[PATCH 0/3] Fix code issues spotted by clang

[PATCH 0/3] Fix code issues spotted by clang

[Ævar Arnfjörð Bjarmason]

This series fixes some of the code issues raised by clang. This leaves
the following warnings that I haven't addressed:

    revision.c:766:25: warning: implicit truncation from 'unsigned int' to bitfield changes value from 4294967279 to 134217711
          [-Wconstant-conversion]
                    p->item->object.flags &= ~TMP_MARK;
                                          ^  ~~~~~~~~~
    revision.c:768:25: warning: implicit truncation from 'unsigned int' to bitfield changes value from 4294967279 to 134217711
          [-Wconstant-conversion]
                    p->item->object.flags &= ~TMP_MARK;
                                          ^  ~~~~~~~~~
    revision.c:1875:25: warning: implicit truncation from 'unsigned int' to bitfield changes value from 4294967279 to 134217711
          [-Wconstant-conversion]
                    p->item->object.flags &= ~TMP_MARK;
                                          ^  ~~~~~~~~~
    revision.c:2202:25: warning: implicit truncation from 'unsigned int' to bitfield changes value from 4294967158 to 134217590
          [-Wconstant-conversion]
                            commit->object.flags &= ~(ADDED | SEEN | SHOWN);
                                                 ^  ~~~~~~~~~~~~~~~~~~~~~~~
    upload-pack.c:115:12: warning: implicit truncation from 'unsigned int' to bitfield changes value from 4294967293 to 134217725
          [-Wconstant-conversion]
                    o->flags &= ~UNINTERESTING;
                             ^  ~~~~~~~~~~~~~~
    upload-pack.c:689:19: warning: implicit truncation from 'unsigned int' to bitfield changes value from 4294705151 to 133955583
          [-Wconstant-conversion]
                                    object->flags &= ~CLIENT_SHALLOW;
                                                  ^  ~~~~~~~~~~~~~~~
    builtin/checkout.c:676:16: warning: implicit truncation from 'unsigned int' to bitfield changes value from 4294967293 to 134217725
          [-Wconstant-conversion]
            object->flags &= ~UNINTERESTING;
                          ^  ~~~~~~~~~~~~~~
    builtin/reflog.c:173:32: warning: implicit truncation from 'unsigned int' to bitfield changes value from 4294965247 to 134215679
          [-Wconstant-conversion]
                    found.objects[i].item->flags &= ~STUDYING;
                                                 ^  ~~~~~~~~~
    builtin/reflog.c:232:31: warning: implicit truncation from 'unsigned int' to bitfield changes value from 4294963199 to 134213631
          [-Wconstant-conversion]
                    pending->item->object.flags &= ~REACHABLE;
                                                ^  ~~~~~~~~~~
    bisect.c:66:24: warning: implicit truncation from 'unsigned int' to bitfield changes value from 4294901759 to 134152191
          [-Wconstant-conversion]
                    commit->object.flags &= ~COUNTED;
                                         ^  ~~~~~~~~
    
Ævar Arnfjörð Bjarmason (3):
  apply: get rid of useless x < 0 comparison on a size_t type
  diff/apply: cast variable in call to free()
  grep: get rid of useless x < 0 comparison on an enum member

 builtin/apply.c |    3 ---
 builtin/diff.c  |    2 +-
 grep.c          |    2 +-
 submodule.c     |    2 +-
 4 files changed, 3 insertions(+), 6 deletions(-)

-- 
1.7.6.3

[PATCH 1/3] apply: get rid of useless x < 0 comparison on a size_t type

[Ævar Arnfjörð Bjarmason]

According to the C standard size_t is always unsigned, therefore the
comparison "n1 < 0 || n2 < 0" when n1 and n2 are size_t will always be
false.

This was raised by clang 2.9 which throws this warning when compiling
apply.c:

    builtin/apply.c:253:9: warning: comparison of unsigned expression < 0 is always false [-Wtautological-compare]
            if (n1 < 0 || n2 < 0)
                ~~ ^ ~
    builtin/apply.c:253:19: warning: comparison of unsigned expression < 0 is always false [-Wtautological-compare]
            if (n1 < 0 || n2 < 0)
                          ~~ ^ ~

This check was originally added in v1.6.5-rc0~53^2 by Giuseppe Bilotta
while adding an option to git-apply to ignore whitespace differences.

