json_view: remove checks that invariants make dead

Branch coverage of the test suite and of 24k mutated inputs showed
these conditions as never taken; each is implied by the code around it:

- view_serializer::write_codepoint<EnsureAscii>(): the only caller
  passes the byte a run of plain output stopped at (a quote, a
  backslash or a control character), so the function is now
  write_escaped(), which writes that byte's escape sequence
- load_image(): `owned_image.empty() || image != owned_image.data()`;
  both callers hand in a fresh document_data, and for load(vector&&)
  the image is owned_image itself
- set_moved(): reserve_moved(); all three callers reserved first or
  have the moved flag set (the documented precondition)
- view_side::string() and json_side::string() in equal(): only used
  after both sides were found to be strings, so they read the string
  directly (and are noexcept)
- number<false>(): the '1'..'9' test after a sign-less dispatch, which
  only happens for a digit
- value_range(): the pre-loop `is_new || off >= size` test, which the
  loop's first pass repeats on the same node

No change in behaviour: a build that aborts on each removed side passes
the test suite and the fuzz corpora.

Signed-off-by: Niels Lohmann <mail@nlohmann.me>

include/nlohmann/detail/iterators/iter_impl.hpp

@@ -108,6 +108,9 @@ class iter_impl // NOLINT(cppcoreguidelines-special-member-functions,hicpp-speci
     {
         JSON_ASSERT(m_object != nullptr);
 
+        // m_it is already value-initialized, so this is not needed for
+        // correctness; it is kept because GCC generates faster loops with it
+        // (iterating a parsed document is 0.5-2.7 % slower without it, #6005)
         if (m_object->is_object())
         {
             m_it.object_iterator = typename object_t::iterator();

include/nlohmann/detail/output/serializer.hpp

@@ -1113,21 +1113,14 @@ class serializer
                 {
                     // the code point is at least 0x60 (smaller ones are handled
                     // above) and is not printable ASCII (which the scanner
-                    // copies): it is DEL (0x7F) under EnsureAscii or a non-ASCII
-                    // character
+                    // copies). Under EnsureAscii it is DEL (0x7F): every
+                    // well-formed multi-byte character is escaped by
+                    // write_u_escapes() above, so decode() only ever accepts a
+                    // single byte here, and nothing of it was buffered
                     if (EnsureAscii)
                     {
                         JSON_ASSERT(codepoint == 0x7F);
-                        if (error_handler == error_handler_t::keep)
-                        {
-                            // this character was buffered as raw bytes below
-                            // in case it turned out to be part of an
-                            // ill-formed sequence (which is kept as is); now
-                            // that it decoded to a well-formed code point,
-                            // undo that and \u-escape it like any other
-                            // character instead
-                            bytes = bytes_after_last_accept;
-                        }
+                        JSON_ASSERT(bytes == bytes_after_last_accept);
                         write_u_escape(bytes, static_cast<std::uint16_t>(codepoint));
                     }
                     else

include/nlohmann/detail/view/builder.hpp

@@ -1174,8 +1174,9 @@ indent_done:
             {
                 ++p;
             }
-            else if (NLOHMANN_VIEW_LIKELY(cur() >= '1' && cur() <= '9'))
+            else if (!negative || NLOHMANN_VIEW_LIKELY(cur() >= '1' && cur() <= '9'))
             {
+                // (without a sign, the dispatch saw a digit)
                 p = skip_digits(p + 1, e);
             }
             else

include/nlohmann/detail/view/compare.hpp

@@ -397,9 +397,9 @@ class view_side
         return m_view.size();
     }
 
-    string_view_t string() const
+    string_view_t string() const noexcept
     {
-        return m_view.get_string();
+        return {m_view.m_doc->str(*m_view.m_node), m_view.m_node->len};
     }
 
     bool boolean() const noexcept
@@ -522,9 +522,9 @@ class json_side
         return m_json->size();
     }
 
