michael@0: /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ michael@0: /* vim: set ts=8 sts=2 et sw=2 tw=80: */ michael@0: /* This Source Code Form is subject to the terms of the Mozilla Public michael@0: * License, v. 2.0. If a copy of the MPL was not distributed with this michael@0: * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ michael@0: michael@0: /* Implementations of runtime and static assertion macros for C and C++. */ michael@0: michael@0: #ifndef mozilla_Assertions_h michael@0: #define mozilla_Assertions_h michael@0: michael@0: #include "mozilla/Attributes.h" michael@0: #include "mozilla/Compiler.h" michael@0: #include "mozilla/Likely.h" michael@0: #include "mozilla/MacroArgs.h" michael@0: michael@0: #include michael@0: #include michael@0: #include michael@0: #ifdef WIN32 michael@0: /* michael@0: * TerminateProcess and GetCurrentProcess are defined in , which michael@0: * further depends on . We hardcode these few definitions manually michael@0: * because those headers clutter the global namespace with a significant michael@0: * number of undesired macros and symbols. michael@0: */ michael@0: # ifdef __cplusplus michael@0: extern "C" { michael@0: # endif michael@0: __declspec(dllimport) int __stdcall michael@0: TerminateProcess(void* hProcess, unsigned int uExitCode); michael@0: __declspec(dllimport) void* __stdcall GetCurrentProcess(void); michael@0: # ifdef __cplusplus michael@0: } michael@0: # endif michael@0: #else michael@0: # include michael@0: #endif michael@0: #ifdef ANDROID michael@0: # include michael@0: #endif michael@0: michael@0: /* michael@0: * MOZ_STATIC_ASSERT may be used to assert a condition *at compile time* in C. michael@0: * In C++11, static_assert is provided by the compiler to the same effect. michael@0: * This can be useful when you make certain assumptions about what must hold for michael@0: * optimal, or even correct, behavior. For example, you might assert that the michael@0: * size of a struct is a multiple of the target architecture's word size: michael@0: * michael@0: * struct S { ... }; michael@0: * // C michael@0: * MOZ_STATIC_ASSERT(sizeof(S) % sizeof(size_t) == 0, michael@0: * "S should be a multiple of word size for efficiency"); michael@0: * // C++11 michael@0: * static_assert(sizeof(S) % sizeof(size_t) == 0, michael@0: * "S should be a multiple of word size for efficiency"); michael@0: * michael@0: * This macro can be used in any location where both an extern declaration and a michael@0: * typedef could be used. michael@0: */ michael@0: #ifndef __cplusplus michael@0: /* michael@0: * Some of the definitions below create an otherwise-unused typedef. This michael@0: * triggers compiler warnings with some versions of gcc, so mark the typedefs michael@0: * as permissibly-unused to disable the warnings. michael@0: */ michael@0: # if defined(__GNUC__) michael@0: # define MOZ_STATIC_ASSERT_UNUSED_ATTRIBUTE __attribute__((unused)) michael@0: # else michael@0: # define MOZ_STATIC_ASSERT_UNUSED_ATTRIBUTE /* nothing */ michael@0: # endif michael@0: # define MOZ_STATIC_ASSERT_GLUE1(x, y) x##y michael@0: # define MOZ_STATIC_ASSERT_GLUE(x, y) MOZ_STATIC_ASSERT_GLUE1(x, y) michael@0: # if defined(__SUNPRO_CC) michael@0: /* michael@0: * The Sun Studio C++ compiler is buggy when declaring, inside a function, michael@0: * another extern'd function with an array argument whose length contains a michael@0: * sizeof, triggering the error message "sizeof expression not accepted as michael@0: * size of array parameter". This bug (6688515, not public yet) would hit michael@0: * defining moz_static_assert as a function, so we always define an extern michael@0: * array for Sun Studio. michael@0: * michael@0: * We include the line number in the symbol name in a best-effort attempt michael@0: * to avoid conflicts (see below). michael@0: */ michael@0: # define MOZ_STATIC_ASSERT(cond, reason) \ michael@0: extern char MOZ_STATIC_ASSERT_GLUE(moz_static_assert, __LINE__)[(cond) ? 