[libc-commits] [libc] [libc] Implement CheckedPtr utility (PR #234646)

[Jeff Bailey via libc-commits]

================
@@ -0,0 +1,200 @@
+//===----------------------------------------------------------------------===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+///
+/// \file
+/// Smart pointer wrapper around cpp::unique_ptr enforcing null checks.
+///
+//===----------------------------------------------------------------------===//
+
+#ifndef LLVM_LIBC_SRC___SUPPORT_CHECKED_PTR_H
+#define LLVM_LIBC_SRC___SUPPORT_CHECKED_PTR_H
+
+#include "hdr/types/size_t.h"
+#include "src/__support/CPP/type_traits.h"
+#include "src/__support/CPP/unique_ptr.h"
+#include "src/__support/CPP/utility.h"
+#include "src/__support/alloc-checker.h"
+#include "src/__support/libc_assert.h"
+#include "src/__support/macros/attributes.h"
+#include "src/__support/macros/config.h"
+
+namespace LIBC_NAMESPACE_DECL {
+
+namespace detail {
+
+class LIBC_TRIVIAL_ABI CheckedState {
+#ifndef NDEBUG
+  bool checked = false;
+
+public:
+  LIBC_INLINE constexpr CheckedState() = default;
+
+  // Moving disarms `other` and starts `this` unchecked so the new owner must
+  // explicitly check its value.
+  LIBC_INLINE constexpr CheckedState(CheckedState &&other) {
+    other.checked = true;
+  }
+
+  // Overwriting an existing CheckedState requires it to have been checked,
+  // disarms `other`, and resets `this` to unchecked.
+  LIBC_INLINE constexpr CheckedState &operator=(CheckedState &&other) {
+    assert_checked();
+    // Self-move-assignment leaves the (checked) state unchanged.
+    if (this == &other)
+      return *this;
+    other.checked = true;
+    checked = false;
+    return *this;
+  }
+
+  LIBC_INLINE ~CheckedState() { assert_checked(); }
+
+  LIBC_INLINE constexpr void mark_checked() { checked = true; }
+  LIBC_INLINE constexpr void assert_checked() const { LIBC_ASSERT(checked); }
+#else
+public:
+  LIBC_INLINE constexpr CheckedState() = default;
+  LIBC_INLINE constexpr CheckedState(CheckedState &&) = default;
+  LIBC_INLINE constexpr CheckedState &operator=(CheckedState &&) = default;
+
+  LIBC_INLINE constexpr void mark_checked() {}
+  LIBC_INLINE constexpr void assert_checked() const {}
+#endif
+};
+
+} // namespace detail
+
+/// A smart pointer wrapper around cpp::unique_ptr that enforces (in !NDEBUG
+/// builds) that callers check pointer nullness before accessing or destroying
+/// the pointer.
+///
+/// A pointer (including a null one) counts as checked once its operator bool
+/// has been called. In !NDEBUG builds, the following operations assert that the
+/// pointer has been checked:
+/// - dereferencing (operator*, operator->, operator[]),
+/// - extracting the pointer via take_unique(),
+/// - destruction,
+/// - being overwritten by a move assignment.
+///
+/// Moving from a CheckedPtr disarms the source and leaves the destination
+/// unchecked, forcing the new owner to check it.
+///
+/// In NDEBUG builds, nothing is tracked and CheckedPtr behaves like
+/// cpp::unique_ptr.
+template <typename T, typename Deleter = cpp::default_delete<T>>
+class [[nodiscard]] LIBC_TRIVIAL_ABI CheckedPtr {
+  using PtrType = cpp::unique_ptr<T, Deleter>;
+  LIBC_NO_UNIQUE_ADDRESS detail::CheckedState state;
+  PtrType ptr;
+
+  template <typename U, typename E> friend class CheckedPtr;
+
+public:
+  using deleter_type = typename PtrType::deleter_type;
+  using element_type = typename PtrType::element_type;
+  using pointer = typename PtrType::pointer;
+
+  LIBC_INLINE constexpr explicit CheckedPtr(pointer p) : ptr(p) {}
+  LIBC_INLINE constexpr CheckedPtr(pointer p, const deleter_type &d)
+      : ptr(p, d) {}
+  LIBC_INLINE constexpr CheckedPtr(pointer p, deleter_type &&d)
+      : ptr(p, cpp::move(d)) {}
+
+  LIBC_INLINE constexpr CheckedPtr(CheckedPtr &&other) = default;
----------------
kaladron wrote:

I think we probably also want to delete these:

CheckedPtr(const CheckedPtr &) = delete;
CheckedPtr &operator=(const CheckedPtr &) = delete;

https://github.com/llvm/llvm-project/pull/234646