Signed-off-by: Ævar Arnfjörð Bjarmason <avarab@gmail.com>
---
 builtin/apply.c |    3 ---
 1 files changed, 0 insertions(+), 3 deletions(-)

diff --git a/builtin/apply.c b/builtin/apply.c
index 84a8a0b..b3b59db 100644
--- a/builtin/apply.c
+++ b/builtin/apply.c
@@ -250,9 +250,6 @@ static int fuzzy_matchlines(const char *s1, size_t n1,
 	const char *last2 = s2 + n2 - 1;
 	int result = 0;
 
-	if (n1 < 0 || n2 < 0)
-		return 0;
-
 	/* ignore line endings */
 	while ((*last1 == '\r') || (*last1 == '\n'))
 		last1--;
-- 
1.7.6.3

Re: [PATCH 1/3] apply: get rid of useless x < 0 comparison on a size_t type

[Junio C Hamano]

Ævar Arnfjörð Bjarmason  <avarab@gmail.com> writes:

> According to the C standard size_t is always unsigned, therefore the
> comparison "n1 < 0 || n2 < 0" when n1 and n2 are size_t will always be
> false.
>
> This was raised by clang 2.9 which throws this warning when compiling
> apply.c:
>
>     builtin/apply.c:253:9: warning: comparison of unsigned expression < 0 is always false [-Wtautological-compare]
>             if (n1 < 0 || n2 < 0)
>                 ~~ ^ ~
>     builtin/apply.c:253:19: warning: comparison of unsigned expression < 0 is always false [-Wtautological-compare]
>             if (n1 < 0 || n2 < 0)
>                           ~~ ^ ~
>
> This check was originally added in v1.6.5-rc0~53^2 by Giuseppe Bilotta
> while adding an option to git-apply to ignore whitespace differences.
>
> Signed-off-by: Ævar Arnfjörð Bjarmason <avarab@gmail.com>
> ---

I agree that these quantities can never be negative, so I'll apply the
patch as is.

But I have this suspicion that this was a rather sloppy defensive check to
protect this codepath against potential breakage in another codepath (most
likely update_pre_post_images() touched by the same patch) that adjusts
image->line[].len the caller of this function uses to feed these two
parameters. Giuseppe may have been not confident enough that the code
added to that function ensures not to undershoot when it reduces "len", or
something.

Giuseppe, can you explain what is going on?

Thanks

>  builtin/apply.c |    3 ---
>  1 files changed, 0 insertions(+), 3 deletions(-)
>
> diff --git a/builtin/apply.c b/builtin/apply.c
> index 84a8a0b..b3b59db 100644
> --- a/builtin/apply.c
> +++ b/builtin/apply.c
> @@ -250,9 +250,6 @@ static int fuzzy_matchlines(const char *s1, size_t n1,
>  	const char *last2 = s2 + n2 - 1;
>  	int result = 0;
>  
> -	if (n1 < 0 || n2 < 0)
> -		return 0;
> -
>  	/* ignore line endings */
>  	while ((*last1 == '\r') || (*last1 == '\n'))
>  		last1--;

Re: [PATCH 1/3] apply: get rid of useless x < 0 comparison on a size_t type

[Giuseppe Bilotta]

On Sun, Nov 6, 2011 at 7:35 PM, Junio C Hamano <gitster@pobox.com> wrote:
> Ævar Arnfjörð Bjarmason  <avarab@gmail.com> writes:
>>
>> This check was originally added in v1.6.5-rc0~53^2 by Giuseppe Bilotta
>> while adding an option to git-apply to ignore whitespace differences.
>
> I agree that these quantities can never be negative, so I'll apply the
> patch as is.

I agree too. In fact I spotted this some time ago when I started
compiling git with Clang but never found the time to look into it.

> But I have this suspicion that this was a rather sloppy defensive check to
> protect this codepath against potential breakage in another codepath (most
> likely update_pre_post_images() touched by the same patch) that adjusts
> image->line[].len the caller of this function uses to feed these two
> parameters. Giuseppe may have been not confident enough that the code
> added to that function ensures not to undershoot when it reduces "len", or
> something.
>
> Giuseppe, can you explain what is going on?

No, I can't, so I guess the sloppy coding is the right motivation. I
remember working this patch from a rather older submission that was
never followed-up to, so my guess is that I just forgot to clean it up
properly, and during review the focus was obviously on other aspects
of the submission too. Also, having a look at the current caller of
the function, I don't see how the check would even be needed.

