[libc++] Add a lightweight overridable assertion handler
This patch adds a lightweight assertion handler mechanism that can be
overriden at link-time in a fashion similar to `operator new`.
This is a third take on https://llvm.org/D121123 (which allowed customizing
the assertion handler at compile-time), and https://llvm.org/D119969
(which allowed customizing the assertion handler at runtime only).
This approach is, I think, the best of all three explored approaches.
Indeed, replacing the assertion handler in user code is ergonomic,
yet we retain the ability to provide a custom assertion handler when
deploying to older platforms that don't have a default handler in
the dylib.
As-is, this patch provides a pretty good amount of backwards compatibility
with the previous debug mode:
- Code that used to set _LIBCPP_DEBUG=0 in order to get basic assertions
in their code will still get basic assertions out of the box, but
those assertions will be using the new assertion handler support.
- Code that was previously compiled with references to __libcpp_debug_function
and friends will work out-of-the-box, no changes required. This is
because we provide the same symbols in the dylib as we used to.
- Code that used to set a custom __libcpp_debug_function will stop
compiling, because we don't provide that declaration anymore. Users
will have to migrate to the new way of setting a custom assertion
handler, which is extremely easy. I suspect that pool of users is
very limited, so breaking them at compile-time is probably acceptable.
The main downside of this approach is that code being compiled with
assertions enabled but deploying to an older platform where the assertion
handler didn't exist yet will fail to compile. However users can easily
fix the problem by providing a custom assertion handler and defining
the _LIBCPP_AVAILABILITY_CUSTOM_ASSERTION_HANDLER_PROVIDED macro to
let the library know about the custom handler. In a way, this is
actually a feature because it avoids a load-time error that one would
otherwise get when trying to run the code on the older target.
Differential Revision: https://reviews.llvm.org/D121478
NOKEYCHECK=True
GitOrigin-RevId: b0fd9497af6d2efd305e9eecfa0c1e265f1b2192
diff --git a/docs/BuildingLibcxx.rst b/docs/BuildingLibcxx.rst
index 0dd278e..17e90f9 100644
--- a/docs/BuildingLibcxx.rst
+++ b/docs/BuildingLibcxx.rst
@@ -216,7 +216,10 @@
**Default**: ``OFF``
- Build libc++ with assertions enabled.
+ Build libc++ with assertions enabled in the compiled library, and enable assertions
+ by default when building user code as well. Assertions can be turned off by users
+ by defining ``_LIBCPP_ENABLE_ASSERTIONS=0``. For details, see
+ :ref:`the documentation <assertions-mode>`.
.. option:: LIBCXX_ENABLE_SHARED:BOOL
diff --git a/docs/ReleaseNotes.rst b/docs/ReleaseNotes.rst
index 9e2e4a7..ea42b56 100644
--- a/docs/ReleaseNotes.rst
+++ b/docs/ReleaseNotes.rst
@@ -46,6 +46,12 @@
"heapsort with bounce" to reduce the number of comparisons, and rearranges
elements using move-assignment instead of `swap`.
+ - Libc++ now supports a variety of assertions that can be turned on to help catch
+ undefined behavior in user code. This new support is now separate from the old
+ (and incomplete) Debug Mode. Vendors can select whether the library they ship
+ should include assertions or not by default. For details, see
+ :ref:`the documentation <assertions-mode>` about this new feature.
+
API Changes
-----------
@@ -74,6 +80,10 @@
- The C++14 function ``std::quoted(const char*)`` is no longer supported in
C++03 or C++11 modes.
+- Setting a custom debug handler with ``std::__libcpp_debug_function`` is not
+ supported anymore. Please migrate to using the new support for
+ :ref:`assertions <assertions-mode>` instead.
+
ABI Changes
-----------
diff --git a/docs/UsingLibcxx.rst b/docs/UsingLibcxx.rst
index bd999f0..3eab44a 100644
--- a/docs/UsingLibcxx.rst
+++ b/docs/UsingLibcxx.rst
@@ -121,6 +121,92 @@
<args>
+.. _assertions-mode:
+
+Enabling the "safe libc++" mode
+===============================
+
+Libc++ contains a number of assertions whose goal is to catch undefined behavior in the
+library, usually caused by precondition violations. Those assertions do not aim to be
+exhaustive -- instead they aim to provide a good balance between safety and performance.
