Implement null dereference check #22040

rikkimax · 2025-10-28T09:16:42Z

Approved work: https://forum.dlang.org/post/mwffryejcmqyolmweaps@forum.dlang.org

Currently turned on to see what the CI does.

Will request Walter to review once I'm happy with CI.

Heavily inspired by OpenD with thanks to @adamdruppe.

EDIT: Special thanks to @limepoutine for helping to get both function pointers and delegate function pointers to be null checked!

dlang-bot · 2025-10-28T09:16:45Z

Thanks for your pull request and interest in making D better, @rikkimax! We are looking forward to reviewing it, and you should be hearing from a maintainer soon.
Please verify that your PR follows this checklist:

My PR is fully covered with tests (you can see the coverage diff by visiting the details link of the codecov check)
My PR is as minimal as possible (smaller, focused PRs are easier to review than big ones)
I have provided a detailed rationale explaining my changes
New or modified functions have Ddoc comments (with Params: and Returns:)

Please see CONTRIBUTING.md for more information.

If you have addressed all reviews or aren't sure how to proceed, don't hesitate to ping us with a simple comment.

Bugzilla references

Your PR doesn't reference any Bugzilla issue.

If your PR contains non-trivial changes, please reference a Bugzilla issue or create a manual changelog.

Testing this PR locally

If you don't have a local development environment setup, you can use Digger to test this PR:

dub run digger -- build "master + dmd#22040"

rikkimax · 2025-10-28T10:23:51Z

Fun fact, lazy parameters can have a null object. Oh well we just can't check for null on the object of a delegate prior to a call.

nordlow · 2025-10-28T13:56:57Z

So a NullPointerError is unrecoverable, right?

rikkimax · 2025-10-28T13:57:31Z

So I take it a NullPointerError unrecoverable, right?

It is an Error. Something has to die in response, like all Error's.

nordlow · 2025-10-28T14:00:20Z

Is the plan to have -check=nullderef=on be on my default or optionally in debug mode or something else?

adamdruppe · 2025-10-28T14:00:42Z

There's no technical reason why you can't recover from a NullPointerError in general, though you may choose not to as it can indicate you don't understand program state.

rikkimax · 2025-10-28T14:01:16Z

Will using -check=nullderef=on affect performance?

Possibly.

I intend to wire up the fast DFA engine to elide the checks. But can't do it until what does exist is proven to work.

adamdruppe · 2025-10-28T14:03:05Z

The performance impact is very small. The cpu's branch predictor handles it well and ldc's code generator is decent at removing dead checks and arranging the code blocks in a cache-friendly manner. (dmd's isn't so good but ldc is known to optimize better than dmd in many ways)

nordlow · 2025-10-29T09:54:34Z

So a single unittest in libdparse at

https://buildkite.com/dlang/dmd/builds/43787/steps/canvas?sid=019a2b1c-9d02-4993-b9df-dfb58a18783d

fails buildkite/dmd.

The libdparse/test/fail_files/killer2.d contains

unittest
{
version (53056)[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[
union {}
Klse
gosh ÿ� 'A+ SPL : tape];
		}
	}
}

. Could the CI failure be caused by the compiler existing with error code other than what the tests expects? I also wonder how these seemingly random test cases where deduced...

rikkimax · 2025-10-29T10:35:11Z

I'm aware, but the problem will be in the compiled libdparse, and without compiling it locally I won't be figuring out which emitted hook did it.

As far as I know this could be related to XMM intrinsics, and since those are more of a known problem they're up first.

rikkimax · 2025-12-10T08:24:25Z

CI has done the correct, thing.

Anything else you need @WalterBright before I turn it off and take it out of draft?

changelog/dmd.nullderefcheck.dd

WalterBright · 2025-12-11T08:27:25Z

changelog/dmd.nullderefcheck.dd

+This can be enabled by using ``-check=nullderef=on``
+What happens may be customized by the ``-checkaction`` switch and by setting a new handler in ``core.exception``.
+
+Due to issues in dmd's backend, not all pointer dereferences are guaranteed to get a check.


What does that mean?

Disabling of intrinsics and their arguments.

I don't particularly want to explain this in a changelog as it won't impact everyone, but it does need acknowledgment that dmd specifically can't check all pointer dereferences.