-- 
Giuseppe "Oblomov" Bilotta

[PATCH 2/3] diff/apply: cast variable in call to free()

[Ævar Arnfjörð Bjarmason]

Both of these free() calls are freeing a "const unsigned char (*)[20]"
type while free() expects a "void *". This results in the following
warning under clang 2.9:

    builtin/diff.c:185:7: warning: passing 'const unsigned char (*)[20]' to parameter of type 'void *' discards qualifiers
            free(parent);
                 ^~~~~~

    submodule.c:394:7: warning: passing 'const unsigned char (*)[20]' to parameter of type 'void *' discards qualifiers
            free(parents);
                 ^~~~~~~

This free()-ing without a cast was added by Jim Meyering to
builtin/diff.c in v1.7.6-rc3~4 and later by Fredrik Gustafsson in
submodule.c in v1.7.7-rc1~25^2.

Signed-off-by: Ævar Arnfjörð Bjarmason <avarab@gmail.com>
---
 builtin/diff.c |    2 +-
 submodule.c    |    2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/builtin/diff.c b/builtin/diff.c
index 1118689..0fe638f 100644
--- a/builtin/diff.c
+++ b/builtin/diff.c
@@ -182,7 +182,7 @@ static int builtin_diff_combined(struct rev_info *revs,
 		hashcpy((unsigned char *)(parent + i), ent[i].item->sha1);
 	diff_tree_combined(parent[0], parent + 1, ents - 1,
 			   revs->dense_combined_merges, revs);
-	free(parent);
+	free((void *)parent);
 	return 0;
 }
 
diff --git a/submodule.c b/submodule.c
index 0fd10a0..52cdcc6 100644
--- a/submodule.c
+++ b/submodule.c
@@ -391,7 +391,7 @@ static void commit_need_pushing(struct commit *commit, struct commit_list *paren
 	rev.diffopt.format_callback_data = needs_pushing;
 	diff_tree_combined(commit->object.sha1, parents, n, 1, &rev);
 
-	free(parents);
+	free((void *)parents);
 }
 
 int check_submodule_needs_pushing(unsigned char new_sha1[20], const char *remotes_name)
-- 
1.7.6.3

[PATCH 3/3] grep: get rid of useless x < 0 comparison on an enum member

[Ævar Arnfjörð Bjarmason]

Remove an "p->field < 0" comparison in grep.c that'll always be
false. In this case "p" is a "grep_pat" where "field" is defined as:

	enum grep_header_field field;

And grep_header_field is in turn defined as:

    enum grep_header_field {
    	GREP_HEADER_AUTHOR = 0,
    	GREP_HEADER_COMMITTER
    };

Meaning that this comparison will always be false. This was spotted by
clang 2.9 which produced the following warning while compiling grep.c:

    grep.c:330:16: warning: comparison of unsigned enum expression < 0 is always false [-Wtautological-compare]
                    if (p->field < 0 || GREP_HEADER_FIELD_MAX <= p->field)
                        ~~~~~~~~ ^ ~

Signed-off-by: Ævar Arnfjörð Bjarmason <avarab@gmail.com>
---
 grep.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/grep.c b/grep.c
index b29d09c..025d3f8 100644
--- a/grep.c
+++ b/grep.c
@@ -327,7 +327,7 @@ static struct grep_expr *prep_header_patterns(struct grep_opt *opt)
 	for (p = opt->header_list; p; p = p->next) {
 		if (p->token != GREP_PATTERN_HEAD)
 			die("bug: a non-header pattern in grep header list.");
-		if (p->field < 0 || GREP_HEADER_FIELD_MAX <= p->field)
+		if (GREP_HEADER_FIELD_MAX <= p->field)
 			die("bug: unknown header field %d", p->field);
 		compile_regexp(p, opt);
 	}
-- 
1.7.6.3

Re: [PATCH 3/3] grep: get rid of useless x < 0 comparison on an enum member

[Andreas Schwab]

Ævar Arnfjörð Bjarmason <avarab@gmail.com> writes:

> Remove an "p->field < 0" comparison in grep.c that'll always be
> false. In this case "p" is a "grep_pat" where "field" is defined as:
>
> 	enum grep_header_field field;
>
> And grep_header_field is in turn defined as:
>
>     enum grep_header_field {
>     	GREP_HEADER_AUTHOR = 0,
>     	GREP_HEADER_COMMITTER
>     };
>
> Meaning that this comparison will always be false.

The underlying integer type is implementation-defined, and can be any
signed or unsigned integer type that can represent all enumerations.

Andreas.

-- 
Andreas Schwab, schwab@linux-m68k.org
GPG Key fingerprint = 58CA 54C7 6D53 942B 1756  01D3 44D5 214B 8276 4ED5
"And now for something completely different."