-    string_view_t string() const
+    string_view_t string() const noexcept
     {
-        const auto& s = m_json->template get_ref<const typename BasicJsonType::string_t&>();
+        const auto& s = *m_json->template get_ptr<const typename BasicJsonType::string_t*>();
         return string_view_t(s.data(), s.size());
     }
 

include/nlohmann/detail/view/edit_storage.hpp

@@ -158,7 +158,7 @@ inline void set_moved(document_data& d, node* n, node* seq, std::size_t cap)
         e.moved_cap[n->off] = cap;
         return;
     }
-    reserve_moved(d);
+    // every caller has called reserve_moved() (see above), so neither push_back() can throw
     e.moved.push_back(seq);
     e.moved_cap.push_back(cap);
     n->off = static_cast<std::uint32_t>(e.moved.size() - 1);

include/nlohmann/detail/view/errors.hpp

@@ -185,10 +185,6 @@ void value_range(const document_data& d, const node* n, std::size_t& start, std:
         end = p.end;
         return;
     }
-    if ((n->flags & node_flags::is_new) != 0 || n->off >= d.size)
-    {
-        return;
-    }
     // the open brackets: n, then the last element as long as it is a non-empty container
     std::size_t closing = 0;
     std::size_t pos = std::string::npos;

include/nlohmann/detail/view/image.hpp

@@ -787,10 +787,6 @@ inline void load_image(document_data& d, const std::uint8_t* image, std::size_t
     d.edits.reset();
     d.base[2] = nullptr;
     d.owned.clear();
-    if (d.owned_image.empty() || image != d.owned_image.data())
-    {
-        d.owned_image.clear();
-    }
     d.arena.clear();
     d.indexes.clear();
     d.index_slots.clear();

include/nlohmann/detail/view/serializer.hpp

@@ -641,7 +641,7 @@ class view_serializer
             {
                 invalid_utf8(s, n.len); // (the scan stopped at ill-formed UTF-8)
             }
-            write_codepoint<false>(s[i], s + i, 1); // a quote, a backslash, or a control character
+            write_escaped(s[i]); // a quote, a backslash, or a control character
             ++i;
         }
         m_out.put('"');
@@ -1489,8 +1489,9 @@ class view_serializer
         static_cast<void>(dumped);
     } // LCOV_EXCL_LINE (dump() throws: the callers pass only ill-formed UTF-8)
 
-    template<bool EnsureAscii>
-    void write_codepoint(std::uint32_t codepoint, const unsigned char* bytes, std::size_t len)
+    /// write the escape sequence of a quote, a backslash or a control
+    /// character (the only bytes a run of plain output stops at)
+    void write_escaped(std::uint32_t codepoint)
     {
         switch (codepoint)
         {
@@ -1518,12 +1519,7 @@ class view_serializer
             default:
                 break;
         }
-        if (codepoint <= 0x1F || (EnsureAscii && codepoint >= 0x7F))
-        {
-            write_u_escape(codepoint); // (a single byte: the only caller passes s[i])
-            return;
-        }
-        m_out.put(reinterpret_cast<const char*>(bytes), len); // NOLINT(cppcoreguidelines-pro-type-reinterpret-cast) LCOV_EXCL_LINE (printable characters are copied in runs)
+        write_u_escape(codepoint); // (a control character)
     }
 
     void write_u_escape(std::uint32_t u)

include/nlohmann/json.hpp

@@ -1576,7 +1576,7 @@ public:
         auto src_it = src_object.cbegin();
         for (auto& element : *dst.m_data.m_value.object)
         {
-            if (JSON_HEDLEY_LIKELY(src_it != src_object.cend() && copy_keys_equal(src_it->first, element.first)))
+            if (JSON_HEDLEY_LIKELY(copy_keys_equal(src_it->first, element.first)))
             {
                 copy_shallow(src_it->second, element.second, worklist);
                 ++src_it;
@@ -5353,8 +5353,7 @@ public:
     /// @name lexicographical comparison operators
     /// @{
 
