N1453: Supporting the 'noreturn' property in C1x

The noreturn keyword is useful for a few library functions such as abort and exit which cannot return. The user can also define their own functions that never return using this keyword.

_Noreturn void fatal (void); 
void fatal() { 
  /* ... */
  exit(1); 
} 

The noreturn keyword tells the compiler to assume that fatal() cannot return. It can then optimize without regard to what would happen if fatal ever did return. This makes slightly better code. More importantly, it helps avoid spurious warnings of uninitialized variables. You cannot assume that registers saved by the calling function are restored before calling the noreturn function. It does not make sense for a noreturn function to have a return type other than void.

This is a good keyword for standardization because it gives additional information that can be used by the optimizer, but does not alter the semantics of the program if removed. It is supported by both MSVC and GCC.

History

Changelog

• 2010-01-27: Clarified paragraph formatting suggestion from D. Keaton
• 2010-01-26: Added normative wording suggestions from D. Keaton.
• 2005-01-13: Added quick_exit().
• 2005-01-13: Writeup of compatibility with GCC & MSVC
• 2005-01-14: Extended compatibility to handle cross-compiler code
• 2005-01-15: Fleshed out MSVC macro in compatibility section
• 2005-01-15: Added Hans Boehm's rationale into the Type System section

Rationale

void f (void) {
  FILE *f;
  f = fopen( file, ...);
  if (f == NULL) {
    handle_error( ... );
  }
  /* work with f */
}

Type System

This is a saccrifice because the type system could help to identify locations where a noreturn function was useful. For instance, a function that takes a function pointer as an argument could insist that its argument be a noreturn function.

However, there is a simple workaround. It is easy to encapsulate the 'noreturn-ness' of a function pointer:

If a function wishes to treat a function pointer as a pointer to a noreturn function, it can simply call exit() after the function pointer. Consequently, if the pointed-to function actually does return, the system exits immediately.

void (*handle_error(void)); /* this should be a noreturn function */
...
void fn() {
  if (!operation_successful()) {
    handle_error();

    // If we cannot guarantee the pointer does not return,
    // we can stop this flow of control thus:
    exit(1);
  }
  // at this point, the operation was successful
}

The same argument could be extended to claim that _Noreturn itself is not necessary, because a developer could always append an exit() call after any non-returning function. To apply to the fopen() example above, this would yield:

void f (void) {
  FILE *f;
  f = fopen( file, ...);
  if (f == NULL) {
    handle_error( ... );
    exit(1);
  }
  /* work with f */
}

This approach has one major disadvantage, however. It forces responsibility for handling 'noreturn' onto any function that calls a noreturn function. This increases the complexity of using non-returning functions, and also increases the likelihood the developer will forget to call exit(), which leaves them in the same state as we are in today.

The noreturn keyword allows developers to invoke noreturn functions without concern for their return status, simplifying their code and reducing the chance for error. Explicitly calling exit() after a noreturn function should only be necessary when the noreturn function is accessed through a function pointer.

Compatibility

GCC

void fn(void) __attribute__ ((noreturn));
__attribute__ ((noreturn)) void fn(void);
__attribute__ ((noreturn)) void fn(void) {exit(1);}

#define _Noreturn __attribute__ ((noreturn))

_Noreturn void fn(void);
_Noreturn void fn(void) {exit(1);}

Microsoft Visual C++

__declspec( noreturn) void fn(void);
__declspec( noreturn) void fn(void) {exit(1);}

#define _Noreturn __declspec( noreturn)

_Noreturn void fn(void);
_Noreturn void fn(void) {exit(1);}

C++0x

void fn [[noreturn]] (void);
void fn [[noreturn]] (void) {exit(1);}

In a declaration attribute-specifieropt T attribute-specifieropt D where D is an unadorned identifier the type of this identifier is “T”. The first optional attribute-specifier appertains to the entity being declared. The second optional attribute-specifier appertains to the type T, but not to the class or enumeration declared in the decl-specifier-seq, if any. This implies that if the [[noreturn]] attribute precedes the declaration, it still appertains to the function being declared. Therefore, the following declarations have the same meaning:

[[noreturn]] void fn(void);
[[noreturn]] void fn(void) {exit(1);}

#define _Noreturn [[noreturn]]

_Noreturn void fn(void);
_Noreturn void fn(void) {exit(1);}

Cross-platform

#if _MSC_VER >= 1310 
/* MS Visual Studio 2003/.NET Framework 1.1 or newer */
#define NORETURN _declspec( noreturn)
#if __GNUC__ > 2 || (__GNUC__ == 2 && (__GNUC_MINOR__ >= 5)
/* GCC 2.5 or newer */
#define NORETURN __attribute__ ((noreturn))
#elif __cplusplus >= ???
// ??? = the value [tbd] specified in C++0x 16.8
#define NORETURN [[noreturn]]
#elif __STDC_VERSION__ >= 201ymmL 
// the value specified in C1x 6.10.8)
#define NORETURN _Noreturn
#else
#define NORETURN ???
// (my project's choice: #error, or nothing)
#endif

NORETURN void fn(void);
NORETURN void fn(void) {exit(1);}

Proposed Changes

  Syntax
        function-specifier:
                inline
                _Noreturn

In a hosted environment, no function specifier shall appear in a
declaration of main.

A function specifier may appear more than once; the behavior is the
same as if it appeared only once.

A function declared with an inline function specifier is an inline
function. Making a function an inline function suggests that calls to
the function be as fast as possible.120) The extent to which such
suggestions are effective is implementation-defined.121)

Add a new paragraph:

The keyword _Noreturn specifies that a function does not return. The
implementation shall produce a diagnostic message if a function f is
declared with the noreturn keyword, but the implementation cannot be
certain that the function does not indeed return.  If a function f is
called where f was previously declared with the noreturn attribute,
and f eventually returns, the behavior is undefined.

[ Example: 
_Noreturn void f () { 
  abort(); /* ok */
}
_Noreturn void g (int i) { /* ill-formed if called with i <= 0 */
  if (i > 0) 
    abort(); 
}
]

Usage

• longjmp()
• raise()
• abort()
• exit()
• _Exit()
• quick_exit()

Reference