Re: [PATCH 3/3] grep: get rid of useless x < 0 comparison on an enum member

[Ævar Arnfjörð Bjarmason]

On Sun, Nov 6, 2011 at 16:03, Andreas Schwab <schwab@linux-m68k.org> wrote:
> Ævar Arnfjörð Bjarmason <avarab@gmail.com> writes:
>
>> Remove an "p->field < 0" comparison in grep.c that'll always be
>> false. In this case "p" is a "grep_pat" where "field" is defined as:
>>
>>       enum grep_header_field field;
>>
>> And grep_header_field is in turn defined as:
>>
>>     enum grep_header_field {
>>       GREP_HEADER_AUTHOR = 0,
>>       GREP_HEADER_COMMITTER
>>     };
>>
>> Meaning that this comparison will always be false.
>
> The underlying integer type is implementation-defined, and can be any
> signed or unsigned integer type that can represent all enumerations.

Yes, but as far as I can tell since we've done "= 0" there that
doesn't apply to us. To quote the ANSI C Standard (ANSI X3J11/88-090):

    3.5.2.2 Enumeration specifiers

    Syntax

              enum-specifier:
                      enum  identifier<opt> { enumerator-list }
                      enum  identifier

              enumerator-list:
                      enumerator
                      enumerator-list , enumerator

              enumerator:
                      enumeration-constant
                      enumeration-constant = constant-expression

    Constraints

       The expression that defines the value of an enumeration constant
    shall be an integral constant expression that has a value
    representable as an int.

    Semantics

       The identifiers in an enumerator list are declared as constants
    that have type int and may appear wherever such are permitted./52/ An
    enumerator with = defines its enumeration constant as the value of the
    constant expression.  If the first enumerator has no = , the value of
    its enumeration constant is 0.  Each subsequent enumerator with no =
    defines its enumeration constant as the value of the constant
    expression obtained by adding 1 to the value of the previous
    enumeration constant.  (A combination of both forms of enumerators may
    produce enumeration constants with values that duplicate other values
    in the same enumeration.) The enumerators of an enumeration are also
    known as its members.

       Each enumerated type shall be compatible with an integer type; the
    choice of type is implementation-defined.

    Example

             enum hue { chartreuse, burgundy, claret=20, winedark };
             /*...*/
             enum hue col, *cp;
             /*...*/
             col = claret;
             cp = &col;
             /*...*/
             /*...*/ (*cp != burgundy) /*...*/

    makes hue the tag of an enumeration, and then declares col as an
    object that has that type and cp as a pointer to an object that has
    that type.  The enumerated values are in the set {0, 1, 20, 21}.

I.e. we'll always have GREP_HEADER_AUTHOR = 0 and
GREP_HEADER_COMMITTER = 1, we'll never have GREP_HEADER_AUTHOR = and
GREP_HEADER_COMMITTER = <some int>.

Re: [PATCH 3/3] grep: get rid of useless x < 0 comparison on an enum member

[Andreas Schwab]

Ævar Arnfjörð Bjarmason <avarab@gmail.com> writes:

> I.e. we'll always have GREP_HEADER_AUTHOR = 0 and
> GREP_HEADER_COMMITTER = 1, we'll never have GREP_HEADER_AUTHOR = and
> GREP_HEADER_COMMITTER = <some int>.

That is irrelevant.  You can always assign -1 to an object of enumerated
type and the implicit conversion to the underlying type is fully
defined, no matter what type the compiler choses.

Andreas.

-- 
Andreas Schwab, schwab@linux-m68k.org
GPG Key fingerprint = 58CA 54C7 6D53 942B 1756  01D3 44D5 214B 8276 4ED5
"And now for something completely different."

Re: [PATCH 3/3] grep: get rid of useless x < 0 comparison on an enum member

[Jeff King]

On Mon, Nov 07, 2011 at 02:12:28PM +0100, Andreas Schwab wrote:

> Ævar Arnfjörð Bjarmason <avarab@gmail.com> writes:
> 
> > I.e. we'll always have GREP_HEADER_AUTHOR = 0 and
> > GREP_HEADER_COMMITTER = 1, we'll never have GREP_HEADER_AUTHOR = and
> > GREP_HEADER_COMMITTER = <some int>.
> 
> That is irrelevant.  You can always assign -1 to an object of enumerated
> type and the implicit conversion to the underlying type is fully
> defined, no matter what type the compiler choses.

