[cfe-dev] ISO C3X proposal: nonnull qualifier

[Joerg Sonnenberger via cfe-dev]

On Mon, Nov 15, 2021 at 05:01:49PM +0100, Alejandro Colomar (man-pages) via cfe-dev wrote:
>        Clang doesn't specify the behavior  as  being  undefined.
>        That  forbids optimizations, that would otherwise be pos‐
>        sible.  We prefer to allow for those optimizations.

Have you read the old discussions on this topic? Without wanting to
sound harsh, I'm missing the justification for why the optimisation is
useful. The clang _Nonnull exists exactly because the GCC attribute has
proven to be much more harmful than it ever helped to produce better
code. Your proposal should therefore at the very least discuss two
related topics:

(1) Why is it a good idea to remove explicit sanity checks from the
code? History of many libraries have proven that this checks are much
more useful than the branching cost and it is very surprising if the
compiler drops them.

(2) Why can propagation of assumptions not result in the
removal of range checks? See the whole deferencing-implies-notnull
discussion from the Linux kernel a few years ago for why this can be
problematic.

As it stands, this just seems to repeat the mistakes of the GCC
attributes in a slightly different shape.

Joerg