-    // the same-type cases for non-owning scalars, shared by JSON_IMPLEMENT_OPERATOR
-    // and JSON_IMPLEMENT_SCALAR_FAST
+    // the same-type cases for non-owning scalars, used by JSON_IMPLEMENT_SCALAR_FAST
 #define JSON_IMPLEMENT_SCALAR_CASES(op, null_result)                                                     \
   case value_t::null:                                                                                  \
         return (null_result);                                                                            \
@@ -5376,7 +5375,7 @@ public:
     // because any negative signed value is smaller than any unsigned value.
     // Otherwise, the non-negative signed value is cast to unsigned before the
     // comparison to avoid wraparound.
-#define JSON_IMPLEMENT_OPERATOR(op, null_result, unordered_result, default_result, deep_result, may_descend) \
+#define JSON_IMPLEMENT_OPERATOR(op, unordered_result, default_result, deep_result, may_descend)          \
     const auto lhs_type = lhs.type();                                                                    \
     const auto rhs_type = rhs.type();                                                                    \
     \
@@ -5404,8 +5403,15 @@ public:
                 return (*lhs.m_data.m_value.object) op (*rhs.m_data.m_value.object);                                   \
             }                                                                                            \
             \
-            JSON_IMPLEMENT_SCALAR_CASES(op, null_result)                                                 \
-            \
+                /* same-type scalars never get here: the inline fast path of the operator handles them */ \
+            case value_t::null:                                                                          \
+            case value_t::boolean:                                                                       \
+            case value_t::number_integer:                                                                \
+            case value_t::number_unsigned:                                                               \
+            case value_t::number_float:                                                                  \
+                JSON_ASSERT(false); /* NOLINT(cert-dcl03-c,hicpp-static-assert,misc-static-assert) */ \
+                return (unordered_result);                                                               \
+                \
             case value_t::string:                                                                        \
                 return (*lhs.m_data.m_value.string) op (*rhs.m_data.m_value.string);                                   \
                 \
@@ -5445,7 +5451,7 @@ public:
                ? (number_integer_t(-1) op number_integer_t(1))                                           \
                : (static_cast<number_unsigned_t>(lhs.m_data.m_value.number_integer) op rhs.m_data.m_value.number_unsigned); \
     }                                                                                             \
-    else if(compares_unordered(lhs, rhs))\
+    else if(lhs_type == value_t::discarded || rhs_type == value_t::discarded)\
     {\
         return (unordered_result);\
     }\
@@ -5513,7 +5519,7 @@ public:
         JSON_HEDLEY_DIAGNOSTIC_PUSH
         JSON_HEDLEY_PRAGMA(GCC diagnostic ignored "-Wfloat-equal")
 #endif
-        JSON_IMPLEMENT_OPERATOR( ==, true, false, false,
+        JSON_IMPLEMENT_OPERATOR( ==, false, false,
                                  compare_iteratively<false>(lhs, rhs, false) == compare_result::equal, true)
 #ifdef __GNUC__
         JSON_HEDLEY_DIAGNOSTIC_POP
@@ -5527,7 +5533,6 @@ public:
         // default_result is used if we cannot compare values. In that case,
         // we compare types.
         JSON_IMPLEMENT_OPERATOR(<=>, // *NOPAD*
-                                std::partial_ordering::equivalent,
                                 std::partial_ordering::unordered,
                                 lhs_type <=> rhs_type, // *NOPAD*
                                 to_partial_ordering(compare_iteratively<true>(lhs, rhs, false)), true)
@@ -5539,7 +5544,7 @@ public:
         // default_result is used if we cannot compare values. In that case,
         // we compare types. Note we have to call the operator explicitly,
         // because MSVC has problems otherwise.
-        JSON_IMPLEMENT_OPERATOR( <, false, false, operator<(lhs_type, rhs_type),
+        JSON_IMPLEMENT_OPERATOR( <, false, operator<(lhs_type, rhs_type),
                                  compare_iteratively<true>(lhs, rhs, true) == compare_result::less, false)
     }
 #endif

single_include/nlohmann/json.hpp

@@ -24064,6 +24064,9 @@ class iter_impl // NOLINT(cppcoreguidelines-special-member-functions,hicpp-speci
     {
         JSON_ASSERT(m_object != nullptr);
 
+        // m_it is already value-initialized, so this is not needed for
+        // correctness; it is kept because GCC generates faster loops with it
+        // (iterating a parsed document is 0.5-2.7 % slower without it, #6005)
         if (m_object->is_object())
         {
             m_it.object_iterator = typename object_t::iterator();
@@ -36267,21 +36270,14 @@ class serializer
                 {
                     // the code point is at least 0x60 (smaller ones are handled
                     // above) and is not printable ASCII (which the scanner
-                    // copies): it is DEL (0x7F) under EnsureAscii or a non-ASCII
-                    // character
+                    // copies). Under EnsureAscii it is DEL (0x7F): every
+                    // well-formed multi-byte character is escaped by
+                    // write_u_escapes() above, so decode() only ever accepts a
+                    // single byte here, and nothing of it was buffered
                     if (EnsureAscii)
                     {
                         JSON_ASSERT(codepoint == 0x7F);
-                        if (error_handler == error_handler_t::keep)
-                        {
-                            // this character was buffered as raw bytes below
-                            // in case it turned out to be part of an
-                            // ill-formed sequence (which is kept as is); now
-                            // that it decoded to a well-formed code point,
-                            // undo that and \u-escape it like any other
-                            // character instead
-                            bytes = bytes_after_last_accept;
-                        }
+                        JSON_ASSERT(bytes == bytes_after_last_accept);
                         write_u_escape(bytes, static_cast<std::uint16_t>(codepoint));
                     }
                     else
@@ -39305,7 +39301,7 @@ public:
         auto src_it = src_object.cbegin();
         for (auto& element : *dst.m_data.m_value.object)
         {
-            if (JSON_HEDLEY_LIKELY(src_it != src_object.cend() && copy_keys_equal(src_it->first, element.first)))
+            if (JSON_HEDLEY_LIKELY(copy_keys_equal(src_it->first, element.first)))
             {
                 copy_shallow(src_it->second, element.second, worklist);
                 ++src_it;
@@ -43082,8 +43078,7 @@ public:
     /// @name lexicographical comparison operators
     /// @{
 