1 : -1] michael@0: # elif defined(__COUNTER__) michael@0: /* michael@0: * If there was no preferred alternative, use a compiler-agnostic version. michael@0: * michael@0: * Note that the non-__COUNTER__ version has a bug in C++: it can't be used michael@0: * in both |extern "C"| and normal C++ in the same translation unit. (Alas michael@0: * |extern "C"| isn't allowed in a function.) The only affected compiler michael@0: * we really care about is gcc 4.2. For that compiler and others like it, michael@0: * we include the line number in the function name to do the best we can to michael@0: * avoid conflicts. These should be rare: a conflict would require use of michael@0: * MOZ_STATIC_ASSERT on the same line in separate files in the same michael@0: * translation unit, *and* the uses would have to be in code with michael@0: * different linkage, *and* the first observed use must be in C++-linkage michael@0: * code. michael@0: */ michael@0: # define MOZ_STATIC_ASSERT(cond, reason) \ michael@0: typedef int MOZ_STATIC_ASSERT_GLUE(moz_static_assert, __COUNTER__)[(cond) ? 1 : -1] MOZ_STATIC_ASSERT_UNUSED_ATTRIBUTE michael@0: # else michael@0: # define MOZ_STATIC_ASSERT(cond, reason) \ michael@0: extern void MOZ_STATIC_ASSERT_GLUE(moz_static_assert, __LINE__)(int arg[(cond) ? 1 : -1]) MOZ_STATIC_ASSERT_UNUSED_ATTRIBUTE michael@0: # endif michael@0: michael@0: #define MOZ_STATIC_ASSERT_IF(cond, expr, reason) MOZ_STATIC_ASSERT(!(cond) || (expr), reason) michael@0: #else michael@0: #define MOZ_STATIC_ASSERT_IF(cond, expr, reason) static_assert(!(cond) || (expr), reason) michael@0: #endif michael@0: michael@0: #ifdef __cplusplus michael@0: extern "C" { michael@0: #endif michael@0: michael@0: /* michael@0: * Prints |s| as an assertion failure (using file and ln as the location of the michael@0: * assertion) to the standard debug-output channel. michael@0: * michael@0: * Usually you should use MOZ_ASSERT or MOZ_CRASH instead of this method. This michael@0: * method is primarily for internal use in this header, and only secondarily michael@0: * for use in implementing release-build assertions. michael@0: */ michael@0: static MOZ_ALWAYS_INLINE void michael@0: MOZ_ReportAssertionFailure(const char* s, const char* file, int ln) michael@0: { michael@0: #ifdef ANDROID michael@0: __android_log_print(ANDROID_LOG_FATAL, "MOZ_Assert", michael@0: "Assertion failure: %s, at %s:%d\n", s, file, ln); michael@0: #else michael@0: fprintf(stderr, "Assertion failure: %s, at %s:%d\n", s, file, ln); michael@0: fflush(stderr); michael@0: #endif michael@0: } michael@0: michael@0: static MOZ_ALWAYS_INLINE void michael@0: MOZ_ReportCrash(const char* s, const char* file, int ln) michael@0: { michael@0: #ifdef ANDROID michael@0: __android_log_print(ANDROID_LOG_FATAL, "MOZ_CRASH", michael@0: "Hit MOZ_CRASH(%s) at %s:%d\n", s, file, ln); michael@0: #else michael@0: fprintf(stderr, "Hit MOZ_CRASH(%s) at %s:%d\n", s, file, ln); michael@0: fflush(stderr); michael@0: #endif michael@0: } michael@0: michael@0: /** michael@0: * MOZ_REALLY_CRASH is used in the implementation of MOZ_CRASH(). You should michael@0: * call MOZ_CRASH instead. michael@0: */ michael@0: #if defined(_MSC_VER) michael@0: /* michael@0: * On MSVC use the __debugbreak compiler intrinsic, which produces an inline michael@0: * (not nested in a system function) breakpoint. This distinctively invokes michael@0: * Breakpad without requiring system library symbols on all stack-processing michael@0: * machines, as a nested breakpoint would require. michael@0: * michael@0: * We use TerminateProcess with the exit code aborting would generate michael@0: * because we don't want to invoke atexit