gcc Documentation

Technical Documentation: gcc-mirror/gcc

ℹ️ Provenance: Multi-Tier Ingestion · CodeWiki Reference

Gcc Ada Doc Gnat Style (`gcc/ada/doc/gnat-style.rst`)

GNAT Coding Style: A Guide for GNAT Developers

General

Most of GNAT is written in Ada using a consistent style to ensure
readability of the code. This document has been written to help
maintain this consistent style, while having a large group of developers
work on the compiler.

For the coding style in the C parts of the compiler and run time,
see the GNU Coding Guidelines.

This document is structured after the Ada Reference Manual.
Those familiar with that document should be able to quickly
lookup style rules for particular constructs.

Lexical Elements

Character Set and Separators

.. index:: Character set
.. index:: ASCII
.. index:: Separators
.. index:: End-of-line
.. index:: Line length
.. index:: Indentation

The character set used should be plain 7-bit ASCII.
The only separators allowed are space and the end-of-line sequence.
No other control character or format effector (such as HT,
VT, FF )
should be used.
The normal end-of-line sequence is used, which may be
LF, CR/LF or CR,
depending on the host system. An optional SUB
( 16#1A# ) may be present as the
last character in the file on hosts using that character as file terminator.
Files that are checked in or distributed should be in host format.
A line should never be longer than 79 characters, not counting the line
separator.
Lines must not have trailing blanks.
Indentation is 3 characters per level for if statements, loops, and
case statements.
For exact information on required spacing between lexical
elements, see file style.adb.

.. index:: style.adb file

Identifiers

Identifiers will start with an upper case letter, and each letter following
an underscore will be upper case.

.. index:: Casing (for identifiers)

Short acronyms may be all upper case.
All other letters are lower case.
An exception is for identifiers matching a foreign language. In particular,
we use all lower case where appropriate for C.
Use underscores to separate words in an identifier.

.. index:: Underscores
Try to limit your use of abbreviations in identifiers.
It is ok to make a few abbreviations, explain what they mean, and then
use them frequently, but don't use lots of obscure abbreviations. An
example is the ALI word which stands for Ada Library
Information and is by convention always written in upper-case when
used in entity names.

.. code-block:: ada
text
```
procedure Find_ALI_Files;
```
Don't use the variable name I, use J instead; I is too
easily confused with 1 in some fonts. Similarly don't use the
variable O, which is too easily mistaken for the number 0.

Numeric Literals

Numeric literals should include underscores where helpful for
readability.

.. index:: Underscores

.. code-block:: ada
text
```
1_000_000
    16#8000_0000#
    3.14159_26535_89793_23846
```

Reserved Words

Reserved words use all lower case.

.. index:: Casing (for reserved words)

.. code-block:: ada
text
```
return else
```
The words Access, Delta and Digits are
capitalized when used as attribute_designator.

Comments

A comment starts with -- followed by two spaces.
The only exception to this rule (i.e. one space is tolerated) is when the
comment ends with a single space followed by --.
It is also acceptable to have only one space between -- and the start
of the comment when the comment is at the end of a line,
after some Ada code.
Every sentence in a comment should start with an upper-case letter (including
the first letter of the comment).

.. index:: Casing (in comments)
When declarations are commented with 'hanging' comments, i.e.
comments after the declaration, there is no blank line before the
comment, and if it is absolutely necessary to have blank lines within
the comments, e.g. to make paragraph separations within a single comment,
these blank lines do have a -- (unlike the
normal rule, which is to use entirely blank lines for separating
comment paragraphs). The comment starts at same level of indentation
as code it is commenting.

.. index:: Blank lines (in comments)
.. index:: Indentation

.. code-block:: ada
text
```
z : Integer;
     --  Integer value for storing value of z
     --
     --  The previous line was a blank line.
```
Comments that are dubious or incomplete, or that comment on possibly
wrong or incomplete code, should be preceded or followed by ???.
Comments in a subprogram body must generally be surrounded by blank lines.
An exception is a comment that follows a line containing a single keyword
( begin, else, loop ):

.. code-block:: ada
text
```
begin
        --  Comment for the next statement

        A := 5;

        --  Comment for the B statement

        B := 6;
     end;
```
In sequences of statements, comments at the end of the lines should be
aligned.

.. index:: Alignment (in comments)

.. code-block:: ada
text
```
My_Identifier := 5;      --  First comment
      Other_Id := 6;           --  Second comment
```
Short comments that fit on a single line are not ended with a
period. Comments taking more than a line are punctuated in the normal
manner.
Comments should focus on why instead of what.
Descriptions of what subprograms do go with the specification.
Comments describing a subprogram spec should specifically mention the
formal argument names. General rule: write a comment that does not
depend on the names of things. The names are supplementary, not
sufficient, as comments.
Do not put two spaces after periods in comments.

Declarations and Types

In entity declarations, colons must be surrounded by spaces. Colons
should be aligned.

.. index:: Alignment (in declarations)

.. code-block:: ada
text
```
Entity1   : Integer;
      My_Entity : Integer;
```
Declarations should be grouped in a logical order.
Related groups of declarations may be preceded by a header comment.
All local subprograms in a subprogram or package body should be declared
before the first local subprogram body.
Do not declare local entities that hide global entities.

.. index:: Hiding of outer entities
Do not declare multiple variables in one declaration that spans lines.
Start a new declaration on each line, instead.
The defining_identifiers of global declarations serve as
comments of a sort. So don't choose terse names, but look for names
that give useful information instead.
Local names can be shorter, because they are used only within
one context, where comments explain their purpose.
When starting an initialization or default expression on the line that follows
the declaration line, use 2 characters for indentation.

.. code-block:: ada
text
```
Entity1 : Integer :=
        Function_Name (Parameters, For_Call);
```
If an initialization or default expression needs to be continued on subsequent
lines, the continuations should be indented from the start of the expression.

.. code-block:: ada
text
```
Entity1 : Integer := Long_Function_Name
                             (parameters for call);
```

Expressions and Names

Every operator must be surrounded by spaces. An exception is that
this rule does not apply to the exponentiation operator, for which
there are no specific layout rules. The reason for this exception
is that sometimes it makes clearer reading to leave out the spaces
around exponentiation.

.. index:: Operators

.. code-block:: ada
text
```
E := A * B**2 + 3 * (C - D);
```
Use parentheses where they clarify the intended association of operands
with operators:

.. index:: Parenthesization of expressions

.. code-block:: ada
text
```
(A / B) * C
```

Statements

Simple and Compound Statements

Use only one statement or label per line.
A longer sequence_of_statements may be divided in logical
groups or separated from surrounding code using a blank line.

If Statements

When the if, elsif or else keywords fit on the
same line with the condition and the then keyword, then the
statement is formatted as follows:

.. index:: Alignment (in an if statement)

.. code-block:: ada
text
```
if condition then
         ...
      elsif condition then
         ...
      else
         ...
      end if;
```
When the above layout is not possible, then should be aligned
with if, and conditions should preferably be split before an
and or or keyword a follows:

.. code-block:: ada
text
```
if long_condition_that_has_to_be_split
        and then continued_on_the_next_line
      then
         ...
      end if;
```
The elsif, else and end if always line up with
the if keyword. The preferred location for splitting the line
is before and or or. The continuation of a condition is
indented with two spaces or as many as needed to make nesting clear.
As an exception, if conditions are closely related either of the
following is allowed:

.. code-block:: ada
text
```
if x = lakdsjfhlkashfdlkflkdsalkhfsalkdhflkjdsahf
        or else
      x = asldkjhalkdsjfhhfd
        or else
      x = asdfadsfadsf
   then
     ...
   end if;

   if x = lakdsjfhlkashfdlkflkdsalkhfsalkdhflkjdsahf or else
      x = asldkjhalkdsjfhhfd                         or else
      x = asdfadsfadsf
   then
     ...
   end if;
```
Conditions should use short-circuit forms ( and then,
or else ), except when the operands are boolean variables
or boolean constants.

.. index:: Short-circuit forms
Complex conditions in if statements are indented two characters:

.. index:: Indentation (in if statements)

.. code-block:: ada
text
```
if this_complex_condition
      and then that_other_one
      and then one_last_one
    then
       ...
    end if;
```
There are some cases where complex conditionals can be laid out
in manners that do not follow these rules to preserve better
parallelism between branches, e.g.

.. code-block:: ada
text
```
if xyz.abc (gef) = 'c'
         or else
       xyz.abc (gef) = 'x'
    then
       ...
    end if;
```
Every if block is preceded and followed by a blank line, except
where it begins or ends a sequence_of_statements.

.. index:: Blank lines (in an if statement)

.. code-block:: ada
text
```
A := 5;

      if A = 5 then
         null;
      end if;

      A := 6;
```

Case Statements

Layout is as below. For long case statements, the extra indentation
can be saved by aligning the when clauses with the opening case.

.. code-block:: ada
text
```
case expression is
        when condition =>
           ...
        when condition =>
           ...
     end case;
```

Loop Statements

When possible, have for or while on one line with the
condition and the loop keyword.

.. code-block:: ada
text
```
for J in S'Range loop
        ...
     end loop;
```
If the condition is too long, split the condition (see 'If
statements' above) and align loop with the for or
while keyword.

.. index:: Alignment (in a loop statement)

.. code-block:: ada
text
```
while long_condition_that_has_to_be_split
      and then continued_on_the_next_line
    loop
       ...
    end loop;
```
If the loop_statement has an identifier, it is laid out as follows:

.. code-block:: ada
text
```
Outer : while not condition loop
       ...
    end Outer;
```

Block Statements

The declare (optional), begin and end words
are aligned, except when the block_statement is named. There
is a blank line before the begin keyword:

.. index:: Alignment (in a block statement)

.. code-block:: ada
text
```
Some_Block : declare
       ...

    begin
       ...
    end Some_Block;
```

Subprograms

Subprogram Declarations

Do not write the in for parameters.

.. code-block:: ada
text
```
function Length (S : String) return Integer;
```
When the declaration line for a procedure or a function is too long to fit
the entire declaration (including the keyword procedure or function) on a
single line, then fold it, putting a single parameter on a line, aligning
the colons, as in:

.. code-block:: ada
text
```
procedure Set_Heading
     (Source : String;
      Count  : Natural;
      Pad    : Character := Space;
      Fill   : Boolean   := True);
```
In the case of a function, if the entire spec does not fit on one line, then
the return may appear after the last parameter, as in:

.. code-block:: ada
text
```
function Head
      (Source : String;
       Count  : Natural;
       Pad    : Character := Space) return String;
```
Or it may appear on its own as a separate line. This form is preferred when
putting the return on the same line as the last parameter would result in
an overlong line. The return type may optionally be aligned with the types
of the parameters (usually we do this aligning if it results only in a small
number of extra spaces, and otherwise we don't attempt to align). So two
alternative forms for the above spec are:

.. code-block:: ada
text
```
function Head
      (Source : String;
       Count  : Natural;
       Pad    : Character := Space)
       return   String;

    function Head
      (Source : String;
       Count  : Natural;
       Pad    : Character := Space)
       return String;
```

Subprogram Bodies

Function and procedure bodies should usually be sorted alphabetically. Do
not attempt to sort them in some logical order by functionality. For a
sequence of subprogram specs, a general alphabetical sorting is also
usually appropriate, but occasionally it makes sense to group by major
function, with appropriate headers.
All subprograms have a header giving the function name, with the following
format:

.. code-block:: ada
text
```
-----------------
    -- My_Function --
    -----------------

    procedure My_Function is
    begin
      ...
    end My_Function;
```
Note that the name in the header is preceded by a single space,
not two spaces as for other comments. These headers are used on
nested subprograms as well as outer level subprograms. They may
also be used as headers for sections of comments, or collections
of declarations that are related.
Every subprogram body must have a preceding subprogram_declaration,
which includes proper client documentation so that you do not need to
read the subprogram body in order to understand what the subprogram does and
how to call it. All subprograms should be documented, without exceptions.

.. index:: Blank lines (in subprogram bodies)
A sequence of declarations may optionally be separated from the following
begin by a blank line. Just as we optionally allow blank lines in general
between declarations, this blank line should be present only if it improves
readability. Generally we avoid this blank line if the declarative part is
small (one or two lines) and the body has no blank lines, and we include it
if the declarative part is long or if the body has blank lines.
If the declarations in a subprogram contain at least one nested
subprogram body, then just before the begin of the enclosing
subprogram, there is a comment line and a blank line:

.. code-block:: ada
text
```
--  Start of processing for Enclosing_Subprogram

  begin
    ...
  end Enclosing_Subprogram;
```

When nested subprograms are present, variables that are referenced by any
nested subprogram should precede the nested subprogram specs. For variables
that are not referenced by nested procedures, the declarations can either also
be before any of the nested subprogram specs (this is the old style, more
generally used). Or then can come just before the begin, with a header. The
following example shows the two possible styles:

.. code-block:: ada

text

procedure Style1 is
     Var_Referenced_In_Nested      : Integer;
     Var_Referenced_Only_In_Style1 : Integer;

     proc Nested;
     --  Comments ...

     ------------
     -- Nested --
     ------------

     procedure Nested is
     begin
        ...
     end Nested;

  --  Start of processing for Style1

  begin
     ...
  end Style1;

  procedure Style2 is
     Var_Referenced_In_Nested : Integer;

     proc Nested;
     --  Comments ...

     ------------
     -- Nested --
     ------------

     procedure Nested is
     begin
        ...
     end Nested;

     --  Local variables

     Var_Referenced_Only_In_Style2 : Integer;

  --  Start of processing for Style2

  begin
     ...
  end Style2;

For new code, we generally prefer Style2, but we do not insist on
modifying all legacy occurrences of Style1, which is still much
more common in the sources.

Packages and Visibility Rules

All program units and subprograms have their name at the end:

.. code-block:: ada
text
```
package P is
       ...
    end P;
```
We will use the style of use -ing with -ed packages, with
the context clauses looking like:

.. index:: use clauses

.. code-block:: ada
text
```
with A; use A;
    with B; use B;
```
Names declared in the visible part of packages should be
unique, to prevent name clashes when the packages are use d.

.. index:: Name clash avoidance

.. code-block:: ada
text
```
package Entity is
       type Entity_Kind is ...;
       ...
    end Entity;
```
After the file header comment, the context clause and unit specification
should be the first thing in a program_unit.
Preelaborate, Pure and Elaborate_Body pragmas should be added right after the
package name, indented an extra level and using the parameterless form:

.. code-block:: ada
text
```
package Preelaborate_Package is
       pragma Preelaborate;
       ...
    end Preelaborate_Package;
```

Program Structure and Compilation Issues

Every GNAT source file must be compiled with the -gnatg
switch to check the coding style.
(Note that you should look at
style.adb to see the lexical rules enforced by -gnatg ).

.. index:: -gnatg option (to gcc)
.. index:: style.adb file
Each source file should contain only one compilation unit.
Filenames should be 8 or fewer characters, followed by the .adb
extension for a body or .ads for a spec.

