<html><head></head><body><div class="gmail_quote">Le 26 juillet 2017 11:04:54 GMT+03:00, Steve Lhomme <robux4@gmail.com> a écrit :<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<pre class="k9mail">As a side note, the standard has this example:<br />***<br />struct s { int n; double d[]; };<br /><br />struct s t1 = { 0 }; // valid<br />struct s t2 = { 1, { 4.2 }}; // invalid<br />t1.n = 4; // valid<br />t1.d[0] = 4.2; // might be undefined behavior<br /><br />The initialization of t2 is invalid (and violates a constraint)<br />because struct s is treated as if it did not contain member d. The<br />assignment to t1.d[0] is probably undefined behavior, but it is<br />possible that<br /><br />sizeof (struct s) >= offsetof(struct s, d) + sizeof (double)<br /><br />in which case the assignment would be legitimate. Nevertheless, it<br />cannot appear in strictly conforming code.<br />***<br /><br />So it seems possible, according to the standard, that sizeof(struct s)<br />and offsetof(struct s, d) do not have the same value.<br /><br />On Wed, Jul 26, 2017 at 9:39 AM, Steve Lhomme <robux4@videolabs.io> wrote:<br /><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;"> In those cases the parent of a payload is accessed via the container_of() macro<br /> that removes the size of the containing structure of the payload pointer. This<br /> size comes from offsetof() the flexible array element at the end of the parent<br /> structure.<br /> The compiler is supposed to treat the flexible array element has having no size<br /> in the structure (except when accessed).<br /> ---<br /> src/misc/objects.c | 3 +++<br /> src/misc/objres.c | 2 ++<br /> 2 files changed, 5 insertions(+)<br /><br /> diff --git a/src/misc/objects.c b/src/misc/objects.c<br /> index 91eebdaf20..e953e38a64 100644<br /> --- a/src/misc/objects.c<br /> +++ b/src/misc/objects.c<br /> @@ -186,6 +186,9 @@ void *vlc_custom_create (vlc_object_t *parent, size_t length,<br /> * and zeroes the rest.<br /> */<br /> assert (length >= sizeof (vlc_object_t));<br /> + static_assert( sizeof(vlc_object_internals_t) ==<br /> + offsetof(vlc_object_internals_t, aligned_end),<br /> + "flexible array size is not ignored" );<br /><br /> vlc_object_internals_t *priv = malloc (sizeof (*priv) + length);<br /> if (unlikely(priv == NULL))<br /> diff --git a/src/misc/objres.c b/src/misc/objres.c<br /> index 1afaccb700..b9aa87f30d 100644<br /> --- a/src/misc/objres.c<br /> +++ b/src/misc/objres.c<br /> @@ -51,6 +51,8 @@ void *vlc_objres_new(size_t size, void (*release)(void *))<br /> errno = ENOMEM;<br /> return NULL;<br /> }<br /> + static_assert( sizeof(struct vlc_res) == offsetof(struct vlc_res, payload),<br /> + "flexible array size is not ignored" );<br /><br /> struct vlc_res *res = malloc(sizeof (*res) + size);<br /> if (unlikely(res == NULL))<br /> --<br /> 2.12.1</blockquote><br /><hr /><br />vlc-devel mailing list<br />To unsubscribe or modify your subscription options:<br /><a href="https://mailman.videolan.org/listinfo/vlc-devel">https://mailman.videolan.org/listinfo/vlc-devel</a></pre></blockquote></div><br clear="all">It is possible if the alignment of double is less than the alignment of a struct. For instance, you could have all structures aligned to 16 bytes by ABI while double is aligned to 8 bytes (or less).<br>
<br>
It is not clear to me that this is legal for max_align_t though. It would mean that the size of a structure is padded to a larger alignment than the actual alignment of the structure... Which sound somewhat contradictory.<br>
<br>
And if this is legal, then vlc_externals and vlc_internals macros are broken, and the aligned_end addition needs reverting - as are probably a few other things.<br>
-- <br>
Rémi Denis-Courmont<br>
Typed on an inconvenient virtual keyboard</body></html>