Yes, but now you are getting into implementation-defined behavior, which
is also something to avoid. IOW, I don't think it's wrong for a static
analyzer to complain about:

  if (enum_with_only_positive_values < 0)

just because you could say:

  enum_with_only_positive_values = -1;

and it would work on _some_ platforms. That same static analyzer should
be complaining about the second line, which is where the real potential
bug is. If you want "-1" as an enumerated value, then add it to your
enum definition and the compiler will do the right thing.

It is perfectly fine to do:

     enum foo { a = -1, b, c };
     ...
     if (foo < 0)
        ...

and the static analyzer should not complain about the conditional there.

-Peff

Re: [PATCH 3/3] grep: get rid of useless x < 0 comparison on an enum member

[Andreas Schwab]

Jeff King <peff@peff.net> writes:

> Yes, but now you are getting into implementation-defined behavior, which
> is also something to avoid.

The whole point of the statement is a sanity check to uncover bugs.  If
you remove the first condition you completely ruin its point.

Andreas.

-- 
Andreas Schwab, schwab@linux-m68k.org
GPG Key fingerprint = 58CA 54C7 6D53 942B 1756  01D3 44D5 214B 8276 4ED5
"And now for something completely different."

Re: [PATCH 3/3] grep: get rid of useless x < 0 comparison on an enum member

[Jeff King]

On Mon, Nov 07, 2011 at 07:24:05PM +0100, Andreas Schwab wrote:

> Jeff King <peff@peff.net> writes:
> 
> > Yes, but now you are getting into implementation-defined behavior, which
> > is also something to avoid.
> 
> The whole point of the statement is a sanity check to uncover bugs.  If
> you remove the first condition you completely ruin its point.

I'm somewhat dubious of the value of a bug-check that may or may not
actually kick in depending on your compiler's choice of enum
representation, and whose bugs are generally easier to check via static
analysis (i.e., making sure the enum value is one of the enumerated
values when it is initialized or assigned).

Yes, static analysis can miss some bugs (like passing the address of the
enum through a void pointer (e.g., when memset'ing a struct)). But
couldn't it just as easily be out of range in the other direction?

It seems like the bug trying to be caught is probably something like:

  enum foo v = function_which_returns_value_or_negative_error();
  if (v < 0)
     die("BUG");

But in that case the bug is on the first line, and it is easily caught
by static analysis, no?

-Peff

Re: [PATCH 3/3] grep: get rid of useless x < 0 comparison on an enum member

[Jeff King]

On Mon, Nov 07, 2011 at 01:34:02PM -0500, Jeff King wrote:

> > The whole point of the statement is a sanity check to uncover bugs.  If
> > you remove the first condition you completely ruin its point.
> [...]
> Yes, static analysis can miss some bugs (like passing the address of the
> enum through a void pointer (e.g., when memset'ing a struct)). But
> couldn't it just as easily be out of range in the other direction?

Oops, I just looked at the actual conditional, and it is indeed
range-checking the whole enum. So if you are going to do that at all,
then yes, checking both sides is sensible, and that is what the original
conditional does. Sorry for my confusion.

I do still question the value of the check at all, though, given that
static analysis can find those bugs.

-Peff

Re: [PATCH 3/3] grep: get rid of useless x < 0 comparison on an enum member

[Ævar Arnfjörð Bjarmason]

On Mon, Nov 7, 2011 at 19:55, Jeff King <peff@peff.net> wrote:

> I do still question the value of the check at all, though, given that
> static analysis can find those bugs.

Agreed, which is why I submitted this patch.

Also if this is the sort of thing we'd like to guard against we should
be discussing it more generally. We have a bunch of occurances where
we'd probably break down if someone manually assigned -1 to an enum
variable:

    $ git grep -E -A1 'enum.*\{' | grep -B1 '=.*0' | grep enum
    builtin/branch.c:enum color_branch {
    builtin/branch.c:static enum merge_filter {
    builtin/fetch-pack.c:enum ack_type {
    builtin/fetch.c:enum {
    builtin/grep.c: enum {
    builtin/mv.c:   enum update_mode { BOTH = 0, WORKING_DIRECTORY,
INDEX } *modes;
    builtin/remote.c:enum {
    builtin/remote.c:       enum {
    cache.h:enum rebase_setup_type {
    cache.h:enum push_default_type {
    cache.h:enum object_creation_mode {
    cache.h:enum sharedrepo {
    cache.h:enum date_mode {
    cache.h:        enum {
    convert.h:enum safe_crlf {
    convert.h:enum auto_crlf {
    diff.h:enum diff_words_type {
    diff.h:enum color_diff {
    dir.c:enum exist_status {
    dir.h:  enum {
    grep.h:enum grep_header_field {
    http-push.c:enum dav_header_flag {
    imap-send.c:enum CAPABILITY {
    log-tree.c:enum decoration_type {
    merge-recursive.c:enum rename_type {
    merge-recursive.h:      enum {
    notes-merge.h:  enum {
    remote.h:enum match_refs_flags {
    rerere.c:       enum {
    unpack-trees.h:enum unpack_trees_error_types {
    wt-status.h:enum color_wt_status {

