llvm-project/issues/74573 for the interaction 119 * between naked and no_profile_instrument_function. 120 */ 121 #define MOZ_NAKED __attribute__((naked)) MOZ_NOPROFILE MOZ_NOINSTRUMENT 122 123 /** 124 * Per clang's documentation: 125 * 126 * If a statement is marked nomerge and contains call expressions, those call 127 * expressions inside the statement will not be merged during optimization. This 128 * attribute can be used to prevent the optimizer from obscuring the source 129 * location of certain calls. 130 * 131 * This is useful to have clearer information on assertion failures. 132 */ 133 #if MOZ_HAS_CLANG_ATTRIBUTE(nomerge) 134 # define MOZ_NOMERGE __attribute__((nomerge)) 135 #else 136 # define MOZ_NOMERGE 137 #endif 138 139 /* 140 * MOZ_NEVER_INLINE is a macro which expands to tell the compiler that the 141 * method decorated with it must never be inlined, even if the compiler would 142 * otherwise choose to inline the method. Compilers aren't absolutely 143 * guaranteed to support this, but most do. 144 */ 145 #if defined(MOZ_HAVE_NEVER_INLINE) 146 # define MOZ_NEVER_INLINE MOZ_HAVE_NEVER_INLINE 147 #else 148 # define MOZ_NEVER_INLINE /* no support */ 149 #endif 150 151 /* 152 * MOZ_NEVER_INLINE_DEBUG is a macro which expands to MOZ_NEVER_INLINE 153 * in debug builds, and nothing in opt builds. 154 */ 155 #if defined(DEBUG) 156 # define MOZ_NEVER_INLINE_DEBUG MOZ_NEVER_INLINE 157 #else 158 # define MOZ_NEVER_INLINE_DEBUG /* don't inline in opt builds */ 159 #endif 160 /* 161 * MOZ_HAVE_NORETURN_PTR is equivalent to [[noreturn]] but can be set on 162 * function pointers. 163 * 164 * This modifier does not affect the corresponding function's linking behavior. 165 */ 166 #if defined(MOZ_HAVE_NORETURN_PTR) 167 # define MOZ_NORETURN_PTR MOZ_HAVE_NORETURN_PTR 168 #else 169 # define MOZ_NORETURN_PTR /* no support */ 170 #endif 171 172 /** 173 * MOZ_COLD tells the compiler that a function is "cold", meaning infrequently 174 * executed. This may lead it to optimize for size more aggressively than speed, 175 * or to allocate the body of the function in a distant part of the text segment 176 * to help keep it from taking up unnecessary icache when it isn't in use. 177 * 178 * Place this attribute at the very beginning of a function definition. For 179 * example, write 180 * 181 * MOZ_COLD int foo(); 182 * 183 * or 184 * 185 * MOZ_COLD int foo() { return 42; } 186 */ 187 #if defined(__GNUC__) || defined(__clang__) 188 # define MOZ_COLD __attribute__((cold)) 189 #else 190 # define MOZ_COLD 191 #endif 192 193 /** 194 * MOZ_NONNULL tells the compiler that some of the arguments to a function are 195 * known to be non-null. The arguments are a list of 1-based argument indexes 196 * identifying arguments which are known to be non-null. 197 * 198 * Place this attribute at the very beginning of a function definition. For 199 * example, write 200 * 201 * MOZ_NONNULL(1, 2) int foo(char *p, char *q); 202 */ 203 #if defined(__GNUC__) || defined(__clang__) 204 # define MOZ_NONNULL(...) __attribute__((nonnull(__VA_ARGS__))) 205 #else 206 # define MOZ_NONNULL(...) 207 #endif 208 209 /** 210 * MOZ_NONNULL_RETURN tells the compiler that the function's return value is 211 * guaranteed to be a non-null pointer, which may enable the compiler to 212 * optimize better at call sites. 213 * 214 * Place this attribute at the end of a function declaration. For example, 215 * 216 * char* foo(char *p, char *q) MOZ_NONNULL_RETURN; 217 */ 218 #if defined(__GNUC__) || defined(__clang__) 219 # define MOZ_NONNULL_RETURN __attribute__((returns_nonnull)) 220 #else 221 # define MOZ_NONNULL_RETURN 222 #endif 223 224 /* 225 * MOZ_PRETEND_NORETURN_FOR_STATIC_ANALYSIS, specified at the end of a function 226 * declaration, indicates that for the purposes of static analysis, this 227 * function does not return. (The function definition does not need to be 228 * annotated.) 229 * 230 * MOZ_ReportCrash(const char* s, const char* file, int ln) 231 * MOZ_PRETEND_NORETURN_FOR_STATIC_ANALYSIS 232 * 233 * Some static analyzers, like scan-build from clang, can use this information 234 * to eliminate false positives. From the upstream documentation of scan-build: 235 * "This attribute is useful for annotating assertion handlers that actually 236 * can return, but for the purpose of using the analyzer we want to pretend 237 * that such functions do not return." 238 * 239 */ 240 #if defined(MOZ_HAVE_ANALYZER_NORETURN) 241 # define MOZ_PRETEND_NORETURN_FOR_STATIC_ANALYSIS MOZ_HAVE_ANALYZER_NORETURN 242 #else 243 # define MOZ_PRETEND_NORETURN_FOR_STATIC_ANALYSIS /* no support */ 244 #endif 245 246 /* 247 * MOZ_ASAN_IGNORE is a macro to tell AddressSanitizer (a compile-time 248 * instrumentation shipped with Clang and GCC) to not instrument the annotated 249 * function. Furthermore, it will prevent the compiler from inlining the 250 * function because inlining currently breaks the blocklisting mechanism of 251 * AddressSanitizer. 252 */ 253 #if defined(__has_feature) 254 # if __has_feature(address_sanitizer) 255 # define MOZ_HAVE_ASAN_IGNORE 256 # endif 257 #elif defined(__GNUC__) 258 # if defined(__SANITIZE_ADDRESS__) 259 # define MOZ_HAVE_ASAN_IGNORE 260 # endif 261 #endif 262 263 #if defined(MOZ_HAVE_ASAN_IGNORE) 264 # define MOZ_ASAN_IGNORE MOZ_NEVER_INLINE __attribute__((no_sanitize_address)) 265 #else 266 # define MOZ_ASAN_IGNORE /* nothing */ 267 #endif 268 269 /* 270 * MOZ_TSAN_IGNORE is a macro to tell ThreadSanitizer (a compile-time 271 * instrumentation shipped with Clang) to not instrument the annotated function. 272 * Furthermore, it will prevent the compiler from inlining the function because 273 * inlining currently breaks the blocklisting mechanism of ThreadSanitizer. 