Am Freitag, dem 09.10.2026 um 09:37 +0200 schrieb Alejandro Colomar:
> Hi Martin, Joseph,
>
> > Date: 2026-10-09 08:29:28+0200
> > From: Martin Uecker <[email protected]>
> >
> > Am Donnerstag, dem 08.10.2026 um 21:55 +0200 schrieb Alejandro Colomar:
> > > Hi Joseph,
> > >
> > > > Date: 2026-10-08 18:55:44+0000
> > > > From: Joseph Myers <[email protected]>
> > > >
> > > > On Thu, 8 Oct 2026, Alejandro Colomar wrote:
> > > >
> > > > > > My suggestion would be to be strict on the new feature (e.g.
> > > > > > disallow
> > > > > > _Countof for any parameter for which both a forward declaration and
> > > > > > another declaration of the parameter are visible) rather than
> > > > > > adding extra
> > > > > > checks for consistency of forward parameter declarations.
> > > > >
> > > > > That'd be unacceptable for me. I need to be able to use _Countof() on
> > > > > arrays that have been forward declared.
> > > > >
> > > > > Here's are a couple of examples:
> > > > >
> > > > > char *
> > > > > vseprintf(char dst[], const char end[];
> > > > > char dst[dst?end-dst:0], const char end[0], const char
> > > > > *restrict fmt, va_list ap)
> > > >
> > > > Then the strict semantics could be for e.g. using _Countof for a
> > > > parameter
> > > > where a forward declaration gives an array length.
> > >
> > > I find that ok.
> > >
> > > Another (simpler, but which is a breaking change) would be to disallow
> > > the use of array length expressions in forward declarations.
> > >
> > > > > But we could have a different constraint which I'd find acceptable:
> > > > >
> > > > > - Disallow declaring any array length expressions within a forward
> > > > > declaration of a parameter.
> > > > >
> > > > > void f(int a[42]; int a[]); // constraint violation
> > > > > void g(int a[42]; int a[42]); // constraint violation
> > > > > void g(int a[]; int a[42]); // ok
> > > >
> > > > I think restricting the new feature in such cases would be better than
> > > > restricting forward declarations themselves in such cases.
> > >
> > > Ok. I have some concerns about having _Countof invalidate a certain
> > > expression that would otherwise be fine. But I also see the point in
> > > keeping backwards compatibility, so I accept the compromise.
> >
> > BTW: Even if not a constraint, I would still like to have the diagnostic
> > for any inconsistency between forward declaration and parameter as
> > this is most likely a bug which should be diagnosed (I do not count
> > one as having a length and the other not as inconsistncy).
> >
> > >
> > > Let's say it's disallowed to take the _Countof() of an array whose
> > > length expression has appeared in a forward declaration.
> > >
> > > Would you (or Martin) mind helping me implement that? I'm pretty much
> > > lost about how to do it. I guess we should have a flag or something
> > > that tells whether this has happened, but I lack the knowledge of the
> > > internals needed to do this, I fear.
> >
> > Yes, it would be a bit annoying to implement I think.
> >
> > Perhaps we could remove the attribute carrying the length information
> > from the parameter when there is also such an attribute on the
> > forward declaration. This should then perhaps cause a warning.
>
> Hmmm, this could work, although it could be surprising and dangerous to
> remove it, because then fortification would be degraded, right?
>
> I think it might be better to disallow it.
>
> So, let's see alternatives we have not fully discarded yet (in no
> particular order):
>
>
> - Make it unspecified which of the array length expressions is used.
This would be my first choice.
>
> - Disallow using _Countof() on array parameters where the array length
> is specified in a forward declaration.
>
> The easiest way to implement this is to interpret
>
> void f(int a[42]; int a[42]);
> as
> void f(int a[42]; int a[]);
>
> which will obviously disallow _Countof().
> This could be dangerous, as we'd be degrading fortification
> information.
Isn't this the same as what I proposed above?
>
> - Disallow specifying an array length if it has been specified before.
>
> Diagnose the following:
>
> void f(int a[42]; int a[42]);
>
> (even when not using _Countof()!)
> This is a breaking change, but chances are quite low of actually
> having code that does this. Other than potentially requiring
> changes to existing code, it should be fine and safe.
>
It is a weird rule though that makes zero sense by itself.
> We could continue allowing this:
>
> void f(int a[42]; int a[]);
>
> (but _Countof() would fail.)
> The specification of _Countof() would be that it is not allowed
> if the array length was specified in a forward declaration.
>
Why would you not allow _Countof in this case? We currently allow
this:
int f(int n, int (*p)[n]; int (*p)[], int n)
{
return _Countof *p;
}
> I think I've covered them all.
>
> I prefer the 3rd alternative, then the 1st, and I'd like to avoid the
> 2nd. What do you think about them? Did I miss any other alternative?
>
Personally, I would prefer the first as this is the most simply
and does not affect any existing or plausible use case.
Martin
>
> Have a lovely day!
> Alex
>
> >
> >
> > Martin
> >
> > >
> > > Anyway, I can start by documenting that it's not allowed to do that.
> > >
> > >
> > > Have a lovely night!
> > > Alex
--
Univ.-Prof. Dr. rer. nat. Martin Uecker
Graz University of Technology
Institute of Biomedical Imaging
