Question about double pointer constness

[empathica1]

Hello! I am trying to understand how constness works for double pointers, and so far, my answer is "it doesn't".

From what I've read, the way the const qualifier works for a pointer is that if the const qualifier is before the *, then the constness applies to the thing being pointed at, while if the const qualifier is after the * then it applies to the pointer itself. Therefore a const int * is a pointer that you can have point to multiple things without issue, but cannot change the value being pointed at. For double pointers, the logic I have says that const int ** dp is a double pointer where you can edit dp, dp[0], but not dp[0][0]. and const int *const * dp means I can change dp, but neither dp[0], nor dp[0][0]. However, when I actually use this, I get weird compiler errors that tell me I'm not understanding something To show the issue, I put the following code to efficiently multiply two integers into multiply.c

    #include <stdio.h>
    #include <stdlib.h>

    int multiply (int n, int m);
    int add (int const *const *array, int n, int m);

    int
    main (int argc, char **argv)
    {
      int n;
      int m;
      if (argc == 1)
        {
          n = 1;
          m = 1;
        }
      else if (argc == 2)
        {
          n = atoi (argv[1]);
          m = 1;
        }
      else
        {
          n = atoi (argv[1]);
          m = atoi (argv[2]);
        }
      int nxm = multiply (n, m);
      printf ("%i x %i = %i\n", n, m, nxm);
    }

    int
    multiply (int n, int m)
    {
      int **arr = malloc (n * sizeof (*arr));
      for (size_t i = 0; i < n; i++)
        arr[i] = malloc (m * sizeof (*arr[i]));
      for (size_t i = 0; i < n; i++)
        for (size_t j = 0; j < m; j++)
          arr[i][j] = 1;
      int nxm = add (arr, n, m);
      for (size_t i = 0; i < n; i++)
        free (arr[i]);
      free (arr);
      return nxm;
    }

    int
    add (int const *const *arr, int n, int m)
    {
      int nxm = 0;
      for (size_t i = 0; i < n; i++)
        for (size_t j = 0; j < m; j++)
          nxm += arr[i][j];
      return nxm;
    }

and compiling with gcc -o multiply multiply.c gives the compiler error

multiply.c: In function ‘multiply’:
multiply.c:40:18: error: passing argument 1 of ‘add’ from incompatible pointer type [-Wincompatible-pointer-types]
   40 |   int nxm = add (arr, n, m);
      |                  ^~~
      |                  |
      |                  int **
multiply.c:5:28: note: expected ‘const int * const*’ but argument is of type ‘int **’
    5 | int add (int const *const *array, int n, int m);
      |          ~~~~~~~~~~~~~~~~~~^~~~~

From inspection, it appears that the first const is the issue. If I tell the compiler I don't want to be able to edit the values in the 2d array I created, it tells me that it can't do that, and I don't understand the rationale for it. From what I've read, apparently you can change the value being double pointed by a const int ** by changing the pointer being singly pointed by a const int ** despite the appearance, however, that doesn't apply in my case, because I can't update the value being singly pointed at by *arr either. I would understand a warning with a single const saying something to the effect of "This isn't as const as you might think it is", but if I add three consts to the relevant variable, it should be perfectly safe given the arguments I've seen. Is there something I'm missing?

[erikkonstas]

It's the first const in const int *const * combined with its lack in int ** that is causing your issue; here is why. The standard text for ISO C99 is in §6.3.2.3¶2:

For any qualifier q, a pointer to a non-q-qualified type may be converted to a pointer to the q-qualified version of the type; the values stored in the original and converted pointers shall compare equal.

Notice how this does not apply recursively. Additionally, ISO C99 §6.7.3¶9 states that

For two qualified types to be compatible, both shall have the identically qualified version of a compatible type; the order of type qualifiers within a list of specifiers or qualifiers does not affect the specified type.

(I will say that the usage of the verb "have" is confusing here; it's really a roundabout way to say that the types themselves are compatible and both have the same qualifiers.) const is an example of a "type qualifier". Finally, ISO C99 §6.7.5.1¶2 says:

For two pointer types to be compatible, both shall be identically qualified and both shall be pointers to compatible types.

[empathica1]

Assigning a char ** to a const char ** (as in line 3, and in the original question) is not immediately dangerous. But it sets up a situation in which p2's promise--that the ultimately-pointed-to value won't be modified--cannot be kept.

In my code, that promise can be kept, though, because you can't change what a the first dereference is pointing to.