.. index:: File name length
Unit names should be distinct when 'krunch'ed to 8 characters
(see krunch.ads) and the filenames should match the unit name,
except that they are all lower case.

.. index:: krunch.ads file

.. toctree::
share/gnu_free_documentation_license

Gcc Ada Doc Gnat Rm (`gcc/ada/doc/gnat_rm.rst`)

GNAT Reference Manual

.. only:: not latex

text

*GNAT, The GNU Ada Development Environment*

.. only:: PRO

   *GNAT Pro Edition*

   | Version |version|
   | Date: |today|

.. only:: GPL

   *GNAT Community Edition*

   | Version |version|
   | Date: |today|

.. only:: FSF

   .. raw:: texinfo

      @include gcc-common.texi
      GCC version @value{version-GCC}@*

AdaCore

Permission is granted to copy, distribute and/or modify this document
under the terms of the GNU Free Documentation License, Version 1.3 or
any later version published by the Free Software Foundation; with no
Invariant Sections, with the Front-Cover Texts being "GNAT Reference
Manual", and with no Back-Cover Texts.  A copy of the license is
included in the section entitled :ref:`gnu_fdl`.

.. toctree::
:numbered:
:maxdepth: 3

gnat_rm/about_this_guide
gnat_rm/implementation_defined_pragmas
gnat_rm/implementation_defined_aspects
gnat_rm/implementation_defined_attributes
gnat_rm/standard_and_implementation_defined_restrictions
gnat_rm/implementation_advice
gnat_rm/gnat_implementation_mode
gnat_rm/implementation_defined_characteristics
gnat_rm/intrinsic_subprograms
gnat_rm/representation_clauses_and_pragmas
gnat_rm/standard_library_routines
gnat_rm/the_implementation_of_standard_i_o
gnat_rm/the_gnat_library
gnat_rm/interfacing_to_other_languages
gnat_rm/specialized_needs_annexes
gnat_rm/implementation_of_specific_ada_features
gnat_rm/implementation_of_ada_2022_features
gnat_rm/gnat_language_extensions
gnat_rm/security_hardening_features
gnat_rm/obsolescent_features
gnat_rm/compatibility_and_porting_guide

.. raw:: latex

\appendix

.. toctree::
:maxdepth: 3

share/gnu_free_documentation_license

Gcc Ada Doc Gnat Ugn (`gcc/ada/doc/gnat_ugn.rst`)

GNAT User's Guide for Native Platforms

.. only:: not latex

text

*GNAT, The GNU Ada Development Environment*

.. only:: PRO

   *GNAT Pro Edition*

   | Version |version|
   | Date: |today|

.. only:: GPL

   *GNAT Community Edition*

   | Version |version|
   | Date: |today|

.. only:: FSF

   .. raw:: texinfo

      @include gcc-common.texi
      GCC version @value{version-GCC}@*

AdaCore

Permission is granted to copy, distribute and/or modify this document
under the terms of the GNU Free Documentation License, Version 1.3 or
any later version published by the Free Software Foundation; with no
Invariant Sections, with the Front-Cover Texts being
"GNAT User's Guide for Native Platforms",
and with no Back-Cover Texts.  A copy of the license is
included in the section entitled :ref:`gnu_fdl`.

.. toctree::
:maxdepth: 3
:numbered:

gnat_ugn/about_this_guide
gnat_ugn/getting_started_with_gnat
gnat_ugn/the_gnat_compilation_model
gnat_ugn/building_executable_programs_with_gnat
gnat_ugn/gnat_utility_programs
gnat_ugn/gnat_and_program_execution

.. raw:: latex

\appendix

.. toctree::
:maxdepth: 3

A. Platform-Specific Information <gnat_ugn/platform_specific_information>
B. Example of Binder Output <gnat_ugn/example_of_binder_output>
C. Elaboration Order Handling in GNAT <gnat_ugn/elaboration_order_handling_in_gnat>
D. Inline Assembler <gnat_ugn/inline_assembler>
E. GNU Free Documentation License <share/gnu_free_documentation_license>

Gcc Doc Libgdiagnostics Index (`gcc/doc/libgdiagnostics/index.rst`)

.. Copyright (C) 2024-2026 Free Software Foundation, Inc.
Originally contributed by David Malcolm [email protected]

This is free software: you can redistribute it and/or modify it
under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.

This program is distributed in the hope that it will be useful, but
WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
General Public License for more details.

You should have received a copy of the GNU General Public License
along with this program. If not, see
https://www.gnu.org/licenses/.

libgdiagnostics

This document describes libgdiagnostics <https://gcc.gnu.org/wiki/libgdiagnostics>_,
an API for programs to use to emit diagnostics (such as for "lint"-style checker
tools), supporting:

text output similar to GCC's errors and warnings::

test-typo.c:19:13: error: unknown field 'colour'
19 | return p->colour;
| ^~~~~~

quoting pertinent source code (with a cache), and underlining
:doc:points and ranges in the files being tested <tutorial/02-physical-locations>,
possibly with labels::

test-labelled-ranges.c:9:6: error: mismatching types: 'int' and 'const char *'
19 | 42 + "foo"
| ~~ ^ ~~~~~
| | |
| int const char *
emitting :doc:fix-it hints <tutorial/06-fix-it-hints>::

test-fix-it-hint.c:19:13: error: unknown field 'colour'; did you mean 'color'
19 | return p->colour;
| ^~~~~~
| color

and generating patches from them::

@@ -16,7 +16,7 @@
struct rgb
get_color (struct object *p)
{
- return p->colour;
- return p->color;
  }
capturing :doc:execution paths<tutorial/07-execution-paths> through code::

In function 'make_a_list_of_random_ints_badly':
test-warning-with-path.c:30:5: warning: passing NULL as argument 1 to 'PyList_Append' which requires a non-NULL parameter"
30 | PyList_Append(list, item);
| ^~~~~~~~~~~~~~~~~~~~~~~~~

make_a_list_of_random_ints_badly': events 1-3
26 | list = PyList_New(0);
| ^~~~~~~~~~~~~
| |
| (1) when 'PyList_New' fails, returning NULL
27 |
28 | for (i = 0; i < count; i++) {
| ~~~~~~~~~
| |
| (2) when 'i < count'
29 | item = PyLong_FromLong(random());
30 | PyList_Append(list, item);
| ~~~~~~~~~~~~~~~~~~~~~~~~~
| |
| (3) when calling 'PyList_Append', passing NULL from (1) as argument 1
support for emitting machine-readable representations of the above
using the :doc:SARIF file format <topics/sarif>

There are actually two APIs for the library:

a pure C API: libgdiagnostics.h
a C++ wrapper API: libgdiagnostics+.h. This is a header-only
collection of wrapper classes around the C API to give a less
verbose API.

This documentation covers the C API.

Contents

.. toctree::
:maxdepth: 2

tutorial/index.rst
topics/index.rst

libgdiagnostics is free software: you can redistribute it and/or modify it
under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.

Indices and tables

:ref:genindex
:ref:search

Gcc Jit Docs Index (`gcc/jit/docs/index.rst`)

.. Copyright (C) 2014-2026 Free Software Foundation, Inc.
Originally contributed by David Malcolm [email protected]

You should have received a copy of the GNU General Public License
along with this program. If not, see
https://www.gnu.org/licenses/.

libgccjit

This document describes libgccjit <https://gcc.gnu.org/wiki/JIT>_, an API
for embedding GCC inside programs and libraries.

There are actually two APIs for the library:

a pure C API: libgccjit.h
a C++ wrapper API: libgccjit++.h. This is a collection of "thin"
wrapper classes around the C API, to save typing.

Contents:

.. toctree::
:maxdepth: 2

intro/index.rst
topics/index.rst
cp/index.rst
internals/index.rst

Indices and tables

:ref:genindex
:ref:search

Gcc Ada Doc Gnat Rm About This Guide (`gcc/ada/doc/gnat_rm/about_this_guide.rst`)

.. _About_This_Guide:

About This Guide

.. only:: PRO

For ease of exposition, 'GNAT Pro' will be referred to simply as
'GNAT' in the remainder of this document.

This manual contains useful information in writing programs using the
GNAT compiler. It includes information on implementation dependent
characteristics of GNAT, including all the information required by
Annex M of the Ada language standard.

GNAT implements Ada 95, Ada 2005, Ada 2012 and Ada 2022, and it may also be
invoked in Ada 83 compatibility mode.
By default, GNAT assumes Ada 2012,
but you can override with a compiler switch
to explicitly specify the language version.
(Please refer to the GNAT User's Guide for details on these switches.)
Throughout this manual, references to 'Ada' without a year suffix
apply to all the Ada versions of the language.

Ada is designed to be highly portable.
In general, a program will have the same effect even when compiled by
different compilers on different platforms.
However, since Ada is designed to be used in a
wide variety of applications, it also contains a number of system
dependent features to be used in interfacing to the external world.

.. index:: Implementation-dependent features

.. index:: Portability

Note: Any program that makes use of implementation-dependent features
may be non-portable. You should follow good programming practice and
isolate and clearly document any sections of your program that make use
of these features in a non-portable manner.

What This Reference Manual Contains

This reference manual contains the following chapters:

:ref:Implementation_Defined_Pragmas, lists GNAT implementation-dependent
pragmas, which can be used to extend and enhance the functionality of the
compiler.
:ref:Implementation_Defined_Attributes, lists GNAT
implementation-dependent attributes, which can be used to extend and
enhance the functionality of the compiler.
:ref:Standard_and_Implementation_Defined_Restrictions, lists GNAT
implementation-dependent restrictions, which can be used to extend and
enhance the functionality of the compiler.
:ref:Implementation_Advice, provides information on generally
desirable behavior which are not requirements that all compilers must
follow since it cannot be provided on all systems, or which may be
undesirable on some systems.
:ref:GNAT_Implementation_Mode details the features and restrictions that
are enabled while building the compiler and its runtime libraries.
:ref:Implementation_Defined_Characteristics, provides a guide to
minimizing implementation dependent features.
:ref:Intrinsic_Subprograms, describes the intrinsic subprograms
implemented by GNAT, and how they can be imported into user
application programs.
:ref:Representation_Clauses_and_Pragmas, describes in detail the
way that GNAT represents data, and in particular the exact set
of representation clauses and pragmas that is accepted.
:ref:Standard_Library_Routines, provides a listing of packages and a
brief description of the functionality that is provided by Ada's
extensive set of standard library routines as implemented by GNAT.
:ref:The_Implementation_of_Standard_I/O, details how the GNAT
implementation of the input-output facilities.
:ref:The_GNAT_Library, is a catalog of packages that complement
the Ada predefined library.
:ref:Interfacing_to_Other_Languages, describes how programs
written in Ada using GNAT can be interfaced to other programming
languages.
:ref:Specialized_Needs_Annexes, describes the GNAT implementation of all
of the specialized needs annexes.
:ref:Implementation_of_Specific_Ada_Features, discusses issues related
to GNAT's implementation of machine code insertions, tasking, and several
other features.
:ref:Implementation_of_Ada_2022_Features, describes the status of the
GNAT implementation of the Ada 2022 language standard.
:ref:Security_Hardening_Features documents GNAT extensions aimed
at security hardening.
:ref:Obsolescent_Features documents implementation dependent features,
including pragmas and attributes, which are considered obsolescent, since
there are other preferred ways of achieving the same results. These
obsolescent forms are retained for backwards compatibility.
:ref:Compatibility_and_Porting_Guide presents some guidelines for
developing portable Ada code, describes the compatibility issues that
may arise between GNAT and other Ada compilation systems (including those
for Ada 83), and shows how GNAT can expedite porting applications
developed in other Ada environments.
:ref:gnu_fdl contains the license for this document.

.. index:: Ada 95 Language Reference Manual

.. index:: Ada 2005 Language Reference Manual

This reference manual assumes a basic familiarity with the Ada 95 language, as
described in the
:title:International Standard ANSI/ISO/IEC-8652:1995.
It does not require knowledge of the new features introduced by Ada 2005 or
Ada 2012.
All three reference manuals are included in the GNAT documentation
package.

Conventions

.. index:: Conventions, typographical

.. index:: Typographical conventions

Following are examples of the typographical and graphic conventions used
in this guide:

Functions, utility program names, standard names,
and classes.
Option flags
:file:File names
Variables
Emphasis
[optional information or parameters]
Examples are described by text

::

and then shown this way.
Commands that are entered by the user are shown as preceded by a prompt string
comprising the $ character followed by a space.

See the following documents for further information on GNAT:

:title:GNAT User's Guide for Native Platforms,
which provides information on how to use the
GNAT development environment.
:title:Ada 95 Reference Manual, the Ada 95 programming language standard.
:title:Ada 95 Annotated Reference Manual, which is an annotated version
of the Ada 95 standard. The annotations describe
detailed aspects of the design decision, and in particular contain useful
sections on Ada 83 compatibility.
:title:Ada 2005 Reference Manual, the Ada 2005 programming language standard.
:title:Ada 2005 Annotated Reference Manual, which is an annotated version
of the Ada 2005 standard. The annotations describe
detailed aspects of the design decision.
:title:Ada 2012 Reference Manual, the Ada 2012 programming language standard.
:title:DEC Ada, Technical Overview and Comparison on DIGITAL Platforms,
which contains specific information on compatibility between GNAT and
DEC Ada 83 systems.
:title:DEC Ada, Language Reference Manual, part number AA-PYZAB-TK, which
describes in detail the pragmas and attributes provided by the DEC Ada 83
compiler system.

Gcc Ada Doc Gnat Rm Compatibility And Porting Guide (`gcc/ada/doc/gnat_rm/compatibility_and_porting_guide.rst`)

.. _Compatibility_and_Porting_Guide:

Compatibility and Porting Guide

This chapter presents some guidelines for developing portable Ada code,
describes the compatibility issues that may arise between
GNAT and other Ada compilation systems (including those for Ada 83),
and shows how GNAT can expedite porting
applications developed in other Ada environments.

.. _Writing_Portable_Fixed-Point_Declarations:

Writing Portable Fixed-Point Declarations

The Ada Reference Manual gives an implementation freedom to choose bounds
that are narrower by Small from the given bounds.
For example, if we write

.. code-block:: ada

text

type F1 is delta 1.0 range -128.0 .. +128.0;

then the implementation is allowed to choose -128.0 .. +127.0 if it
likes, but is not required to do so.

This leads to possible portability problems, so let's have a closer
look at this, and figure out how to avoid these problems.

First, why does this freedom exist, and why would an implementation
take advantage of it? To answer this, take a closer look at the type
declaration for F1 above. If the compiler uses the given bounds,
it would need 9 bits to hold the largest positive value (and typically
that means 16 bits on all machines). But if the implementation chooses
the +127.0 bound then it can fit values of the type in 8 bits.

