| Message ID | patch-1.1-f225b78e01-20210608T104454Z-avarab@gmail.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 338abb0f045b87df5e628543800e74dec0e72cdf |
| Headers | show |
| Series | [v2] builtins + test helpers: use return instead of exit() in cmd_* | expand |
Ævar Arnfjörð Bjarmason <avarab@gmail.com> writes: > Change various cmd_* functions that claim no return an "int" to use s/no return/to return/ > "return" instead of exit() to indicate an exit code. These were not > marked with NORETURN, Up to this point, it is well written. > and by directly exit()-ing we'll skip the > cleanup git.c would otherwise do (e.g. closing fd's, erroring if we > can't). See run_builtin() in git.c. But I think this is a hyperbole. File descritors are closed when we exit without git.c's help, thank-you-very-much ;-), and if we do have clean-ups that are truly important, we would have arranged them to happen in the atexit handler, so it is not a crime for functions called from the subcommand dispatchers to exit themselves (as long as they exit sensibly, e.g. without doing nonsense like exit(-1)). It nevertheless is a good idea because it encourages good code hygiene, just like marking with NORETURN if the function must exit. Selling this change as if it were a correctness fix (i.e. we were exiting and missed these important clean-ups that the caller wanted to do after we return) is misleading. > In the case of shell.c and sh-i18n--envsubst.c this was the result of > an incomplete migration to using a cmd_main() in 3f2e2297b9 (add an > extra level of indirection to main(), 2016-07-01). > > This was spotted by SunCC 12.5 on Solaris 10 (gcc210 on the gccfarm). > > Signed-off-by: Ævar Arnfjörð Bjarmason <avarab@gmail.com> > --- > > Clarified the commit message, and made the same s/exit/return/g change > in shell.c and sh-i18n--envsubst.c. I also missed an "exit(2)" in a > brach in builtin/merge-ours.c. The range diff looks good to me. Thanks.
On Wed, Jun 09 2021, Junio C Hamano wrote: > Ævar Arnfjörð Bjarmason <avarab@gmail.com> writes: > >> Change various cmd_* functions that claim no return an "int" to use > > s/no return/to return/ > >> "return" instead of exit() to indicate an exit code. These were not >> marked with NORETURN, > > Up to this point, it is well written. > >> and by directly exit()-ing we'll skip the >> cleanup git.c would otherwise do (e.g. closing fd's, erroring if we >> can't). See run_builtin() in git.c. > > But I think this is a hyperbole. File descritors are closed when we > exit without git.c's help, thank-you-very-much ;-), [...] Closed yes, but not ", erroring if we can't". That's referring to the behavior in git.c added in g0f157315a1 (Check for IO errors after running a command, 2007-06-24) and 0227f9887b (git: Try a bit harder not to lose errno in stdio, 2007-06-30). That strictness isn't something you get by default from an exiting C program, which is why we're explicitly checking and calling die_errno() in run_builtin(). I wasn't aiming for hyperbole, just accurately describing the implications of skipping the code we'd skip before this patch. > [...]and if we do > have clean-ups that are truly important, we would have arranged them > to happen in the atexit handler, so it is not a crime for functions > called from the subcommand dispatchers to exit themselves (as long > as they exit sensibly, e.g. without doing nonsense like exit(-1)). I'm not quite sure what "clean-ups that are truly important" is meant to get at here. I was just describing the cleanups in git.c that we were skipping, which aren't implemened as atexit handlers. But no, those couldn't be done in atexit handlers as they call die_errno() or BUG(), and both of them want to modify the exit code. The atexit() handlers cannot modify the exit code (both per the C standard, and POSIX). That particular edge was last last discussed on-list in my https://lore.kernel.org/git/20210202020001.31601-6-avarab@gmail.com/; when the whole "should SIGPIPE from the pager be ignored" topic came up. So it's really the opposite of what you're saying. If you have cleanups that are truly important, i.e. so important that you'd like to notify the user with a non-zero exit code if they fail, you *don't* want them in an atexit handler. That won't work. > It nevertheless is a good idea because it encourages good code > hygiene, just like marking with NORETURN if the function must exit. > Selling this change as if it were a correctness fix (i.e. we were > exiting and missed these important clean-ups that the caller wanted > to do after we return) is misleading. Before this patch: $ git ls-tree HEAD | git mktree >/dev/full; echo $? 0 After: $ git ls-tree HEAD | git mktree >/dev/full; echo $? fatal: unknown write failure on standard output 128 So yes, it's a correctness fix, and you can't do that in an atexit handler, at least not portably. You might find that if you try it that it works perfectly fine. But that's because e.g. glibc does non-standard shenanigans to make it work, but it's not portable behavior. See e.g. https://wiki.musl-libc.org/functional-differences-from-glibc.html#Re_entrancy_of_exit That page suggests that glibc's behavior might be an accident, but it's not. They explicitly support that non-standard behavior of an atexit handler munging the exit code. See their implementation & comments: https://github.com/bminor/glibc/blob/master/stdlib/exit.c
Ævar Arnfjörð Bjarmason <avarab@gmail.com> writes: > So it's really the opposite of what you're saying. If you have cleanups > that are truly important, i.e. so important that you'd like to notify > the user with a non-zero exit code if they fail, you *don't* want them > in an atexit handler. That won't work. Ah, OK. What I had in mind was things like removing the directory "clone" attempted to create and populate, removing temporary files, etc. when a function that is not marked as NORETURN calls die(), by the atexit handler. But you're right. We leave a final clean-up for normal returns (i.e. when cmd_foo() intends to return or exit with 0) to be done to the caller that is git.::run_builtin(). Thanks.