handlers, destructors, library michael@0: * unload handlers, and so on when our process might be in a compromised michael@0: * state. michael@0: * michael@0: * We don't use abort() because it'd cause Windows to annoyingly pop up the michael@0: * process error dialog multiple times. See bug 345118 and bug 426163. michael@0: * michael@0: * We follow TerminateProcess() with a call to MOZ_NoReturn() so that the michael@0: * compiler doesn't hassle us to provide a return statement after a michael@0: * MOZ_REALLY_CRASH() call. michael@0: * michael@0: * (Technically these are Windows requirements, not MSVC requirements. But michael@0: * practically you need MSVC for debugging, and we only ship builds created michael@0: * by MSVC, so doing it this way reduces complexity.) michael@0: */ michael@0: michael@0: __declspec(noreturn) __inline void MOZ_NoReturn() {} michael@0: michael@0: # ifdef __cplusplus michael@0: # define MOZ_REALLY_CRASH() \ michael@0: do { \ michael@0: ::__debugbreak(); \ michael@0: *((volatile int*) NULL) = 123; \ michael@0: ::TerminateProcess(::GetCurrentProcess(), 3); \ michael@0: ::MOZ_NoReturn(); \ michael@0: } while (0) michael@0: # else michael@0: # define MOZ_REALLY_CRASH() \ michael@0: do { \ michael@0: __debugbreak(); \ michael@0: *((volatile int*) NULL) = 123; \ michael@0: TerminateProcess(GetCurrentProcess(), 3); \ michael@0: MOZ_NoReturn(); \ michael@0: } while (0) michael@0: # endif michael@0: #else michael@0: # ifdef __cplusplus michael@0: # define MOZ_REALLY_CRASH() \ michael@0: do { \ michael@0: *((volatile int*) NULL) = 123; \ michael@0: ::abort(); \ michael@0: } while (0) michael@0: # else michael@0: # define MOZ_REALLY_CRASH() \ michael@0: do { \ michael@0: *((volatile int*) NULL) = 123; \ michael@0: abort(); \ michael@0: } while (0) michael@0: # endif michael@0: #endif michael@0: michael@0: /* michael@0: * MOZ_CRASH([explanation-string]) crashes the program, plain and simple, in a michael@0: * Breakpad-compatible way, in both debug and release builds. michael@0: * michael@0: * MOZ_CRASH is a good solution for "handling" failure cases when you're michael@0: * unwilling or unable to handle them more cleanly -- for OOM, for likely memory michael@0: * corruption, and so on. It's also a good solution if you need safe behavior michael@0: * in release builds as well as debug builds. But if the failure is one that michael@0: * should be debugged and fixed, MOZ_ASSERT is generally preferable. michael@0: * michael@0: * The optional explanation-string, if provided, must be a string literal michael@0: * explaining why we're crashing. This argument is intended for use with michael@0: * MOZ_CRASH() calls whose rationale is non-obvious; don't use it if it's michael@0: * obvious why we're crashing. michael@0: * michael@0: * If we're a DEBUG build and we crash at a MOZ_CRASH which provides an michael@0: * explanation-string, we print the string to stderr. Otherwise, we don't michael@0: * print anything; this is because we want MOZ_CRASH to be 100% safe in release michael@0: * builds, and it's hard to print to stderr safely when memory might have been michael@0: * corrupted. michael@0: */ michael@0: #ifndef DEBUG michael@0: # define MOZ_CRASH(...) MOZ_REALLY_CRASH() michael@0: #else michael@0: # define MOZ_CRASH(...) \ michael@0: do { \ michael@0: MOZ_ReportCrash("" __VA_ARGS__, __FILE__, __LINE__); \ michael@0: MOZ_REALLY_CRASH(); \ michael@0: } while(0) michael@0: #endif michael@0: michael@0: #ifdef __cplusplus michael@0: } /* extern "C" */ michael@0: #endif michael@0: michael@0: /* michael@0: * MOZ_ASSERT(expr [, explanation-string]) asserts that |expr| must be truthy in michael@0: * debug builds. If it is, execution continues. Otherwise, an error message michael@0: * including the expression and the explanation-string (if provided) is printed, michael@0: * an attempt is made to invoke any existing debugger, and execution halts. michael@0: * MOZ_ASSERT is fatal: no recovery is possible. Do not assert a condition michael@0: * which can correctly be falsy. michael@0: * michael@0: * The optional explanation-string, if provided, must be a string literal michael@0: * explaining the assertion. It is intended for use with assertions whose michael@0: * correctness or rationale is non-obvious, and for assertions where the "real" michael@0: * condition being tested is best described prosaically. Don't provide an michael@0: * explanation if it's not actually helpful. michael@0: * michael@0: * // No explanation needed: pointer arguments often must not be NULL. michael@0: * MOZ_ASSERT(arg); michael@0: * michael@0: * // An explanation can be helpful to explain exactly how we know an michael@0: * // assertion is valid. michael@0: * MOZ_ASSERT(state == WAITING_FOR_RESPONSE, michael@0: * "given that and , we must have..."); michael@0: * michael@0: * // Or it might disambiguate multiple identical (save for their location) michael@0: * // assertions of the same expression. michael@0: * MOZ_ASSERT(getSlot(PRIMITIVE_THIS_SLOT).isUndefined(), michael@0: * "we already set [[PrimitiveThis]] for this Boolean object"); michael@0: * MOZ_ASSERT(getSlot(PRIMITIVE_THIS_SLOT).isUndefined(), michael@0: * "we already set [[PrimitiveThis]] for this String object"); michael@0: * michael@0: * MOZ_ASSERT has no effect in non-debug builds. It is designed to catch bugs michael@0: * *only* during debugging, not "in the field". If you want the latter, use michael@0: * MOZ_RELEASE_ASSERT, which applies to non-debug builds as well. michael@0: */ michael@0: michael@0: /* First the single-argument form. */ michael@0: #define MOZ_ASSERT_HELPER1(expr) \ michael@0: do { \ michael@0: if (MOZ_UNLIKELY(!(expr))) { \ michael@0: MOZ_ReportAssertionFailure(#expr, __FILE__, __LINE__); \ michael@0: MOZ_REALLY_CRASH(); \ michael@0: } \ michael@0: } while (0) michael@0: /* Now the two-argument form. */ michael@0: #define MOZ_ASSERT_HELPER2(expr, explain) \ michael@0: do { \ michael@0: if (MOZ_UNLIKELY(!(expr))) { \ michael@0: MOZ_ReportAssertionFailure(#expr " (" explain ")", __FILE__, __LINE__); \ michael@0: MOZ_REALLY_CRASH(); \ michael@0: } \ michael@0: } while (0) michael@0: michael@0: #define MOZ_RELEASE_ASSERT_GLUE(a, b) a b michael@0: #define MOZ_RELEASE_ASSERT(...) \ michael@0: MOZ_RELEASE_ASSERT_GLUE( \ michael@0: MOZ_PASTE_PREFIX_AND_ARG_COUNT(MOZ_ASSERT_HELPER, __VA_ARGS__), \ michael@0: (__VA_ARGS__)) michael@0: michael@0: #ifdef DEBUG michael@0: # define MOZ_ASSERT(...) MOZ_RELEASE_ASSERT(__VA_ARGS__) michael@0: #else michael@0: # define MOZ_ASSERT(...) do { } while(0) michael@0: #endif /* DEBUG */ michael@0: michael@0: /* michael@0: * MOZ_ASSERT_IF(cond1, cond2) is equivalent to MOZ_ASSERT(cond2) if cond1 is michael@0: * true. michael@0: * michael@0: * MOZ_ASSERT_IF(isPrime(num), num == 2 || isOdd(num)); michael@0: * michael@0: * As with MOZ_ASSERT, MOZ_ASSERT_IF has effect only in debug builds. It is michael@0: * designed to catch bugs during debugging, not "in the field". michael@0: */ michael@0: #ifdef DEBUG michael@0: # define MOZ_ASSERT_IF(cond, expr) \ michael@0: do { \ michael@0: if (cond) \ michael@0: MOZ_ASSERT(expr); \ michael@0: } while (0) michael@0: #else michael@0: # define MOZ_ASSERT_IF(cond, expr) do { } while (0) michael@0: #endif michael@0: michael@0: /* michael@0: * MOZ_ASSUME_UNREACHABLE_MARKER() expands to an expression which states that it is michael@0: * undefined behavior for execution to reach this point. No guarantees are made michael@0: * about what will happen if this is reached at runtime. Most code should michael@0: * probably use the higher level MOZ_ASSUME_UNREACHABLE, which uses this when michael@0: * appropriate. michael@0: */ michael@0: #if defined(__clang__) michael@0: # define MOZ_ASSUME_UNREACHABLE_MARKER() __builtin_unreachable() michael@0: #elif defined(__GNUC__) michael@0: /* michael@0: * __builtin_unreachable() was implemented in gcc 4.5. If we don't have michael@0: * that, call a noreturn function; abort() will do nicely. Qualify the call michael@0: * in C++ in case there's another abort() visible in local scope. michael@0: */ michael@0: # if MOZ_GCC_VERSION_AT_LEAST(4, 5, 0) michael@0: # define MOZ_ASSUME_UNREACHABLE_MARKER() __builtin_unreachable() michael@0: # else michael@0: # ifdef __cplusplus michael@0: # define MOZ_ASSUME_UNREACHABLE_MARKER() ::abort() michael@0: # else michael@0: # define MOZ_ASSUME_UNREACHABLE_MARKER() abort() michael@0: # endif michael@0: # endif michael@0: #elif defined(_MSC_VER) michael@0: # define MOZ_ASSUME_UNREACHABLE_MARKER() __assume(0) michael@0: #else michael@0: # ifdef __cplusplus michael@0: # define MOZ_ASSUME_UNREACHABLE_MARKER() ::abort() michael@0: # else michael@0: # define MOZ_ASSUME_UNREACHABLE_MARKER() abort() michael@0: # endif michael@0: #endif michael@0: michael@0: /* michael@0: * MOZ_ASSUME_UNREACHABLE([reason]) tells the compiler that it can assume that michael@0: * the macro call cannot be reached during execution. This lets the compiler michael@0: * generate better-optimized code under some circumstances, at the expense of michael@0: * the program's behavior being undefined if control reaches the michael@0: * MOZ_ASSUME_UNREACHABLE. michael@0: * michael@0: * In Gecko, you probably should not use this macro outside of performance- or michael@0: * size-critical code, because it's unsafe. If you don't care about code size michael@0: * or performance, you should probably use MOZ_ASSERT or MOZ_CRASH. michael@0: * michael@0: * SpiderMonkey is a different beast, and there it's acceptable to use michael@0: * MOZ_ASSUME_UNREACHABLE more widely. michael@0: * michael@0: * Note that MOZ_ASSUME_UNREACHABLE is noreturn, so it's valid not to return a michael@0: * value following a MOZ_ASSUME_UNREACHABLE call. michael@0: * michael@0: * Example usage: michael@0: * michael@0: * enum ValueType { michael@0: * VALUE_STRING, michael@0: * VALUE_INT, michael@0: * VALUE_FLOAT michael@0: * }; michael@0: * michael@0: * int ptrToInt(ValueType type, void* value) { michael@0: * { michael@0: * // We know for sure that type is either INT or FLOAT, and we want this michael@0: * // code to run as quickly as possible. michael@0: * switch (type) { michael@0: * case VALUE_INT: michael@0: * return *(int*) value; michael@0: * case VALUE_FLOAT: michael@0: * return (int) *(float*) value; michael@0: * default: michael@0: * MOZ_ASSUME_UNREACHABLE("can only handle VALUE_INT and VALUE_FLOAT"); michael@0: * } michael@0: * } michael@0: */ michael@0: #if defined(DEBUG) michael@0: # define MOZ_ASSUME_UNREACHABLE(...) \ michael@0: do { \ michael@0: MOZ_ASSERT(false, "MOZ_ASSUME_UNREACHABLE(" __VA_ARGS__ ")"); \ michael@0: MOZ_ASSUME_UNREACHABLE_MARKER(); \ michael@0: } while (0) michael@0: #else michael@0: # define MOZ_ASSUME_UNREACHABLE(reason) MOZ_ASSUME_UNREACHABLE_MARKER() michael@0: #endif michael@0: michael@0: /* michael@0: * MOZ_ALWAYS_TRUE(expr) and MOZ_ALWAYS_FALSE(expr) always evaluate the provided michael@0: * expression, in debug builds and in release builds both. Then, in debug michael@0: * builds only, the value of the expression is asserted either true or false michael@0: * using MOZ_ASSERT. michael@0: */ michael@0: #ifdef DEBUG michael@0: # define MOZ_ALWAYS_TRUE(expr) MOZ_ASSERT((expr)) michael@0: # define MOZ_ALWAYS_FALSE(expr) MOZ_ASSERT(!(expr)) michael@0: #else michael@0: # define MOZ_ALWAYS_TRUE(expr) ((void)(expr)) michael@0: # define MOZ_ALWAYS_FALSE(expr) ((void)(expr)) michael@0: #endif michael@0: michael@0: #endif /* mozilla_Assertions_h */