On Sun, Nov 22, 2020 at 11:54 PM Finn Thain fthain@telegraphics.com.au wrote:
We should also take into account optimisim about future improvements in tooling.
Not sure what you mean here. There is no reliable way to guess what the intention was with a missing fallthrough, even if you parsed whitespace and indentation.
It is if you want to spin it that way.
How is that a "spin"? It is a fact that we won't get *implicit* fallthrough mistakes anymore (in particular if we make it a hard error).
But what we inevitably get is changes like this:
case 3: this();
break;case 4: hmmm();
Why? Mainly to silence the compiler. Also because the patch author argued successfully that they had found a theoretical bug, often in mature code.
If someone changes control flow, that is on them. Every kernel developer knows what `break` does.
But is anyone keeping score of the regressions? If unreported bugs count, what about unreported regressions?
Introducing `fallthrough` does not change semantics. If you are really keen, you can always compare the objects because the generated code shouldn't change.
Cheers, Miguel
On Mon, 23 Nov 2020, Miguel Ojeda wrote:
On Mon, 23 Nov 2020, Finn Thain wrote:
On Sun, 22 Nov 2020, Miguel Ojeda wrote:
It isn't that much effort, isn't it? Plus we need to take into account the future mistakes that it might prevent, too.
We should also take into account optimisim about future improvements in tooling.
Not sure what you mean here. There is no reliable way to guess what the intention was with a missing fallthrough, even if you parsed whitespace and indentation.
What I meant was that you've used pessimism as if it was fact.
For example, "There is no way to guess what the effect would be if the compiler trained programmers to add a knee-jerk 'break' statement to avoid a warning".
Moreover, what I meant was that preventing programmer mistakes is a problem to be solved by development tools. The idea that retro-fitting new language constructs onto mature code is somehow necessary to "prevent future mistakes" is entirely questionable.
So even if there were zero problems found so far, it is still a positive change.
It is if you want to spin it that way.
How is that a "spin"? It is a fact that we won't get *implicit* fallthrough mistakes anymore (in particular if we make it a hard error).
Perhaps "handwaving" is a better term?
I would agree if these changes were high risk, though; but they are almost trivial.
This is trivial:
case 1: this();
fallthrough;case 2: that();
But what we inevitably get is changes like this:
case 3: this();
break;case 4: hmmm();
Why? Mainly to silence the compiler. Also because the patch author argued successfully that they had found a theoretical bug, often in mature code.
If someone changes control flow, that is on them. Every kernel developer knows what `break` does.
Sure. And if you put -Wimplicit-fallthrough into the Makefile and if that leads to well-intentioned patches that cause regressions, it is partly on you.
Have you ever considered the overall cost of the countless -Wpresume-incompetence flags?
Perhaps you pay the power bill for a build farm that produces logs that no-one reads? Perhaps you've run git bisect, knowing that the compiler messages are not interesting? Or compiled software in using a language that generates impenetrable messages? If so, here's a tip:
# grep CFLAGS /etc/portage/make.conf CFLAGS="... -Wno-all -Wno-extra ..." CXXFLAGS="${CFLAGS}"
Now allow me some pessimism: the hardware upgrades, gigawatt hours and wait time attributable to obligatory static analyses are a net loss.
But is anyone keeping score of the regressions? If unreported bugs count, what about unreported regressions?
Introducing `fallthrough` does not change semantics. If you are really keen, you can always compare the objects because the generated code shouldn't change.
No, it's not for me to prove that such patches don't affect code generation. That's for the patch author and (unfortunately) for reviewers.
Cheers, Miguel
On Tue, 2020-11-24 at 11:58 +1100, Finn Thain wrote:
it's not for me to prove that such patches don't affect code generation. That's for the patch author and (unfortunately) for reviewers.
Ideally, that proof would be provided by the compilation system itself and not patch authors nor reviewers nor maintainers.
Unfortunately gcc does not guarantee repeatability or deterministic output. To my knowledge, neither does clang.
On Mon, 23 Nov 2020, Joe Perches wrote:
On Tue, 2020-11-24 at 11:58 +1100, Finn Thain wrote:
it's not for me to prove that such patches don't affect code generation. That's for the patch author and (unfortunately) for reviewers.
Ideally, that proof would be provided by the compilation system itself and not patch authors nor reviewers nor maintainers.
Unfortunately gcc does not guarantee repeatability or deterministic output. To my knowledge, neither does clang.
Yes, I've said the same thing myself. But having attempted it, I now think this is a hard problem. YMMV.
https://lore.kernel.org/linux-scsi/alpine.LNX.2.22.394.2004281017310.12@nipp... https://lore.kernel.org/linux-scsi/alpine.LNX.2.22.394.2005211358460.8@nippy...
On Tue, Nov 24, 2020 at 1:58 AM Finn Thain fthain@telegraphics.com.au wrote:
What I meant was that you've used pessimism as if it was fact.
"future mistakes that it might prevent" is neither pessimism nor states a fact.
For example, "There is no way to guess what the effect would be if the compiler trained programmers to add a knee-jerk 'break' statement to avoid a warning".
It is only knee-jerk if you think you are infallible.
Moreover, what I meant was that preventing programmer mistakes is a problem to be solved by development tools
This warning comes from a development tool -- the compiler.
The idea that retro-fitting new language constructs onto mature code is somehow necessary to "prevent future mistakes" is entirely questionable.
The kernel is not a frozen codebase.
Further, "mature code vs. risk of change" arguments don't apply here because the semantics of the program and binary output isn't changing.
Sure. And if you put -Wimplicit-fallthrough into the Makefile and if that leads to well-intentioned patches that cause regressions, it is partly on you.
Again: adding a `fallthrough` does not change the program semantics. If you are a maintainer and want to cross-check, compare the codegen.
Have you ever considered the overall cost of the countless -Wpresume-incompetence flags?
Yeah: negative. On the other hand, the overall cost of the countless -fI-am-infallible flags is very noticeable.
Perhaps you pay the power bill for a build farm that produces logs that no-one reads? Perhaps you've run git bisect, knowing that the compiler messages are not interesting? Or compiled software in using a language that generates impenetrable messages? If so, here's a tip:
# grep CFLAGS /etc/portage/make.conf CFLAGS="... -Wno-all -Wno-extra ..." CXXFLAGS="${CFLAGS}"
Now allow me some pessimism: the hardware upgrades, gigawatt hours and wait time attributable to obligatory static analyses are a net loss.
If you really believe compiler warnings and static analysis are useless and costly, I think there is not much point in continuing the discussion.
No, it's not for me to prove that such patches don't affect code generation. That's for the patch author and (unfortunately) for reviewers.
I was not asking you to prove it. I am stating that proving it is very easy.
Cheers, Miguel
dri-devel@lists.freedesktop.org
-
Finn Thain -
Joe Perches -
Miguel Ojeda