274 */ 275 #if defined(__has_feature) 276 # if __has_feature(thread_sanitizer) 277 # define MOZ_TSAN_IGNORE MOZ_NEVER_INLINE __attribute__((no_sanitize_thread)) 278 # else 279 # define MOZ_TSAN_IGNORE /* nothing */ 280 # endif 281 #else 282 # define MOZ_TSAN_IGNORE /* nothing */ 283 #endif 284 285 #if defined(__has_attribute) 286 # if __has_attribute(no_sanitize) 287 # define MOZ_HAVE_NO_SANITIZE_ATTR 288 # endif 289 #endif 290 291 #ifdef __clang__ 292 # ifdef MOZ_HAVE_NO_SANITIZE_ATTR 293 # define MOZ_HAVE_UNSIGNED_OVERFLOW_SANITIZE_ATTR 294 # define MOZ_HAVE_SIGNED_OVERFLOW_SANITIZE_ATTR 295 # endif 296 #endif 297 298 /* 299 * MOZ_NO_SANITIZE_UNSIGNED_OVERFLOW disables *un*signed integer overflow 300 * checking on the function it annotates, in builds configured to perform it. 301 * (Currently this is only Clang using -fsanitize=unsigned-integer-overflow, or 302 * via --enable-unsigned-overflow-sanitizer in Mozilla's build system.) It has 303 * no effect in other builds. 304 * 305 * Place this attribute at the very beginning of a function declaration. 306 * 307 * Unsigned integer overflow isn't *necessarily* a bug. It's well-defined in 308 * C/C++, and code may reasonably depend upon it. For example, 309 * 310 * MOZ_NO_SANITIZE_UNSIGNED_OVERFLOW inline bool 311 * IsDecimal(char aChar) 312 * { 313 * // For chars less than '0', unsigned integer underflow occurs, to a value 314 * // much greater than 10, so the overall test is false. 315 * // For chars greater than '0', no overflow occurs, and only '0' to '9' 316 * // pass the overall test. 317 * return static_cast<unsigned int>(aChar) - '0' < 10; 318 * } 319 * 320 * But even well-defined unsigned overflow often causes bugs when it occurs, so 321 * it should be restricted to functions annotated with this attribute. 322 * 323 * The compiler instrumentation to detect unsigned integer overflow has costs 324 * both at compile time and at runtime. Functions that are repeatedly inlined 325 * at compile time will also implicitly inline the necessary instrumentation, 326 * increasing compile time. Similarly, frequently-executed functions that 327 * require large amounts of instrumentation will also notice significant runtime 328 * slowdown to execute that instrumentation. Use this attribute to eliminate 329 * those costs -- but only after carefully verifying that no overflow can occur. 330 */ 331 #ifdef MOZ_HAVE_UNSIGNED_OVERFLOW_SANITIZE_ATTR 332 # define MOZ_NO_SANITIZE_UNSIGNED_OVERFLOW \ 333 __attribute__((no_sanitize("unsigned-integer-overflow"))) 334 #else 335 # define MOZ_NO_SANITIZE_UNSIGNED_OVERFLOW /* nothing */ 336 #endif 337 338 /* 339 * MOZ_NO_SANITIZE_SIGNED_OVERFLOW disables *signed* integer overflow checking 340 * on the function it annotates, in builds configured to perform it. (Currently 341 * this is only Clang using -fsanitize=signed-integer-overflow, or via 342 * --enable-signed-overflow-sanitizer in Mozilla's build system. GCC support 343 * will probably be added in the future.) It has no effect in other builds. 344 * 345 * Place this attribute at the very beginning of a function declaration. 346 * 347 * Signed integer overflow is undefined behavior in C/C++: *anything* can happen 348 * when it occurs. *Maybe* wraparound behavior will occur, but maybe also the 349 * compiler will assume no overflow happens and will adversely optimize the rest 350 * of your code. Code that contains signed integer overflow needs to be fixed. 351 * 352 * The compiler instrumentation to detect signed integer overflow has costs both 353 * at compile time and at runtime. Functions that are repeatedly inlined at 354 * compile time will also implicitly inline the necessary instrumentation, 355 * increasing compile time. Similarly, frequently-executed functions that 356 * require large amounts of instrumentation will also notice significant runtime 357 * slowdown to execute that instrumentation. Use this attribute to eliminate 358 * those costs -- but only after carefully verifying that no overflow can occur. 359 */ 360 #ifdef MOZ_HAVE_SIGNED_OVERFLOW_SANITIZE_ATTR 361 # define MOZ_NO_SANITIZE_SIGNED_OVERFLOW \ 362 __attribute__((no_sanitize("signed-integer-overflow"))) 363 #else 364 # define MOZ_NO_SANITIZE_SIGNED_OVERFLOW /* nothing */ 365 #endif 366 367 #undef MOZ_HAVE_NO_SANITIZE_ATTR 368 369 /** 370 * MOZ_ALLOCATOR tells the compiler that the function it marks returns either a 371 * "fresh", "pointer-free" block of memory, or nullptr. "Fresh" means that the 372 * block is not pointed to by any other reachable pointer in the program. 373 * "Pointer-free" means that the block contains no pointers to any valid object 374 * in the program. It may be initialized with other (non-pointer) values. 375 * 376 * Placing this attribute on appropriate functions helps GCC analyze pointer 377 * aliasing more accurately in their callers. 378 * 379 * GCC warns if a caller ignores the value returned by a function marked with 380 * MOZ_ALLOCATOR: it is hard to imagine cases where dropping the value returned 381 * by a function that meets the criteria above would be intentional. 382 * 383 * Place this attribute after the argument list and 'this' qualifiers of a 384 * function definition. For example, write 385 * 386 * void *my_allocator(size_t) MOZ_ALLOCATOR; 387 * 388 * or 389 * 390 * void *my_allocator(size_t bytes) MOZ_ALLOCATOR { ... } 391 */ 392 #if defined(__GNUC__) || defined(__clang__) 393 # define MOZ_ALLOCATOR __attribute__((malloc, warn_unused_result)) 394 # define MOZ_INFALLIBLE_ALLOCATOR \ 395 __attribute__((malloc, warn_unused_result, returns_nonnull)) 396 #else 397 # define MOZ_ALLOCATOR 398 # define MOZ_INFALLIBLE_ALLOCATOR 399 #endif 400 401 /* 402 * MOZ_NO_STACK_PROTECTOR, specified at the start of a function declaration, 403 * indicates that the given function should *NOT* be instrumented to detect 404 * stack buffer overflows at runtime. (The function definition does not need to 405 * be annotated.) 