Proto commits in google/crubit

These 45 commits are when the Protocol Buffers files have changed:

2025-03-07

Infer Nonnull for pointers accessed with operator[]. PiperOrigin-RevId: 734675720 Change-Id: I1efa1e9dd2e5dbc7c7d6adbf4451d79699c40147

The documentation is generated from this commit.

Replace existing annotation offsets before/after the range with whole independent ranges. This allows removing annotations that encapsulate or are further from the type than CVR qualifiers, without removing the qualifiers. PiperOrigin-RevId: 734572481 Change-Id: I1b96dd56b2992a6d8f75f0da5ac2bcbe06b311d9

2025-03-03

Insert qualifier-positioned annotations on the left for named types not ending with `*`. This is consistent with Google's style for the placement of `const`. Our preference is to place the annotation closer to the type than `const`, but this is not required. PiperOrigin-RevId: 733036109 Change-Id: I45b9142ded5bfa63bb8680ccdeb5cebae3cb2563

2025-02-25

Do not generate crubit bindings for protobufs, only collect metadata PiperOrigin-RevId: 730805673 Change-Id: I788eaeb42b203d31e8951b7448b8daa3a64e6e42

2025-02-17

Add (failing) protobuf rust integration test PiperOrigin-RevId: 727834378 Change-Id: I2747d6055fd0dbeace146c24d60fbe9865f4b1ab

2024-12-20

Remove unused slot_in_type from SlotRange. And re-number proto fields now that we've removed so many from this proto that doesn't get stored. PiperOrigin-RevId: 708317146 Change-Id: I0c10620264bd6bb15475279656854b900d3db4f5

2024-12-19

Remove support for detecting eligible ranges containing `auto*`. This detection is not needed for adding/removing macro annotations or removing any other annotation style and we no longer need to support (avoiding) adding template alias annotations to `auto*`. PiperOrigin-RevId: 707970366 Change-Id: I04babb5ca0b027160c048477b076ab6732411eff

Remove supporting metadata for adding template-based annotations to complex declarators. We no longer support addition of this annotation style. PiperOrigin-RevId: 707965602 Change-Id: Iaf29a2a95c2c2b533769763792743bbcc70d1e5c

Add support for adding and removing absl nullability annotation macros. These annotations are expected to behave syntactically exactly as clang's _Nonnull, etc. do. The same level of partial, broken support for removing annotations of both clang/macro and template alias forms from complex declarators is retained. Tests are added to clarify this level of support. PiperOrigin-RevId: 707926518 Change-Id: I6cb3ced82608af11cdba61d72990415a0090fbe1

2024-12-13

No public description PiperOrigin-RevId: 705850175 Change-Id: I2c6b2e7be116701436a8727804ce6eda8eaff019

2024-12-04

Emit evidence for the second parameter of a main function, based on it's well-known definition as being a non-null pointer. PiperOrigin-RevId: 702718576 Change-Id: I8c9cfc9ebc84627d4ee9275caa1de0153980eadf

2024-12-02

Collect softer evidence from Nonnull pointers (or references to them) that are passed as arguments or return values to const reference types. Much like non-reference types, const reference type nullabilities in these positions are not completely invariant. It is safe for the recipient of a `int* _Nullable const&` to hold a reference to an immutable Nonnull value. PiperOrigin-RevId: 701973456 Change-Id: I378f9bae3561b83278c94e07fff513c90e911a1b

2024-11-26

More precisely collect evidence from the taking of references to pointers. When a reference to a mutable pointer is taken, their type nullabilities must match, not just the nullability of the decl's current value, to ensure that the underlying value is not made inappropriately null by assignment through the reference. When a reference declared as referring to a const Nonnull pointer is taken, the left and right side type nullabilities must also match, to ensure the underlying value is not made inappropriately null directly or through a different reference that is declared as pointing to a Nullable pointer. Also add some aspirational test cases for assignments to pointers to mutable pointers and some cases of copy assignment through references. PiperOrigin-RevId: 700398379 Change-Id: I5eba1c4fffcdc8de589b3d5d59d9430ddd42700b

2024-11-11

Remove the slot field of a SlotRange. This allows the same SlotRange to represent a single source range that supplies the type for two different nullability slots (aka two different positions in potentially two different nullability vectors). This is a rare situation, but can occur with macros that accept type arguments and use the same type argument in multiple places. PiperOrigin-RevId: 695431990 Change-Id: I1a3b041c87f0eb603004db9d3c8ca81ea5b0dec3

2024-11-07

Remove Inference proto in favor of only SlotInferences. This will allow future changes to potentially merge all evidence for a source range into an inference, instead of only being able to merge evidence for a symbol by slot. PiperOrigin-RevId: 694183620 Change-Id: I053114c83c050cf945e9937f808916e9f843cd26

2024-11-05

Remove TypeLocRanges and instead use collections of SlotRanges. This provides more flexibility in how these ranges are used to produce edits applying inferred nullabilities, particularly in cases where a single source range contains a type used in multiple places, e.g. through the use of macros. PiperOrigin-RevId: 693144103 Change-Id: I8eb24677bc619e3b987e1ef664674e4c424155ab

