qapi: Change visit_type_FOO() to no longer return partial objects

Returning a partial object on error is an invitation for a careless
caller to leak memory.  We already fixed things in an earlier
patch to guarantee NULL if visit_start fails ("qapi: Guarantee
NULL obj on input visitor callback error"), but that does not
help the case where visit_start succeeds but some other failure
happens before visit_end, such that we leak a partially constructed
object outside visit_type_FOO(). As no one outside the testsuite
was actually relying on these semantics, it is cleaner to just
document and guarantee that ALL pointer-based visit_type_FOO()
functions always leave a safe value in *obj during an input visitor
(either the new object on success, or NULL if an error is
encountered), so callers can now unconditionally use
qapi_free_FOO() to clean up regardless of whether an error occurred.

The decision is done by adding visit_is_input(), then updating the
generated code to check if additional cleanup is needed based on
the type of visitor in use.

Note that we still leave *obj unchanged after a scalar-based
visit_type_FOO(); I did not feel like auditing all uses of
visit_type_Enum() to see if the callers would tolerate a specific
sentinel value (not to mention having to decide whether it would
be better to use 0 or ENUM__MAX as that sentinel).

Signed-off-by: Eric Blake <eblake@redhat.com>
Message-Id: <1461879932-9020-25-git-send-email-eblake@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
This commit is contained in:
Eric Blake 2016-04-28 15:45:32 -06:00 committed by Markus Armbruster
parent d9f62dde13
commit 68ab47e4b4
7 changed files with 57 additions and 43 deletions

View file

@ -66,12 +66,14 @@
* member @name is not present, or is present but not the specified
* type).
*
* FIXME: At present, visit_type_FOO() is an awkward interface: input
* visitors may allocate an incomplete *@obj even when reporting an
* error, but using an output visitor with an incomplete object has
* undefined behavior. To avoid a memory leak, callers must use
* qapi_free_FOO() even on error (this uses the dealloc visitor, and
* safely handles an incomplete object).
* If an error is detected during visit_type_FOO() with an input
* visitor, then *@obj will be NULL for pointer types, and left
* unchanged for scalar types. Using an output visitor with an
* incomplete object has undefined behavior (other than a special case
* for visit_type_str() treating NULL like ""), while the dealloc
* visitor safely handles incomplete objects. Since input visitors
* never produce an incomplete object, such an object is possible only
* by manual construction.
*
* For the QAPI object types (structs, unions, and alternates), there
* is an additional generated function in qapi-visit.h compatible
@ -106,7 +108,6 @@
* v = ...obtain input visitor...
* visit_type_Foo(v, NULL, &f, &err);
* if (err) {
* qapi_free_Foo(f);
* ...handle error...
* } else {
* ...use f...
@ -124,7 +125,6 @@
* v = ...obtain input visitor...
* visit_type_FooList(v, NULL, &l, &err);
* if (err) {
* qapi_free_FooList(l);
* ...handle error...
* } else {
* for ( ; l; l = l->next) {
@ -154,7 +154,9 @@
* helpers that rely on in-tree information to control the walk:
* visit_optional() for the 'has_member' field associated with
* optional 'member' in the C struct; and visit_next_list() for
* advancing through a FooList linked list. Only the generated
* advancing through a FooList linked list. Similarly, the
* visit_is_input() helper makes it possible to write code that is
* visitor-agnostic everywhere except for cleanup. Only the generated
* visit_type functions need to use these helpers.
*
* It is also possible to use the visitors to do a virtual walk, where
@ -405,6 +407,11 @@ bool visit_optional(Visitor *v, const char *name, bool *present);
void visit_type_enum(Visitor *v, const char *name, int *obj,
const char *const strings[], Error **errp);
/*
* Check if visitor is an input visitor.
*/
bool visit_is_input(Visitor *v);
/*** Visiting built-in types ***/
/*