Joel Winstead CS201j: Engineering Software University of Virginia Computer Science Lecture 16: Pointers and Memory Management

Halloween 2002CS 201J Fall Menu Null Pointers in C Memory Management in C Phylogeny Revisited

Halloween 2002CS 201J Fall Pointers in C Pointers are similar to object references in Java Assigning a pointer has sharing semantics int i = 37; int *p = malloc(sizeof(int)); int *q; q = p; *p = 7; i p q 7 37

Halloween 2002CS 201J Fall Null Pointers What if a pointer doesn’t point to anything? void main(String argv[]) { Integer i = null; System.out.println(i.intValue()); } int main(int argc,char *argv[]) { int *i = NULL; printf(“i is %d\n”,*i); }

Halloween 2002CS 201J Fall Null Pointers What if a pointer doesn’t point to anything? void main(String argv[]) { Integer i = null; System.out.println(i.intValue()); } int main(int argc,char *argv[]) { int *i = NULL; printf(“i is %d\n”,*i); } Exception in thread “main” java.lang.NullPointerException at nullref.main(nullref.java:7) Behavior is undefined!

Halloween 2002CS 201J Fall Following Null Pointers The program may crash immediately The program may produce corrupted output The program may corrupt data somewhere else in the program’s memory –This results in a difficult-to-find bug The program could mail itself to everyone in your address book and cause your computer to self-destruct –The C standard does not define what should happen, so absolutely anything is legal!

Halloween 2002CS 201J Fall Splint Annotations for Pointers –A pointer guaranteed not to be null –A pointer that might be null FILE * char *filename,char *mode);

Halloween 2002CS 201J Fall Splint Warnings Splint reports a warning if: –The program dereferences a pointer without checking first –The program assigns a pointer to a variable –The program passes a pointer to a function expecting a pointer

Halloween 2002CS 201J Fall Example char firstChar( char *s) { return *s; } > splint null.c Splint null.c: (in function firstChar) null.c:3:11: Dereference of possibly null pointer s: *s null.c:1:35: Storage s may become null Finished checking code warning found

Halloween 2002CS 201J Fall Correcting the Problem char firstChar( char *s) { if (s == NULL) { fprintf(stderr,”s is null in firstChar\n”); exit(EXIT_FAILURE); } else { return *s; }

Halloween 2002CS 201J Fall Another Solution char firstChar( char *s) { return *s; }

Memory Management in C

Halloween 2002CS 201J Fall malloc Memory in C is allocated using the malloc function –This is similar in some ways to Java’s new operator We use sizeof to determine how much memory to allocate int *i = malloc(sizeof(int)); char *s = malloc(sizeof(char)*100); Species s = malloc(sizeof(*s));

Halloween 2002CS 201J Fall Creating Objects in C Species Species_new(const char *name,const char *genome) { Species result = malloc(sizeof(*result)); result->name = name; result->genome = genome; return result; }

Halloween 2002CS 201J Fall Memory Leaks for (i = 0; i < 10; i++) { int *p = malloc(sizeof(*p)); *p = i*i; printf(“%d squared is %d\n”,i,*p); } p i0 0

Halloween 2002CS 201J Fall Memory Leaks for (i = 0; i < 10; i++) { int *p = malloc(sizeof(*p)); *p = i*i; printf(“%d squared is %d\n”,i,*p); } p i1 0 1

Halloween 2002CS 201J Fall Memory Leaks for (i = 0; i < 10; i++) { int *p = malloc(sizeof(*p)); *p = i*i; printf(“%d squared is %d\n”,i,*p); } p i

Halloween 2002CS 201J Fall Detecting Memory Leaks for (i = 0; i < 10; i++) { int *p = malloc(sizeof(*p)); *p = i*i; printf(“%d squared is %d\n”,i,*p); } > splint leak.c Splint leak.c:11:6 Fresh storage p not released before scope exit A memory leak has been detected. Storage allocated locally is not released before the last reference to it is lost.

