跨模块* / c，c ++的编译时断言

Question

recently i discovered in a relatively large project, that ugly runtime crashes occurred because various headers were included in different order in different cpp files.

These headers included #pragma pack - and these pragmas were sometimes not 'closed' ( i mean, set back to the compiler default #pragma pack() ) - resulting in different object layouts in different object files. No wonder the application crashed when it accessed struct members being created in one module and passed to another module. Or derived classes accessing members from base classes.

Since i like the idea to create a more general debugging and assertion strategy from every bug i find, i would really like to assert that object layouts are always and everywhere the same.

So it would be easy to assert

ASSERT( offsetof(membervar) == 4 )

But this would not catch a different layout in another module - or require manual updates whenever the struct layout changes .. so my favourite idea would be something like

ASSERT( offsetof(membervar) == offsetof(othermodule_membervar) )

Would this be possible with an assertion? Or is this a case for a unit test?

Thanks, H

Answer 1

ASSERT( offsetof(membervar) == offsetof(othermodule_membervar) )

I can't see way to make this technically possible. Further, even if it was phyiscally possible, it isn't practical. You'd need an assert for every pair of source files:

ASSERT( offsetof(A.c::MyClass.membervar) == offsetof(B.c::MyClass.membervar) )
ASSERT( offsetof(A.c::MyClass.membervar) == offsetof(C.c::MyClass.membervar) )
ASSERT( offsetof(A.c::MyClass.membervar) == offsetof(D.c::MyClass.membervar) )
ASSERT( offsetof(B.c::MyClass.membervar) == offsetof(C.c::MyClass.membervar) )
ASSERT( offsetof(B.c::MyClass.membervar) == offsetof(D.c::MyClass.membervar) )

etc

Answer 2

You might be able to get away with this by asserting the sizeof(class) in different files. If the packing is causing the size of the object to be smaller, than I would expect that sizeof() would show that up.

You could also do this as a static assert using C++0x's static assert, or Boost's (or a handrolled one of course)

On the part of not wanting to do this in every file, I would recommend putting together a header file that includes all the headers you're worried about, and the static_asserts.

Personally though, I'd just recommend searching through the code base over the list of pragmas and fix them.

Answer 3

Wendy,

In Win32, there are single functions that can populate different versions of a given struct. Over the years, the FOOBAR struct might have new features added to it, so they create a FOOBAR2 or FOOBAREX. In some cases there are more than two versions.

Anyway, the way they handle this is to have the caller pass in sizeof(theStruct) in addition to the pointer to the struct:

FOOBAREX foobarex = {0};
long lResult = SomeWin32Api(sizeof(foobarex), &foobarex);

Within the implementation of SomWin32Api() , they check the first parameter and determine which version of the struct they're dealing with.

You could do something similar in a debug build to assure that the caller and callee agree on the size of the struct being referred to, and assert if the value doesn't match the expected size. With macros, you might even be able to automate/hide this so that it only happens in a debug build.

Unfortunately, this is a run-time check and not a compile-time check...

Answer 4

What you want isn't directly possible as such. If you're using VC++, the following may be of interest:

http://blogs.msdn.com/vcblog/archive/2007/05/17/diagnosing-hidden-odr-violations-in-visual-c-and-fixing-lnk2022.aspx

There's probably scope to create some way of semi-automating the process it describes, collating the output and cross-referencing.

To detect this sort of problem somewhat more automatically, the following occurs to me. Create a file that defines a struct that will have a particular size with the designated default packing amount, but a different size with different pack values. Also include some kind of static assert that its size is correct. For example, if the default is 4-byte packing:

struct X {
    char c;
    int i;
    double d;
};
extern const char g_check[sizeof(X)==16?1:-1];

Then #include this file at the start of every header (just write a program to put the extra includes in if there's too many to do by hand), and compile and see what happens. This won't directly detect changes in struct layout, just non-standard packing settings, which is what you're interested in anyway.

(When adding new headers one would put this #include at the top, along with the usual ifdef boilerplate and so on. This is unfortunate but I'm not sure there's any way around it. The best solution is probably to ask people to do it, but assume they'll forget, and run the extra-include-inserting program every now and again...)

Answer 5

Apologies for posting an answer - which this is not - but I don't know how to post code in comments. Sorry.

To wrap Brone's idea in a macro, here is what free we currently use (feel free to edit it):

/** Our own assert macro, which will trace a FATAL error message if the assert
 * fails. A FATAL trace will cause a system restart.
 * Note: I would love to use CPPUNIT_ASSERT_MESSAGE here, for a nice clean
 * test failure if testing with CppUnit, but since this header file is used
 * by C code and the relevant CppUnit include file uses C++ specific
 * features, I cannot.
 */
#ifdef TESTING
/* ToDo: might want to trace a FATAL if integration testing */
#define ASSERT_MSG(subsystem, message, condition) if (!(condition)) {printf("Assert    failed: \"%s\" at line %d in file \"%s\"\n", message, __LINE__, __FILE__); fflush(stdout); abort();}

/* we can also use this, which prints of the failed condition as its message */
#define ASSERT_CONDITION(subsystem, condition) if (!(condition)) {printf("Assert failed: \%s\" at line %d in file \%s\"\n", #condition, __LINE__, __FILE__); fflush(stdout); abort();}
#else
#define ASSERT_MSG(subsystem, message, condition)  if (!condition) DebugTrace(FATAL, subsystem, __FILE__, __LINE__, "%s", message);
#define ASSERT_CONDITION(subsystem, condition)     if (!(condition)) DebugTrace(FATAL, subsystem, __FILE__, __LINE__, "%s", #condition);
#endif

Answer 6

What you would be looking for is an assertion like ASSERT_CONSISTENT(A_x, offsetof(A,x)) , placed in a header file. Let me explain why, and what the problem is.

Because the problem exists across translation units, you can only detect the error at link time. That means you need to force the linker to spit out an error. Unfortunately, most cross-translation unit problems are formally of the "no diagnosis needed" kind. The most familiar one is the ODR rule. We can trivially cause ODR violations with such assertions, but you just can't rely on the linker to warn you about them. If you can, the implementation of the ODR can be as simple as

#define ASSERT_CONSISTENT(label, x) class ASSERT_ ## label { char test[x]; };

But if the linker doesn't notice these ODR violations, this will pass by silently. And here lies the problem: the linker really only needs to complain if it can't find something.

With two macro's the problem is solved:

template <int i> class dummy; // needed to differentiate functions
#define ASSERT_DEFINE(label, x) void ASSERT_label(dummy<x>&) { }
#define ASSERT_CHECK(label, x) void (*check)(dummy<x>&) = &ASSERT_label;

You'd need to put the ASSERT_DEFINE macro in a .cpp, and ASSERT_CHECK in its header. If the x value checked isn't the x value defined for that label, you're taking the address of an undefined function. Now, a linker doesn't need to warn about multiple definitions, but it must warn about missing definitions.

BTW, for this particular problem, see Diagnosing Hidden ODR Violations in Visual C++ (and fixing LNK2022)