Why not make the user write +127.0 if that's what is wanted?
The rationale is that if you are thinking of fixed point
as a kind of 'poor man's floating-point', then you don't want
to be thinking about the scaled integers that are used in its
representation. Let's take another example:

.. code-block:: ada

text

type F2 is delta 2.0**(-15) range -1.0 .. +1.0;

Looking at this declaration, it seems casually as though
it should fit in 16 bits, but again that extra positive value
+1.0 has the scaled integer equivalent of 2**15 which is one too
big for signed 16 bits. The implementation can treat this as:

.. code-block:: ada

text

type F2 is delta 2.0**(-15) range -1.0 .. +1.0-(2.0**(-15));

and the Ada language design team felt that this was too annoying
to require. We don't need to debate this decision at this point,
since it is well established (the rule about narrowing the ranges
dates to Ada 83).

But the important point is that an implementation is not required
to do this narrowing, so we have a potential portability problem.
We could imagine three types of implementation:

(a) those that narrow the range automatically if they can figure
out that the narrower range will allow storage in a smaller machine unit,

(b) those that will narrow only if forced to by a 'Size clause, and

Now if we are language theoreticians, we can imagine a fourth
approach: to narrow all the time, e.g. to treat

.. code-block:: ada

text

type F3 is delta 1.0 range -10.0 .. +23.0;

as though it had been written:

.. code-block:: ada

text

type F3 is delta 1.0 range -9.0 .. +22.0;

But although technically allowed, such a behavior would be hostile and silly,
and no real compiler would do this. All real compilers will fall into one of
the categories (a), (b) or (c) above.

So, how do you get the compiler to do what you want? The answer is give the
actual bounds you want, and then use a 'Small clause and a
'Size clause to absolutely pin down what the compiler does.
E.g., for F2 above, we will write:

.. code-block:: ada

text

My_Small : constant := 2.0**(-15);
 My_First : constant := -1.0;
 My_Last  : constant := +1.0 - My_Small;

 type F2 is delta My_Small range My_First .. My_Last;

and then add

.. code-block:: ada

text

for F2'Small use my_Small;
 for F2'Size  use 16;

In practice all compilers will do the same thing here and will give you
what you want, so the above declarations are fully portable. If you really
want to play language lawyer and guard against ludicrous behavior by the
compiler you could add

.. code-block:: ada

text

Test1 : constant := 1 / Boolean'Pos (F2'First = My_First);
 Test2 : constant := 1 / Boolean'Pos (F2'Last  = My_Last);

One or other or both are allowed to be illegal if the compiler is
behaving in a silly manner, but at least the silly compiler will not
get away with silently messing with your (very clear) intentions.

If you follow this scheme you will be guaranteed that your fixed-point
types will be portable.

.. _Compatibility_with_Ada_83:

Compatibility with Ada 83

.. index:: Compatibility (between Ada 83 and Ada 95 / Ada 2005 / Ada 2012 / Ada 2022)

Ada 95 and the subsequent revisions Ada 2005, Ada 2012, Ada 2022
are highly upwards compatible with Ada 83. In
particular, the design intention was that the difficulties associated
with moving from Ada 83 to later versions of the standard should be no greater
than those that occur when moving from one Ada 83 system to another.

However, there are a number of points at which there are minor
incompatibilities. The :title:Ada 95 Annotated Reference Manual contains
full details of these issues as they relate to Ada 95,
and should be consulted for a complete treatment.
In practice the
following subsections treat the most likely issues to be encountered.

.. _Legal_Ada_83_programs_that_are_illegal_in_Ada_95:

Legal Ada 83 programs that are illegal in Ada 95

Some legal Ada 83 programs are illegal (i.e., they will fail to compile) in
Ada 95 and later versions of the standard:

Character literals

Some uses of character literals are ambiguous. Since Ada 95 has introduced
Wide_Character as a new predefined character type, some uses of
character literals that were legal in Ada 83 are illegal in Ada 95.
For example:

.. code-block:: ada
text
```
for Char in 'A' .. 'Z' loop ... end loop;
```
The problem is that 'A' and 'Z' could be from either
Character or Wide_Character. The simplest correction
is to make the type explicit; e.g.:

.. code-block:: ada
text
```
for Char in Character range 'A' .. 'Z' loop ... end loop;
```
New reserved words

The identifiers abstract, aliased, protected,
requeue, tagged, and until are reserved in Ada 95.
Existing Ada 83 code using any of these identifiers must be edited to
use some alternative name.
Freezing rules

The rules in Ada 95 are slightly different with regard to the point at
which entities are frozen, and representation pragmas and clauses are
not permitted past the freeze point. This shows up most typically in
the form of an error message complaining that a representation item
appears too late, and the appropriate corrective action is to move
the item nearer to the declaration of the entity to which it refers.

A particular case is that representation pragmas
cannot be applied to a subprogram body. If necessary, a separate subprogram
declaration must be introduced to which the pragma can be applied.
Optional bodies for library packages

In Ada 83, a package that did not require a package body was nevertheless
allowed to have one. This lead to certain surprises in compiling large
systems (situations in which the body could be unexpectedly ignored by the
binder). In Ada 95, if a package does not require a body then it is not
permitted to have a body. To fix this problem, simply remove a redundant
body if it is empty, or, if it is non-empty, introduce a dummy declaration
into the spec that makes the body required. One approach is to add a private
part to the package declaration (if necessary), and define a parameterless
procedure called Requires_Body, which must then be given a dummy
procedure body in the package body, which then becomes required.
Another approach (assuming that this does not introduce elaboration
circularities) is to add an Elaborate_Body pragma to the package spec,
since one effect of this pragma is to require the presence of a package body.
Numeric_Error is the same exception as Constraint_Error

In Ada 95, the exception Numeric_Error is a renaming of Constraint_Error.
This means that it is illegal to have separate exception handlers for
the two exceptions. The fix is simply to remove the handler for the
Numeric_Error case (since even in Ada 83, a compiler was free to raise
Constraint_Error in place of Numeric_Error in all cases).
Indefinite subtypes in generics

In Ada 83, it was permissible to pass an indefinite type (e.g, String)
as the actual for a generic formal private type, but then the instantiation
would be illegal if there were any instances of declarations of variables
of this type in the generic body. In Ada 95, to avoid this clear violation
of the methodological principle known as the 'contract model',
the generic declaration explicitly indicates whether
or not such instantiations are permitted. If a generic formal parameter
has explicit unknown discriminants, indicated by using (<>) after the
subtype name, then it can be instantiated with indefinite types, but no
stand-alone variables can be declared of this type. Any attempt to declare
such a variable will result in an illegality at the time the generic is
declared. If the (<>) notation is not used, then it is illegal
to instantiate the generic with an indefinite type.
This is the potential incompatibility issue when porting Ada 83 code to Ada 95.
It will show up as a compile time error, and
the fix is usually simply to add the (<>) to the generic declaration.

.. _More_deterministic_semantics:

More deterministic semantics

Conversions

Conversions from real types to integer types round away from 0. In Ada 83
the conversion Integer(2.5) could deliver either 2 or 3 as its value. This
implementation freedom was intended to support unbiased rounding in
statistical applications, but in practice it interfered with portability.
In Ada 95 the conversion semantics are unambiguous, and rounding away from 0
is required. Numeric code may be affected by this change in semantics.
Note, though, that this issue is no worse than already existed in Ada 83
when porting code from one vendor to another.
Tasking

The Real-Time Annex introduces a set of policies that define the behavior of
features that were implementation dependent in Ada 83, such as the order in
which open select branches are executed.

.. _Changed_semantics:

Changed semantics

The worst kind of incompatibility is one where a program that is legal in
Ada 83 is also legal in Ada 95 but can have an effect in Ada 95 that was not
possible in Ada 83. Fortunately this is extremely rare, but the one
situation that you should be alert to is the change in the predefined type
Character from 7-bit ASCII to 8-bit Latin-1.

text

.. index:: Latin-1

Range of type Character

The range of Standard.Character is now the full 256 characters
of Latin-1, whereas in most Ada 83 implementations it was restricted
to 128 characters. Although some of the effects of
this change will be manifest in compile-time rejection of legal
Ada 83 programs it is possible for a working Ada 83 program to have
a different effect in Ada 95, one that was not permitted in Ada 83.
As an example, the expression
Character'Pos(Character'Last) returned 127 in Ada 83 and now
delivers 255 as its value.
In general, you should look at the logic of any
character-processing Ada 83 program and see whether it needs to be adapted
to work correctly with Latin-1. Note that the predefined Ada 95 API has a
character handling package that may be relevant if code needs to be adapted
to account for the additional Latin-1 elements.
The desirable fix is to
modify the program to accommodate the full character set, but in some cases
it may be convenient to define a subtype or derived type of Character that
covers only the restricted range.

.. _Other_language_compatibility_issues:

Other language compatibility issues

-gnat83 switch

All implementations of GNAT provide a switch that causes GNAT to operate
in Ada 83 mode. In this mode, some but not all compatibility problems
of the type described above are handled automatically. For example, the
new reserved words introduced in Ada 95 and Ada 2005 are treated simply
as identifiers as in Ada 83. However,
in practice, it is usually advisable to make the necessary modifications
to the program to remove the need for using this switch.
See the Compiling Different Versions of Ada section in
the :title:GNAT User's Guide.
Support for removed Ada 83 pragmas and attributes

A number of pragmas and attributes from Ada 83 were removed from Ada 95,
generally because they were replaced by other mechanisms. Ada 95 and Ada 2005
compilers are allowed, but not required, to implement these missing
elements. In contrast with some other compilers, GNAT implements all
such pragmas and attributes, eliminating this compatibility concern. These
include pragma Interface and the floating point type attributes
(Emax, Mantissa, etc.), among other items.

.. _Compatibility_between_Ada_95_and_Ada_2005:

Compatibility between Ada 95 and Ada 2005

.. index:: Compatibility between Ada 95 and Ada 2005

Although Ada 2005 was designed to be upwards compatible with Ada 95, there are
a number of incompatibilities. Several are enumerated below;
for a complete description please see the
:title:Annotated Ada 2005 Reference Manual, or section 9.1.1 in
:title:Rationale for Ada 2005.

New reserved words.

The words interface, overriding and synchronized are
reserved in Ada 2005.
A pre-Ada 2005 program that uses any of these as an identifier will be
illegal.
New declarations in predefined packages.

A number of packages in the predefined environment contain new declarations:
Ada.Exceptions, Ada.Real_Time, Ada.Strings,
Ada.Strings.Fixed, Ada.Strings.Bounded,
Ada.Strings.Unbounded, Ada.Strings.Wide_Fixed,
Ada.Strings.Wide_Bounded, Ada.Strings.Wide_Unbounded,
Ada.Tags, Ada.Text_IO, and Interfaces.C.
If an Ada 95 program does a with and use of any of these
packages, the new declarations may cause name clashes.
Access parameters.

A nondispatching subprogram with an access parameter cannot be renamed
as a dispatching operation. This was permitted in Ada 95.
Access types, discriminants, and constraints.

Rule changes in this area have led to some incompatibilities; for example,
constrained subtypes of some access types are not permitted in Ada 2005.
Aggregates for limited types.

The allowance of aggregates for limited types in Ada 2005 raises the
possibility of ambiguities in legal Ada 95 programs, since additional types
now need to be considered in expression resolution.
Fixed-point multiplication and division.

Certain expressions involving '*' or '/' for a fixed-point type, which
were legal in Ada 95 and invoked the predefined versions of these operations,
are now ambiguous.
The ambiguity may be resolved either by applying a type conversion to the
expression, or by explicitly invoking the operation from package
Standard.
Return-by-reference types.

The Ada 95 return-by-reference mechanism has been removed. Instead, the user
can declare a function returning a value from an anonymous access type.

.. _Implementation-dependent_characteristics:

Implementation-dependent characteristics

Although the Ada language defines the semantics of each construct as
precisely as practical, in some situations (for example for reasons of
efficiency, or where the effect is heavily dependent on the host or target
platform) the implementation is allowed some freedom. In porting Ada 83
code to GNAT, you need to be aware of whether / how the existing code
exercised such implementation dependencies. Such characteristics fall into
several categories, and GNAT offers specific support in assisting the
transition from certain Ada 83 compilers.

.. _Implementation-defined_pragmas:

Implementation-defined pragmas

Ada compilers are allowed to supplement the language-defined pragmas, and
these are a potential source of non-portability. All GNAT-defined pragmas
are described in :ref:Implementation_Defined_Pragmas,
and these include several that are specifically
intended to correspond to other vendors' Ada 83 pragmas.
For migrating from VADS, the pragma Use_VADS_Size may be useful.
For compatibility with HP Ada 83, GNAT supplies the pragmas
Extend_System, Ident, Inline_Generic,
Interface_Name, Passive, Suppress_All,
and Volatile.
Other relevant pragmas include External and Link_With.
Some vendor-specific
Ada 83 pragmas (Share_Generic, Subtitle, and Title) are
recognized, thus
avoiding compiler rejection of units that contain such pragmas; they are not
relevant in a GNAT context and hence are not otherwise implemented.

.. _Implementation-defined_attributes:

Implementation-defined attributes

Analogous to pragmas, the set of attributes may be extended by an
implementation. All GNAT-defined attributes are described in
:ref:Implementation_Defined_Attributes,
and these include several that are specifically intended
to correspond to other vendors' Ada 83 attributes. For migrating from VADS,
the attribute VADS_Size may be useful. For compatibility with HP
Ada 83, GNAT supplies the attributes Bit, Machine_Size and
Type_Class.

.. _Libraries:

Libraries

Vendors may supply libraries to supplement the standard Ada API. If Ada 83
code uses vendor-specific libraries then there are several ways to manage
this in Ada 95 and later versions of the standard:

If the source code for the libraries (specs and bodies) are
available, then the libraries can be migrated in the same way as the
application.
If the source code for the specs but not the bodies are
available, then you can reimplement the bodies.
Some features introduced by Ada 95 obviate the need for library support. For
example most Ada 83 vendors supplied a package for unsigned integers. The
Ada 95 modular type feature is the preferred way to handle this need, so
instead of migrating or reimplementing the unsigned integer package it may
be preferable to retrofit the application using modular types.

.. _Elaboration_order:

Elaboration order

The implementation can choose any elaboration order consistent with the unit
dependency relationship. This freedom means that some orders can result in
Program_Error being raised due to an 'Access Before Elaboration': an attempt
to invoke a subprogram before its body has been elaborated, or to instantiate
a generic before the generic body has been elaborated. By default GNAT
attempts to choose a safe order (one that will not encounter access before
elaboration problems) by implicitly inserting Elaborate or
Elaborate_All pragmas where
needed. However, this can lead to the creation of elaboration circularities
and a resulting rejection of the program by gnatbind. This issue is
thoroughly described in the Elaboration Order Handling in GNAT appendix
in the :title:GNAT User's Guide.
In brief, there are several
ways to deal with this situation:

Modify the program to eliminate the circularities, e.g., by moving
elaboration-time code into explicitly-invoked procedures
Constrain the elaboration order by including explicit Elaborate_Body or
Elaborate pragmas, and then inhibit the generation of implicit
Elaborate_All
pragmas either globally (as an effect of the -gnatE switch) or locally
(by selectively suppressing elaboration checks via pragma
Suppress(Elaboration_Check) when it is safe to do so).

