Ways to ASSERT expressions at build time in C

Question

I'm tidying up some older code that uses 'magic numbers' all over the place to set hardware registers, and I would like to use constants instead of these numbers to make the code somewhat more expressive (in fact they will map to the names/values used to document the registers).

However, I'm concerned that with the volume of changes I might break the magic numbers. Here is a simplified example (the register set is more complex):

const short mode0 = 0;
const short mode1 = 1;
const short mode2 = 2;

const short state0 = 0;
const short state1 = 4;
const short state2 = 8;

so instead of :

set_register(5);

we have:

set_register(state1|mode1);

What I'm looking for is a build time version of:

ASSERT(5==(state1|mode1));

Update

@Christian, thanks for the quick response, I'm interested on a C / non-boost environment answer too because this is driver/kernel code.

Subservient

There's also a very thorough examination of STATIC_ASSERT techniques in Alexandrescu's Modern C++ Design, ISBN 978-0201704310. – Pigsty

Answer 1

NEW ANSWER :

In my original answer (below), I had to have two different macros to support assertions in a function scope and at the global scope. I wondered if it was possible to come up with a single solution that would work in both scopes.

I was able to find a solution that worked for Visual Studio and Comeau compilers using extern character arrays. But I was able to find a more complex solution that works for GCC. But GCC's solution doesn't work for Visual Studio. :( But adding a '#ifdef __ GNUC __', it's easy to choose the right set of macros for a given compiler.

Solution:

#ifdef __GNUC__
#define STATIC_ASSERT_HELPER(expr, msg) \
    (!!sizeof \ (struct { unsigned int STATIC_ASSERTION__##msg: (expr) ? 1 : -1; }))
#define STATIC_ASSERT(expr, msg) \
    extern int (*assert_function__(void)) [STATIC_ASSERT_HELPER(expr, msg)]
#else
    #define STATIC_ASSERT(expr, msg)   \
    extern char STATIC_ASSERTION__##msg[1]; \
    extern char STATIC_ASSERTION__##msg[(expr)?1:2]
#endif /* #ifdef __GNUC__ */

Here are the error messages reported for STATIC_ASSERT(1==1, test_message); at line 22 of test.c:

GCC:

line 22: error: negative width in bit-field `STATIC_ASSERTION__test_message'

Visual Studio:

test.c(22) : error C2369: 'STATIC_ASSERTION__test_message' : redefinition; different subscripts
    test.c(22) : see declaration of 'STATIC_ASSERTION__test_message'

Comeau:

line 22: error: declaration is incompatible with
        "char STATIC_ASSERTION__test_message[1]" (declared at line 22)

 
 

ORIGINAL ANSWER :

I do something very similar to what Checkers does. But I include a message that'll show up in many compilers:

#define STATIC_ASSERT(expr, msg)               \
{                                              \
    char STATIC_ASSERTION__##msg[(expr)?1:-1]; \
    (void)STATIC_ASSERTION__##msg[0];          \
}

And for doing something at the global scope (outside a function) use this:

#define GLOBAL_STATIC_ASSERT(expr, msg)   \
  extern char STATIC_ASSERTION__##msg[1]; \
  extern char STATIC_ASSERTION__##msg[(expr)?1:2]

Tressa

I have something similar here: atalasoft.com/cs/blogs/stevehawley/archive/2007/10/29/… – Diver

I like what you do with the msg parameter; I may have to add that capability to mine. I'll also have to test mine on gcc. I wonder if you changed the '2' to a '-1' in your conditional char array declaration, wouldn't that have to cause an error on gcc? Then you could get rid of the gcc special case. – Oilcup

Since your macro doesn't correspond 100% to what is asked, you should have added some examples. Your solution takes 2 parameters, and the 2nd parameter is not a string. – Procreate

Is this still the recommended way to accomplish compile-time assertions? – Entity

Answer 2

There is an article by Ralf Holly that examines different options for static asserts in C.

He presents three different approaches:

• switch case values must be unique
• arrays must not have negative dimensions
• division by zero for constant expressions

His conclusion for the best implementation is this:

#define assert_static(e) \
    do { \
        enum { assert_static__ = 1/(e) }; \
    } while (0)

Skell

The "do {... } while(0)" allows that macro to work only within a function. If you're testing a declaration at the top of the file, outside of a function, the compiler will issue an error. I reduced that to just "enum { assert_static__ = 1/(e) }" and now it works everywhere. – Ritual

"assert_static__" ... Tip: call that dummy variable something that hints at the error, e.g.: array_size_is_wrong – Ritual

Answer 3

Checkout boost's static assert

Karyn

I use this all over our code. Its even caught people doing silly things that would have caused unexplained but major havok once or twice. – Jazminejazz

Answer 4

You can roll your own static assert if you don't have access to a third-party library static assert function (like boost):

#define STATIC_ASSERT(x) \
    do { \
        const static char dummy[(x)?1:-1] = {0};\
    } while(0)

The downside is, of course, that error message is not going to be very helpful, but at least, it will give you the line number.

