clang: forbid composite literals in macro calls (#78)

Author: nalgeon

internal/clang/expr.go

@@ -609,27 +609,42 @@ func (g *Generator) emitNotNil(w io.Writer, expr ast.Expr, suffixes ...string) {
 		return
 	}
 	fmt.Fprint(w, "so_notnil(")
-	g.emitMacroArg(w, expr)
+	g.emitExpr(w, expr)
 	fmt.Fprint(w, suffix)
 	fmt.Fprint(w, ")")
 }
 
-// emitMacroArg emits an argument to a function-like macro, wrapping
-// it in parentheses when the expression is a composite literal.
+// emitMacroArg emits an argument to a function-like macro.
+//
+// Composite literals reference stack-backed temporaries, so passing them to a
+// macro that indexes, slices, or stores them would create a use-after-scope
+// bug. Only a struct value literal is safe (it gets copied into the slot); it
+// is wrapped in parentheses so the preprocessor does not split it on the commas
+// of its braced initializer. Everything else fails.
 //
-// All emitted macro calls must use emitMacroArg for their arguments
-// to avoid preprocessor parsing issues.
+// All emitted macro calls must use emitMacroArg for their arguments.
 func (g *Generator) emitMacroArg(w io.Writer, arg ast.Expr) {
-	if isCompositeLit(arg) {
-		// A composite literal emits a braced initializer (e.g. (so_Slice){p, n, n})
-		// whose commas would otherwise be misread by the preprocessor as macro
-		// argument separators.
-		fmt.Fprint(w, "(")
+	// &T{...}: a pointer to a block-scoped temporary that dangles once it escapes.
+	if u, ok := arg.(*ast.UnaryExpr); ok && u.Op == token.AND {
+		if _, ok := u.X.(*ast.CompositeLit); ok {
+			g.fail(arg, "cannot use composite literal here; assign it to a variable first")
+		}
+	}
+	lit, ok := arg.(*ast.CompositeLit)
+	if !ok {
+		// Not a composite literal, emit directly.
 		g.emitExpr(w, arg)
+		return
+	}
+	// Only struct value literals are safe; they are copied into the slot.
+	if _, ok := g.types.TypeOf(lit).Underlying().(*types.Struct); ok {
+		fmt.Fprint(w, "(")
+		g.emitExpr(w, lit)
 		fmt.Fprint(w, ")")
 		return
 	}
-	g.emitExpr(w, arg)
+	// Array, slice, or map literal: references stack-backed storage.
+	g.fail(arg, "cannot use composite literal here; assign it to a variable first")
 }
 
 // needsVoidParens reports whether expr needs parentheses in a (void) cast.
@@ -670,20 +685,6 @@ func (g *Generator) isArrayParam(ident *ast.Ident) bool {
 	return false
 }
 
-// isCompositeLit reports whether expr emits a braced composite-literal
-// initializer at the top level.
-func isCompositeLit(expr ast.Expr) bool {
-	switch e := expr.(type) {
-	case *ast.CompositeLit:
-		// E.g., Point{1, 2} or []int{1, 2, 3}.
-		return true
-	case *ast.UnaryExpr:
-		// E.g. &Point{1, 2} or &[]int{1, 2, 3}.
-		return isCompositeLit(e.X)
-	}
-	return false
-}
-
 // isSelfParenthesized reports whether expr emits its own parentheses.
 func isSelfParenthesized(expr ast.Expr) bool {
 	bin, ok := expr.(*ast.BinaryExpr)

testdata/lang/macro-args/dst/main.c

@@ -4,10 +4,6 @@
 
 typedef struct point point;
 
-// Composite literals passed to function-like C macros (len, cap, append,
-// copy, clear, indexing, slicing, map access) emit braced initializers whose
-// commas would be misread by the preprocessor as macro argument separators.
-// Each such argument must be wrapped in parentheses.
 typedef struct point {
     so_int x;
     so_int y;
@@ -16,64 +12,18 @@ typedef struct point {
 // -- Implementation --
 