.. _Target-specific_aspects:

Target-specific aspects

Low-level applications need to deal with machine addresses, data
representations, interfacing with assembler code, and similar issues. If
such an Ada 83 application is being ported to different target hardware (for
example where the byte endianness has changed) then you will need to
carefully examine the program logic; the porting effort will heavily depend
on the robustness of the original design. Moreover, Ada 95 (and thus
Ada 2005, Ada 2012, and Ada 2022) are sometimes
incompatible with typical Ada 83 compiler practices regarding implicit
packing, the meaning of the Size attribute, and the size of access values.
GNAT's approach to these issues is described in :ref:Representation_Clauses.

.. _Compatibility_with_Other_Ada_Systems:

Compatibility with Other Ada Systems

If programs avoid the use of implementation dependent and
implementation defined features, as documented in the
:title:Ada Reference Manual, there should be a high degree of portability between
GNAT and other Ada systems. The following are specific items which
have proved troublesome in moving Ada 95 programs from GNAT to other Ada 95
compilers, but do not affect porting code to GNAT.
(As of January 2007, GNAT is the only compiler available for Ada 2005;
the following issues may or may not arise for Ada 2005 programs
when other compilers appear.)

Ada 83 Pragmas and Attributes

Ada 95 compilers are allowed, but not required, to implement the missing
Ada 83 pragmas and attributes that are no longer defined in Ada 95.
GNAT implements all such pragmas and attributes, eliminating this as
a compatibility concern, but some other Ada 95 compilers reject these
pragmas and attributes.
Specialized Needs Annexes

GNAT implements the full set of special needs annexes. At the
current time, it is the only Ada 95 compiler to do so. This means that
programs making use of these features may not be portable to other Ada
95 compilation systems.
Representation Clauses

Some other Ada 95 compilers implement only the minimal set of
representation clauses required by the Ada 95 reference manual. GNAT goes
far beyond this minimal set, as described in the next section.

.. _Representation_Clauses:

Representation Clauses

The Ada 83 reference manual was quite vague in describing both the minimal
required implementation of representation clauses, and also their precise
effects. Ada 95 (and thus also Ada 2005) are much more explicit, but the
minimal set of capabilities required is still quite limited.

GNAT implements the full required set of capabilities in
Ada 95 and Ada 2005, but also goes much further, and in particular
an effort has been made to be compatible with existing Ada 83 usage to the
greatest extent possible.

A few cases exist in which Ada 83 compiler behavior is incompatible with
the requirements in Ada 95 (and thus also Ada 2005). These are instances of
intentional or accidental dependence on specific implementation dependent
characteristics of these Ada 83 compilers. The following is a list of
the cases most likely to arise in existing Ada 83 code.

Implicit Packing

Some Ada 83 compilers allowed a Size specification to cause implicit
packing of an array or record. This could cause expensive implicit
conversions for change of representation in the presence of derived
types, and the Ada design intends to avoid this possibility.
Subsequent AI's were issued to make it clear that such implicit
change of representation in response to a Size clause is inadvisable,
and this recommendation is represented explicitly in the Ada 95 (and Ada 2005)
Reference Manuals as implementation advice that is followed by GNAT.
The problem will show up as an error
message rejecting the size clause. The fix is simply to provide
the explicit pragma Pack, or for more fine tuned control, provide
a Component_Size clause.
Meaning of Size Attribute

The Size attribute in Ada 95 (and Ada 2005) for discrete types is defined as
the minimal number of bits required to hold values of the type. For example,
on a 32-bit machine, the size of Natural will typically be 31 and not
32 (since no sign bit is required). Some Ada 83 compilers gave 31, and
some 32 in this situation. This problem will usually show up as a compile
time error, but not always. It is a good idea to check all uses of the
'Size attribute when porting Ada 83 code. The GNAT specific attribute
Object_Size can provide a useful way of duplicating the behavior of
some Ada 83 compiler systems.
Size of Access Types

A common assumption in Ada 83 code is that an access type is in fact a pointer,
and that therefore it will be the same size as a System.Address value. This
assumption is true for GNAT in most cases with one exception. For the case of
a pointer to an unconstrained array type (where the bounds may vary from one
value of the access type to another), the default is to use a 'fat pointer',
which is represented as two separate pointers, one to the bounds, and one to
the array. This representation has a number of advantages, including improved
efficiency. However, it may cause some difficulties in porting existing Ada 83
code which makes the assumption that, for example, pointers fit in 32 bits on
a machine with 32-bit addressing.

To get around this problem, GNAT also permits the use of 'thin pointers' for
access types in this case (where the designated type is an unconstrained array
type). These thin pointers are indeed the same size as a System.Address value.
To specify a thin pointer, use a size clause for the type, for example:

.. code-block:: ada
text
```
type X is access all String;
 for X'Size use Standard'Address_Size;
```
which will cause the type X to be represented using a single pointer.
When using this representation, the bounds are right behind the array.
This representation is slightly less efficient, and does not allow quite
such flexibility in the use of foreign pointers or in using the
Unrestricted_Access attribute to create pointers to non-aliased objects.
But for any standard portable use of the access type it will work in
a functionally correct manner and allow porting of existing code.
Note that another way of forcing a thin pointer representation
is to use a component size clause for the element size in an array,
or a record representation clause for an access field in a record.

See the documentation of Unrestricted_Access in the GNAT RM for a
full discussion of possible problems using this attribute in conjunction
with thin pointers.

.. _Compatibility_with_HP_Ada_83:

Compatibility with HP Ada 83

All the HP Ada 83 pragmas and attributes are recognized, although only a subset
of them can sensibly be implemented. The description of pragmas in
:ref:Implementation_Defined_Pragmas indicates whether or not they are
applicable to GNAT.

Default floating-point representation

In GNAT, the default floating-point format is IEEE, whereas in HP Ada 83,
it is VMS format.
System

the package System in GNAT exactly corresponds to the definition in the
Ada 95 reference manual, which means that it excludes many of the
HP Ada 83 extensions. However, a separate package Aux_DEC is provided
that contains the additional definitions, and a special pragma,
Extend_System allows this package to be treated transparently as an
extension of package System.

Gcc Ada Doc Gnat Rm Gnat Implementation Mode (`gcc/ada/doc/gnat_rm/gnat_implementation_mode.rst`)

.. _GNAT_Implementation_Mode:

GNAT Implementation Mode (the -gnatg switch)

-gnatg enables GNAT implementation mode, the internal compilation mode
used when building GNAT itself and its runtime libraries. It is not intended
for user application programs.

It implies -gnatw.ge (extended warning set, treated as errors) and
-gnatyg (GNAT style checks).

Language & Semantic Changes

Ada Version and Identifier Rules

Ada version is fixed at Ada 2012, regardless of other switches.
Identifier character set is restricted to 7-bit ASCII;
extended characters are disallowed.
Identifiers are allowed to start with underscore to avoid conflicts
between global symbols in the runtime and those defined in the user code.

Limited Types

Copying limited objects is permitted (normally illegal).
Initializing limited types emits a warning rather than an error.
Returning objects of limited types is permitted.

Preelaboration and Categorization

Categorization errors (pure/preelaborated unit violations) are downgraded
to warnings.
Statements in preelaborated units emit a warning rather than an error.
Private objects and non-static constants/calls in preelaborated units emit
warnings rather than errors.
Calls to non-preelaborable subprograms in preelaborated packages are
demoted to suppressible warnings (RM 10.2.1), allowing the runtime to
include elaboration code that would otherwise be forbidden.
Assignment statements to library-level variables are excluded from
access-before-elaboration (ABE) analysis, on the assumption that the
predefined runtime manages its own elaboration order correctly.

Overflow

Overflow checks are suppressed but the overflow checking mode is set to
Strict (for assertion purposes).

Miscellaneous

Scalar_Storage_Order attribute applies to generic types (normally
it does not).
Only the --! special comment sequence is recognized; all others are
disallowed.
The Priority aspect/attribute on protected types accepts the
unconstrained type Any_Priority rather than the subtype
System.Priority (a subrange of Integer), giving GNAT's own
protected objects access to the full implementation-defined priority range.
pragma Extend_System is ignored (prevents circularities in System).
Exception: predefined renaming units (Text_IO, Direct_IO, etc.) are
compiled without GNAT implementation mode so that Extend_System still
works for them.
Importing a non-pure external function (pragma Import) into a Pure
unit does not produce a purity warning, on the assumption that the
runtime knows the purity properties of the C functions it imports.
pragma Style_Checks ("All_Checks") activates the stricter -gnatyg
rule set rather than the default -gnaty set.

ALI Files and Recompilation

ALI files are always generated for predefined generic packages.
Compiling a unit whose top-level name is Ada, Interfaces, or
System as the main unit is permitted; the RM reserves these as
hierarchical library-unit name prefixes, but the diagnostic is suppressed
to let GNAT compile its own predefined library (Ada.Text_IO,
System.Storage_Elements, etc.) as main units.

Gcc Ada Doc Gnat Rm Gnat Language Extensions (`gcc/ada/doc/gnat_rm/gnat_language_extensions.rst`)

.. role:: ada(code)
:language: ada

.. _GNAT_Language_Extensions:

GNAT language extensions

The GNAT compiler implements a certain number of language extensions on top of
the latest Ada standard, implementing its own extended superset of Ada.

There are two sets of language extensions:

The first is the curated set. The features in that set are features that we
consider being worthy additions to the Ada language, and that we want to make
available to users early on.
The second is the experimental set. It includes the first, but also
experimental features, which are considered experimental because
they're still in an early prototyping phase.
These features might be removed or heavily modified at any time.

How to activate the extended GNAT Ada superset

There are two ways to activate the extended GNAT Ada superset:

The :ref:Pragma Extensions_Allowed. To activate
the curated set of extensions, you should use

.. code-block:: ada

pragma Extensions_Allowed (On)

As a configuration pragma, you can either put it at the beginning of a source
file, or in a .adc file corresponding to your project.

The -gnatX command-line option will
activate the curated subset of extensions.

.. attention:: You can activate the experimental set of extensions
in addition by using either
the -gnatX0 command-line option, or the pragma Extensions_Allowed with
All_Extensions as an argument. However, it is not recommended you use
this subset for serious projects; it is only meant as a technology preview
for use in playground experiments.

.. _Curated_Language_Extensions:

Curated Extensions

Features activated via -gnatX or
pragma Extensions_Allowed (On).

Local Declarations Without Block

A basic_declarative_item may appear at the place of any statement. This
avoids the heavy syntax of block_statements just to declare something locally.

The only valid kinds of declarations for now are object_declaration,
object_renaming_declaration, use_package_clause, and
use_type_clause.

For example:

.. code-block:: ada

if X > 5 then
X := X + 1;

text

Squared : constant Integer := X**2;

  X := X + Squared;

end if;

It is generally a good practice to declare local variables (or constants) with as
short a lifetime as possible. However, introducing a declare block to accomplish
this is a relatively heavy syntactic load along with a traditional extra level
of indentation. The alternative syntax supported here allows declarations
in any statement sequence.
The lifetime of such local declarations is until the end of
the enclosing construct. The same enclosing construct cannot contain several
declarations of the same defining name; however, overriding symbols from higher-level
scopes works similarly to the explicit declare block.

If the enclosing construct allows an exception handler (such as an accept
statement, begin-except-end block or a subprogram body), declarations that
appear at the place of a statement are not visible within the handler. Only
declarations that precede the beginning of the construct with an exception
handler would be visible in this handler.

.. attention::

Here are a couple of examples illustrating the scoping rules described above.

Those declarations are not visible from the potential exception handler:

.. code-block:: ada

begin
A : Integer
...

exception
when others =>
Put_Line (A'Image) -- ILLEGAL

end;
The following is legal

.. code-block:: ada

declare
A : Integer := 10;

begin
A : Integer := 12;

end;

because it is roughly expanded into

.. code-block:: ada

declare
A : Integer := 10;

begin
declare
A : Integer := 12;
begin
...
end;

end;

And as such the second A declaration is hiding the first one.

Deep delta Aggregates

Ada 2022's delta aggregates are extended to allow deep updates.

A delta aggregate may be used to specify new values for subcomponents of the
copied base value, instead of only new values for direct components of the
copied base value. This allows a more compact expression of updated values with
a single delta aggregate, instead of multiple nested delta aggregates.

The syntax of delta aggregates in the extended version is the following:

Syntax
^^^^^^

.. code::

delta_aggregate ::= record_delta_aggregate | array_delta_aggregate

record_delta_aggregate ::=
( base_expression with delta record_subcomponent_association_list )

record_subcomponent_association_list ::=
record_subcomponent_association {, record_subcomponent_association}

record_subcomponent_association ::=
record_subcomponent_choice_list => expression

record_subcomponent_choice_list ::=
record_subcomponent_choice {'|' record_subcomponent_choice}

record_subcomponent_choice ::=
component_selector_name
| record_subcomponent_choice (expression)
| record_subcomponent_choice . component_selector_name

array_delta_aggregate ::=
( base_expression with delta array_component_association_list )
| '[' base_expression with delta array_component_association_list ']'
| ( base_expression with delta array_subcomponent_association_list )
| '[' base_expression with delta array_subcomponent_association_list ']'

array_subcomponent_association_list ::=
array_subcomponent_association {, array_subcomponent_association}

array_subcomponent_association ::=
array_subcomponent_choice_list => expression

array_subcomponent_choice_list ::=
array_subcomponent_choice {'|' array_subcomponent_choice}

array_subcomponent_choice ::=
( expression )
| array_subcomponent_choice (expression)
| array_subcomponent_choice . component_selector_name

Legality Rules
^^^^^^^^^^^^^^

For an array_delta_aggregate, the discrete_choice shall not be others.
For an array_delta_aggregate, the dimensionality of the type of the
delta_aggregate shall be 1.
For an array_delta_aggregate, the base_expression and each
expression in every array_component_association or
array_subcomponent_association shall be of a nonlimited type.
For a record_delta_aggregate, no record_subcomponent_choices that
consists of only component_selector_names shall be the same or a prefix
of another record_subcomponent_choice.
For an array_subcomponent_choice or a record_subcomponent_choice the
component_selector_name shall not be a subcomponent that depends on
discriminants of an unconstrained record subtype with defaulted
discriminants unless its prefix consists of only
component_selector_names.

[Rationale: As a result of this rule, accessing the subcomponent can only
lead to a discriminant check failure if the subcomponent was not present in
the object denoted by the base_expression, prior to any update.]

Dynamic Semantics
^^^^^^^^^^^^^^^^^

The evaluation of a delta_aggregate begins with the evaluation of the
base_expression of the delta_aggregate; then that value is used to create
and initialize the anonymous object of the aggregate. The bounds of the
anonymous object of an array_delta_aggregate and the discriminants (if any)
of the anonymous object of a record_delta_aggregate are those of the
base_expression.