2024-11-04

Expose the ordering of SlotRanges within the type they are extracted from, not just the inference slot number. This provides more flexibility when generating source range edits from SlotRanges which may not be contained within a TypeLocRanges or may not already be ordered by this newly-exposed ordering. PiperOrigin-RevId: 692980270 Change-Id: I0843bb913e212c89b1d74988494faa92c8761fd1

2024-09-06

Mark ranges for nested pointers using `auto`, not just top-level. PiperOrigin-RevId: 671745910 Change-Id: I40a787347f1006017ec0558d8b636233027fcedc

2024-09-04

Record when an eligible range is produced for an `auto*` type and add tests to reveal current behavior of inference for them. PiperOrigin-RevId: 670963249 Change-Id: I13af16e872b00da6a9e93951bfc63378e51d78ca

2024-08-15

Collect evidence from assignments from Nonnull and Unknown. Infer from Nonnull assignments with no evidence of any other assignments that the slot should be annotated Nonnull. PiperOrigin-RevId: 663339024 Change-Id: Ib3c4122242b553f670a21ce444a804cfa90e4b35

2024-07-11

Produce ranges for nested array/pointer/function pointer types with complex declarators. These types need special handling due to the placement of names and array brackets that is different when the pointer types are inside an alias template (such as a nullability annotation). This won't cover all cases, but those not covered are even more rare than these complex declarators already are in general. PiperOrigin-RevId: 651443512 Change-Id: I265849ba30466e8d90e1f8b7ecc274bb1a4d95cd

2024-06-28

Use distinct evidence for reference type returns and arguments. Nullability of pointers held by reference needs to be invariant, unlike bare pointers. For reference/pointer-to-mutable-pointer parameters, this revealed a limitation of our post-transfer-function evidence collection, due to the treatment of these parameters as output parameters that leave the arguments as Unknown by the time we are collecting evidence. PiperOrigin-RevId: 647742932 Change-Id: I0f634892373d99b1b94ff982e8392cc3a2f729bf

2024-06-21

Avoid producing edits duplicative with an existing pragma-defined default nullability. PiperOrigin-RevId: 645395033 Change-Id: I1fce2801054b3edc2608e2812aa2178a6c2aa7ed

Enable removal of Unknown annotations when Nonnull/Nullable inferences are produced. Only looks for absl::NullabilityUnknown<...> and _Null_unspecified as an Unknown annotation to be removed. If we have determined that there is an Unknown annotation and a Nonnull/Nullable inference, but we don't have lengths, we leave the Unknown annotation in place to avoid producing useless edits that may not build or be readable by verification tooling. PiperOrigin-RevId: 645390584 Change-Id: Idae050a168f0902df3871e612df561fbe6e84281

2024-06-13

Infer stronger intent from non-literal nullable default member initializers. NULLABLE_DEFAULT_MEMBER_INITIALIZER evidence is considered in a soft no-conflict rule, subordinate to other evidence of Nonnull-ness, as literal nullptrs are often used simply to turn uninitialized-memory bugs into louder nullptr dereference crashes in cases where the pointer is still expected to be never null after construction of the containing object. ASSIGNED_TO_NULLABLE is more aggressive evidence, which will cause a conflict if we also see evidence requiring the pointer to be marked Nonnull, and we will now use this for cases where the default member initializer is a more complex nullable form than literal nullptr, which likely indicates more explicit Nullable intent. PiperOrigin-RevId: 642991495 Change-Id: I8f0d7cc232748cbb82c13ee5f500ba1e26fd0774

2024-06-10

Collect evidence from the returns_nonnull attribute. Mirrors the evidence for parameters from the nonnull attribute. PiperOrigin-RevId: 641897483 Change-Id: Iba9d516ab01dd48ca6edaadfdcd62cc98fd46d14

Collect inference evidence for Nonnull-ness from nonnull attribute. Using a soft rule only because if e.g. someone were somehow getting past the compiler check and assigning a nullable, safety would be violated by applying a Nonnull inference instead of a Nullable one. Not treating it the same as one of our annotations because verification won't be reading the attribute as an annotation or checking for conflicts between ours and these attributes. PiperOrigin-RevId: 641892104 Change-Id: Ie51a6f624b6eef643d104e24d22828243fec539c

2024-05-22

Rename remaining references to "bound" to "assigned". PiperOrigin-RevId: 636137233 Change-Id: I3ba14e0a6b205ca59e256adea60920614d8bb502

2024-04-30

Collect evidence from field initializers in constructors. Collects evidence for both the member and any inference targets in the initializer, from the member initializer list and any default member initializers for members not present in the member initializer list. Additionally, make an inference from the evidence of nullable default member initializers. PiperOrigin-RevId: 629433226 Change-Id: If7ee7ddc492ce966cf588899049f02958651f826