 int main(void) {
-    // len/cap of a slice literal.
-    if (so_len(((so_Slice){(so_int[3]){1, 2, 3}, 3, 3})) != 3) {
-        so_panic("len");
-    }
-    if (so_cap(((so_Slice){(so_int[3]){1, 2, 3}, 3, 3})) != 3) {
-        so_panic("cap");
-    }
-    // index and slice of a slice literal.
-    if (so_at(so_int, ((so_Slice){(so_int[3]){10, 20, 30}, 3, 3}), 1) != 20) {
-        so_panic("index");
-    }
-    if (so_len(so_slice(so_int, ((so_Slice){(so_int[4]){1, 2, 3, 4}, 4, 4}), 1, 3)) != 2) {
-        so_panic("slice");
-    }
-    if (so_len(so_slice(so_int, ((so_Slice){(so_int[4]){1, 2, 3, 4}, 4, 4}), 2, ((so_Slice){(so_int[4]){1, 2, 3, 4}, 4, 4}).len)) != 2) {
-        so_panic("slice open-ended");
-    }
-    // address of an element of a slice literal.
-    (void)&so_at(so_int, ((so_Slice){(so_int[3]){5, 6, 7}, 3, 3}), 0);
-    // slice-to-array conversion of a literal.
-    so_int arr[2];
-    memcpy(arr, so_slice_array(((so_Slice){(so_int[2]){7, 8}, 2, 2}), 2), sizeof(arr));
-    if (arr[0] != 7) {
-        so_panic("slice-to-array");
-    }
-    // byte slice literal to string conversion.
-    if (so_string_ne(so_bytes_string(((so_Slice){(so_byte[2]){'h', 'i'}, 2, 2})), so_str("hi"))) {
-        so_panic("byte slice to string");
-    }
-    if (so_string_ne(so_bytes_string(((so_Slice){(so_byte[1]){(so_byte)(97)}, 1, 1})), so_str("a"))) {
-        so_panic("byte slice to string");
-    }
-    // copy from a slice literal.
-    so_Slice dst = so_make_slice(so_int, 3, 3);
-    so_copy(so_int, dst, ((so_Slice){(so_int[3]){1, 2, 3}, 3, 3}));
-    if (so_at(so_int, dst, 2) != 3) {
-        so_panic("copy");
-    }
     // append a composite-literal value.
     so_Slice pts = so_make_slice(point, 0, 2);
     pts = so_append(point, pts, ((point){1, 2}));
     if (so_at(point, pts, 0).y != 2) {
         so_panic("append value");
     }
-    // clear a slice literal (exercises the macro; no observable effect).
-    so_clear(so_int, ((so_Slice){(so_int[3]){1, 2, 3}, 3, 3}));
     // map with a composite-literal value.
     so_Map* mv = so_make_map(so_int, point, 1);
     so_map_set(so_int, point, mv, 0, ((point){3, 4}));
     if (so_map_get(so_int, point, mv, 0).x != 3) {
         so_panic("map value");
     }
-    // map with a composite-literal pointer value.
-    so_Map* mp = so_make_map(so_int, point*, 1);
-    so_map_set(so_int, point*, mp, 1, (&(point){8, 9}));
-    if (so_map_get(so_int, point*, mp, 1)->y != 9) {
-        so_panic("map pointer value");
-    }
     // map with a composite-literal key.
     so_Map* mk = so_make_map(point, so_int, 1);
     so_map_set(point, so_int, mk, ((point){1, 2}), 42);

testdata/lang/macro-args/src/main.go

@@ -1,82 +1,24 @@
 package main
 
-// Composite literals passed to function-like C macros (len, cap, append,
-// copy, clear, indexing, slicing, map access) emit braced initializers whose
-// commas would be misread by the preprocessor as macro argument separators.
-// Each such argument must be wrapped in parentheses.
-
 type point struct {
 	x, y int
 }
 
 func main() {
-	// len/cap of a slice literal.
-	if len([]int{1, 2, 3}) != 3 {
-		panic("len")
-	}
-	if cap([]int{1, 2, 3}) != 3 {
-		panic("cap")
-	}
-
-	// index and slice of a slice literal.
-	if []int{10, 20, 30}[1] != 20 {
-		panic("index")
-	}
-	if len([]int{1, 2, 3, 4}[1:3]) != 2 {
-		panic("slice")
-	}
-	if len([]int{1, 2, 3, 4}[2:]) != 2 {
-		panic("slice open-ended")
-	}
-
-	// address of an element of a slice literal.
-	_ = &[]int{5, 6, 7}[0]
-
-	// slice-to-array conversion of a literal.
-	arr := [2]int([]int{7, 8})
-	if arr[0] != 7 {
-		panic("slice-to-array")
-	}
-
-	// byte slice literal to string conversion.
-	if string([]byte{'h', 'i'}) != "hi" {
-		panic("byte slice to string")
-	}
-	if string([]byte{byte(97)}) != "a" {
-		panic("byte slice to string")
-	}
-
-	// copy from a slice literal.
-	dst := make([]int, 3)
-	copy(dst, []int{1, 2, 3})
-	if dst[2] != 3 {
-		panic("copy")
-	}
-
 	// append a composite-literal value.
 	pts := make([]point, 0, 2)
 	pts = append(pts, point{1, 2})
 	if pts[0].y != 2 {
 		panic("append value")
 	}
 
-	// clear a slice literal (exercises the macro; no observable effect).
-	clear([]int{1, 2, 3})
-
 	// map with a composite-literal value.
 	mv := make(map[int]point, 1)
 	mv[0] = point{3, 4}
 	if mv[0].x != 3 {
 		panic("map value")
 	}
 
-	// map with a composite-literal pointer value.
-	mp := make(map[int]*point, 1)
-	mp[1] = &point{8, 9}
-	if mp[1].y != 9 {
-		panic("map pointer value")
-	}
-
 	// map with a composite-literal key.
 	mk := make(map[point]int, 1)
 	mk[point{1, 2}] = 42