nullability annotations in C

Posted Feb 11, 2025 20:15 UTC (Tue) by tialaramex (subscriber, #21167)
In reply to: nullability annotations in C by alx.manpages
Parent article: Maintainer opinions on Rust-for-Linux

Here's the thing, if you were talking about a C17 feature that wasn't yet seeing wide enough adoption I'd give it the benefit of the doubt, but this is a _proposed_ C2Y feature. It might land in C29 (or whatever C2Y turns into) or it might not. It might then be implemented across major compilers like GCC and it _might_ then become so widely used that it's equivalent to features like Rust's Option<&T> today eventually many years from today.

That's a lot of "might" for an unknowable future. That's a bad gamble. And its predicated upon this irrational steady state/ zero sum idea that well, if Rust is better in some ways than C that just means it's worse in other ways. Not so. Rust isn't _perfect_ but that doesn't preclude being better. Seven needn't be the largest possible number in order to be a bigger number than three, Rust can be a better choice than C while BOTH of these propositions remain true: C was a good idea in the 1970s (fifty years ago!); Rust is not perfect and will itself be replaced in time.

nullability annotations in C

Posted Feb 11, 2025 22:47 UTC (Tue) by alx.manpages (subscriber, #145117) [Link]

> It might land in C29 (or whatever C2Y turns into) or it might not.

There are features having been accepted into C2y a few months ago, which will be available (most likely) in GCC 16. For example, there's the countof() operator.

<https://thephd.dev/the-big-array-size-survey-for-c-results>
<https://thephd.dev/the-big-array-size-survey-for-c>

My patch was actually ready around November, but I'm holding it due to lack of agreement in the name of the operator.

That's one of the features that will bring some safety to the language soon. And there are some obvious extensions that will make it even better. Consider this code:

```
wchar_t *
wmemset(size_t n;
wchar_t wcs[n], wchar_t wc, size_t n)
{
for (size_t i = 0; i < _Countof(wcs); i++)
wcs[i] = wc;
}
```

That is, being able to reference the number of elements of an array even if it's an array parameter (thus, a pointer). That's not yet standardized, but we're working on getting this into GCC soon. There are several other features that will similarly make the language safer.

Features will arrive to GCC soon, even if there's not a release of ISO C in the near future.

> It might then be implemented across major compilers like GCC

The author of the proposal has already a working implementation in Clang. It's not yet in mainline Clang, but I don't expect that it would take much time to mainline it once it's been accepted into C2y. It might be way sooner than you expect.

> Rust isn't _perfect_ but that doesn't preclude being better.

I don't say it's not better. But most changes in the FOSS community are merged very slowly, precisely to prove that they are good. Pressing Rust is the opposite of that. Maybe Rust proves to be as good as it sounds, but only time will say it. Every change is suspect of being worse, until it is proven beyond reasonable doubt that it isn't.