Compiler Explorer

Source code

#include <stdlib.h>   // abort

__attribute__((noinline))
__attribute__((warning("condition not guaranteed")))
static void never_reach(void) { abort(); }   // must define a side effect, to not be optimized away

// EXPECT() : will trigger a warning if the condition is not guaranteed
#define EXPECT(c)  (void)((c) ? (void)0 : never_reach())

// *********************************************************
// Examples with a macro encapsulating target function
// Enforces input conditions and triggers warnings with exact line number
// *********************************************************

// Simple implementation, without EXPECT() in the body.
// The function should not be accessed directly,
// contract is defined later in the macro of same name.
int minus2_pos_expect(int iv) { return iv - 2; }

// The macro definition "masks" the real symbol.
// The macro will only work if it is expanded,
// hence not if symbol is accessed directly.
// (this may happen when invoking symbol in a dynamic library for example)
#define minus2_pos_expect(iv) ( EXPECT(iv>=2), minus2_pos_expect(iv) )

// Usages
int test31(void) { return minus2_pos_expect(3); }  // Fine : condition is respected
int test34(int i){ if (i<2) return 0; return minus2_pos_expect(i); }  // after the `if`, i >= 2 necessarily, so `i` respects the condition => no warning
int test35(int i){ if (i<0) return 0; i+=2; return minus2_pos_expect(i);} // compiler can correctly track the range value of `i` after simple arithmetic

// Bad usages generate a compiler warning
#if 0    // Change to 1 to enable next examples, 
         // they invoke the macro with incorrect arguments
int test32(void) { return minus2_pos_expect(1); }  // Condition not respected : triggers a warning at correct line number
int test33(int i){ return minus2_pos_expect(i); }  // No idea about value of `i` : correctly triggers a warning
#endif

# if 0
// *********************************************************
// Examples with input conditions defined inside the function
// TLDR; this does not work
//       only inlined functions correctly analyze input arguments
//       but even then doesn't identify the line number where the condition is broken
// *********************************************************

// This function requires input to be >= 2.
// Return is then guaranteed to be positive.
static inline int minus2_pos_inlined(int iv)
{
    EXPECT(iv >= 2);   // warning is triggered here, which does not tell which caller breaks the condition
    return iv - 2;
}

int test11(void) { return minus2_pos_inlined(3); }  // Fine : condition is respected, no warning

int test12(void) { return minus2_pos_inlined(1); }  // Condition not respected : triggers a warning, into the inlined function (line number does not help to identify the issue)

// Same function but not inlined
int minus2_pos(int iv)
{
    EXPECT(iv >= 2);  // Without inlining, the function cannot make any assumption on `iv` value
                      // EXPECT() will always fail
    return iv - 2;
}

int test21(void) { return minus2_pos(3); }   // Condition is respected, but warning is nonetheless triggered inside minus2_pos()

#endif