I can disable the intrinsic check in a follow-up PR for you to look into.

What do the intrinsics have to do with null pointer checking?

Ideally nothing.

If I remove the counter check the backend errors when intrinsics are used.

WalterBright · 2025-12-11T08:27:46Z

changelog/dmd.nullderefcheck.dd

+A new check is implemented for when a null dereference occurs.
+
+This can be enabled by using ``-check=nullderef=on``
+What happens may be customized by the ``-checkaction`` switch and by setting a new handler in ``core.exception``.


No mention of what the default behavior is.

Could add a brief discussion of why one would want this feature.

compiler/src/dmd/astenums.d

rikkimax · 2025-12-11T13:46:38Z

I've turned this off now, will need confirmation that @WalterBright doesn't want any more changes.

WalterBright · 2026-01-09T08:34:02Z

@rikkimax can you please resolve the conflicts? Thanks!

rikkimax · 2026-01-09T08:44:07Z

@rikkimax can you please resolve the conflicts? Thanks!

Can do later on, is your feedback handled?

WalterBright · 2026-01-10T04:13:52Z

Approved work: https://forum.dlang.org/post/mwffryejcmqyolmweaps@forum.dlang.org

What is the relationship between this PR and the opening comment?

rikkimax · 2026-01-10T04:16:09Z

Approved work: https://forum.dlang.org/post/mwffryejcmqyolmweaps@forum.dlang.org

What is the relationship between this PR and the opening comment?

Remember the error handling meeting we had for exceptions?

This came up and was approved work.

Null deref read barrier aka null check. CLI switch, throw Error with a hook function. Noted that this is useful for platforms like web assembly and debugging CI's where no stack trace is present.

WalterBright · 2026-01-10T04:21:26Z

compiler/src/dmd/cli.d

  =invariant[=[on|off]] Class/struct invariants
  =out[=[on|off]]       Out contracts
  =switch[=[on|off]]    Final switch failure checking
+  =nullderef[=[on|off]] Null dereference error


=safeonly ?

None of the others support it. I'm matching them.

WalterBright · 2026-01-10T04:22:51Z

compiler/src/dmd/dfa/fast/report.d

     * when the scope exits.
     */
-    void onEndOfScope(FuncDeclaration fd, ref Loc loc)
+    void onEndOfScope(FuncDeclaration fd, ref const(Loc) loc)


ref const Loc loc will suffice

Applying to elsewhere in module where I've done it.

compiler/src/dmd/funcsem.d

WalterBright · 2026-01-10T04:25:43Z

compiler/src/dmd/funcsem.d

+        case CHECKENABLE.on:
+            return true;
+        case CHECKENABLE.safeonly:
+            {


unnecessary { }

I prefer adding the extra scope to make it clearer. Removing.

WalterBright · 2026-01-10T04:27:34Z

compiler/src/dmd/glue/e2ir.d

-        ec = el_same(ethis);
-        ethis = el_una(target.isX86_64 || target.isAArch64 ? OP128_64 : OP64_32, TYnptr, ethis); // get this
-        ec = array_toPtr(t, ec);                // get funcptr
+


why removed?

Not removed, slightly moved around.

https://github.com/dlang/dmd/pull/22040/files#diff-54719c55eec4a6cfe3b7b7f4b5289d0b5a0b9d41e8589a023bba4d68921f8be0R5505

This was the cleanest I could come up with, which resulted in the least memory allocations.

WalterBright · 2026-01-10T04:31:31Z

compiler/src/dmd/mars.d

                params.useInvariants    = CHECKENABLE.off;
                params.useOut           = CHECKENABLE.off;
                params.useSwitchError   = CHECKENABLE.off;
+                params.useNullCheck     = CHECKENABLE.off;


what happened to =safeonly ?

I have no idea, I don't remove such things.

the nullcheck has three settings - on|off|safeonly

There is nothing to enable safeonly for -check.

dmd/compiler/src/dmd/mars.d

Line 746 in 72eac87

static bool check(const(char)[] checkarg, string name, ref CHECKENABLE ce)

I haven't got an opinion about it being added. But right now, it doesn't exist for any of the checks.

