@safe code should prevent null dereferences

[Elronnd]

I've been meaning to make a post about this for a while, and the 
other thread on the topic reminded me.

D does not attempt to prevent null pointer dereferences in @safe 
code.  This is predicated on the assumption that dereferencing a 
null pointer will always cause a fault, and as such does not 
represent a safety concern.  This assumption is wrong.

There was a somewhat famous bug in the linux kernel caused by the 
compiler assuming that a null dereference would never happen.  
The code looked something like this (see [1] for more details):

struct mystruct {
	int x;
}
void function(struct mystruct *m) {
	// (1)
	int t = m->x;

	// since 'm' was already dereferenced at (1), the compiler 
assumes
	// that there is no way for 'm' to be null here.  So it removes
	// the check and unconditionally executes 'stuff'.
	if (m) {
		stuff;
	}
}

Of course, the zero page was mapped as readable in kernel space.  
So if you passed NULL into the function, bad things would happen.

The bug was fixed, but linux is also now compiled with a special 
compiler flag telling the compiler to assume that null pointers 
may be accessible[2].  As noted in the commit message, that bug 
was not an isolated one, and there have been other cases when 
null pointer checks were incorrectly removed.

For d, the situation is even worse than in c.  In c, it is 
undefined behaviour to dereference any invalid pointer; but in d 
null pointers are singled out and it is only unspecified what 
happens when they are accessed[3].  The specification is clearly 
aware that null pointers are accessible, but no allowance for 
this is made in the sections on @safe[4][5].  It would be very 
easy to cause memory corruption or leak information through a 
null pointer access.

Most d code runs in userspace, but it clearly has ring0 
aspirations.  There was a talk[6] at dconf last year about using 
d in the linux kernel.  There have also been a few experimental 
kernels implemented in pure d, most notably powernex[7]; and 
there has been interest in getting d to run on microcontrollers 
(this is the only really legitimate use for betterc).

If safeD wants to be useful for kernels, it needs a way to 
prevent null pointer dereferences.

-----------------------------------------------------------------------

References:

1. https://lwn.net/Articles/342330/

2. 
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a3ca86aea507

3. https://dlang.org/spec/arrays.html#pointers

4. https://dlang.org/spec/memory-safe-d.html

5. https://dlang.org/spec/function.html#function-safety

6. https://www.youtube.com/watch?v=weRSwbZtKu0

7. https://github.com/PowerNex/PowerNex