-    // the same-type cases for non-owning scalars, shared by JSON_IMPLEMENT_OPERATOR
-    // and JSON_IMPLEMENT_SCALAR_FAST
+    // the same-type cases for non-owning scalars, used by JSON_IMPLEMENT_SCALAR_FAST
 #define JSON_IMPLEMENT_SCALAR_CASES(op, null_result)                                                     \
   case value_t::null:                                                                                  \
         return (null_result);                                                                            \
@@ -43105,7 +43100,7 @@ public:
     // because any negative signed value is smaller than any unsigned value.
     // Otherwise, the non-negative signed value is cast to unsigned before the
     // comparison to avoid wraparound.
-#define JSON_IMPLEMENT_OPERATOR(op, null_result, unordered_result, default_result, deep_result, may_descend) \
+#define JSON_IMPLEMENT_OPERATOR(op, unordered_result, default_result, deep_result, may_descend)          \
     const auto lhs_type = lhs.type();                                                                    \
     const auto rhs_type = rhs.type();                                                                    \
     \
@@ -43133,8 +43128,15 @@ public:
                 return (*lhs.m_data.m_value.object) op (*rhs.m_data.m_value.object);                                   \
             }                                                                                            \
             \
-            JSON_IMPLEMENT_SCALAR_CASES(op, null_result)                                                 \
-            \
+                /* same-type scalars never get here: the inline fast path of the operator handles them */ \
+            case value_t::null:                                                                          \
+            case value_t::boolean:                                                                       \
+            case value_t::number_integer:                                                                \
+            case value_t::number_unsigned:                                                               \
+            case value_t::number_float:                                                                  \
+                JSON_ASSERT(false); /* NOLINT(cert-dcl03-c,hicpp-static-assert,misc-static-assert) */ \
+                return (unordered_result);                                                               \
+                \
             case value_t::string:                                                                        \
                 return (*lhs.m_data.m_value.string) op (*rhs.m_data.m_value.string);                                   \
                 \
@@ -43174,7 +43176,7 @@ public:
                ? (number_integer_t(-1) op number_integer_t(1))                                           \
                : (static_cast<number_unsigned_t>(lhs.m_data.m_value.number_integer) op rhs.m_data.m_value.number_unsigned); \
     }                                                                                             \
-    else if(compares_unordered(lhs, rhs))\
+    else if(lhs_type == value_t::discarded || rhs_type == value_t::discarded)\
     {\
         return (unordered_result);\
     }\
@@ -43242,7 +43244,7 @@ public:
         JSON_HEDLEY_DIAGNOSTIC_PUSH
         JSON_HEDLEY_PRAGMA(GCC diagnostic ignored "-Wfloat-equal")
 #endif
-        JSON_IMPLEMENT_OPERATOR( ==, true, false, false,
+        JSON_IMPLEMENT_OPERATOR( ==, false, false,
                                  compare_iteratively<false>(lhs, rhs, false) == compare_result::equal, true)
 #ifdef __GNUC__
         JSON_HEDLEY_DIAGNOSTIC_POP
@@ -43256,7 +43258,6 @@ public:
         // default_result is used if we cannot compare values. In that case,
         // we compare types.
         JSON_IMPLEMENT_OPERATOR(<=>, // *NOPAD*
-                                std::partial_ordering::equivalent,
                                 std::partial_ordering::unordered,
                                 lhs_type <=> rhs_type, // *NOPAD*
                                 to_partial_ordering(compare_iteratively<true>(lhs, rhs, false)), true)
@@ -43268,7 +43269,7 @@ public:
         // default_result is used if we cannot compare values. In that case,
         // we compare types. Note we have to call the operator explicitly,
         // because MSVC has problems otherwise.
-        JSON_IMPLEMENT_OPERATOR( <, false, false, operator<(lhs_type, rhs_type),
+        JSON_IMPLEMENT_OPERATOR( <, false, operator<(lhs_type, rhs_type),
                                  compare_iteratively<true>(lhs, rhs, true) == compare_result::less, false)
     }
 #endif