Re: [PATCH 3/3] grep: get rid of useless x < 0 comparison on an enum member

[Andreas Schwab]

Jeff King <peff@peff.net> writes:

> I do still question the value of the check at all, though, given that
> static analysis can find those bugs.

Then you should remove the whole statement.

Andreas.

-- 
Andreas Schwab, schwab@linux-m68k.org
GPG Key fingerprint = 58CA 54C7 6D53 942B 1756  01D3 44D5 214B 8276 4ED5
"And now for something completely different."

Re: [PATCH 3/3] grep: get rid of useless x < 0 comparison on an enum member

[Jonathan Nieder]

Hi,

> --- a/grep.c
> +++ b/grep.c
> @@ -327,7 +327,7 @@ static struct grep_expr *prep_header_patterns(struct grep_opt *opt)
>  	for (p = opt->header_list; p; p = p->next) {
>  		if (p->token != GREP_PATTERN_HEAD)
>  			die("bug: a non-header pattern in grep header list.");
> -		if (p->field < 0 || GREP_HEADER_FIELD_MAX <= p->field)
> +		if (GREP_HEADER_FIELD_MAX <= p->field)

I imagine the following would be less controversial.

-- >8 --
From: Ævar Arnfjörð Bjarmason <avarab@gmail.com>
Subject: grep: get rid of bounds check on "enum grep_header_field" value

The grep_header_field enum is defined as:

    enum grep_header_field {
    	GREP_HEADER_AUTHOR = 0,
    	GREP_HEADER_COMMITTER
    };

Git's grep code sanity-checks the value of p->field before using it in
order to avoid reading and writing past the end of an array.
Unfortunately that test trips up misguided static analyzers like
"gcc -Wtype-limits" that do not recognize that C allows this enum to
be a signed integer type and an "x < 0" comparison really could fire
if someone passed in an uninitialized value.

Let's just drop the check.  Luckily git always does initialize
p->field correctly, and if it were to stop doing so, then hopefully
running the test suite with valgrind would catch it.

Noticed with clang -Wtautological-compare.

[jn: drop the GREP_HEADER_FIELD_MAX <= p->field check, too,
 for symmetry]

Signed-off-by: Ævar Arnfjörð Bjarmason <avarab@gmail.com>
Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
---
 grep.c |    2 --
 1 files changed, 0 insertions(+), 2 deletions(-)

diff --git a/grep.c b/grep.c
index b29d09c7..424c46cd 100644
--- a/grep.c
+++ b/grep.c
@@ -327,8 +327,6 @@ static struct grep_expr *prep_header_patterns(struct grep_opt *opt)
 	for (p = opt->header_list; p; p = p->next) {
 		if (p->token != GREP_PATTERN_HEAD)
 			die("bug: a non-header pattern in grep header list.");
-		if (p->field < 0 || GREP_HEADER_FIELD_MAX <= p->field)
-			die("bug: unknown header field %d", p->field);
 		compile_regexp(p, opt);
 	}
 
-- 
1.7.8.rc0

Re: [PATCH 3/3] grep: get rid of useless x < 0 comparison on an enum member

[Junio C Hamano]

Jonathan Nieder <jrnieder@gmail.com> writes:

> [jn: drop the GREP_HEADER_FIELD_MAX <= p->field check, too,
>  for symmetry]

Umm, why is this removal of defensive programming practice an improvement?
This part is mostly my code and because I know what I wrote is almost
always perfect, so I do not think there is any real harm done, but still...