406 * 407 * MOZ_NO_STACK_PROTECTOR int foo(); 408 * 409 * Detecting stack buffer overflows at runtime is a security feature. This 410 * modifier should thus only be used on functions which are provably exempt of 411 * stack buffer overflows, for example because they do not use stack buffers. 412 * 413 * This modifier does not affect the corresponding function's linking behavior. 414 */ 415 #if defined(MOZ_HAVE_NO_STACK_PROTECTOR) 416 # define MOZ_NO_STACK_PROTECTOR MOZ_HAVE_NO_STACK_PROTECTOR 417 #else 418 # define MOZ_NO_STACK_PROTECTOR /* no support */ 419 #endif 420 421 /** 422 * MOZ_GSL_OWNER indicates that objects of the type this annotation is attached 423 * to own some kind of resources, generally memory. 424 * 425 * See: https://clang.llvm.org/docs/AttributeReference.html#owner 426 */ 427 #if defined(__clang__) && defined(__has_cpp_attribute) 428 # if __has_cpp_attribute(gsl::Owner) 429 # define MOZ_GSL_OWNER [[gsl::Owner]] 430 # else 431 # define MOZ_GSL_OWNER /* nothing */ 432 # endif 433 #else 434 # define MOZ_GSL_OWNER /* nothing */ 435 #endif 436 437 /** 438 * MOZ_GSL_POINTER indicates that objects of the type this annotation is 439 * attached to provide a non-owning view on some kind of resources, generally 440 * memory. 441 * 442 * See: https://clang.llvm.org/docs/AttributeReference.html#pointer 443 */ 444 #if defined(__clang__) && defined(__has_cpp_attribute) 445 # if __has_cpp_attribute(gsl::Pointer) 446 # define MOZ_GSL_POINTER [[gsl::Pointer]] 447 # else 448 # define MOZ_GSL_POINTER /* nothing */ 449 # endif 450 #else 451 # define MOZ_GSL_POINTER /* nothing */ 452 #endif 453 454 /** 455 * MOZ_LIFETIME_BOUND indicates that objects that are referred to by that 456 * parameter may also be referred to by the return value of the annotated 457 * function (or, for a parameter of a constructor, by the value of the 458 * constructed object). 459 * See: https://clang.llvm.org/docs/AttributeReference.html#lifetimebound 460 */ 461 #if defined(__clang__) && defined(__has_cpp_attribute) 462 # if __has_cpp_attribute(clang::lifetimebound) 463 # define MOZ_LIFETIME_BOUND [[clang::lifetimebound]] 464 # else 465 # define MOZ_LIFETIME_BOUND /* nothing */ 466 # endif 467 #else 468 # define MOZ_LIFETIME_BOUND /* nothing */ 469 #endif 470 471 /** 472 * MOZ_LIFETIME_CAPTURE_BY(x) indicates that objects that are referred to 473 * by that parameter may also be referred to by x. 474 * See: https://clang.llvm.org/docs/AttributeReference.html#lifetime-capture-by 475 */ 476 #if defined(__clang__) && defined(__has_cpp_attribute) 477 # if __has_cpp_attribute(clang::lifetime_capture_by) 478 # define MOZ_LIFETIME_CAPTURE_BY(x) [[clang::lifetime_capture_by(x)]] 479 # else 480 # define MOZ_LIFETIME_CAPTURE_BY(x) /* nothing */ 481 # endif 482 #else 483 # define MOZ_LIFETIME_CAPTURE_BY(x) /* nothing */ 484 #endif 485 486 /** 487 * MOZ_STANDALONE_DEBUG causes complete debug information to be emitted 488 * for a record type when clang would otherwise try to elide some of it. 489 * This helps certain third party debugging tools introspect types. 490 * See: https://clang.llvm.org/docs/AttributeReference.html#standalone-debug 491 */ 492 #if defined(__clang__) && defined(__has_cpp_attribute) 493 # if __has_cpp_attribute(clang::standalone_debug) 494 # define MOZ_STANDALONE_DEBUG [[clang::standalone_debug]] 495 # else 496 # define MOZ_STANDALONE_DEBUG /* nothing */ 497 # endif 498 #else 499 # define MOZ_STANDALONE_DEBUG /* nothing */ 500 #endif 501 502 #ifdef __cplusplus 503 504 /** 505 * C++11 lets unions contain members that have non-trivial special member 506 * functions (default/copy/move constructor, copy/move assignment operator, 507 * destructor) if the user defines the corresponding functions on the union. 508 * (Such user-defined functions must rely on external knowledge about which arm 509 * is active to be safe. Be extra-careful defining these functions!) 510 * 511 * MSVC unfortunately warns/errors for this bog-standard C++11 pattern. Use 512 * these macro-guards around such member functions to disable the warnings: 513 * 514 * union U 515 * { 516 * std::string s; 517 * int x; 518 * 519 * MOZ_PUSH_DISABLE_NONTRIVIAL_UNION_WARNINGS 520 * 521 * // |U| must have a user-defined default constructor because |std::string| 522 * // has a non-trivial default constructor. 523 * U() ... { ... } 524 * 525 * // |U| must have a user-defined destructor because |std::string| has a 526 * // non-trivial destructor. 527 * ~U() { ... } 528 * 529 * MOZ_POP_DISABLE_NONTRIVIAL_UNION_WARNINGS 530 * }; 531 */ 532 # if defined(_MSC_VER) 533 # define MOZ_PUSH_DISABLE_NONTRIVIAL_UNION_WARNINGS \ 534 __pragma(warning(push)) __pragma(warning(disable : 4582)) \ 535 __pragma(warning(disable : 4583)) 536 # define MOZ_POP_DISABLE_NONTRIVIAL_UNION_WARNINGS __pragma(warning(pop)) 537 # else 538 # define MOZ_PUSH_DISABLE_NONTRIVIAL_UNION_WARNINGS /* nothing */ 539 # define MOZ_POP_DISABLE_NONTRIVIAL_UNION_WARNINGS /* nothing */ 540 # endif 541 542 /* 543 * The following macros are attributes that support the static analysis plugin 544 * included with Mozilla, and will be implemented (when such support is enabled) 545 * as C++11 attributes. Since such attributes are legal pretty much everywhere 546 * and have subtly different semantics depending on their placement, the 547 * following is a guide on where to place the attributes. 548 * 549 * Attributes that apply to a struct or class precede the name of the class: 550 * (Note that this is different from the placement of final for classes!) 