single_include/nlohmann/json_view.hpp

@@ -2479,8 +2479,9 @@ indent_done:
             {
                 ++p;
             }
-            else if (NLOHMANN_VIEW_LIKELY(cur() >= '1' && cur() <= '9'))
+            else if (!negative || NLOHMANN_VIEW_LIKELY(cur() >= '1' && cur() <= '9'))
             {
+                // (without a sign, the dispatch saw a digit)
                 p = skip_digits(p + 1, e);
             }
             else
@@ -3549,9 +3550,9 @@ class view_side
         return m_view.size();
     }
 
-    string_view_t string() const
+    string_view_t string() const noexcept
     {
-        return m_view.get_string();
+        return {m_view.m_doc->str(*m_view.m_node), m_view.m_node->len};
     }
 
     bool boolean() const noexcept
@@ -3674,9 +3675,9 @@ class json_side
         return m_json->size();
     }
 
-    string_view_t string() const
+    string_view_t string() const noexcept
     {
-        const auto& s = m_json->template get_ref<const typename BasicJsonType::string_t&>();
+        const auto& s = *m_json->template get_ptr<const typename BasicJsonType::string_t*>();
         return string_view_t(s.data(), s.size());
     }
 
@@ -5013,10 +5014,6 @@ void value_range(const document_data& d, const node* n, std::size_t& start, std:
         end = p.end;
         return;
     }
-    if ((n->flags & node_flags::is_new) != 0 || n->off >= d.size)
-    {
-        return;
-    }
     // the open brackets: n, then the last element as long as it is a non-empty container
     std::size_t closing = 0;
     std::size_t pos = std::string::npos;
@@ -5476,7 +5473,7 @@ inline void set_moved(document_data& d, node* n, node* seq, std::size_t cap)
         e.moved_cap[n->off] = cap;
         return;
     }
-    reserve_moved(d);
+    // every caller has called reserve_moved() (see above), so neither push_back() can throw
     e.moved.push_back(seq);
     e.moved_cap.push_back(cap);
     n->off = static_cast<std::uint32_t>(e.moved.size() - 1);
@@ -7780,10 +7777,6 @@ inline void load_image(document_data& d, const std::uint8_t* image, std::size_t
     d.edits.reset();
     d.base[2] = nullptr;
     d.owned.clear();
-    if (d.owned_image.empty() || image != d.owned_image.data())
-    {
-        d.owned_image.clear();
-    }
     d.arena.clear();
     d.indexes.clear();
     d.index_slots.clear();
@@ -9093,7 +9086,7 @@ class view_serializer
             {
                 invalid_utf8(s, n.len); // (the scan stopped at ill-formed UTF-8)
             }
-            write_codepoint<false>(s[i], s + i, 1); // a quote, a backslash, or a control character
+            write_escaped(s[i]); // a quote, a backslash, or a control character
             ++i;
         }
         m_out.put('"');
@@ -9941,8 +9934,9 @@ class view_serializer
         static_cast<void>(dumped);
     } // LCOV_EXCL_LINE (dump() throws: the callers pass only ill-formed UTF-8)
 
-    template<bool EnsureAscii>
-    void write_codepoint(std::uint32_t codepoint, const unsigned char* bytes, std::size_t len)
+    /// write the escape sequence of a quote, a backslash or a control
+    /// character (the only bytes a run of plain output stops at)
+    void write_escaped(std::uint32_t codepoint)
     {
         switch (codepoint)
         {
@@ -9970,12 +9964,7 @@ class view_serializer
             default:
                 break;
         }
-        if (codepoint <= 0x1F || (EnsureAscii && codepoint >= 0x7F))
-        {
-            write_u_escape(codepoint); // (a single byte: the only caller passes s[i])
-            return;
-        }
-        m_out.put(reinterpret_cast<const char*>(bytes), len); // NOLINT(cppcoreguidelines-pro-type-reinterpret-cast) LCOV_EXCL_LINE (printable characters are copied in runs)
+        write_u_escape(codepoint); // (a control character)
     }
 
     void write_u_escape(std::uint32_t u)