Halloween 2002CS 201J Fall free Java’s garbage collector automatically reclaims memory C has no garbage collector We must release memory explicitly using the free function

Halloween 2002CS 201J Fall Releasing Memory for (i = 0; i < 10; i++) { int *p = malloc(sizeof(*p)); *p = i*i; printf(“%d squared is %d\n”,i,*p); free(p); } p i9 81

Halloween 2002CS 201J Fall Releasing Memory Too Soon int f() { int *i = malloc(sizeof(*i)); *i = 42; free(i); printf(“i is %d\n”,*i); } The result is undefined!

Halloween 2002CS 201J Fall Avoiding Memory Leaks Whenever we allocate memory, there is a responsibility to release it We can specify what part of the code has this responsibility by using annotations. Code that uses an pointer must free the storage, or pass the responsibility somewhere else If an pointer is lost of goes out of scope, Splint warns of a possible memory leak.

Halloween 2002CS 201J Fall Why does Splint detect the error? for (i = 0; i < 10; i++) { int *p = malloc(sizeof(*p)); *p = i*i; printf(“%d squared is %d\n”,i,*p); } > splint leak.c Splint leak.c:11:6 Fresh storage p not released before scope exit A memory leak has been detected. Storage allocated locally is not released before the last reference to it is lost.

Halloween 2002CS 201J Fall Annotating Functions We can annotate functions to indicate how they delegate the responsibility to release memory: void * malloc(size_t bytes); void free(void * ptr); With these annotations, Splint knows: –Any call to malloc might return NULL –The caller of malloc is responsible for releasing the allocated memory.

Halloween 2002CS 201J Fall Annotating Functions We can annotate functions to indicate how they delegate the responsibility to release memory: void * malloc(size_t bytes); void void * ptr); With these annotations, Splint knows: –Any call to malloc might return NULL –The caller of malloc is responsible for releasing the allocated memory. –free will take responsibility for releasing an pointer.

Halloween 2002CS 201J Fall Annotating Constructors Species Species_new(const char *name, const char *genome) { Species s = malloc(sizeof(*s)); s->name = name; s->genome = genome; return s; }

Halloween 2002CS 201J Fall Annotating Constructors Species Species_new(const char *name, const char *genome) { Species s = malloc(sizeof(*s)); s->name = name; s->genome = genome; return s; }

Halloween 2002CS 201J Fall Annotating Constructors Species Species_new(const char *name, const char *genome) { Species s = malloc(sizeof(*s)); if (s == NULL) { fprintf(stderr,”Out of memory in Species_new.\n”); exit(EXIT_FAILURE); } s->name = name; s->genome = genome; return s; }

Halloween 2002CS 201J Fall Annotating Constructors Species const char *name, const char *genome) { Species s = malloc(sizeof(*s)); if (s == NULL) { fprintf(stderr,”Out of memory in Species_new.\n”); exit(EXIT_FAILURE); } s->name = name; s->genome = genome; return s; }

Halloween 2002CS 201J Fall Dependent and Owned Sometimes we need to have more than one pointer to the same object However, we want to be able to check that the object is released –Why can’t we use in this situation? references indicate an obligation to release the memory before the reference is lost references refer to objects that are by some other pointer

Halloween 2002CS 201J Fall Use of Dependent SpeciesSet holds references to Species objects We might want to put a single Species object into more than one SpeciesSet Therefore, SpeciesSet cannot take responsibility for releasing the Species object Some other reference must take responsibility for releasing the Species object void SpeciesSet_insert(SpeciesSet set, Species species);

Halloween 2002CS 201J Fall PS6: Phylogeny Revisited We have rewritten the Phylogeny program from Problem Set 4 in C The C version of the program has several errors: –Null pointer dereferences –Memory leaks –Abstraction violations Your job is to use Splint annotations to find and fix them

Halloween 2002CS 201J Fall Charge The C compiler does not check for null pointer dereferences or memory leaks Splint can catch many of these errors if the program is annotated correctly PS5: Due Today PS6: Use C and Splint (Phylogeny Revisited)