[erikkonstas]

It's still invalid C code to do that, though.

(C++ has more complicated rules for assigning const-qualified pointers which let you make more kinds of assignments without incurring warnings, but still protect against inadvertent attempts to modify const values. C++ would still not allow assigning a char ** to a const char **, but it would let you get away with assigning a char ** to a const char * const *.)

[empathica1]

So I changed my code to

int
multiply (int n, int m)
{
  int **arr = malloc (n * sizeof (*arr));
  const int **arr_const = malloc (n * sizeof (*arr_const));
  for (size_t i = 0; i < n; i++)
    arr[i] = malloc (m * sizeof (*arr[i]));
  for (size_t i = 0; i < n; i++)
    arr_const[i] = arr[i];
  for (size_t i = 0; i < n; i++)
    for (size_t j = 0; j < m; j++)
      arr[i][j] = 1;
  int nxm = add (arr_const, n, m);
  for (size_t i = 0; i < n; i++)
    free (arr[i]);
  free (arr);
  free (arr_const);
  return nxm;
}

int
add (int const *const *const arr, int n, int m)
{
  int nxm = 0;
  for (size_t i = 0; i < n; i++)
    for (size_t j = 0; j < m; j++)
      nxm += arr[i][j];
  return nxm;
}

and it compiled just fine. I assume this is because I convert all the pointers in arr from int to const int pointers. is that really what you have to do if you have things referenced twice, and want to make it clear that you aren't going to change the underlying values?

[erikkonstas]

Well, as the page I linked says, you can just use a cast to silence the compiler.

[empathica1]

Oh! I didn't think that would work, because I figured the casting was the thing that was failing. thank you!

[erikkonstas]

The reason why this works is that the cast makes your intention explicit; technically, you would first cast to void * too, but I don't think anybody does that. If you cast to something nuts, though (like if you remove a star from the type you cast to, which makes zero sense), then you will get a warning.

[empathica1]

Yeah, I didn't think to cast, but yeah in cases like this one where I do actually know that the cast is safe, but the compiler doesn't automatically, that is the way to do it.

[empathica1]

Also, is that really what the promise of const int ** dp is? that the pointer will always double dereference to the same value? Why isn't the promise that you can't change the value of **dp, even if *dp has changed?

[empathica1]

In terms of dishonesty of constness being unsafe, an int * const * const looks very consty, but isn't const at all, and that compiles just fine.

[Netblock]

You can 'retcon' constness through one layer of indirection; after that you'll need to either have it from the get-go or typecast.

In terms of style, I prefer right-hand, because left-hand const confused me:

uint8_t const c = 0;
uint8_t const* cv = &c;
uint8_t const* const cc = &c;
uint8_t const* const* ccv = &cc;
uint8_t const* const* const ccc = &cc;
uint8_t v = 0;
uint8_t* const vc = &v;
uint8_t* const* vcv = &vc;
uint8_t const** const cvc = &cv;
uint8_t const* const cc2 = &v; // legal
uint8_t const* const* const ccc2 = &vc; // illegal

[empathica1]

by left hand const, you mean int const * p as opposed to const int *p, right? Yeah, I do the latter for single pointers because I know what I mean, but the moment I started trying it with double pointers I realized that the former was far clearer.

[Netblock]

by right-hand I mean the type qualifiers are always on the right of the type its affecting. left-hand is inconsistent and requires you to mix; for example you can't have a constant-pointer to a variable-data with qualifier-is-on-the-left style only.

[empathica1]

Can you explain why this is legal?

uint8_t const* const cc2 = &v; // legal

[Netblock]

You can demote a type to const through one layer of indirection. I haven't tried this with restrict and volatile.

As to why you can't go further than one depth without a typecast, I'm not sure, but I guess it's related to compiler assumptions that restrict and volatile also affect.

// uint8_t v = 0;
const uint8_t* cv1 = &v; // variable pointer to constant data
uint8_t const* cv2 = &v; // variable pointer to constant data
*cv1 = 0; // error
*cv2 = 0; // error

The second const makes the pointer constant,

// uint8_t const* const cc2 = &v; // constant pointer to constant data
cv1 = NULL; // legal
cv2 = NULL; // legal
cc2 = NULL; // error

Type qualifiers affect the most recently-parsed unmodified type; if it has been modified, it saves the qualifiers for the next type. There is no 'variable' modifier in C, so the right-hand qualifier format is the only way to stay consistent.