[libc-commits] [libc] [libc] Implement CheckedPtr utility (PR #234646)

[Pavel Labath via libc-commits]

================
@@ -0,0 +1,200 @@
+//===----------------------------------------------------------------------===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+///
+/// \file
+/// Smart pointer wrapper around cpp::unique_ptr enforcing null checks.
+///
+//===----------------------------------------------------------------------===//
+
+#ifndef LLVM_LIBC_SRC___SUPPORT_CHECKED_PTR_H
+#define LLVM_LIBC_SRC___SUPPORT_CHECKED_PTR_H
+
+#include "hdr/types/size_t.h"
+#include "src/__support/CPP/type_traits.h"
+#include "src/__support/CPP/unique_ptr.h"
+#include "src/__support/CPP/utility.h"
+#include "src/__support/alloc-checker.h"
+#include "src/__support/libc_assert.h"
+#include "src/__support/macros/attributes.h"
+#include "src/__support/macros/config.h"
+
+namespace LIBC_NAMESPACE_DECL {
+
+namespace detail {
+
+class LIBC_TRIVIAL_ABI CheckedState {
+#ifndef NDEBUG
+  bool checked = false;
+
+public:
+  LIBC_INLINE constexpr CheckedState() = default;
+
+  // Moving disarms `other` and starts `this` unchecked so the new owner must
+  // explicitly check its value.
+  LIBC_INLINE constexpr CheckedState(CheckedState &&other) {
+    other.checked = true;
+  }
+
+  // Overwriting an existing CheckedState requires it to have been checked,
+  // disarms `other`, and resets `this` to unchecked.
+  LIBC_INLINE constexpr CheckedState &operator=(CheckedState &&other) {
+    assert_checked();
+    // Self-move-assignment leaves the (checked) state unchanged.
+    if (this == &other)
+      return *this;
+    other.checked = true;
+    checked = false;
+    return *this;
+  }
+
+  LIBC_INLINE ~CheckedState() { assert_checked(); }
+
+  LIBC_INLINE constexpr void mark_checked() { checked = true; }
+  LIBC_INLINE constexpr void assert_checked() const { LIBC_ASSERT(checked); }
+#else
+public:
+  LIBC_INLINE constexpr CheckedState() = default;
+  LIBC_INLINE constexpr CheckedState(CheckedState &&) = default;
+  LIBC_INLINE constexpr CheckedState &operator=(CheckedState &&) = default;
+
+  LIBC_INLINE constexpr void mark_checked() {}
+  LIBC_INLINE constexpr void assert_checked() const {}
+#endif
+};
+
+} // namespace detail
+
+/// A smart pointer wrapper around cpp::unique_ptr that enforces (in !NDEBUG
+/// builds) that callers check pointer nullness before accessing or destroying
+/// the pointer.
+///
+/// A pointer (including a null one) counts as checked once its operator bool
+/// has been called. In !NDEBUG builds, the following operations assert that the
+/// pointer has been checked:
+/// - dereferencing (operator*, operator->, operator[]),
+/// - extracting the pointer via take_unique(),
+/// - destruction,
+/// - being overwritten by a move assignment.
+///
+/// Moving from a CheckedPtr disarms the source and leaves the destination
+/// unchecked, forcing the new owner to check it.
+///
+/// In NDEBUG builds, nothing is tracked and CheckedPtr behaves like
+/// cpp::unique_ptr.
+template <typename T, typename Deleter = cpp::default_delete<T>>
+class [[nodiscard]] LIBC_TRIVIAL_ABI CheckedPtr {
----------------
labath wrote:

A =deleted the make_unique overload instead as that's how it's done it the standard. unique_ptr<int[57]> is a thing, though it's pretty hard to use it (correctly). I don't think it's necessary (make_unique is the main footgun), but if we really want to disable it, I'd do it inside unique_ptr.

https://github.com/llvm/llvm-project/pull/234646