+In particular, these assertions do not change the complexity of algorithms. However, they
+might, in some cases, interfere with compiler optimizations.
+
+By default, these assertions are turned off. Vendors can decide to turn them on while building
+the compiled library by defining ``LIBCXX_ENABLE_ASSERTIONS=ON`` at CMake configuration time.
+When ``LIBCXX_ENABLE_ASSERTIONS`` is used, the compiled library will be built with assertions
+enabled, **and** user code will be built with assertions enabled by default. If
+``LIBCXX_ENABLE_ASSERTIONS=OFF`` at CMake configure time, the compiled library will not contain
+assertions and the default when building user code will be to have assertions disabled.
+As a user, you can consult your vendor to know whether assertions are enabled by default.
+
+Furthermore, independently of any vendor-selected default, users can always control whether
+assertions are enabled in their code by defining ``_LIBCPP_ENABLE_ASSERTIONS=0|1`` before
+including any libc++ header (we recommend passing ``-D_LIBCPP_ENABLE_ASSERTIONS=X`` to the
+compiler). Note that if the compiled library was built by the vendor without assertions,
+functions compiled inside the static or shared library won't have assertions enabled even
+if the user defines ``_LIBCPP_ENABLE_ASSERTIONS=1`` (the same is true for the inverse case
+where the static or shared library was compiled **with** assertions but the user tries to
+disable them). However, most of the code in libc++ is in the headers, so the user-selected
+value for ``_LIBCPP_ENABLE_ASSERTIONS`` (if any) will usually be respected.
+
+When an assertion fails, an assertion handler function is called. The library provides a default
+assertion handler that prints an error message and calls ``std::abort()``. Note that this assertion
+handler is provided by the static or shared library, so it is only available when deploying to a
+platform where the compiled library is sufficiently recent. However, users can also override that
+assertion handler with their own, which can be useful to provide custom behavior, or when deploying
+to older platforms where the default assertion handler isn't available.
+
+Replacing the default assertion handler is done by defining the following function:
+
+.. code-block:: cpp
+
+ void __libcpp_assertion_handler(char const* file, int line, char const* expression, char const* message)
+
+This mechanism is similar to how one can replace the default definition of ``operator new``
+and ``operator delete``. For example:
+
+.. code-block:: cpp
+
+ // In HelloWorldHandler.cpp
+ #include <__assert> // must include <__assert> before defining the handler
+
+ void std::__libcpp_assertion_handler(char const* file, int line, char const* expression, char const* message) {
+ std::printf("Assertion %s failed at %s:%d, more info: %s", expression, file, line, message);
+ std::abort();
+ }
+
+ // In HelloWorld.cpp
+ #include <vector>
+
+ int main() {
+ std::vector<int> v;
+ int& x = v[0]; // Your assertion handler will be called here if _LIBCPP_ENABLE_ASSERTIONS=1
+ }
+
+Also note that the assertion handler should usually not return. Since the assertions in libc++
+catch undefined behavior, your code will proceed with undefined behavior if your assertion
+handler is called and does return.
+
+Furthermore, throwing an exception from the assertion handler is not recommended. Indeed, many
+functions in the library are ``noexcept``, and any exception thrown from the assertion handler
+will result in ``std::terminate`` being called.
+
+Back-deploying with a custom assertion handler
+----------------------------------------------
+When deploying to an older platform that does not provide a default assertion handler, the
+compiler will diagnose the usage of ``std::__libcpp_assertion_handler`` with an error. This
+is done to avoid the load-time error that would otherwise happen if the code was being deployed
+on the older system.
+
+If you are providing a custom assertion handler, this error is effectively a false positive.
+To let the library know that you are providing a custom assertion handler in back-deployment
+scenarios, you must define the ``_LIBCPP_AVAILABILITY_CUSTOM_ASSERTION_HANDLER_PROVIDED`` macro,
+and the library will assume that you are providing your own definition. If no definition is
+provided and the code is back-deployed to the older platform, it will fail to load when the
+dynamic linker fails to find a definition for ``std::__libcpp_assertion_handler``, so you
+should only remove the guard rails if you really mean it!
+
Libc++ Configuration Macros
===========================