The grammar below is the C syntax from [K&R,A13] modified to show the syntax of syntactic comments. Only productions effected by LCLint annotations are shown. In the annotations, the @ represents the comment marker char, set by -commentchar (default is @).
direct-declarator:
direct-declarator (parameter-type-list_opt) globals_opt modifies_opt | direct-declarator (identifier-list_opt) globals_opt modifies_opt
globals: (Section 4.2)
/*@globals globitem,+ ;_opt @*/ | /*@globals declaration-list_opt ;_opt @*/globitem:
globannot* identifier | internalState | systemState
globannot: undef | killed
modifies: (Section 4.1)
/*@modifies moditem,+;_opt @*/ | /*@modifies nothing ;_opt @*/ | /*@*/ (Abbreviation for no globals and modifies nothing.)
moditem:
expression | internalState | systemState
The globals and modifies clauses for an iterator are the same as those for a function, except they are not enclosed by a comment, since the iterator is already a comment.
direct-declarator:
/*@iter identifier (parameter-type-list_opt) globals_opt modifies_opt @*/
external-declaration:
/*@constant declaration ;_opt @*/
Alternate Types (Section 8.2.2)
Alternate types may be used in the type specification of parameters and return values.
extended-type:
type-specifier alt-type_opt
alt-type:
/*@alt basic-type,+ @*/
General annotations appear after storage-class-specifiers and before type-specifiers. Multiple annotations may be used in any order. Here, annotations are without the surrounding comment. In a declaration, the annotation would be surrounded by /*@ and @*/. In a globals or modifies clause or iterator or constant declaration, no surrounding comment would be used since they are within a comment.
Type Definitions (Section 3)
A type definition may use any either abstract or concrete, either mutable or immutable, and refcounted. Only a pointer to a struct may be declared with refcounted. Mutability annotations may not be used with concrete types since concrete types inherit their mutability from the actual type.
Type is abstract (representation is hidden from clients).
Type is concrete (representation is visible to clients).
Instances of the type cannot change value. (Section 3.2)
Instances of the type can change value. (Section 3.2)
Reference counted type. (Section 5.4)
Global Variables (Section 4.2.1)
One check annotation may be used on a global or file-static variable declaration.
Weakest checking for global use.
Check modification by not use of global.
Check use and modification of global.
Check use of global, even in functions with no global list.
A reference to externally-owned storage. (Section 5.2.2)
A parameter that is kept by the called function. The caller may use the storage after the call, but the called function is responsible for making sure it is deallocated. (Section 5.2.4)
A refcounted parameter. This reference is killed by the call. (Section 5.4)
A unshared reference. Associated memory must be released before reference is lost. (Section 5.2)
Storage may be shared by dependent references, but associated memory must be released before this reference is lost. (Section 5.2.2)
Shared reference that is never deallocated. (Section 5.2.5)
A temporary parameter. May not be released, and new aliases to it may not be created. (Section 5.2.2)
Aliasing (Section 6)
Both alias annotations may be used on a parameter declaration.
Parameter that may not be aliased by any other reference visible to the function. (Section 6.1.1)
Parameter that may be aliased by the return value. (Section 6.1.2)
Exposure (Section 6.2)
Reference that cannot be modified. (Section 6.2.1)
Exposed reference to storage in another object. (Section 6.2.1)
Definition State (Section 7.1)
Storage reachable from reference need not be defined.
All storage reachable from reference must be defined.
Partially defined. A structure may have undefined fields. No errors reported when fields are used.
Relax definition checking. No errors when reference is not defined, or when it is used.
These annotations may only be used in globals lists. Both annotations may be used for the same variable, to mean the variable is undefined before and after the call.
Variable is undefined before the call.
Variable is undefined after the call.
Null Predicates (Section 7.2.1)
A null predicate annotation may be used of the return value of a function returning a boolean type, taking a possibly-null pointer for its first argument.
If result is TRUE, first parameter is NULL.
If result is TRUE, first parameter is not NULL.
The exits, mayexit and neverexits annotations may be used on any function. The trueexit and falseexit annotations may only be used on functions whose first argument is a boolean.
exits
Function never returns.
mayexit
Function may or may not return.
trueexit
Function does not return if first parameter is TRUE.
falseexit
Function does not return if first parameter if FALSE.
neverexit
Function always returns.
Side-Effects (Section 8.2.1)
Corresponding actual parameter has no side effects.
These annotations can be used on a declaration to control unused or undefined error reporting.
Identifier need not be used (no unused errors reported.) (Section 10.4)
Identifier is defined externally (no undefined error reported.) (Section 10.5)
Case
These annotations are used before a break or continue statement.
Break is breaking an inner loop or switch.
Continue is continuing an inner loop.
This annotation is used before a statement to prevent unreachable code errors.
Special Functions (Apppendix E)
These annotations are used immediately before a function declaration.
Check variable arguments like printf library function.
Check variable arguments like scanf library function.
Next: Appendix E. Control Comments
Contents