2024-04-18

Collect evidence for nullability of fields from function implementations. Does not yet collect ranges for them or collect evidence from their declarations or default initializers or from the state of fields at the end of constructors for the containing type. PiperOrigin-RevId: 626028690 Change-Id: Id8bc25dc53726564dab43a65675b6dcd3be88ab4

2024-04-10

Collect evidence from pointer arithmetic. This will over-collect for a small set of cases that are not UB for nullptrs: addition with 0 and subtraction with another nullptr. PiperOrigin-RevId: 623503790 Change-Id: If4670a6a3c19063c779ed0ce96c6ef1502571f2a

2024-04-01

Collect already-annotated ranges again, now marked as such. PiperOrigin-RevId: 620840035 Change-Id: I437b98c7288bafeff9f71a852b30887292a1ae33

2024-02-02

Collect Nullable evidence from assignments from null/nullable. E.g. `p = nullptr` indicates that p should be Nullable. This notably diverges from the way we treat Unknown-but-provably null values in other places in evidence collection, but in a more thorough way. Left TODOs to perhaps adjust those other places to be more like this, and added/adjusted tests to make current behaviors clear. PiperOrigin-RevId: 603704781 Change-Id: I193b23454af0e7bf2c015b29800cb51d126bb1ed

2024-01-24

Collect evidence from calls to CHECK(expr), a macro assumed to abort if !expr. Adds necessary functionality to wrap the arguments to such macros in no-op functions that can be easily identified and noticed during evidence collection. Uses this functionality in tests, but not yet in the `infer_tu_main` tool, which will need to explicitly engage the macro replacement functionality in order to collect any such evidence. Also add already-passing test for verification handling of CHECK, i.e. treating the expression as Nonnull post-CHECK. PiperOrigin-RevId: 601192616 Change-Id: Ided9f922132a66fa7bffd01f996981ef56317edb

2023-12-05

Infer Nullable if bound to a mutable Nullable ref. The mutable reference can be used to set the pointer to null, so creating such a reference to a Nonnull-declared pointer would not be safe. Also adjust a few cases of type eligibility that don't currently handle references. Some are semantically a fit for isInferable, but not all. PiperOrigin-RevId: 588078953 Change-Id: Ie71a0f4082e9705c9ca263c3ff0d7dcaa5f4dee8

2023-11-30

Adds library to collect all eligible type locs from a given function declaration, which can then be combined (separately) with inference results to produce annotation edits. PiperOrigin-RevId: 586484034 Change-Id: I99626687edc0415ea07280ea73d999e1e24d2cf9

2023-11-02

Collect evidence from assignments. Evidence collection involving binding values to types does not yet incorporate information from previous inferences input or from InferableSlotsConstraint. That's coming soon in a separate change. PiperOrigin-RevId: 578905076 Change-Id: If1b9878be063dd5a2d2127ea111b3d5543eee894

2023-10-02

Mark non-conflicting inferences made from existing annotations as trivial. PiperOrigin-RevId: 570048944 Change-Id: Id2b75fbdc339512d8f3015520a5d1c5662976889

2023-09-26

Infer Nonnull parameters from the passing of an influenced value to a Nonnull parameter. An influenced value is a value that is made Nonnull by the inferred parameter being marked Nonnull. PiperOrigin-RevId: 568588041 Change-Id: I14939fc1f7a035721829cfcd4ed1e2b10fe1fa10

2023-07-19

Collect evidence for return type from return statements. Records Nonnull, Nullable, and Unknown return values. PiperOrigin-RevId: 549329488 Change-Id: I3c95554d674e5555a25cc99d771509162b7cb78b

2023-07-18

Collect evidence for function parameters from observed call sites. Records Nonnull, Nullable, and Unknown arguments for use in flexible heuristics. PiperOrigin-RevId: 549105355 Change-Id: Iea59d3ff84987446357d84cdba11df6d6ba8478f

2023-07-17

Define merge of Evidence -> Inference, with serializable partials for combine PiperOrigin-RevId: 548722528 Change-Id: I4c263d33a2ce0ff4336711e984d9650d688f1faa

Changes to Evidence proto for aggregation and debugging Instead of conclusions like must_be_nonnull, evidence simply describes the event it saw using an enum. This has a few benefits: - it's less lossy, so easier to reason about the meaning and final inference can make better decisions - emitting evidence and merging evidence are now purely mechanical - more information preserved for debugging Also add a facility for debugging: - from the above, evidence already includes "why" - we add a source location field, so we can see "where" - source locations can be preserved all the way to Inference, but only a few PiperOrigin-RevId: 548719575 Change-Id: I254bac8a2b1c7e1988023d33fa167d46216aa4ea

2023-07-11

Add rest of protos to represent inference intermediates and results PiperOrigin-RevId: 547220791 Change-Id: I6753cb2414c13eb3ebef185b71926fe387a4e521

2023-06-23

Add skeleton proto for distributed nullability inference PiperOrigin-RevId: 542954465