Abacist

Nice improvisation, thanks! In my build environment I hit the error: Error: #257: const variable "dummy" requires an initializer So I changed this to const static char dummy[(x)?1:-1]={0}; If you agree/update this I'll mark this as answered, thanks again. – Subservient

Answer 5

#define static_assert(expr) \
int __static_assert(int static_assert_failed[(expr)?1:-1])

It can be used anywhere, any times. I think it is the easiest solution.

Before usage, test it with your compiler carefully.

Casabonne

I like it, although for the project I'm on it wouldn't do because my compiler settings would complain about a function declared but not used. – Spaniard

@AndyLester: That's what the inline keyword is for, or __attribute__((unused)) – Englishism

Don't write double underscore in your own identifiers - those names are reserved for the implementation, for any purpose! – Sima

Answer 6

Any of the techniques listed here should work and when C++0x becomes available you will be able to use the built-in static_assert keyword.

Propagate

C is not C++. – Sima

Answer 7

Try:

#define STATIC_ASSERT(x, error) \
do { \
    static const char error[(x)?1:-1];\
} while(0)

Then you can write:

STATIC_ASSERT(a == b, a_not_equal_to_b);

Which may give you a better error message (depending on your compiler).

Hanaper

Ahh... you beat me too it! :-) – Tressa

Answer 8

If you have Boost then using BOOST_STATIC_ASSERT is the way to go. If you're using C or don't want to get Boost here's my c_assert.h file that defines (and explains the workings of) a few macros to handle static assertions.

It's a bit more convoluted that it should be because in ANSI C code you need 2 different macros - one that can work in the area where you have declarations and one that can work in the area where normal statements go. There is a also a bit of work that goes into making the macro work at global scope or in block scope and a bunch of gunk to ensure that there are no name collisions.

STATIC_ASSERT() can be used in the variable declaration block or global scope.

STATIC_ASSERT_EX() can be among regular statements.

For C++ code (or C99 code that allow declarations mixed with statements) STATIC_ASSERT() will work anywhere.

/*
    Define macros to allow compile-time assertions.

    If the expression is false, an error something like

        test.c(9) : error XXXXX: negative subscript

    will be issued (the exact error and its format is dependent
    on the compiler).

    The techique used for C is to declare an extern (which can be used in
    file or block scope) array with a size of 1 if the expr is TRUE and
    a size of -1 if the expr is false (which will result in a compiler error).
    A counter or line number is appended to the name to help make it unique.  
    Note that this is not a foolproof technique, but compilers are
    supposed to accept multiple identical extern declarations anyway.

    This technique doesn't work in all cases for C++ because extern declarations
    are not permitted inside classes.  To get a CPP_ASSERT(), there is an 
    implementation of something similar to Boost's BOOST_STATIC_ASSERT().  Boost's
    approach uses template specialization; when expr evaluates to 1, a typedef
    for the type 

        ::interslice::StaticAssert_test< sizeof( ::interslice::StaticAssert_failed<true>) >

    which boils down to 

        ::interslice::StaticAssert_test< 1>

    which boils down to 

        struct StaticAssert_test

    is declared. If expr is 0, the compiler will be unable to find a specialization for

        ::interslice::StaticAssert_failed<false>.

    STATIC_ASSERT() or C_ASSERT should work in either C or C++ code  (and they do the same thing)

    CPP_ASSERT is defined only for C++ code.

    Since declarations can only occur at file scope or at the start of a block in 
    standard C, the C_ASSERT() or STATIC_ASSERT() macros will only work there.  For situations
    where you want to perform compile-time asserts elsewhere, use C_ASSERT_EX() or
    STATIC_ASSERT_X() which wrap an enum declaration inside it's own block.

 */

#ifndef C_ASSERT_H_3803b949_b422_4377_8713_ce606f29d546
#define C_ASSERT_H_3803b949_b422_4377_8713_ce606f29d546

/* first some utility macros to paste a line number or counter to the end of an identifier
 * this will let us have some chance of generating names that are unique
 * there may be problems if a static assert ends up on the same line number in different headers
 * to avoid that problem in C++ use namespaces
*/

#if !defined( PASTE)
#define PASTE2( x, y) x##y
#define PASTE( x, y)  PASTE2( x, y)
#endif /* PASTE */

#if !defined( PASTE_LINE)
#define PASTE_LINE( x)    PASTE( x, __LINE__)
#endif /* PASTE_LINE */

#if!defined( PASTE_COUNTER)
#if (_MSC_VER >= 1300)      /* __COUNTER__ introduced in VS 7 (VS.NET 2002) */
    #define PASTE_COUNTER( x) PASTE( x, __COUNTER__)   /* __COUNTER__ is a an _MSC_VER >= 1300 non-Ansi extension */
#else
    #define PASTE_COUNTER( x) PASTE( x, __LINE__)      /* since there's no __COUNTER__ use __LINE__ as a more or less reasonable substitute */
#endif
#endif /* PASTE_COUNTER */



