Re: [PATCH 0/1] Add returns_twice attribute to setjmp()

On Thu, Oct 2, 2025 at 11:43 AM Richard Earnshaw (lists) <
[email protected]> wrote:

> On 30/09/2025 15:49, Joel Sherrill wrote:
> > Hi
> >
> > This patch set cover letter is longer than usual because even though
> > the change is small, the rationale for the change is complicated.
> >
> > This patch adds the "returns_twice" attribute to setjmp(). This attribute
> > is related to the processing of -Wclobbered. -Wclobbered is enabled
> > as part of -Wextra and documented as follows:
> >
> > '-Wclobbered'
> >      Warn for variables that might be changed by 'longjmp' or 'vfork'.
> >      This warning is also enabled by '-Wextra'.
> >
> > I believe vfork() probably also needs the "returns_twice" attribute but
> > that function is not supported by RTEMS so I did not have any test cases
> > to verify the change against.
>
> I'm not sure that's the same.  vfork creates two processes, but each
> process returns only once.
>

I only mentioned vfork() because the GCC manual does:

'-Wclobbered'

     Warn for variables that might be changed by 'longjmp' or 'vfork'.
     This warning is also enabled by '-Wextra'.

The POSIX spec for vfork() says it does not copy the entire address space
of the caller which would lead to the same possible issues with local
variables. This also sounds like the used stack contents are not copied so
that is unusable as well.

The *vfork*() function shall be equivalent to *fork*()
<https://pubs.opengroup.org/onlinepubs/009696799/functions/fork.html>,
except that the behavior is undefined if the process created by *vfork*()
either modifies any data other than a variable of type *pid_t* used to
store the return value from *vfork*(), or returns from the function in
which *vfork*() was called, or calls any other function before successfully
calling *_exit*()
<https://pubs.opengroup.org/onlinepubs/009696799/functions/_exit.html> or
one of the *exec
<https://pubs.opengroup.org/onlinepubs/009696799/functions/exec.html>* family
of functions.

 --joel

>
> R.
>
> >
> > The "returns_twice" attribute was introduced in GCC in 2005 by this
> > commit. Given how long ago this was added, I did not see any need to
> > conditionalize the use on GCC version.
> >
> > commit 6e9a32219ba643ca53c2b68822f0eddbf3280503
> > Author: Alexey Neyman <[email protected]>
> > Date:   Tue Mar 8 13:19:40 2005 +0000
> >
> >     re PR c/14411 (Request for setjmp/longjmp attributes)
> >
> >             PR c/14411
> >             * calls.c (flags_from_decl_or_type): Handle eturns_twice'
> attribute.
> >             * c-common.c (handle_returns_twice): New function.
> >             (c_common_attribute_table): Declare eturns_twice' attribute.
> >             * doc/extend.texi: Document eturns_twice' attribute.
> >             * tree.h (DECL_IS_RETURNS_TWICE): New macro.
> >             (struct tree_decl): Add returns_twice_flag.
> >
> >     From-SVN: r96101
> >
> > The "returns_twice" attribute is documented by GCC as follows:
> >
> > returns_twice'
> >      The 'returns_twice' attribute tells the compiler that a function
> >      may return more than one time.  The compiler ensures that all
> >      registers are dead before calling such a function and emits a
> >      warning about the variables that may be clobbered after the second
> >      return from the function.  Examples of such functions are 'setjmp'
> >      and 'vfork'.  The 'longjmp'-like counterpart of such function, if
> >      any, might need to be marked with the 'noreturn' attribute.
> >
> > RTEMS had about 25 -wclobbered warnings across the entire source base.
> > Adding this attribute addressed all but two of the them. We modified
> > both of those cases to address the warning and ensure any variables
> > used were safe from being clobbered.
> >
> > -Wclobbered warns about code where it is hard to see what is wrong.
> > The Linux man page for setjmp() includes this:
> >
> >
> >        The  compiler  may  optimize  variables  into  registers, and
> >        longjmp() may restore the values of other registers in  addi‐
> >        tion to the stack pointer and program counter.  Consequently,
> >        the values of automatic variables  are  unspecified  after  a
> >        call to longjmp() if they meet all the following criteria:
> >
> >        •  they are local to the function that made the corresponding
> >           setjmp() call;
> >
> >        •  their values are changed between the calls to setjmp() and
> >           longjmp(); and
> >
> >        •  they are not declared as volatile.
> >
> >        Analogous remarks apply for siglongjmp().
> > Joel Sherrill (1):
> >   newlib/libc/include/setjmp.h: Add returns_twice attribute to setjmp()
> >
> >  newlib/libc/include/setjmp.h | 7 ++++++-
> >  1 file changed, 6 insertions(+), 1 deletion(-)
> >
>
>