If a record_delta_aggregate is of a specific tagged type, its tag is that
of the specific type; if it is of a class-wide type, its tag is that of the
base_expression.

For a delta_aggregate, for each discrete_choice or each subcomponent
associated with a record_subcomponent_associated,
array_component_association or array_subcomponent_association (in the
order given in the enclosing discrete_choice_list or
subcomponent_association_list, respectively):

if the associated subcomponent belongs to a variant, a check is made that the
values of the governing discriminants are such that the anonymous object has
this component. The exception Constraint_Error is raised if this check fails.
if the associated subcomponent is a subcomponent of an array, then for each
represented index value (in ascending order, if the discrete_choice
represents a range):
- the index value is converted to the index type of the array type.
- a check is made that the index value belongs to the index range of the
  corresponding array part of the anonymous object; Constraint_Error is
  raised if this check fails.
- the expression of the record_subcomponent_association,
  array_component_association or array_subcomponent_association is
  evaluated, converted to the nominal subtype of the associated subcomponent,
  and assigned to the corresponding subcomponent of the anonymous object.

Examples
^^^^^^^^

.. code-block:: ada
:linenos:

declare
type Point is record
X, Y : Integer;
end record;

text

type Segment is array (1 .. 2) of Point;
  type Triangle is array (1 .. 3) of Segment;

  S : Segment := (1 .. 2 => (0, 0));
  T : Triangle := (1 .. 3 => (1 .. 2 => (0, 0)));

begin
S := (S with delta (1).X => 11, (2).Y => 12, (1).Y => 15);

text

pragma Assert (S (1).X = 11);
  pragma Assert (S (2).Y = 12);
  pragma Assert (S (1).Y = 15);

  T := (T with delta (2)(1).Y => 18);
  pragma Assert (T (2)(1).Y = 18);

end;

Fixed lower bounds for array types and subtypes

Unconstrained array types and subtypes can be specified with a lower bound that
is fixed to a certain value, by writing an index range that uses the syntax
<lower-bound-expression> .. <>. This guarantees that all objects of the
type or subtype will have the specified lower bound.

For example, a matrix type with fixed lower bounds of zero for each dimension
can be declared by the following:

.. code-block:: ada

text

type Matrix is
  array (Natural range 0 .. <>, Natural range 0 .. <>) of Integer;

Objects of type Matrix declared with an index constraint must have index
ranges starting at zero:

.. code-block:: ada

text

M1 : Matrix (0 .. 9, 0 .. 19);
M2 : Matrix (2 .. 11, 3 .. 22);  -- Warning about bounds; will raise CE

Similarly, a subtype of String can be declared that specifies the lower
bound of objects of that subtype to be 1:

.. code-block:: ada

text

subtype String_1 is String (1 .. <>);

If a string slice is passed to a formal of subtype String_1 in a call to a
subprogram S, the slice's bounds will "slide" so that the lower bound is
1.

Within S, the lower bound of the formal is known to be 1, so, unlike a
normal unconstrained String formal, there is no need to worry about
accounting for other possible lower-bound values. Sliding of bounds also occurs
in other contexts, such as for object declarations with an unconstrained
subtype with fixed lower bound, as well as in subtype conversions.

Use of this feature increases safety by simplifying code, and can also improve
the efficiency of indexing operations, since the compiler statically knows the
lower bound of unconstrained array formals when the formal's subtype has index
ranges with static fixed lower bounds.

Prefixed-view notation for calls to primitive subprograms of untagged types

When operating on an untagged type, if it has any primitive operations, and the
first parameter of an operation is of the type (or is an access parameter with
an anonymous type that designates the type), you may invoke these operations
using an object.op(...) notation, where the parameter that would normally be
the first parameter is brought out front, and the remaining parameters (if any)
appear within parentheses after the name of the primitive operation.

This same notation is already available for tagged types. This extension allows
for untagged types. It is allowed for all primitive operations of the type
independent of whether they were originally declared in a package spec,
or were inherited and/or overridden as part of a derived type
declaration occurring anywhere, so long as the first parameter is of the type,
or an access parameter designating the type.

For example:

.. code-block:: ada

text

generic
   type Elem_Type is private;
package Vectors is
    type Vector is private;
    procedure Add_Element (V : in out Vector; Elem : Elem_Type);
    function Nth_Element (V : Vector; N : Positive) return Elem_Type;
    function Length (V : Vector) return Natural;
private
    function Capacity (V : Vector) return Natural;
       --  Return number of elements that may be added without causing
       --  any new allocation of space

    type Vector is ...
      with Type_Invariant => Vector.Length <= Vector.Capacity;
    ...
end Vectors;

package Int_Vecs is new Vectors(Integer);

V : Int_Vecs.Vector;
...
V.Add_Element(42);
V.Add_Element(-33);

pragma Assert (V.Length = 2);
pragma Assert (V.Nth_Element(1) = 42);

Expression defaults for generic formal functions

The declaration of a generic formal function is allowed to specify
an expression as a default, using the syntax of an expression function.

Here is an example of this feature:

.. code-block:: ada

text

generic
   type T is private;
   with function Copy (Item : T) return T is (Item); -- Defaults to Item
package Stacks is

   type Stack is limited private;

   procedure Push (S : in out Stack; X : T); -- Calls Copy on X
   function Pop (S : in out Stack) return T; -- Calls Copy to return item

private
   -- ...
end Stacks;

If Stacks is instantiated with an explicit actual for Copy,
then that will be called when Copy is called in the generic body.
If the default is used (i.e. there is no actual corresponding to Copy),
then calls to Copy in the instance will simply return Item.

String interpolation

The syntax for string literals is extended to support string interpolation.
An interpolated string literal starts with f, immediately before
the first double-quote character.

Within an interpolated string literal, an arbitrary expression, when
enclosed in { ... }, is expanded at run time into the result of calling
'Image on the result of evaluating the expression enclosed by the brace
characters, unless it is already a string or a single character.

Here is an example of this feature where the expressions Name and X + Y
will be evaluated and included in the string.

.. code-block:: ada

procedure Test_Interpolation is
X : Integer := 12;
Y : Integer := 15;
Name : String := "Leo";
begin
Put_Line (f"The name is {Name} and the sum is {X + Y}.");
end Test_Interpolation;

This will print:

.. code-block:: ada

text

The name is Leo and the sum is 27.

In addition, an escape character (\) is provided for inserting certain
standard control characters (such as \t for tabulation or \n for
newline) or to escape characters with special significance to the
interpolated string syntax, namely ", {, },and \ itself.

================= =================
escaped_character meaning

\a ALERT
\b BACKSPACE
\f FORM FEED
\n LINE FEED
\r CARRIAGE RETURN
\t CHARACTER TABULATION
\v LINE TABULATION
\0 NUL

\\ \
\" "
\{ {
\} }
================= =================

Note that, unlike normal string literals, doubled double-quote characters have no
special significance. So to include a double-quote or a brace character
in an interpolated string, they must be preceded by a \.
Multiple interpolated strings are concatenated.
For example:

.. code-block:: ada

text

Put_Line
  (f"X = {X} and Y = {Y} and X+Y = {X+Y};\n" &
   f" a double quote is \" and" &
   f" an open brace is \{");

This will print:

.. code-block:: ada

text

X = 12 and Y = 15 and X+Y = 27
  a double quote is " and an open brace is {

Constrained attribute for generic objects

The Constrained attribute is permitted for objects of generic types. The
result indicates whether the corresponding actual is constrained.

``Static`` aspect on intrinsic functions

The Ada 202x Static aspect can be specified on Intrinsic imported functions
and the compiler will evaluate some of these intrinsics statically, in
particular the Shift_Left and Shift_Right intrinsics.

First Controlling Parameter

A new pragma/aspect, First_Controlling_Parameter, is introduced for tagged
types, altering the semantics of primitive/controlling parameters. When a
tagged type is marked with this aspect, only subprograms where the first
parameter is of that type will be considered dispatching primitives. This
pragma/aspect applies to the entire hierarchy, starting from the specified
type, without affecting inherited primitives.

Here is an example of this feature:

.. code-block:: ada

text

package Example is
   type Root is tagged private;

   procedure P (V : Integer; V2 : Root);
   -- Primitive

   type Child is tagged private
     with First_Controlling_Parameter;

private
   type Root is tagged null record;
   type Child is new Root with null record;

   overriding
   procedure P (V : Integer; V2 : Child);
   -- Primitive

   procedure P2 (V : Integer; V2 : Child);
   -- NOT Primitive

   function F return Child; -- NOT Primitive

   function F2 (V : Child) return Child;
   -- Primitive, but only controlling on the first parameter
end Example;

Note that function F2 (V : Child) return Child; differs from F2 (V : Child) return Child'Class; in that the return type is a specific, definite type. This
is also distinct from the legacy semantics, where further derivations with
added fields would require overriding the function.

The option -gnatw_j, that you can pass to the compiler directly, enables
warnings related to this new language feature. For instance, compiling the
example above without this switch produces no warnings, but compiling it with
-gnatw_j generates the following warning on the declaration of procedure P2:

.. code-block:: ada

text

warning: not a dispatching primitive of tagged type "Child"
warning: disallowed by First_Controlling_Parameter on "Child"

For generic formal tagged types, you can specify whether the type has the
First_Controlling_Parameter aspect enabled:

.. code-block:: ada

text

generic
   type T is tagged private with First_Controlling_Parameter;
package T is
    type U is new T with null record;
    function Foo return U; -- Not a primitive
end T;

For tagged partial views, the value of the aspect must be consistent between
the partial and full views:

.. code-block:: ada

text

package R is
   type T is tagged private;
...
private
   type T is tagged null record with First_Controlling_Parameter; -- ILLEGAL
end R;

Restricting the position of controlling parameter offers several advantages:

Simplification of the dispatching rules improves readability of Ada programs.
One doesn't need to analyze all subprogram parameters to understand if the given
subprogram is a primitive of a certain tagged type.
A programmer is free to use any type, including class-wide types, on other
parameters of a subprogram, without the need to consider possible effects of
overriding a primitive or creating new one.
The result of a function is never a controlling result.

``Unsigned_Base_Range`` aspect

A new pragma/aspect, Unsigned_Base_Range, is introduced to explicitly
enforce the use of an unsigned base type for signed integer types.
RM-3.5.4(9) mandates a symmetric base range for signed integer types. This
requirement often requires the use of larger data types for arithmetic
operations, potentially introducing undesirable run-time overhead and
performance penalties, particularly in embedded systems. For instance,
on a 64-bit architecture, a 64-bit multiplication can be performed with
a single hardware instruction, whereas a 128-bit multiplication requires
multiple instructions and intermediate steps.

Here is an example of this feature:

.. code-block:: ada

type Uns_64 is range 0 .. 2 ** 64 - 1
with Size => 64,
Unsigned_Base_Range => True;

It ensures that arithmetic operations of type Uns_64 are carried
out using 64 bits.

Generalized Finalization

The Finalizable aspect can be applied to any record type, tagged or not,
to specify that it provides the same level of control on the operations of
initialization, finalization, and assignment of objects as the controlled
types (see RM 7.6(2) for a high-level overview). The only restriction is
that the record type must be a root type, in other words not a derived type.

The aspect additionally makes it possible to specify relaxed semantics for
the finalization operations by means of the Relaxed_Finalization setting.
Here is the archetypal example:

.. code-block:: ada

text

type T is record
  ...
end record
  with Finalizable => (Initialize           => Initialize,
                       Adjust               => Adjust,
                       Finalize             => Finalize,
                       Relaxed_Finalization => True);

procedure Adjust     (Obj : in out T);
procedure Finalize   (Obj : in out T);
procedure Initialize (Obj : in out T);

The three procedures must be primitive operations of T and have a single
in out parameter. They need not be all specified by the aspect. If they
are specified, they have the same dynamic semantics as for controlled types:

Initialize is called when an object of type T is declared without
initialization expression.
Adjust is called after an object of type T is assigned a new value.
Finalize is called when an object of type T goes out of scope (for
stack-allocated objects) or is deallocated (for heap-allocated objects).
It is also called when the value is replaced by an assignment.

However, when Relaxed_Finalization is either True or not explicitly
specified, the following differences are implemented relative to the semantics
of controlled types:

The compiler has permission to perform no automatic finalization of
heap-allocated objects: Finalize is only called when such an object
is explicitly deallocated, or when the designated object is assigned a new
value. As a consequence, no runtime support is needed for performing
implicit deallocation. In particular, no per-object header data is needed
for heap-allocated objects.

Heap-allocated objects allocated through a nested access type will therefore
not be deallocated either. The result is simply that memory will be leaked
in this case.
The Adjust and Finalize procedures are automatically considered as
having the :ref:No_Raise_Aspect specified for them. In particular, the
compiler has permission to enforce none of the guarantees specified by the
RM 7.6.1 (14/1) and subsequent subclauses.

Simple example of ref-counted type:

.. code-block:: ada

type T is record
Value : Integer;
Ref_Count : Natural := 0;
end record;

procedure Inc_Ref (X : in out T);
procedure Dec_Ref (X : in out T);

type T_Access is access all T;

type T_Ref is record
Value : T_Access;
end record
with Finalizable => (Adjust => Adjust,
Finalize => Finalize);

procedure Adjust (Ref : in out T_Ref) is
begin
Inc_Ref (Ref.Value);
end Adjust;

procedure Finalize (Ref : in out T_Ref) is
begin
Def_Ref (Ref.Value);
end Finalize;

Simple file handle that ensures resources are properly released:

.. code-block:: ada

package P is
type File (<>) is limited private;

text

function Open (Path : String) return File;

  procedure Close (F : in out File);

private
type File is limited record
Handle : ...;
end record
with Finalizable (Finalize => Close);
end P;

Finalizable tagged types
^^^^^^^^^^^^^^^^^^^^^^^^

The aspect is inherited by derived types and the primitives may be overridden
by the derivation. The compiler-generated calls to these operations are then
dispatching whenever it makes sense, i.e. when the object in question is of a
class-wide type and the class includes at least one finalizable tagged type.

Composite types
^^^^^^^^^^^^^^^

When a finalizable type is used as a component of a composite type, the latter
becomes finalizable as well. The three primitives are derived automatically
in order to call the primitives of their components. The dynamic semantics is
the same as for controlled components of composite types.

Interoperability with controlled types
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Finalizable types are fully interoperable with controlled types, in particular
it is possible for a finalizable type to have a controlled component and vice
versa, but the stricter dynamic semantics, in other words that of controlled
types, is applied in this case.

.. _Experimental_Language_Extensions:

Experimental Language Extensions

Features activated via -gnatX0 or
pragma Extensions_Allowed (All_Extensions).

Conditional when constructs

This feature extends the use of when as a way to condition a control-flow
related statement, to all control-flow related statements.