diff --git a/builtin/difftool.c b/builtin/difftool.c index 89334b77fb..6a9242a803 100644 --- a/builtin/difftool.c +++ b/builtin/difftool.c @@ -675,7 +675,7 @@ static int run_file_diff(int prompt, const char *prefix, "GIT_PAGER=", "GIT_EXTERNAL_DIFF=git-difftool--helper", NULL, NULL }; - int ret = 0, i; + int i; if (prompt > 0) env[2] = "GIT_DIFFTOOL_PROMPT=true"; @@ -686,8 +686,7 @@ static int run_file_diff(int prompt, const char *prefix, strvec_push(&args, "diff"); for (i = 0; i < argc; i++) strvec_push(&args, argv[i]); - ret = run_command_v_opt_cd_env(args.v, RUN_GIT_CMD, prefix, env); - exit(ret); + return run_command_v_opt_cd_env(args.v, RUN_GIT_CMD, prefix, env); } int cmd_difftool(int argc, const char **argv, const char *prefix) diff --git a/builtin/merge-ours.c b/builtin/merge-ours.c index 4594507420..3583cff71c 100644 --- a/builtin/merge-ours.c +++ b/builtin/merge-ours.c @@ -28,6 +28,6 @@ int cmd_merge_ours(int argc, const char **argv, const char *prefix) if (read_cache() < 0) die_errno("read_cache failed"); if (index_differs_from(the_repository, "HEAD", NULL, 0)) - exit(2); - exit(0); + return 2; + return 0; } diff --git a/builtin/mktree.c b/builtin/mktree.c index 891991b00d..ae78ca1c02 100644 --- a/builtin/mktree.c +++ b/builtin/mktree.c @@ -189,5 +189,5 @@ int cmd_mktree(int ac, const char **av, const char *prefix) used=0; /* reset tree entry buffer for re-use in batch mode */ } strbuf_release(&sb); - exit(0); + return 0; } diff --git a/sh-i18n--envsubst.c b/sh-i18n--envsubst.c index e7430b9aa8..6cd307ac2c 100644 --- a/sh-i18n--envsubst.c +++ b/sh-i18n--envsubst.c @@ -104,12 +104,12 @@ cmd_main (int argc, const char *argv[]) if (ferror (stderr) || fflush (stderr)) { fclose (stderr); - exit (EXIT_FAILURE); + return (EXIT_FAILURE); } if (fclose (stderr) && errno != EBADF) - exit (EXIT_FAILURE); + return (EXIT_FAILURE); - exit (EXIT_SUCCESS); + return (EXIT_SUCCESS); } /* Parse the string and invoke the callback each time a $VARIABLE or diff --git a/shell.c b/shell.c index cef7ffdc9e..811e13b9c9 100644 --- a/shell.c +++ b/shell.c @@ -177,7 +177,7 @@ int cmd_main(int argc, const char **argv) default: continue; } - exit(cmd->exec(cmd->name, arg)); + return cmd->exec(cmd->name, arg); } cd_to_homedir(); diff --git a/t/helper/test-hash-speed.c b/t/helper/test-hash-speed.c index 432233c7f0..f40d9ad0c2 100644 --- a/t/helper/test-hash-speed.c +++ b/t/helper/test-hash-speed.c @@ -57,5 +57,5 @@ int cmd__hash_speed(int ac, const char **av) free(p); } - exit(0); + return 0; } diff --git a/t/helper/test-hash.c b/t/helper/test-hash.c index 0a31de66f3..261c545b9d 100644 --- a/t/helper/test-hash.c +++ b/t/helper/test-hash.c @@ -54,5 +54,5 @@ int cmd_hash_impl(int ac, const char **av, int algo) fwrite(hash, 1, algop->rawsz, stdout); else puts(hash_to_hex_algop(hash, algop)); - exit(0); + return 0; } diff --git a/t/helper/test-match-trees.c b/t/helper/test-match-trees.c index b9fd427571..4079fdee06 100644 --- a/t/helper/test-match-trees.c +++ b/t/helper/test-match-trees.c @@ -23,5 +23,5 @@ int cmd__match_trees(int ac, const char **av) shift_tree(the_repository, &one->object.oid, &two->object.oid, &shifted, -1); printf("shifted: %s\n", oid_to_hex(&shifted)); - exit(0); + return 0; } diff --git a/t/helper/test-reach.c b/t/helper/test-reach.c index cda804ed79..2f65c7f6a5 100644 --- a/t/helper/test-reach.c +++ b/t/helper/test-reach.c @@ -166,5 +166,5 @@ int cmd__reach(int ac, const char **av) print_sorted_commit_ids(list); } - exit(0); + return 0; }