WalterBright · 2026-01-10T05:20:57Z

compiler/src/dmd/funcsem.d

+            return false;
+        case CHECKENABLE.on:
+            return true;
+        case CHECKENABLE.safeonly:


Here is where the null dereference check is enabled for safeonly. But there is no way to set it to safeonly.

Indeed. Seems to be an unused enum member for all the checks.

Do you think it would be reasonable to add safeonly for the null check?

I think safeonly should be readded for all of the check's in one go.

A separate PR.

It's probably just

dmd/compiler/src/dmd/mars.d

Line 763 in 72eac87

}

needs an extra else if, then update all the comments/docs. As well as test cases.

rikkimax force-pushed the nullderef-barrier branch 5 times, most recently from 1ca48e7 to c0d2c45 Compare October 28, 2025 10:23

rikkimax force-pushed the nullderef-barrier branch 13 times, most recently from 86f1e3b to 05957b2 Compare October 28, 2025 13:46

rikkimax force-pushed the nullderef-barrier branch from 05957b2 to 7f74a82 Compare October 28, 2025 13:57

rikkimax force-pushed the nullderef-barrier branch from 7f74a82 to 0686734 Compare October 29, 2025 10:43

rikkimax force-pushed the nullderef-barrier branch from 47116b7 to 8db71ae Compare December 10, 2025 06:22

WalterBright reviewed Dec 11, 2025

View reviewed changes

changelog/dmd.nullderefcheck.dd Outdated Show resolved Hide resolved

WalterBright reviewed Dec 11, 2025

View reviewed changes

changelog/dmd.nullderefcheck.dd Outdated Show resolved Hide resolved

WalterBright reviewed Dec 11, 2025

View reviewed changes

compiler/src/dmd/astenums.d Outdated Show resolved Hide resolved

WalterBright reviewed Dec 11, 2025

View reviewed changes

compiler/src/dmd/astenums.d Outdated Show resolved Hide resolved

rikkimax force-pushed the nullderef-barrier branch 2 times, most recently from 7e31fd7 to 773864e Compare December 11, 2025 13:44

rikkimax marked this pull request as ready for review December 11, 2025 13:46

rikkimax requested a review from ibuclaw as a code owner December 11, 2025 13:46

rikkimax force-pushed the nullderef-barrier branch from 773864e to cec2f8d Compare January 10, 2026 00:24

WalterBright reviewed Jan 10, 2026

View reviewed changes

compiler/src/dmd/funcsem.d Outdated Show resolved Hide resolved

WalterBright reviewed Jan 10, 2026

View reviewed changes

rikkimax force-pushed the nullderef-barrier branch from cec2f8d to 6c8cefc Compare January 10, 2026 04:58

WalterBright reviewed Jan 10, 2026

View reviewed changes

Implement null dereference check

7d3b300

rikkimax force-pushed the nullderef-barrier branch from 6c8cefc to 7d3b300 Compare January 10, 2026 05:25

WalterBright approved these changes Jan 10, 2026

View reviewed changes

thewilsonator merged commit 2fd2eba into dlang:master Jan 21, 2026
54 of 55 checks passed

Uh oh!

Implement null dereference check #22040

Implement null dereference check #22040

Uh oh!

Conversation

rikkimax commented Oct 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dlang-bot commented Oct 28, 2025

Bugzilla references

Testing this PR locally

Uh oh!

rikkimax commented Oct 28, 2025

Uh oh!

nordlow commented Oct 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rikkimax commented Oct 28, 2025

Uh oh!

nordlow commented Oct 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

adamdruppe commented Oct 28, 2025

Uh oh!

rikkimax commented Oct 28, 2025

Uh oh!

adamdruppe commented Oct 28, 2025

Uh oh!

nordlow commented Oct 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rikkimax commented Oct 29, 2025

Uh oh!

rikkimax commented Dec 10, 2025

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

rikkimax commented Dec 11, 2025

Uh oh!

WalterBright commented Jan 9, 2026

Uh oh!

rikkimax commented Jan 9, 2026

Uh oh!

WalterBright commented Jan 10, 2026

Uh oh!

rikkimax commented Jan 10, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rikkimax commented Oct 28, 2025 •

edited

Loading

nordlow commented Oct 28, 2025 •

edited

Loading

nordlow commented Oct 28, 2025 •

edited

Loading

nordlow commented Oct 29, 2025 •

edited

Loading