To do a conditional return in a procedure the following syntax should be used:

.. code-block:: ada

procedure P (Condition : Boolean) is
begin
return when Condition;
end P;

This will return from the procedure if Condition is true.

When being used in a function the conditional part comes after the return value:

.. code-block:: ada

function Is_Null (I : Integer) return Boolean is
begin
return True when I = 0;
return False;
end;

In a similar way to the exit when a goto ... when can be employed:

.. code-block:: ada

procedure Low_Level_Optimized is
Flags : Bitmapping;
begin
Do_1 (Flags);
goto Cleanup when Flags (1);

text

Do_2 (Flags);
  goto Cleanup when Flags (32);

  --  ...

<>
-- ...
end;

.. code-block

To use a conditional raise construct:

.. code-block:: ada

procedure Foo is
begin
raise Error when Imported_C_Func /= 0;
end;

An exception message can also be added:

.. code-block:: ada

procedure Foo is
begin
raise Error with "Unix Error"
when Imported_C_Func /= 0;
end;

Implicit With

This feature allows a standalone use clause in the context clause of a
compilation unit to imply an implicit with of the same library unit where
an equivalent with clause would be allowed.

.. code-block:: ada

use Ada.Text_IO;
procedure Main is
begin
Put_Line ("Hello");
end;

Storage Model

This extends Storage Pools into a more efficient model allowing higher performance,
easier integration with low footprint embedded run-times and copying data between
different pools of memory. The latter is especially useful when working with distributed
memory models, in particular to support interactions with GPU.

Aspect Storage_Model_Type
^^^^^^^^^^^^^^^^^^^^^^^^^^

A Storage model is a type with a specified Storage_Model_Type
aspect, e.g.:

.. code-block:: Ada

type A_Model is null record
with Storage_Model_Type (...);

Storage_Model_Type itself accepts six parameters:

Address_Type, the type of the address managed by this model. This has to be
a scalar type or derived from System.Address.
Allocate, a procedure used for allocating memory in this model
Deallocate, a procedure used for deallocating memory in this model
Copy_To, a procedure used to copy memory from native memory to this model
Copy_From, a procedure used to copy memory from this model to native memory
Storage_Size, a function returning the amount of memory left
Null_Address, a value for the null address value

By default, Address_Type is System.Address, and the five subprograms
perform native operations (e.g. the allocator is the native new allocator).
Users can decide to specify one or more of these. When an Address_Type is
specified to be other than System.Address, all of the subprograms have
to be specified.

The prototypes of these procedures are as follows:

.. code-block:: Ada

procedure Allocate
(Model : in out A_Model;
Storage_Address : out Address_Type;
Size : Storage_Count;
Alignment : Storage_Count);

procedure Deallocate
(Model : in out A_Model;
Storage_Address : out Address_Type;
Size : Storage_Count;
Alignment : Storage_Count);

procedure Copy_To
(Model : in out A_Model;
Target : Address_Type;
Source : System.Address;
Size : Storage_Count);

procedure Copy_From
(Model : in out A_Model;
Target : System.Address;
Source : Address_Type;
Size : Storage_Count);

function Storage_Size
(Pool : A_Model)
return Storage_Count;

Here's an example of how this could be instantiated in the context of CUDA:

.. code-block:: Ada

package CUDA_Memory is

text

type CUDA_Storage_Model is null record
     with Storage_Model_Type => (
        Address_Type => CUDA_Address,
        Allocate     => CUDA_Allocate,
        Deallocate   => CUDA_Deallocate,
        Copy_To      => CUDA_Copy_To,
        Copy_From    => CUDA_Copy_From,
        Storage_Size => CUDA_Storage_Size,
        Null_Address => CUDA_Null_Address
     );

  type CUDA_Address is new System.Address;
  --  We're assuming for now same address size on host and device

  procedure CUDA_Allocate
    (Model           : in out CUDA_Storage_Model;
     Storage_Address : out CUDA_Address;
     Size            : Storage_Count;
     Alignment       : Storage_Count);

  procedure CUDA_Deallocate
    (Model           : in out CUDA_Storage_Model;
     Storage_Address : out CUDA_Address;
     Size            : Storage_Count;
     Alignment       : Storage_Count);

  procedure CUDA_Copy_To
    (Model  : in out CUDA_Storage_Model;
     Target : CUDA_Address;
     Source : System.Address;
     Size   : Storage_Count);

  procedure CUDA_Copy_From
    (Model   : in out CUDA_Storage_Model;
     Target  : System.Address;
     Source  : CUDA_Address;
     Size    : Storage_Count);

  function CUDA_Storage_Size
    (Pool : CUDA_Storage_Model)
     return Storage_Count return Storage_Count'Last;

  CUDA_Null_Address : constant CUDA_Address :=
     CUDA_Address (System.Null_Address);

  CUDA_Memory : CUDA_Storage_Model;

end CUDA_Memory;

Aspect Designated_Storage_Model
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

A new aspect, Designated_Storage_Model, allows to specify the memory model
for the objects pointed by an access type. Under this aspect, allocations
and deallocations will come from the specified memory model instead
of the standard ones. In addition, if write operations are needed for
initialization, or if there is a copy of the target object from and to a
standard memory area, the Copy_To and Copy_From functions will be called.
It allows to encompass the capabilities of storage pools, e.g.:

.. code-block:: Ada

procedure Main is
type Integer_Array is array (Integer range <>) of Integer;

text

type Host_Array_Access is access all Integer_Array;
  type Device_Array_Access is access Integer_Array
     with Designated_Storage_Model => CUDA_Memory;

  procedure Free is new Unchecked_Deallocation
     (Host_Array_Type, Host_Array_Access);
  procedure Free is new Unchecked_Deallocation
     (Device_Array_Type, Device_Array_Access);

  Host_Array : Host_Array_Access := new Integer_Array (1 .. 10);

  Device_Array : Device_Array_Access := new Host_Array (1 .. 10);
  --  Calls CUDA_Storage_Model.Allocate to allocate the fat pointers and
  --  the bounds, then CUDA_Storage_Model.Copy_In to copy the values of the
  --  boundaries.

begin
Host_Array.all := (others => 0);

text

Device_Array.all := Host_Array.all;
  --  Calls CUDA_Storage_Model.Copy_To to write to the device array from the
  --  native memory.

  Host_Array.all := Device_Array.all;
  --  Calls CUDA_Storage_Model.Copy_From to read from the device array and
  --  write to native memory.

  Free (Host_Array);

  Free (Device_Array);
  --  Calls CUDA_Storage_Model.Deallocate;

end;

Taking 'Address of an object with a specific memory model returns an object of
the type of the address for that memory category, which may be different from
System.Address.

When copying is performed between two specific memory models, the native memory
is used as a temporary between the two. E.g.:

.. code-block:: Ada

type Foo_I is access Integer with Designated_Storage_Model => Foo;
type Bar_I is access Integer with Designated_Storage_Model => Bar;

text

X : Foo_I := new Integer;
Y : Bar_I := new Integer;

begin
X.all := Y.all;

conceptually becomes:

.. code-block:: Ada

text

X : Foo_I := new Integer;
T : Integer;
Y : Bar_I := new Integer;

begin
T := Y.all;
X.all := T;

Legacy Storage Pools
^^^^^^^^^^^^^^^^^^^^^

Legacy Storage Pools are now replaced by a Storage_Model_Type.
They are implemented as follows:

.. code-block:: Ada

type Root_Storage_Pool is abstract
new Ada.Finalization.Limited_Controlled with private
with Storage_Model_Type => (
Allocate => Allocate,
Deallocate => Deallocate,
Storage_Size => Storage_Size
);
pragma Preelaborable_Initialization (Root_Storage_Pool);

procedure Allocate
(Pool : in out Root_Storage_Pool;
Storage_Address : out System.Address;
Size_In_Storage_Elements : System.Storage_Elements.Storage_Count;
Alignment : System.Storage_Elements.Storage_Count)
is abstract;

procedure Deallocate
(Pool : in out Root_Storage_Pool;
Storage_Address : System.Address;
Size_In_Storage_Elements : System.Storage_Elements.Storage_Count;
Alignment : System.Storage_Elements.Storage_Count)
is abstract;

function Storage_Size
(Pool : Root_Storage_Pool)
return System.Storage_Elements.Storage_Count
is abstract;

The legacy notation:

.. code-block:: Ada

type My_Pools is new Root_Storage_Pool with record [...]

My_Pool_Instance : Storage_Model_Pool.Storage_Model :=
My_Pools'(others => <>);

type Acc is access Integer_Array with Storage_Pool => My_Pool;

can still be accepted as a shortcut for the new syntax.

Attribute Super

.. index:: Super

The Super attribute can be applied to objects of tagged types in order
to obtain a view conversion to the most immediate specific parent type.

It cannot be applied to objects of types without any ancestors.

.. code-block:: ada

type T1 is tagged null record;
procedure P (V : T1);

type T2 is new T1 with null record;

type T3 is new T2 with null record;
procedure P (V : T3);

procedure Call (
V1 : T1'Class;
V2 : T2'Class;
V3 : T3'Class) is
begin
V1'Super.P; -- Illegal call as T1 doesn't have any ancestors
V2'Super.P; -- Equivalent to "T1 (V).P;", a non-dispatching call
-- to T1's primitive procedure P.
V3'Super.P; -- Equivalent to "T2 (V).P;"; Since T2 doesn't
-- override P, a non-dispatching call to T1.P is
-- executed.
end;

Simpler Accessibility Model

The goal of this feature is to simplify the accessibility rules by removing
dynamic accessibility checks that are often difficult to understand and debug.
The new rules eliminate the need for runtime accessibility checks by imposing
more conservative legality rules when enabled via a new restriction (see RM 13.12),
No_Dynamic_Accessibility_Checks, which prevents dangling reference problems
at compile time.

This restriction has no effect on the user-visible behavior of a program when executed;
the only effect of this restriction is to enable additional compile-time checks
(described below) which ensure statically that Ada's dynamic accessibility checks
will not fail.

The feature can be activated with pragma Restrictions (No_Dynamic_Accessibility_Checks);.
As a result, additional compile-time checks are performed; these checks pertain to
stand-alone objects, subprogram parameters, and function results as described below.

All of the refined rules are compatible with the [use of anonymous access types in SPARK]
(http://docs.adacore.com/spark2014-docs/html/lrm/declarations-and-types.html#access-types).

Stand-alone objects
^^^^^^^^^^^^^^^^^^^^

.. code-block:: ada

Var : access T := ...
Var_To_Cst : access constant T := ...
Cst : constant access T := ...
Cst_To_Cst : constant access constant T := ...

In this section, we will refer to a stand-alone object of an anonymous access
type as an SO.

When the restriction is in effect, the "statically deeper" relationship
(see RM 3.10.2(4)) does apply to the type of a SO (contrary to RM 3.10.2(19.2))
and, for the purposes of compile-time checks, the accessibility level of the
type of a SO is the accessibility level of that SO.
This supports many common use-cases without the employment of Unchecked_Access
while still removing the need for dynamic checks.

This statically disallows cases that would otherwise require a dynamic accessibility
check, such as

.. code-block:: ada

type Ref is access all Integer;
Ptr : Ref;
Good : aliased Integer;

procedure Proc is
Bad : aliased Integer;
Stand_Alone : access Integer;
begin
if then
Stand_Alone := Good'Access;
else
Stand_Alone := Bad'Access;
end if;
Ptr := Ref (Stand_Alone);
end Proc;

If a No_Dynamic_Accessibility_Checks restriction is in effect, then the otherwise-legal
type conversion (the right-hand side of the assignment to Ptr) becomes a violation
of the RM 4.6 rule "The accessibility level of the operand type shall not be
statically deeper than that of the target type ...".

Subprogram parameters
^^^^^^^^^^^^^^^^^^^^^^

.. code-block:: ada

procedure P (V : access T; X : access constant T);

In most cases (the exceptions are described below), a No_Dynamic_Accessibility_Checks
restriction means that the "statically deeper" relationship does apply to the anonymous
type of an access parameter specifying an access-to-object type (contrary to RM 3.10.2(19.1))
and, for purposes of compile-time "statically deeper" checks, the accessibility level
of the type of such a parameter is the accessibility level of the parameter.

This change (at least as described so far) doesn't affect the caller's side, but on the
callee's side it means that object designated by a non-null parameter of an anonymous
access type is treated as having the same accessibility level as a local object declared
immediately within the called subprogram.

With the restriction in effect, the otherwise-legal type conversion in the following example
becomes illegal:

.. code-block:: ada

type Ref is access all Integer;
Ptr : Ref;

procedure Proc (Param : access Integer) is
begin
Ptr := Ref (Param);
end Proc;

The aforementioned exceptions have to do with return statements from functions that either
return the given parameter (in the case of a function whose result type is an anonymous
access type) or return the given parameter value as an access discriminant of the function
result (or of some discriminated part thereof). More specifically, the "statically deeper"
changes described above do not apply for purposes of checking the "shall not be statically
deeper" rule for access discriminant parts of function results (RM 6.5(5.9)) or in determining
the legality of an (implicit) type conversion from the anonymous access type of a parameter
of a function to an anonymous access result type of that function. In order to prevent these
rule relaxations from introducing the possibility of dynamic accessibility check failures,
compensating compile-time checks are performed at the call site to prevent cases where
including the value of an access parameter as part of a function result could make such
check failures possible (specifically, the discriminant checks of RM 6.5(21) or, in the
case of an anonymous access result type, the RM 4.6(48) check performed when converting
to that result type). These compile-time checks are described in the next section.

From the callee's perspective, the level of anonymous access formal parameters would be
between the level of the subprogram and the level of the subprogram's locals. This has the effect
of formal parameters being treated as local to the callee except in:

Use as a function result
Use as a value for an access discriminant in result object
Use as an assignments between formal parameters

Note that with these more restricted rules we lose track of accessibility levels when assigned to
local objects thus making (in the example below) the assignment to Node2.Link from Temp below
compile-time illegal.

.. code-block:: ada

type Node is record
Data : Integer;
Link : access Node;
end record;

procedure Swap_Links (Node1, Node2 : in out Node) is
Temp : constant access Node := Node1.Link; -- We lose the "association" to Node1
begin
Node1.Link := Node2.Link; -- Allowed
Node2.Link := Temp; -- Not allowed
end;

function Identity (N : access Node) return access Node is
Local : constant access Node := N;
begin
if True then
return N; -- Allowed
else
return Local; -- Not allowed
end if;
end;

Function results
^^^^^^^^^^^^^^^^

.. code-block:: ada

function Get (X : Rec) return access T;

If the result subtype of a function is either an anonymous access (sub)type, a
class-wide (sub)type, an unconstrained subtype with an access discriminant, or
a type with an unconstrained subcomponent subtype that has at least one access
discriminant (this last case is only possible if the access discriminant has a
default value), then we say that the function result type "might require an
anonymous-access-part accessibility check". If a function has an access parameter,
or a parameter whose subtype "might require an anonymous-access-part accessibility
check", then we say that the each such parameter "might be used to pass in an
anonymous-access value". If the first of these conditions holds for the result
subtype of a function and the second condition holds for at least one parameter
that function, then it is possible that a call to that function could return a
result that contains anonymous-access values that were passed in via the parameter.

