For every dynamic array variable x in a function:
* Scan every statement in the function for length-changing assignment to x.
Distinguish three cases:
(a) assignment from something of known length
x = array literal of length N
x = static array of length N
x.length = N
x = new T[N]
---> For all of these, the possible length of X is equal to the range of N.
(b) relative length change by a known amount
x ~= expression_of_fixed_length;
x.length += N;
x = x ~ expression_of_fixed_length;
If any of these occur inside a loop or a nested function (or in a function with a goto statement), the range of x is 0..size_t; except in the case where length = length - N. Otherwise, new range of range of x.length = oldrange + N.range.
(c) anything else
conservatively assume that the length of x could be 0..size_t/(x[0].sizeof).
* Any use of asm or a pointer inside the function should set the range of all arrays to 0..size_t/(x[0].sizeof).
The reason I think this is valuable, is that most arrays do not arbitrarily change size throughout a function.
Benefits:
(1) Eliminate most false positives from signed-unsigned mismatches.
Cases like this:
int [] x = new int[6]; // or x = some array literal.
for (int i = 0; i < x.length; ++i) {...}
As long as x is only assigned from an object of known length, this sort of thing is always safe.
(2) This minimal array-length range tracking would also allow some out-of-bounds array indexing errors to be detected at compile time.
Comment #1 by lio+bugzilla — 2014-06-16T07:39:15Z
This applies to any (member) variable and is by no means specific to 'length' (apart from the size_t/sizeof trick, which should be the IntRange for ArrayLengthExp)
Comment #2 by robert.schadek — 2024-12-13T17:56:00Z