551 * 552 * class MOZ_CLASS_ATTRIBUTE SomeClass {}; 553 * 554 * Attributes that apply to functions follow the parentheses and const 555 * qualifiers but precede final, override and the function body: 556 * 557 * void DeclaredFunction() MOZ_FUNCTION_ATTRIBUTE; 558 * void SomeFunction() MOZ_FUNCTION_ATTRIBUTE {} 559 * void PureFunction() const MOZ_FUNCTION_ATTRIBUTE = 0; 560 * void OverriddenFunction() MOZ_FUNCTION_ATTIRBUTE override; 561 * 562 * Attributes that apply to variables or parameters follow the variable's name: 563 * 564 * int variable MOZ_VARIABLE_ATTRIBUTE; 565 * 566 * Attributes that apply to types follow the type name: 567 * 568 * typedef int MOZ_TYPE_ATTRIBUTE MagicInt; 569 * int MOZ_TYPE_ATTRIBUTE someVariable; 570 * int* MOZ_TYPE_ATTRIBUTE magicPtrInt; 571 * int MOZ_TYPE_ATTRIBUTE* ptrToMagicInt; 572 * 573 * Attributes that apply to statements precede the statement: 574 * 575 * MOZ_IF_ATTRIBUTE if (x == 0) 576 * MOZ_DO_ATTRIBUTE do { } while (0); 577 * 578 * Attributes that apply to labels precede the label: 579 * 580 * MOZ_LABEL_ATTRIBUTE target: 581 * goto target; 582 * MOZ_CASE_ATTRIBUTE case 5: 583 * MOZ_DEFAULT_ATTRIBUTE default: 584 * 585 * The static analyses that are performed by the plugin are as follows: 586 * 587 * MOZ_CAN_RUN_SCRIPT: Applies to functions which can run script. Callers of 588 * this function must also be marked as MOZ_CAN_RUN_SCRIPT, and all refcounted 589 * arguments must be strongly held in the caller. Note that MOZ_CAN_RUN_SCRIPT 590 * should only be applied to function declarations, not definitions. If you 591 * need to apply it to a definition (eg because both are generated by a macro) 592 * use MOZ_CAN_RUN_SCRIPT_FOR_DEFINITION. 593 * 594 * MOZ_CAN_RUN_SCRIPT can be applied to XPIDL-generated declarations by 595 * annotating the method or attribute as [can_run_script] in the .idl file. 596 * 597 * MOZ_CAN_RUN_SCRIPT_FOR_DEFINITION: Same as MOZ_CAN_RUN_SCRIPT, but usable on 598 * a definition. If the declaration is in a header file, users of that header 599 * file may not see the annotation. 600 * MOZ_CAN_RUN_SCRIPT_BOUNDARY: Applies to functions which need to call 601 * MOZ_CAN_RUN_SCRIPT functions, but should not themselves be considered 602 * MOZ_CAN_RUN_SCRIPT. This should generally be avoided but can be used in 603 * two cases: 604 * 1) As a temporary measure to limit the scope of changes when adding 605 * MOZ_CAN_RUN_SCRIPT. Such a use must be accompanied by a follow-up bug 606 * to replace the MOZ_CAN_RUN_SCRIPT_BOUNDARY with MOZ_CAN_RUN_SCRIPT and 607 * a comment linking to that bug. 608 * 2) If we can reason that the MOZ_CAN_RUN_SCRIPT callees of the function 609 * do not in fact run script (for example, because their behavior depends 610 * on arguments and we pass the arguments that don't allow script 611 * execution). Such a use must be accompanied by a comment that explains 612 * why it's OK to have the MOZ_CAN_RUN_SCRIPT_BOUNDARY, as well as 613 * comments in the callee pointing out that if its behavior changes the 614 * caller might need adjusting. And perhaps also a followup bug to 615 * refactor things so the "script" and "no script" codepaths do not share 616 * a chokepoint. 617 * Importantly, any use MUST be accompanied by a comment explaining why it's 618 * there, and should ideally have an action plan for getting rid of the 619 * MOZ_CAN_RUN_SCRIPT_BOUNDARY annotation. 620 * MOZ_MUST_OVERRIDE: Applies to all C++ member functions. All immediate 621 * subclasses must provide an exact override of this method; if a subclass 622 * does not override this method, the compiler will emit an error. This 623 * attribute is not limited to virtual methods, so if it is applied to a 624 * nonvirtual method and the subclass does not provide an equivalent 625 * definition, the compiler will emit an error. 626 * MOZ_STATIC_CLASS: Applies to all classes. Any class with this annotation is 627 * expected to live in static memory, so it is a compile-time error to use 628 * it, or an array of such objects, as the type of a variable declaration, or 629 * as a temporary object, or as the type of a new expression (unless 630 * placement new is being used). If a member of another class uses this 631 * class, or if another class inherits from this class, then it is considered 632 * to be a static class as well, although this attribute need not be provided 633 * in such cases. 634 * MOZ_STATIC_LOCAL_CLASS: Applies to all classes. Any class with this 635 * annotation is expected to be a static local variable, so it is 636 * a compile-time error to use it, or an array of such objects, or as a 637 * temporary object, or as the type of a new expression. If another class 638 * inherits from this class then it is considered to be a static local 639 * class as well, although this attribute need not be provided in such cases. 640 * It is also a compile-time error for any class with this annotation to have 641 * a non-trivial destructor. 642 * MOZ_STACK_CLASS: Applies to all classes. Any class with this annotation is 643 * expected to live on the stack, so it is a compile-time error to use it, or 644 * an array of such objects, as a global or static variable, or as the type of 645 * a new expression (unless placement new is being used). If a member of 646 * another class uses this class, or if another class inherits from this 647 * class, then it is considered to be a stack class as well, although this 648 * attribute need not be provided in such cases. 649 * MOZ_NONHEAP_CLASS: Applies to all classes. Any class with this annotation is 650 * expected to live on the stack or in static storage, so it is a compile-time 651 * error to use it, or an array of such objects, as the type of a new 652 * expression. If a member of another class uses this class, or if another 653 * class inherits from this class, then it is considered to be a non-heap 654 * class as well, although this attribute need not be provided in such cases. 655 * MOZ_RUNINIT: Applies to global variables with runtime initialization. 656 * MOZ_GLOBINIT: Applies to global variables with potential runtime 657 * initialization (e.g. inside macro or when initialisation status depends on 658 * template parameter). 