Given a function call where the result type "might require an anonymous-access-part
accessibility check" and a formal parameter of that function that "might be used to
pass in an anonymous-access value", either the type of that formal parameter is an
anonymous access type or it is not. If it is, and if a No_Dynamic_Access_Checks
restriction is in effect, then the accessibility level of the type of the actual
parameter shall be statically known to not be deeper than that of the master of
the call. If it isn't, then the accessibility level of the actual parameter shall
be statically known to not be deeper than that of the master of the call.

Function result example:

.. code-block:: ada

declare
type T is record
Comp : aliased Integer;
end record;

text

function Identity (Param : access Integer) return access Integer is
  begin
     return Param;        -- Legal
  end;

  function Identity_2 (Param : aliased Integer) return access Integer is
  begin
     return Param'Access; -- Legal
  end;

  X : access Integer;

begin
X := Identity (X); -- Legal
declare
Y : access Integer;
Z : aliased Integer;
begin
X := Identity (Y); -- Illegal since Y is too deep
X := Identity_2 (Z); -- Illegal since Z is too deep
end;
end;

In order to avoid having to expand the definition of "might be used to pass in an
anonymous-access value" to include any parameter of a tagged type, the
No_Dynamic_Access_Checks restriction also imposes a requirement that a type extension
cannot include the explicit definition of an access discriminant.

Here is an example of one such case of an upward conversion which would lead to a memory leak:

.. code-block:: ada

declare
type T is tagged null record;
type T2 (Disc : access Integer) is new T with null record; -- Must be illegal

text

function Identity (Param : aliased T'Class) return access Integer is
  begin
     return T2 (T'Class (Param)).Disc; -- Here P gets effectively returned and set to X
  end;

  X : access Integer;

begin
declare
P : aliased Integer;
Y : T2 (P'Access);
begin
X := Identity (T'Class (Y)); -- Pass local variable P (via Y's discriminant),
-- leading to a memory leak.
end;
end;