>
> Signed-off-by: Ævar Arnfjörð Bjarmason <avarab@gmail.com>
> Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
> ---
>  grep.c |    2 --
>  1 files changed, 0 insertions(+), 2 deletions(-)
>
> diff --git a/grep.c b/grep.c
> index b29d09c7..424c46cd 100644
> --- a/grep.c
> +++ b/grep.c
> @@ -327,8 +327,6 @@ static struct grep_expr *prep_header_patterns(struct grep_opt *opt)
>  	for (p = opt->header_list; p; p = p->next) {
>  		if (p->token != GREP_PATTERN_HEAD)
>  			die("bug: a non-header pattern in grep header list.");
> -		if (p->field < 0 || GREP_HEADER_FIELD_MAX <= p->field)
> -			die("bug: unknown header field %d", p->field);
>  		compile_regexp(p, opt);
>  	}

Re: [PATCH 3/3] grep: get rid of useless x < 0 comparison on an enum member

[Jonathan Nieder]

Junio C Hamano wrote:
> Jonathan Nieder <jrnieder@gmail.com> writes:

>> [jn: drop the GREP_HEADER_FIELD_MAX <= p->field check, too,
>>  for symmetry]
>
> Umm, why is this removal of defensive programming practice an improvement?

Checking "p->filed < 0" makes static analyzers complain.  There's no
clean way I know of[*] to get them to shut up and keep the check.  The
fundamental question is whether the -Wtype-limits check is worth it or
not:

 - on one hand, it catches real bugs, such as the mistaken check for
   negative size_t Ævar mentioned;

 - on the other hand, it trips for cases like this in which the type
   only happened to be unsigned on the build platform.  I consider
   that a gcc bug (and apparently clang shares it) --- see
   <http://bugs.debian.org/615525>.

So, the purpose of this patch was to work around this common bug in
static analyzers.

Checking "GREP_HEADER_FIELD_MAX <= p->field" without checking for
"p->field < 0", like the original patch did, would be only checking
half of what it intends to and not add any real guarantees.  And
more importantly, it would be distracting to people like me and
Andreas who would wonder "why doesn't this check p->field < 0, too?".

I guess the commit message should have said

	grep: remove a defensive check to work around common static analyzer bug

> This part is mostly my code and because I know what I wrote is almost
> always perfect, so I do not think there is any real harm done, but still...

Heh.

[*] There are plenty of cryptic, hackish ways possible, though. :)

	if ((size_t) p->field >= GREP_HEADER_FIELD_MAX)
		die(...);

Re: [PATCH 3/3] grep: get rid of useless x < 0 comparison on an enum member

[Junio C Hamano]

Jonathan Nieder <jrnieder@gmail.com> writes:

> So, the purpose of this patch was to work around this common bug in
> static analyzers.

I fail to see how it could be even considered a work around.

If you do not use static analyzers, you do not have to do such a change,
and the resulting code would (not the "negative" side, but the "positive"
side) catch real bugs when somebody screwes up and stuffs a bogus oob
value in p->field.

With the removal of the check, you _have_ to rely on static analyzers to
do the _right thing_, but if you have static analyzers that do the right
thing, you do not have to have such a workaround to begin with.

Re: [PATCH 3/3] grep: get rid of useless x < 0 comparison on an enum member

[Jonathan Nieder]

Junio C Hamano wrote:

> With the removal of the check, you _have_ to rely on static analyzers to
> do the _right thing_, but if you have static analyzers that do the right
> thing, you do not have to have such a workaround to begin with.

No, automatic static analyzers will not help you avoid using an
uninitialized enum value here (well, I guess they could, but I don't
believe gcc or clang is nearly smart enough for that).  The only
replacement for the check is (1) humans and (2) valgrind.

In this particular case, as you mentioned before, (1) seems to be
quite sufficient.

Re: [PATCH 0/3] Fix code issues spotted by clang

[Ævar Arnfjörð Bjarmason]

On Sun, Nov 6, 2011 at 13:06, Ævar Arnfjörð Bjarmason <avarab@gmail.com> wrote:
> This series fixes some of the code issues raised by clang.

Out of curiosity I also compiled git on "Sun Studio 12 Update 1" on
ee6dfb2d83ba1b057943e705f707fa27e34e47f9 with this patch series
applied and it emits the following warnings, quoted below along with
my comments:

    "pack-write.c", line 76: warning: name redefined by pragma
redefine_extname declared static: tmpfile

Presumably this means that we've imported the function tmpfile() and
Sun's CC doesn't like that we're creating a variable with that name.

    "read-cache.c", line 761: warning: statement not reached

SunCC's brain is melting on this particularly clever piece of code:

    	goto inside;
    	for (;;) {
    		if (!c)
    			return 1;
    		if (is_dir_sep(c)) {
    inside:

    "sha1_file.c", line 2453: warning: name redefined by pragma
redefine_extname declared static: tmpfile

same tempfile issue.