659 * MOZ_HEAP_CLASS: Applies to all classes. Any class with this annotation is 660 * expected to live on the heap, so it is a compile-time error to use it, or 661 * an array of such objects, as the type of a variable declaration, or as a 662 * temporary object. If a member of another class uses this class, or if 663 * another class inherits from this class, then it is considered to be a heap 664 * class as well, although this attribute need not be provided in such cases. 665 * MOZ_NON_TEMPORARY_CLASS: Applies to all classes. Any class with this 666 * annotation is expected not to live in a temporary. If a member of another 667 * class uses this class or if another class inherits from this class, then it 668 * is considered to be a non-temporary class as well, although this attribute 669 * need not be provided in such cases. 670 * MOZ_TEMPORARY_CLASS: Applies to all classes. Any class with this annotation 671 * is expected to only live in a temporary. If another class inherits from 672 * this class, then it is considered to be a temporary class as well, although 673 * this attribute need not be provided in such cases. 674 * MOZ_RAII: Applies to all classes. Any class with this annotation is assumed 675 * to be a RAII guard, which is expected to live on the stack in an automatic 676 * allocation. It is prohibited from being allocated in a temporary, static 677 * storage, or on the heap. This is a combination of MOZ_STACK_CLASS and 678 * MOZ_NON_TEMPORARY_CLASS. 679 * MOZ_ONLY_USED_TO_AVOID_STATIC_CONSTRUCTORS: Applies to all classes that are 680 * intended to prevent introducing static initializers. This attribute 681 * currently makes it a compile-time error to instantiate these classes 682 * anywhere other than at the global scope, or as a static member of a class. 683 * In non-debug mode, it also prohibits non-trivial constructors and 684 * destructors. 685 * MOZ_TRIVIAL_CTOR_DTOR: Applies to all classes that must have both a trivial 686 * or constexpr constructor and a trivial destructor. Setting this attribute 687 * on a class makes it a compile-time error for that class to get a 688 * non-trivial constructor or destructor for any reason. 689 * MOZ_ALLOW_TEMPORARY: Applies to constructors. This indicates that using the 690 * constructor is allowed in temporary expressions, if it would have otherwise 691 * been forbidden by the type being a MOZ_NON_TEMPORARY_CLASS. Useful for 692 * constructors like Maybe(Nothing). 693 * MOZ_HEAP_ALLOCATOR: Applies to any function. This indicates that the return 694 * value is allocated on the heap, and will as a result check such allocations 695 * during MOZ_STACK_CLASS and MOZ_NONHEAP_CLASS annotation checking. 696 * MOZ_IMPLICIT: Applies to constructors. Implicit conversion constructors 697 * are disallowed by default unless they are marked as MOZ_IMPLICIT. This 698 * attribute must be used for constructors which intend to provide implicit 699 * conversions. 700 * MOZ_IS_REFPTR: Applies to class declarations of ref pointer to mark them as 701 * such for use with static-analysis. 702 * A ref pointer is an object wrapping a pointer and automatically taking care 703 * of its refcounting upon construction/destruction/transfer of ownership. 704 * This annotation implies MOZ_IS_SMARTPTR_TO_REFCOUNTED. 705 * MOZ_IS_SMARTPTR_TO_REFCOUNTED: Applies to class declarations of smart 706 * pointers to ref counted classes to mark them as such for use with 707 * static-analysis. 708 * MOZ_NO_ARITHMETIC_EXPR_IN_ARGUMENT: Applies to functions. Makes it a compile 709 * time error to pass arithmetic expressions on variables to the function. 710 * MOZ_OWNING_REF: Applies to declarations of pointers to reference counted 711 * types. This attribute tells the compiler that the raw pointer is a strong 712 * reference, where ownership through methods such as AddRef and Release is 713 * managed manually. This can make the compiler ignore these pointers when 714 * validating the usage of pointers otherwise. 715 * 716 * Example uses include owned pointers inside of unions, and pointers stored 717 * in POD types where a using a smart pointer class would make the object 718 * non-POD. 719 * MOZ_NON_OWNING_REF: Applies to declarations of pointers to reference counted 720 * types. This attribute tells the compiler that the raw pointer is a weak 721 * reference, which is ensured to be valid by a guarantee that the reference 722 * will be nulled before the pointer becomes invalid. This can make the 723 * compiler ignore these pointers when validating the usage of pointers 724 * otherwise. 725 * 726 * Examples include an mOwner pointer, which is nulled by the owning class's 727 * destructor, and is null-checked before dereferencing. 728 * MOZ_UNSAFE_REF: Applies to declarations of pointers to reference counted 729 * types. Occasionally there are non-owning references which are valid, but 730 * do not take the form of a MOZ_NON_OWNING_REF. Their safety may be 731 * dependent on the behaviour of API consumers. The string argument passed 732 * to this macro documents the safety conditions. This can make the compiler 733 * ignore these pointers when validating the usage of pointers elsewhere. 734 * 735 * Examples include an nsAtom* member which is known at compile time to point 736 * to a static atom which is valid throughout the lifetime of the program, or 737 * an API which stores a pointer, but doesn't take ownership over it, instead 738 * requiring the API consumer to correctly null the value before it becomes 739 * invalid. 740 * 741 * Use of this annotation is discouraged when a strong reference or one of 742 * the above two annotations can be used instead. 743 * MOZ_NO_ADDREF_RELEASE_ON_RETURN: Applies to function declarations. Makes it 744 * a compile time error to call AddRef or Release on the return value of a 745 * function. This is intended to be used with operator->() of our smart 746 * pointer classes to ensure that the refcount of an object wrapped in a 747 * smart pointer is not manipulated directly. 