#if __cplusplus
extern "C++" {   // required in case we're included inside an extern "C" block
    namespace interslice {
        template<bool b> struct StaticAssert_failed;
        template<>       struct StaticAssert_failed<true> { enum {val = 1 }; };
        template<int x>  struct StaticAssert_test { };
    }
}
    #define CPP_ASSERT( expr) typedef ::interslice::StaticAssert_test< sizeof( ::interslice::StaticAssert_failed< (bool) (expr) >) >  PASTE_COUNTER( IntersliceStaticAssertType_)
    #define STATIC_ASSERT( expr)    CPP_ASSERT( expr)
    #define STATIC_ASSERT_EX( expr) CPP_ASSERT( expr)
#else
    #define C_ASSERT_STORAGE_CLASS extern                  /* change to typedef might be needed for some compilers? */
    #define C_ASSERT_GUID 4964f7ac50fa4661a1377e4c17509495 /* used to make sure our extern name doesn't collide with something else */
    #define STATIC_ASSERT( expr)   C_ASSERT_STORAGE_CLASS char PASTE( PASTE( c_assert_, C_ASSERT_GUID), [(expr) ? 1 : -1])
    #define STATIC_ASSERT_EX(expr) do { enum { c_assert__ = 1/((expr) ? 1 : 0) }; } while (0)
#endif /* __cplusplus */

#if !defined( C_ASSERT)  /* C_ASSERT() might be defined by winnt.h */
#define C_ASSERT( expr)    STATIC_ASSERT( expr)
#endif /* !defined( C_ASSERT) */
#define C_ASSERT_EX( expr) STATIC_ASSERT_EX( expr)



#ifdef TEST_IMPLEMENTATION
C_ASSERT( 1 < 2);
C_ASSERT( 1 < 2);

int main( )
{
    C_ASSERT( 1 < 2);
    C_ASSERT( 1 < 2);

    int x;

    x = 1 + 4;

    C_ASSERT_EX( 1 < 2);
    C_ASSERT_EX( 1 < 2);



    return( 0);
}
#endif /* TEST_IMPLEMENTATION */
#endif /* C_ASSERT_H_3803b949_b422_4377_8713_ce606f29d546 */

Oilcup

Why do you need PASTE and PASTE2 definitions? Can't we directly use x##__LINE__ or x##__COUNTER__? – Reactant

@Cœur: It's necessary to handle pasting macro values properly. See https://mcmap.net/q/24832/-what-are-the-applications-of-the-preprocessor-operator-and-gotchas-to-consider – Oilcup

Thanks for the link, that explains partially. But still, double indirection is only required if you were using the PASTE macro directly in your code. As PASTE is only meaningful within other macros (PASTE_COUNTER, PASTE_LINE or STATIC_ASSERT), the second level of indirection PASTE2 seems useless. – Reactant

If a directly invoked macro, FOO(x) uses the token pasting operator with its operand, x, and it is invoked with a macro as the argument, then what will be pasted is the macro name, not the value of the macro. That is usually not what is desired. The extra indirection solves that problem. – Oilcup

Answer 9

The common, portable option is

#if 5 != (state1|mode1)
#    error "aaugh!"
#endif

but it doesn't work in this case, because they're C constants and not #defines.

You can see the Linux kernel's BUILD_BUG_ON macro for something that handles your case:

#define BUILD_BUG_ON(condition) ((void)sizeof(char[1 - 2*!!(condition)]))

When condition is true, this becomes ((void)sizeof(char[-1])), which is illegal and should fail at compile time, and otherwise it becomes ((void)sizeof(char[1])), which is just fine.

Rocher

The kernel folks have noticed that this doesn't handle non-const expressions as well as they'd like, but efforts to replace it [ such as lkml.org/lkml/2008/8/17/92 and lkml.org/lkml/2008/9/2/170 ] haven't been accepted yet. – Rocher

Answer 10

Ensure you compile with a sufficiently recent compiler (e.g. gcc -std=c11).

Then your statement is simply:

_Static_assert(state1|mode1 == 5, "Unexpected change of bitflags");

Sima

Answer 11

#define MODE0 0
#define MODE1 1
#define MODE2 2

#define STATE0 0
#define STATE1 4
#define STATE2 8

set_register(STATE1|STATE1); //set_register(5);
#if (!(5==(STATE1|STATE1))) //MY_ASSERT(5==(state1|mode1)); note the !
#error "error blah blah"
#endif

This is not as elegant as a one line MY_ASSERT(expr) solution. You could use sed, awk, or m4 macro processor before compiling your C code to generate the DEBUG code expansion of MY_ASSERT(expr) to multiple lines or NODEBUG code which removes them for production.

Obie