    "compat/../git-compat-util.h", line 4: warning: macro redefined:
_FILE_OFFSET_BITS
    "compat/../git-compat-util.h", line 4: warning: macro redefined:
_FILE_OFFSET_BITS

Seems we're clashing with this:

    $ grep -r '#define.*_FILE_OFFSET_BITS' /usr/include/
    /usr/include/sys/feature_tests.h:#define   _FILE_OFFSET_BITS   64
    /usr/include/sys/feature_tests.h:#define   _FILE_OFFSET_BITS   32

    "xdiff/xutils.c", line 194: warning: statement not reached

This was added in b97e911643341cb31e6b97029b9ffd96fc675b1d as a
workaround on systems using glibc, should this even be run on Sun
libc? Martin?

Another clever bit of code blowing SunCC's brain:

	if (flags & XDF_IGNORE_WHITESPACE) {
		goto skip_ws;
		while (i1 < s1 && i2 < s2) {
			if (l1[i1++] != l2[i2++])
				return 0;
		skip_ws:
			while (i1 < s1 && XDL_ISSPACE(l1[i1]))
				i1++;
			while (i2 < s2 && XDL_ISSPACE(l2[i2]))
				i2++;
		}
	}

    "fast-import.c", line 858: warning: name redefined by pragma
redefine_extname declared static: tmpfile

ditto tempfile issue.

    "builtin/fast-export.c", line 54: warning: enum type mismatch: op "="

This seems to me to be a legitimate issue we introduced in
2d8ad46919213ebbd7bb72eb5b56cca8cc3ae07f, Elijah?

We're defining an enum like this:

    static enum { ABORT, VERBATIM, WARN, STRIP } signed_tag_mode = ABORT;
    static enum { ERROR, DROP, REWRITE } tag_of_filtered_mode = ABORT;

And then doing:

	if (unset || !strcmp(arg, "abort"))
		tag_of_filtered_mode = ABORT; <-- Line 54
	else if (!strcmp(arg, "drop"))
		tag_of_filtered_mode = DROP;
	else if (!strcmp(arg, "rewrite"))
		tag_of_filtered_mode = REWRITE;

Presumably that assignment should be "= ERROR".

    "builtin/index-pack.c", line 175: warning: name redefined by
pragma redefine_extname declared static: tmpfile

ditto tempfile.

    "vcs-svn/string_pool.c", line 11: warning: initializer will be
sign-extended: -1
    "vcs-svn/string_pool.c", line 81: warning: initializer will be
sign-extended: -1
    "vcs-svn/repo_tree.c", line 112: warning: initializer will be
sign-extended: -1
    "vcs-svn/repo_tree.c", line 112: warning: initializer will be
sign-extended: -1
    "test-treap.c", line 34: warning: initializer will be sign-extended: -1

All of these come down to assigning ~0 to an uint32_t variable, e.g.:

	uint32_t token = ~0;

Re: [PATCH 0/3] Fix code issues spotted by clang

[Elijah Newren]

On Sun, Nov 6, 2011 at 5:33 AM, Ævar Arnfjörð Bjarmason
<avarab@gmail.com> wrote:
>    "builtin/fast-export.c", line 54: warning: enum type mismatch: op "="
>
> This seems to me to be a legitimate issue we introduced in
> 2d8ad46919213ebbd7bb72eb5b56cca8cc3ae07f, Elijah?
>
> We're defining an enum like this:
>
>    static enum { ABORT, VERBATIM, WARN, STRIP } signed_tag_mode = ABORT;
>    static enum { ERROR, DROP, REWRITE } tag_of_filtered_mode = ABORT;
>
> And then doing:
>
>        if (unset || !strcmp(arg, "abort"))
>                tag_of_filtered_mode = ABORT; <-- Line 54
>        else if (!strcmp(arg, "drop"))
>                tag_of_filtered_mode = DROP;
>        else if (!strcmp(arg, "rewrite"))
>                tag_of_filtered_mode = REWRITE;
>
> Presumably that assignment should be "= ERROR".

Looking back at that patch, "abort" was the word that made the most
sense in the documentation and I was trying to make the code match.
Unfortunately, that would result in "ABORT" being redefined (to the
same value) so to squelch the compiler error I just went with the
quick hack of changing "ABORT" in the enum definition to "ERROR", but
didn't change "ABORT" later since "it had the same value anyway".
Yeah, not the safest programming practice.

I probably should have just used FILTERED_TAG_ABORT and changed the
signed_tag_mode enum to use SIGNED_TAG_ABORT (and then changed all
references to "ABORT" to match one of those two)...or maybe somehow
come up with a combined enum used for both (though WARN would only be
useful fo signed_tag_mode, REWRITE would only be useful for
tag_of_filtered_mode, etc.).