748 * MOZ_NEEDS_NO_VTABLE_TYPE: Applies to template class declarations. Makes it 749 * a compile time error to instantiate this template with a type parameter 750 * which has a VTable. 751 * MOZ_NON_MEMMOVABLE: Applies to class declarations for types that are not safe 752 * to be moved in memory using memmove(). 753 * MOZ_NEEDS_MEMMOVABLE_TYPE: Applies to template class declarations where the 754 * template arguments are required to be safe to move in memory using 755 * memmove(). Passing MOZ_NON_MEMMOVABLE types to these templates is a 756 * compile time error. 757 * MOZ_NEEDS_MEMMOVABLE_MEMBERS: Applies to class declarations where each member 758 * must be safe to move in memory using memmove(). MOZ_NON_MEMMOVABLE types 759 * used in members of these classes are compile time errors. 760 * MOZ_NO_DANGLING_ON_TEMPORARIES: Applies to method declarations which return 761 * a pointer that is freed when the destructor of the class is called. This 762 * prevents these methods from being called on temporaries of the class, 763 * reducing risks of use-after-free. 764 * This attribute cannot be applied to && methods. 765 * In some cases, adding a deleted &&-qualified overload is too restrictive as 766 * this method should still be callable as a non-escaping argument to another 767 * function. This annotation can be used in those cases. 768 * MOZ_INHERIT_TYPE_ANNOTATIONS_FROM_TEMPLATE_ARGS: Applies to template class 769 * declarations where an instance of the template should be considered, for 770 * static analysis purposes, to inherit any type annotations (such as 771 * MOZ_STACK_CLASS) from its template arguments. 772 * MOZ_INIT_OUTSIDE_CTOR: Applies to class member declarations. Occasionally 773 * there are class members that are not initialized in the constructor, 774 * but logic elsewhere in the class ensures they are initialized prior to use. 775 * Using this attribute on a member disables the check that this member must 776 * be initialized in constructors via list-initialization, in the constructor 777 * body, or via functions called from the constructor body. 778 * MOZ_IS_CLASS_INIT: Applies to class method declarations. Occasionally the 779 * constructor doesn't initialize all of the member variables and another 780 * function is used to initialize the rest. This marker is used to make the 781 * static analysis tool aware that the marked function is part of the 782 * initialization process and to include the marked function in the scan 783 * mechanism that determines which member variables still remain 784 * uninitialized. 785 * MOZ_NON_PARAM: Applies to types. Makes it compile time error to use the type 786 * in parameter without pointer or reference. 787 * MOZ_NON_AUTOABLE: Applies to class declarations. Makes it a compile time 788 * error to use `auto` in place of this type in variable declarations. This 789 * is intended to be used with types which are intended to be implicitly 790 * constructed into other other types before being assigned to variables. 791 * MOZ_REQUIRED_BASE_METHOD: Applies to virtual class method declarations. 792 * Sometimes derived classes override methods that need to be called by their 793 * overridden counterparts. This marker indicates that the marked method must 794 * be called by the method that it overrides. 795 * MOZ_MUST_RETURN_FROM_CALLER_IF_THIS_IS_ARG: Applies to method declarations. 796 * Callers of the annotated method must return from that function within the 797 * calling block using an explicit `return` statement if the "this" value for 798 * the call is a parameter of the caller. Only calls to Constructors, 799 * references to local and member variables, and calls to functions or 800 * methods marked as MOZ_MAY_CALL_AFTER_MUST_RETURN may be made after the 801 * MOZ_MUST_RETURN_FROM_CALLER_IF_THIS_IS_ARG call. 802 * MOZ_MAY_CALL_AFTER_MUST_RETURN: Applies to function or method declarations. 803 * Calls to these methods may be made in functions after calls a 804 * MOZ_MUST_RETURN_FROM_CALLER_IF_THIS_IS_ARG method. 805 * MOZ_UNANNOTATED/MOZ_ANNOTATED: Applies to Mutexes/Monitors and variations on 806 * them. MOZ_UNANNOTATED indicates that the Mutex/Monitor/etc hasn't been 807 * examined and annotated using macros from mfbt/ThreadSafety -- 808 * MOZ_GUARDED_BY()/REQUIRES()/etc. MOZ_ANNOTATED is used in rare cases to 809 * indicate that is has been looked at, but it did not need any 810 * MOZ_GUARDED_BY()/REQUIRES()/etc (and thus static analysis knows it can 811 * ignore this Mutex/Monitor/etc) 812 */ 813 814 // gcc emits a nuisance warning -Wignored-attributes because attributes do not 815 // affect mangled names, and therefore template arguments do not propagate 816 // their attributes. It is rare that this would affect anything in practice, 817 // and most compilers are silent about it. Similarly, -Wattributes complains 818 // about attributes being ignored during template instantiation. 819 // 820 // Be conservative and only suppress the warning when running in a 821 // configuration where it would be emitted, namely when compiling with the 822 // XGILL_PLUGIN for the rooting hazard analysis (which runs under gcc.) If we 823 // end up wanting these attributes in general GCC builds, change this to 824 // something like 825 // 826 // #if defined(__GNUC__) && ! defined(__clang__) 827 // 828 # ifdef XGILL_PLUGIN 829 # pragma GCC diagnostic ignored "-Wignored-attributes" 830 # pragma GCC diagnostic ignored "-Wattributes" 831 # endif 832 833 # if defined(MOZ_CLANG_PLUGIN) || defined(XGILL_PLUGIN) 834 # define MOZ_CAN_RUN_SCRIPT __attribute__((annotate("moz_can_run_script"))) 835 # define MOZ_CAN_RUN_SCRIPT_FOR_DEFINITION \ 836 __attribute__((annotate("moz_can_run_script"))) \ 837 __attribute__((annotate("moz_can_run_script_for_definition"))) 838 # define MOZ_CAN_RUN_SCRIPT_BOUNDARY \ 839 __attribute__((annotate("moz_can_run_script_boundary"))) 840 # define MOZ_MUST_OVERRIDE __attribute__((annotate("moz_must_override"))) 841 # define MOZ_STATIC_CLASS __attribute__((annotate("moz_global_class"))) 842 # define MOZ_STATIC_LOCAL_CLASS \ 843 __attribute__((annotate("moz_static_local_class"))) \ 844 __attribute__((annotate("moz_trivial_dtor"))) 845 # define MOZ_STACK_CLASS __attribute__((annotate("moz_stack_class"))) 846 # define MOZ_NONHEAP_CLASS __attribute__((annotate("moz_nonheap_class"))) 847 # define MOZ_HEAP_CLASS __attribute__((annotate("moz_heap_class"))) 848 # define MOZ_NON_TEMPORARY_CLASS \ 849 __attribute__((annotate("moz_non_temporary_class"))) 850 # define MOZ_TEMPORARY_CLASS __attribute__((annotate("moz_temporary_class"))) 851 # define MOZ_TRIVIAL_CTOR_DTOR \ 852 __attribute__((annotate("moz_trivial_ctor_dtor"))) 853 # define MOZ_ALLOW_TEMPORARY __attribute__((annotate("moz_allow_temporary"))) 854 # ifdef DEBUG 855 /* in debug builds, these classes do have non-trivial constructors. */ 856 # define MOZ_ONLY_USED_TO_AVOID_STATIC_CONSTRUCTORS \ 857 __attribute__((annotate("moz_global_class"))) 858 # else 859 # define MOZ_ONLY_USED_TO_AVOID_STATIC_CONSTRUCTORS \ 860 __attribute__((annotate("moz_global_class"))) MOZ_TRIVIAL_CTOR_DTOR 861 # endif 862 # define MOZ_IMPLICIT __attribute__((annotate("moz_implicit"))) 863 # define MOZ_IS_SMARTPTR_TO_REFCOUNTED \ 864 __attribute__((annotate("moz_is_smartptr_to_refcounted"))) 865 # define MOZ_IS_REFPTR MOZ_IS_SMARTPTR_TO_REFCOUNTED 866 # define MOZ_NO_ARITHMETIC_EXPR_IN_ARGUMENT \ 867 __attribute__((annotate("moz_no_arith_expr_in_arg"))) 868 # define MOZ_OWNING_REF __attribute__((annotate("moz_owning_ref"))) 869 # define MOZ_NON_OWNING_REF __attribute__((annotate("moz_non_owning_ref"))) 870 # define MOZ_UNSAFE_REF(reason) __attribute__((annotate("moz_unsafe_ref"))) 871 # define MOZ_NO_ADDREF_RELEASE_ON_RETURN \ 872 __attribute__((annotate("moz_no_addref_release_on_return"))) 873 # define MOZ_NEEDS_NO_VTABLE_TYPE \ 874 __attribute__((annotate("moz_needs_no_vtable_type"))) 875 # define MOZ_NON_MEMMOVABLE __attribute__((annotate("moz_non_memmovable"))) 876 # define MOZ_NEEDS_MEMMOVABLE_TYPE \ 877 __attribute__((annotate("moz_needs_memmovable_type"))) 878 # define MOZ_NEEDS_MEMMOVABLE_MEMBERS \ 879 __attribute__((annotate("moz_needs_memmovable_members"))) 880 # define MOZ_NO_DANGLING_ON_TEMPORARIES \ 881 __attribute__((annotate("moz_no_dangling_on_temporaries"))) 882 # define MOZ_INHERIT_TYPE_ANNOTATIONS_FROM_TEMPLATE_ARGS \ 883 __attribute__(( \ 884 annotate("moz_inherit_type_annotations_from_template_args"))) 885 # define MOZ_NON_AUTOABLE __attribute__((annotate("moz_non_autoable"))) 886 # define MOZ_INIT_OUTSIDE_CTOR 887 # define MOZ_IS_CLASS_INIT 888 # define MOZ_NON_PARAM __attribute__((annotate("moz_non_param"))) 889 # define MOZ_REQUIRED_BASE_METHOD \ 890 __attribute__((annotate("moz_required_base_method"))) 891 # define MOZ_MUST_RETURN_FROM_CALLER_IF_THIS_IS_ARG \ 892 __attribute__((annotate("moz_must_return_from_caller_if_this_is_arg"))) 893 # define MOZ_MAY_CALL_AFTER_MUST_RETURN \ 894 __attribute__((annotate("moz_may_call_after_must_return"))) 895 # define MOZ_KNOWN_LIVE __attribute__((annotate("moz_known_live"))) 896 # ifdef MOZ_CLANG_PLUGIN 897 # define MOZ_UNANNOTATED __attribute__((annotate("moz_unannotated"))) 898 # define MOZ_ANNOTATED __attribute__((annotate("moz_annotated"))) 899 # define MOZ_RUNINIT __attribute__((annotate("moz_global_var"))) 900 # define MOZ_GLOBINIT \ 901 MOZ_RUNINIT __attribute__((annotate("moz_generated"))) 902 # else 903 # define MOZ_UNANNOTATED /* nothing */ 904 # define MOZ_ANNOTATED /* nothing */ 905 # define MOZ_RUNINIT /* nothing */ 906 # define MOZ_GLOBINIT /* nothing */ 907 # endif 908 909 /* 910 * It turns out that clang doesn't like void func() __attribute__ {} without a 911 * warning, so use pragmas to disable the warning. 912 */ 913 # ifdef __clang__ 914 # define MOZ_HEAP_ALLOCATOR \ 915 _Pragma("clang diagnostic push") \ 916 _Pragma("clang diagnostic ignored \"-Wgcc-compat\"") \ 917 __attribute__((annotate("moz_heap_allocator"))) _Pragma( \ 918 "clang diagnostic pop") 919 # else 920 # define MOZ_HEAP_ALLOCATOR __attribute__((annotate("moz_heap_allocator"))) 921 # endif 922 # else 923 # define MOZ_CAN_RUN_SCRIPT /* nothing */ 924 # define MOZ_CAN_RUN_SCRIPT_FOR_DEFINITION /* nothing */ 925 # define MOZ_CAN_RUN_SCRIPT_BOUNDARY /* nothing */ 926 # define MOZ_MUST_OVERRIDE /* nothing */ 927 # define MOZ_STATIC_CLASS /* nothing */ 928 # define MOZ_RUNINIT /* nothing */ 929 # define MOZ_GLOBINIT /* nothing */ 930 # define MOZ_STATIC_LOCAL_CLASS /* nothing */ 931 # define MOZ_STACK_CLASS /* nothing */ 932 # define MOZ_NONHEAP_CLASS /* nothing */ 933 # define MOZ_HEAP_CLASS /* nothing */ 934 # define MOZ_NON_TEMPORARY_CLASS /* nothing */ 935 # define MOZ_TEMPORARY_CLASS /* nothing */ 936 # define MOZ_TRIVIAL_CTOR_DTOR /* nothing */ 937 # define MOZ_ALLOW_TEMPORARY /* nothing */ 938 # define MOZ_ONLY_USED_TO_AVOID_STATIC_CONSTRUCTORS /* nothing */ 939 # define MOZ_IMPLICIT /* nothing */ 940 # define MOZ_IS_SMARTPTR_TO_REFCOUNTED /* nothing */ 941 # define MOZ_IS_REFPTR /* nothing */ 942 # define MOZ_NO_ARITHMETIC_EXPR_IN_ARGUMENT /* nothing */ 943 # define MOZ_HEAP_ALLOCATOR /* nothing */ 944 # define MOZ_OWNING_REF /* nothing */ 945 # define MOZ_NON_OWNING_REF /* nothing */ 946 # define MOZ_UNSAFE_REF(reason) /* nothing */ 947 # define MOZ_NO_ADDREF_RELEASE_ON_RETURN /* nothing */ 948 # define MOZ_NEEDS_NO_VTABLE_TYPE /* nothing */ 949 # define MOZ_NON_MEMMOVABLE /* nothing */ 950 # define MOZ_NEEDS_MEMMOVABLE_TYPE /* nothing */ 951 # define MOZ_NEEDS_MEMMOVABLE_MEMBERS /* nothing */ 952 # define MOZ_NO_DANGLING_ON_TEMPORARIES /* nothing */ 953 # define MOZ_INHERIT_TYPE_ANNOTATIONS_FROM_TEMPLATE_ARGS /* nothing */ 954 # define MOZ_INIT_OUTSIDE_CTOR /* nothing */ 955 # define MOZ_IS_CLASS_INIT /* nothing */ 956 # define MOZ_NON_PARAM /* nothing */ 957 # define MOZ_NON_AUTOABLE /* nothing */ 958 # define MOZ_REQUIRED_BASE_METHOD /* nothing */ 959 # define MOZ_MUST_RETURN_FROM_CALLER_IF_THIS_IS_ARG /* nothing */ 960 # define MOZ_MAY_CALL_AFTER_MUST_RETURN /* nothing */ 961 # define MOZ_KNOWN_LIVE /* nothing */ 962 # define MOZ_UNANNOTATED /* nothing */ 963 # define MOZ_ANNOTATED /* nothing */ 964 # endif /* defined(MOZ_CLANG_PLUGIN) || defined(XGILL_PLUGIN) */ 965 966 # define MOZ_RAII MOZ_NON_TEMPORARY_CLASS MOZ_STACK_CLASS 967 968 // XGILL_PLUGIN is used for the GC rooting hazard analysis, which compiles with 969 // gcc. gcc has different rules governing __attribute__((...)) placement, so 970 // some attributes will error out when used in the source code where clang 971 // expects them to be. Remove the problematic annotations when needed. 972 // 973 // The placement of c++11 [[...]] attributes is more flexible and defined by a 974 // spec, so it would be nice to switch to those for the problematic 975 // cases. Unfortunately, the official spec provides *no* way to annotate a 976 // lambda function, which is one source of the difficulty here. It appears that 977 // this will be fixed in c++23: https://github.com/cplusplus/papers/issues/882 978 979 # ifdef XGILL_PLUGIN 980 981 # undef MOZ_MUST_OVERRIDE 982 # undef MOZ_CAN_RUN_SCRIPT_FOR_DEFINITION 983 # undef MOZ_CAN_RUN_SCRIPT 984 # undef MOZ_CAN_RUN_SCRIPT_BOUNDARY 985 # define MOZ_MUST_OVERRIDE /* nothing */ 986 # define MOZ_CAN_RUN_SCRIPT_FOR_DEFINITION /* nothing */ 987 # define MOZ_CAN_RUN_SCRIPT /* nothing */ 988 # define MOZ_CAN_RUN_SCRIPT_BOUNDARY /* nothing */ 989 990 # endif 991 992 #endif /* __cplusplus */ 993 994 /** 995 * Printf style formats. MOZ_FORMAT_PRINTF and MOZ_FORMAT_WPRINTF can be used 996 * to annotate a function or method that is "printf/wprintf-like"; this will let 997 * (some) compilers check that the arguments match the template string. 998 * 999 * This macro takes two arguments. The first argument is the argument 1000 * number of the template string. The second argument is the argument 1001 * number of the '...' argument holding the arguments. 1002 * 1003 * Argument numbers start at 1. Note that the implicit "this" 1004 * argument of a non-static member function counts as an argument. 1005 * 1006 * So, for a simple case like: 1007 * void print_something (int whatever, const char *fmt, ...); 1008 * The corresponding annotation would be 1009 * MOZ_FORMAT_PRINTF(2, 3) 1010 * However, if "print_something" were a non-static member function, 1011 * then the annotation would be: 1012 * MOZ_FORMAT_PRINTF(3, 4) 1013 * 1014 * The second argument should be 0 for vprintf-like functions; that 1015 * is, those taking a va_list argument. 1016 * 1017 * Note that the checking is limited to standards-conforming 1018 * printf-likes, and in particular this should not be used for 1019 * PR_snprintf and friends, which are "printf-like" but which assign 1020 * different meanings to the various formats. 1021 * 1022 * MinGW requires special handling due to different format specifiers 1023 * on different platforms. The macro __MINGW_PRINTF_FORMAT maps to 1024 * either gnu_printf or ms_printf depending on where we are compiling 1025 * to avoid warnings on format specifiers that are legal. 1026 * 1027 * At time of writing MinGW has no wide equivalent to __MINGW_PRINTF_FORMAT; 1028 * therefore __MINGW_WPRINTF_FORMAT has been implemented following the same 1029 * pattern seen in MinGW's source. 1030 */ 1031 #ifdef __MINGW32__ 1032 # define MOZ_FORMAT_PRINTF(stringIndex, firstToCheck) \ 1033 __attribute__((format(__MINGW_PRINTF_FORMAT, stringIndex, firstToCheck))) 1034 # ifndef __MINGW_WPRINTF_FORMAT 1035 # if defined(__clang__) 1036 # define __MINGW_WPRINTF_FORMAT wprintf 1037 # elif defined(_UCRT) || __USE_MINGW_ANSI_STDIO 1038 # define __MINGW_WPRINTF_FORMAT gnu_wprintf 1039 # else 1040 # define __MINGW_WPRINTF_FORMAT ms_wprintf 1041 # endif 1042 # endif 1043 # define MOZ_FORMAT_WPRINTF(stringIndex, firstToCheck) \ 1044 __attribute__((format(__MINGW_WPRINTF_FORMAT, stringIndex, firstToCheck))) 1045 #elif __GNUC__ || __clang__ 1046 # define MOZ_FORMAT_PRINTF(stringIndex, firstToCheck) \ 1047 __attribute__((format(printf, stringIndex, firstToCheck))) 1048 # define MOZ_FORMAT_WPRINTF(stringIndex, firstToCheck) \ 1049 __attribute__((format(wprintf, stringIndex, firstToCheck))) 1050 #else 1051 # define MOZ_FORMAT_PRINTF(stringIndex, firstToCheck) 1052 # define MOZ_FORMAT_WPRINTF(stringIndex, firstToCheck) 1053 #endif 1054 1055 /** 1056 * To manually declare an XPCOM ABI-compatible virtual function, the following 1057 * macros can be used to handle the non-standard ABI used on Windows for COM 1058 * compatibility. E.g.: 1059 * 1060 * virtual ReturnType MOZ_XPCOM_ABI foo(); 1061 */ 1062 #if defined(XP_WIN) 1063 # define MOZ_XPCOM_ABI __stdcall 1064 #else 1065 # define MOZ_XPCOM_ABI 1066 #endif 1067 1068 /** 1069 * MSVC / clang-cl don't optimize empty bases correctly unless we explicitly 1070 * tell it to, see: 1071 * 1072 * https://stackoverflow.com/questions/12701469/why-is-the-empty-base-class-optimization-ebo-is-not-working-in-msvc 1073 * https://devblogs.microsoft.com/cppblog/optimizing-the-layout-of-empty-base-classes-in-vs2015-update-2-3/ 1074 */ 1075 #if defined(_MSC_VER) 1076 # define MOZ_EMPTY_BASES __declspec(empty_bases) 1077 #else 1078 # define MOZ_EMPTY_BASES 1079 #endif 1080 1081 // XXX: GCC somehow does not allow attributes before lambda return types, while 1082 // clang requires so. See also bug 1627007. 1083 #ifdef __clang__ 1084 # define MOZ_CAN_RUN_SCRIPT_BOUNDARY_LAMBDA MOZ_CAN_RUN_SCRIPT_BOUNDARY 1085 #else 1086 # define MOZ_CAN_RUN_SCRIPT_BOUNDARY_LAMBDA 1087 #endif 1088 1089 #endif /* mozilla_Attributes_h */