text

Thus we need to make the following illegal to avoid such situations:

```ada
package Pkg1 is
   type T1 is tagged null record;
   function Func (X1 : T1) return access Integer is (null);
end;

package Pkg2 is
   type T2 (Ptr1, Ptr2 : access Integer) is new Pkg1.T1 with null record; -- Illegal
   ...
end;

In order to prevent upward conversions of anonymous function results (like below), we
also would need to assure that the level of such a result (from the callee's perspective)
is statically deeper:

.. code-block:: ada

declare
   type Ref is access all Integer;
   Ptr : Ref;
   function Foo (Param : access Integer) return access Integer is
   begin
      return Result : access Integer := Param; do
         Ptr := Ref (Result); -- Not allowed
      end return;
   end;
begin
   declare
      Local : aliased Integer;
   begin
      Foo (Local'Access).all := 123;
   end;
end;

Case pattern matching
---------------------

The selector for a case statement (but not for a case expression) may
be of a composite type, subject to some restrictions (described below).
Aggregate syntax is used for choices of such a case statement; however,
in cases where a "normal" aggregate would require a discrete value, a
discrete subtype may be used instead; box notation can also be used to
match all values.

Consider this example:

.. code-block:: ada

  type Rec is record
  F1, F2 : Integer;
  end record;

  procedure Caser_1 (X : Rec) is
  begin
  case X is
     when (F1 => Positive, F2 => Positive) =>
        Do_This;
     when (F1 => Natural, F2 => <>) | (F1 => <>, F2 => Natural) =>
        Do_That;
     when others =>
         Do_The_Other_Thing;
  end case;
  end Caser_1;

If ``Caser_1`` is called and both components of X are positive, then
``Do_This`` will be called; otherwise, if either component is nonnegative
then ``Do_That`` will be called; otherwise, ``Do_The_Other_Thing`` will be
called.

In addition, pattern bindings are supported. This is a mechanism
for binding a name to a component of a matching value for use within
an alternative of a case statement. For a component association
that occurs within a case choice, the expression may be followed by
``is ``. In the special case of a "box" component association,
the identifier may instead be provided within the box. Either of these
indicates that the given identifier denotes (a constant view of) the matching
subcomponent of the case selector.

.. attention:: Binding is not yet supported for arrays or subcomponents
thereof.

Consider this example (which uses type ``Rec`` from the previous example):

.. code-block:: ada

  procedure Caser_2 (X : Rec) is
  begin
  case X is
     when (F1 => Positive is Abc, F2 => Positive) =>
        Do_This (Abc)
     when (F1 => Natural is N1, F2 => <N2>) |
          (F1 => <N2>, F2 => Natural is N1) =>
        Do_That (Param_1 => N1, Param_2 => N2);
     when others =>
        Do_The_Other_Thing;
  end case;
  end Caser_2;

This example is the same as the previous one with respect to determining
whether ``Do_This``, ``Do_That``, or ``Do_The_Other_Thing`` will be called. But
for this version, ``Do_This`` takes a parameter and ``Do_That`` takes two
parameters. If ``Do_This`` is called, the actual parameter in the call will be
``X.F1``.

If ``Do_That`` is called, the situation is more complex because there are two
choices for that alternative. If ``Do_That`` is called because the first choice
matched (i.e., because ``X.F1`` is nonnegative and either ``X.F1`` or ``X.F2``
is zero or negative), then the actual parameters of the call will be (in order)
``X.F1`` and ``X.F2``. If ``Do_That`` is called because the second choice
matched (and the first one did not), then the actual parameters will be
reversed.

Within the choice list for single alternative, each choice must define the same
set of bindings and the component subtypes for for a given identifier must all
statically match. Currently, the case of a binding for a nondiscrete component
is not implemented.

If the set of values that match the choice(s) of an earlier alternative
overlaps the corresponding set of a later alternative, then the first set shall
be a proper subset of the second (and the later alternative will not be
executed if the earlier alternative "matches"). All possible values of the
composite type shall be covered. The composite type of the selector shall be an
array or record type that is neither limited nor class-wide. Currently, a "when
others =>" case choice is required; it is intended that this requirement will
be relaxed at some point.

If a subcomponent's subtype does not meet certain restrictions, then the only
value that can be specified for that subcomponent in a case choice expression
is a "box" component association (which matches all possible values for the
subcomponent). This restriction applies if:

- the component subtype is not a record, array, or discrete type; or

- the component subtype is subject to a non-static constraint or has a
  predicate; or:

- the component type is an enumeration type that is subject to an enumeration
  representation clause; or

- the component type is a multidimensional array type or an array type with a
  nonstatic index subtype.

Support for casing on arrays (and on records that contain arrays) is
currently subject to some restrictions. Non-positional
array aggregates are not supported as (or within) case choices. Likewise
for array type and subtype names. The current implementation exceeds
compile-time capacity limits in some annoyingly common scenarios; the
message generated in such cases is usually "Capacity exceeded in compiling
case statement with composite selector type".

Mutably Tagged Types with Size'Class Aspect
-------------------------------------------

For a specific tagged nonformal type T that satisfies some conditions
described later in this section, the universal-integer-valued type-related
representation aspect ``Size'Class`` may be specified; any such specified
aspect value shall be static.

Specifying this aspect imposes an upper bound on the sizes of all specific
descendants of T (including T itself). T'Class (but not T) is then said to be
a "mutably tagged" type - meaning that T'Class is a definite subtype and that
the tag of a variable of type T'Class may be modified by assignment in some
cases described later in this section. An inherited ``Size'Class`` aspect
value may be overridden, but not with a larger value.

If the ``Size'Class`` aspect is specified for a type T, then every specific
descendant of T (including T itself)

* shall have a Size that does not exceed the specified value; and

* shall have a (possibly inherited) ``Size'Class`` aspect that does not exceed
  the specified value; and

* shall be undiscriminated; and

* shall have no composite subcomponent whose subtype is subject to a nonstatic
  constraint; and

* shall not have a tagged partial view other than a private extension; and

* shall not be a descendant of an interface type; and

* shall not have a statically deeper accessibility level than that of T.

If the ``Size'Class`` aspect is not specified for a type T (either explicitly
or by inheritance), then it shall not be specified for any descendant of T.

Example:

.. code-block:: ada

 type Root_Type is tagged null record with Size'Class => 16 * 8;

 type Derived_Type is new Root_Type with record
    Stuff : Some_Type;
 end record;  -- ERROR if Derived_Type exceeds 16 bytes

Because any subtype of a mutably tagged type is definite, it can be used as a
component subtype for enclosing array or record types, as the subtype of a
default-initialized stand-alone object, or as the subtype of an uninitialized
allocator, as in this example:

.. code-block:: ada

 Obj : Root_Type'Class;
 type Array_of_Roots is array (Positive range <>) of Root_Type'Class;

Default initialization of an object of such a definite subtype proceeds as
for the corresponding specific type, except that Program_Error is raised if
the specific type is abstract. In particular, the initial tag of the object
is that of the corresponding specific type.

There is a general design principle that if a type has a tagged partial view,
then the type's ``Size'Class`` aspect (or lack thereof) should be determinable
by looking only at the partial view. That provides the motivation for the
rules of the next two paragraphs.

If a type has a tagged partial view, then a ``Size'Class`` aspect specification
may be provided only at the point of the partial view declaration (in other
words, no such aspect specification may be provided when the full view of
the type is declared). All of the above rules (in particular, the rule that
an overriding ``Size'Class`` aspect value shall not be larger than the
overridden inherited value) are also enforced when the full view (which may
have a different ancestor type than that of the partial view) is declared.
If a partial view for a type inherits a ``Size'Class`` aspect value and does
not override that value with an explicit aspect specification, then the
(static) aspect values inherited by the partial view and by the full view
shall be equal.

An actual parameter of an instantiation whose corresponding formal parameter
is a formal tagged private type shall not be either mutably tagged or the
corresponding specific type of a mutably tagged type.

For the legality rules in this section, the RM 12.3(11) rule about legality
checking in the visible part and formal part of an instance is extended (in
the same way that it is extended in many other places in the RM) to include
the private part of an instance.

An object (or a view thereof) of a tagged type is defined to be
"tag-constrained" if it is

* an object whose type is not mutably tagged; or

* a constant object; or

* a view conversion of a tag-constrained object; or

* a view conversion to a type that is not a descendant of the operand's
  type; or

* a formal in out or out parameter whose corresponding actual parameter is
  tag-constrained; or

* a dereference of an access value.

In the case of an assignment to a tagged variable that is not
tag-constrained, no check is performed that the tag of the value
of the expression is the same as that of the target (RM 5.2 notwithstanding).
Instead, the tag of the target object becomes that of the source object of
the assignment. Note that the tag of an object of a mutably tagged type MT
will always be the tag of some specific type that is a descendant of MT.
An assignment to a composite object similarly copies the tags of any
subcomponents of the source object that have a mutably tagged type.

The Constrained attribute is defined for any name denoting an object of a
mutably tagged type (RM 3.7.2 notwithstanding). In this case, the
Constrained attribute yields the value True if the object is
tag-constrained and False otherwise.

Renaming is not allowed (see RM 8.5.1) for a type conversion having an operand
of a mutably tagged type MT and a target type TT such that TT (or its
corresponding specific type if TT is class-wide) is not an ancestor of MT
(this is sometimes called a "downward" conversion), nor for any part of
such an object, nor for any slice of any part of such an object. This
rule also applies in any context where a name is required to be one for
which "renaming is allowed" (for example, see RM 12.4).
[This is analogous to the way that renaming is not allowed for a
discriminant-dependent component of an unconstrained variable.]

A name denoting a view of a variable of a mutably tagged type shall not occur
as an operative constituent of the prefix of a name denoting a prefixed
view of a callable entity, except as the callee name in a call to the
callable entity. This disallows, for example, renaming such a prefixed view,
passing the prefixed view name as a generic actual parameter, or using the
prefixed view name as the prefix of an attribute.

The execution of a construct is erroneous if the construct has a constituent
that is a name denoting a subcomponent of a tagged object and the object's
tag is changed by this execution between evaluating the name and the last
use (within this execution) of the subcomponent denoted by the name.
This is analogous to the RM 3.7.2(4) rule about discriminant-dependent
subcomponents.

If the type of a formal parameter is a specific tagged type, then the execution
of the call is erroneous if the tag of the actual is changed while the formal
parameter exists (that is, before leaving the corresponding callable construct).
This is analogous to the RM 6.4.1(18) rule about discriminated parameters.

.. _No_Raise_Aspect:

No_Raise aspect
----------------

The ``No_Raise`` aspect can be applied to a subprogram to declare that this
subprogram is not expected to raise an exception. Should an exception still
be raised during the execution of the subprogram, it is caught at the end of
this execution and ``Program_Error`` is propagated to the caller.

Inference of Dependent Types in Generic Instantiations
------------------------------------------------------

If a generic formal type T2 depends on another formal type T1,
the actual for T1 can be inferred from the actual for T2.
That is, you can give the actual for T2, and leave out the one
for T1.

For example, ``Ada.Unchecked_Deallocation`` has two generic formals:

.. code-block:: ada

generic
   type Object (<>) is limited private;
   type Name is access Object;
procedure Ada.Unchecked_Deallocation (X : in out Name);

where ``Name`` depends on ``Object``. With this language extension,
you can leave out the actual for ``Object``, as in:

.. code-block:: ada

type Integer_Access is access all Integer;

procedure Free is new Unchecked_Deallocation (Name => Integer_Access);

The compiler will infer that the actual type for ``Object`` is ``Integer``.
Note that named notation is always required when using inference.

The following inferences are allowed:

- For a formal access type, the designated type can be inferred.

- For a formal array type, the index type(s) and the component
  type can be inferred.

- For a formal type with discriminants, the type(s) of the discriminants
  can be inferred.

Example for arrays:

.. code-block:: ada

generic
   type Element_Type is private;
   type Index_Type is (<>);
   type Array_Type is array (Index_Type range <>) of Element_Type;
package Array_Operations is
   ...
end Array_Operations;

...

type Int_Array is array (Positive range <>) of Integer;

package Int_Array_Operations is new Array_Operations (Array_Type => Int_Array);

The index and component types of ``Array_Type`` are inferred from
``Int_Array``, so that the above instantiation is equivalent to
the following standard-Ada instantiation:

.. code-block:: ada

package Int_Array_Operations is new Array_Operations
   (Element_Type => Integer,
      Index_Type   => Positive,
      Array_Type   => Int_Array);


External_Initialization Aspect
------------------------------

The ``External_Initialization`` aspect provides a feature similar to Rust's ``include_bytes!``
and to C23's ``#embed``. It has the effect of initializing an object with the contents of
a file specified by a file path.

Only string objects and objects of type ``Ada.Streams.Stream_Element_Array`` can be subject
to the ``External_Initialization`` aspect.

Example:

.. code-block:: ada

with Ada.Streams;

package P is
   S : constant String with External_Initialization => "foo.txt";

   X : constant Ada.Streams.Stream_Element_Array with External_Initialization => "bar.bin";
end P;

``External_Initialization`` aspect accepts the following parameters:

- mandatory ``Path``: the path the compiler uses to access the binary resource.

If ``Path`` is a relative path, it is interpreted relatively to the directory of the file that contains the aspect specification.

.. attention:: The maximum size of loaded files is limited to 2\ :sup:`31` bytes.


Finally construct
-----------------

The ``finally`` keyword makes it possible to have a sequence of statements be executed when
another sequence of statements is completed, whether normally or abnormally.

This feature is similar to the one with the same name in other languages such as Java.

Note that ``finally`` is a keyword but it is not a reserved word. This is a
configuration that does not exist in standard Ada.

Syntax
^^^^^^

.. code-block:: text

handled_sequence_of_statements ::=
     sequence_of_statements
  [exception
     exception_handler
    {exception_handler}]
  [finally
    sequence_of_statements]

Legality Rules
^^^^^^^^^^^^^^

Return statements in the ``sequence_of_statements`` attached to the finally that would cause control
to be transferred outside the finally part are forbidden.

Goto & exit where the target is outside of the finally's ``sequence_of_statements`` are forbidden

Dynamic Semantics
^^^^^^^^^^^^^^^^^

Statements in the optional ``sequence_of_statements`` contained in the ``finally`` branch will be
executed unconditionally, after the main ``sequence_of_statements`` is executed, and after any
potential ``exception_handler`` is executed.

If an exception is raised in the finally part, it cannot be caught by the ``exception_handler``.

Abort/ATC (asynchronous transfer of control) cannot interrupt a finally block, nor prevent its
execution, that is the finally block must be executed in full even if the containing task is
aborted, or if the control is transferred out of the block.

Continue statement
------------------

The ``continue`` keyword makes it possible to stop execution of a loop iteration
and continue with the next one. A continue statement has the same syntax
(except "exit" is replaced with "continue"), static semantics, and legality
rules as an exit statement. The difference is in the dynamic semantics: where an
exit statement would cause a transfer of control that completes the (implicitly
or explicitly) specified loop_statement, a continue statement would instead
cause a transfer of control that completes only the current iteration of that
loop_statement, like a goto statement targeting a label following the last
statement in the sequence of statements of the specified loop_statement.

Note that ``continue`` is a keyword but it is not a reserved word. This is a
configuration that does not exist in standard Ada.

Destructors
-----------

The :ada:`Destructor` extension adds a new finalization mechanism that
significantly differs from standard Ada in how it interacts with type
derivation.

New syntax is introduced to make it possible to define "destructors" for record
types, tagged or untagged. Here's a simple example:

.. code-block:: ada

package P is
   type T is record
      ...
   end record;

   procedure T'Destructor (X : in out T);
end P;

.. code-block:: ada

package body P is
   procedure T'Destructor (X : in out T) is
   begin
      ...
   end T'Destructor;
end P;

Like :ada:`Finalize` procedures, destructors are called on objects just before they
are destroyed. But destructors are more flexible in how they can used with derived
types. With standard Ada finalization, when you derive from a finalizable type,
you must either inherit the :ada:`Finalize` procedure or override it completely.

Destructors work differently. You can define a destructor for a type derived from
a parent type that also has a destructor, and then when objects of the derived type
are finalized, both destructors will be called. For example:

.. code-block:: ada

type T1 is record
   ...
end record;

procedure T1'Destructor (X : in out T1);

type T2 is new T1;

procedure T2'Destructor (X : in out T2);

When an object of type :ada:`T2` is finalized, there will be first a call to
:ada:`T2'Destructor`, and then a call to :ada:`T1'Destructor` on the object.

Structural Generic Instantiation
--------------------------------

The compiler implements a second kind of generic instantiation, called
"structural", alongside the traditional instantiation specified by the
language, which is defined as follows: the structural instantiation of
a generic unit on given actual parameters is the anonymous instantiation
of the generic unit on the actual parameters done in the outermost scope
where it would be legal to do an identical traditional instantiation.

There is at most one structural instantiation of a generic unit on given
actual parameters done in a partition.

Structural generic instances (the product of structural instantiation)
are implicitly created whenever a reference to them is made in a place
where a name is accepted by the language.

Syntax
^^^^^^

.. code-block:: text

name ::= { set of productions specified in the RM }
         | structural_generic_instance_name

structural_generic_instance_name ::= name generic_actual_part

Legality Rules
^^^^^^^^^^^^^^

The ``name`` in a ``structural_generic_instance_name`` shall denote a generic
unit that is preelaborated. Note that, unlike in a traditional instantiation,
there are no square brackets around the ``generic_actual_part`` in the second
production, which means that it is mandatory and, therefore, that the generic
unit shall have at least one generic formal parameter.

The generic unit shall not take a generic formal object of mode ``in out``.
If the generic unit takes a generic formal object of mode ``in``, then the
corresponding generic actual parameter shall be a static expression.

A ``structural_generic_instance_name`` for a generic package shall not be
present in a library unit if the structural instance is also a library unit
and has a semantic dependence on the former.

For a generic subprogram, if a local entity of the enclosing library-level
package is used as an actual and the structural instance would have a semantic
dependence on the package, the structural instantiation is automatically
demoted to a local instantiation. In this case, several instances of the
generic subprogram may be present in a single partition, unless
whole-partition optimization is performed (e.g., via LTO).

Static Semantics
^^^^^^^^^^^^^^^^

A ``structural_generic_instance_name`` denotes the instance that is the
product of the structural instantiation of a generic unit on the specified
actual parameters. This instance is unique to a partition, except when a
generic subprogram instantiation is automatically demoted to a local
instantiation as described under Legality Rules.

Example:

.. code-block:: ada

with Ada.Containers.Vectors;

procedure P is
   V : Ada.Containers.Vectors(Positive,Integer).Vector;

begin
   V.Append (1);
   V.Append (0);
   Ada.Containers.Vectors(Positive,Integer).Generic_Sorting("<").Sort (V);
end;

This procedure references two structural instantiations of two different generic
units: ``Ada.Containers.Vectors(Positive,Integer)`` is the structural instance
of the generic unit ``Ada.Containers.Vectors`` on ``Positive`` and ``Integer``
and ``Ada.Containers.Vectors(Positive,Integer).Generic_Sorting("<")`` is the
structural instance of the nested generic unit
``Ada.Containers.Vectors(Positive,Integer).Generic_Sorting`` on ``"<"``.

Note that the following example is illegal:

.. code-block:: ada

with Ada.Containers.Vectors;

package Q is
   type T is record
      I : Integer;
   end record;

   V : Ada.Containers.Vectors(Positive,T).Vector;
end Q;

The reason is that ``Ada.Containers.Vectors``, ``Positive`` and ``Q.T`` being
library-level entities, the structural instance ``Ada.Containers.Vectors(Positive,T)`` is a library unit with a dependence
on ``Q`` and, therefore, cannot be referenced from within ``Q``. This
restriction applies to structural instantiations of generic packages. The
simple way out is to declare a traditional instantiation in this case:

.. code-block:: ada

with Ada.Containers.Vectors;

package Q is
   type T is record
      I : Integer;
   end record;

   package Vectors_Of_T is new Ada.Containers.Vectors(Positive,T);

   V : Vectors_Of_T.Vector;
end Q;

But the following example is legal:

.. code-block:: ada

with Ada.Containers.Vectors;

procedure P is
   type T is record
      I : Integer;
   end record;

   V : Ada.Containers.Vectors(Positive,T).Vector;
end;

because the structural instance ``Ada.Containers.Vectors(Positive,T)`` is
not a library unit.

For generic subprograms, the restriction does not apply: if a local entity of
a library-level package is used as an actual, the structural instantiation is
automatically demoted to a local instantiation. For example:

.. code-block:: ada

with Ada.Unchecked_Deallocation;

package Q is
   type T is record
      I : Integer;
   end record;

   type T_Access is access T;
end Q;

package body Q is
   procedure Free_T (X : in out T_Access) is
   begin
      Ada.Unchecked_Deallocation(T, T_Access)(X);
   end Free_T;
end Q;

is legal: since ``T`` and ``T_Access`` are local entities of ``Q``, the
structural instantiation of ``Ada.Unchecked_Deallocation`` is demoted to a
local instantiation rather than producing an error. Note that the uniqueness
guarantee no longer holds in this case and several instances of the generic
subprogram may be present in a single partition.

The first example can be rewritten in a less verbose manner:

.. code-block:: ada

with Ada.Containers.Vectors; use Ada.Containers.Vectors(Positive,Integer);

procedure P is
   V : Vector;

begin
   V.Append (1);
   V.Append (0);
   Generic_Sorting("<").Sort (V);
end;

Another example, which additionally uses the inference of dependent types:

.. code-block:: ada

with Ada.Unchecked_Deallocation;

procedure P is

   type Integer_Access is access all Integer;

   A : Integer_Access := new Integer'(1);

begin
   Ada.Unchecked_Deallocation(Name => Integer_Access) (A);
end;

Attribute Subprograms
---------------------

This feature allows declaring subprograms that are associated with a named
aspect or attribute of a given type, as an alternative to explicitly
specifying the aspect or attribute for the type (using an aspect_specification
or attribute_definition_clause), by defining the name of the subprogram
using attribute syntax. In effect, this implicitly specifies the aspect
or attribute for the type, and is intended to be semantically equivalent to
using an explicit aspect specification, but without needing to give a specific
name in the aspect and subprogram. This is allowed for the various aspects that
denote subprograms (see below for the exact list of supported aspects).

Here is an example of the use of this feature for defining indexing functions
for a container type and an integer-literal function for the container's
element type:

.. code-block:: ada

package My_Container is

   type Container is tagged ...;  -- Implicit indexing aspects

   type Element_Type is ...;      -- Implicit Integer_Literal aspect

   type Cursor_Type is ...;

   type Reference_Type is ...;

   function Container'Constant_Indexing (C : Container; Index : Positive)
     return Element_Type;

   function Container'Constant_Indexing (C : Container; Index : Cursor_Type)
     return Element_Type;

   function Container'Variable_Indexing
     (C : in out Container; Index : Positive)
      return Reference_Type;

   function Element_Type'Integer_Literal (S : String) return Element_Type;

end My_Container;

Syntax
^^^^^^

.. code-block:: text

defining_program_unit_name ::=
  [parent_unit_name . ]defining_identifier
| defining_attribute_subprogram_name

defining_attribute_subprogram_name ::=
  prefix'attribute_designator

Legality Rules
^^^^^^^^^^^^^^

The prefix of a ``defining_attribute_subprogram_name`` shall be either
a ``direct_name`` denoting a type (more properly, a first subtype)
declared immediately within the scope where the associated subprogram
is declared, or else an attribute name itself whose ``attribute_designator``
is ``Class`` and whose prefix denotes a type subject to the same
declaration condition. A ``defining_program_unit_name`` that is
a ``defining_attribute_subprogram_name`` may only be used to define
the name of a subprogram that is neither a library subprogram nor
a subprogram whose body is given by a ``body_stub`` (nor can it be
used to define the name of a generic subprogram).

The ``attribute_designator`` given in a ``defining_attribute_subprogram_name``
shall name an aspect that is allowed to designate a subprogram. Specifically,
it shall be one of the predefined aspects ``Constant_Indexing``,
``Variable_Indexing``, ``Default_Iterator``, ``Integer_Literal``,
``Real_Literal``, ``String_Literal``, ``Put_Image``, ``Read``, ``Write``,
``Input``, or ``Output``, or else one of the implementation-defined aspects
``Constructor`` or ``Destructor``. (Note that this feature is not supported
for aspects that have elements that may designate a subprogram, such as the
``Aggregate`` aspect.)

If the prefix of a ``defining_attribute_subprogram_name`` is an attribute name
whose ``attribute_designator`` is ``Class``, then the ``attribute_designator``
of the ``defining_attribute_subprogram_name`` shall be the name of a stream
attribute.

An attribute subprogram for a given type and aspect is subject to
the same restrictions as would be imposed on a subprogram denoted by
an explicit ``aspect_specification`` or ``attribute_definition_clause``
for that type and aspect. In particular, the profile of the subprogram
must satisfy any expected profile defined for the aspect.

If a subprogram is declared using a ``defining_attribute_subprogram_name``,
then the type named in the attribute subprogram's name shall not have
an explicit ``aspect_specification`` that specifies the same aspect as
that named by the subprogram, nor shall the type derive from an ancestor
type that explicitly specifies that aspect. Similarly, an explicit
``aspect_specification`` shall not specify an aspect for a type that
is derived from a type for which any attribute subprograms have been
declared for the same aspect.

---

### Gcc Ada Doc Gnat Rm Implementation Advice (`gcc/ada/doc/gnat_rm/implementation_advice.rst`)

.. _Implementation_Advice:

*********************
Implementation Advice
*********************

The main text of the Ada Reference Manual describes the required
behavior of all Ada compilers, and the GNAT compiler conforms to
these requirements.

In addition, there are sections throughout the Ada Reference Manual headed
by the phrase 'Implementation advice'.  These sections are not normative,
i.e., they do not specify requirements that all compilers must
follow.  Rather they provide advice on generally desirable behavior.
They are not requirements, because they describe behavior that cannot
be provided on all systems, or may be undesirable on some systems.

As far as practical, GNAT follows the implementation advice in
the Ada Reference Manual.  Each such RM section corresponds to a section
in this chapter whose title specifies the
RM section number and paragraph number and the subject of
the advice.  The contents of each section consists of the RM text within
quotation marks,
followed by the GNAT interpretation of the advice.  Most often, this simply says
'followed', which means that GNAT follows the advice.  However, in a
number of cases, GNAT deliberately deviates from this advice, in which
case the text describes what GNAT does and why.

.. index:: Error detection

RM 1.1.3(20): Error Detection
=============================

  "If an implementation detects the use of an unsupported Specialized Needs
  Annex feature at run time, it should raise ``Program_Error`` if
  feasible."

Not relevant.  All specialized needs annex features are either supported,
or diagnosed at compile time.

.. index:: Child Units

RM 1.1.3(31): Child Units
=========================


  "If an implementation wishes to provide implementation-defined
  extensions to the functionality of a language-defined library unit, it
  should normally do so by adding children to the library unit."

Followed.

.. index:: Bounded errors

RM 1.1.5(12): Bounded Errors
============================

  "If an implementation detects a bounded error or erroneous
  execution, it should raise ``Program_Error``."

Followed in all cases in which the implementation detects a bounded
error or erroneous execution.  Not all such situations are detected at
runtime.

.. index:: Pragmas

.. _RM_2_8_16_Pragmas:

RM 2.8(16): Pragmas
===================

  "Normally, implementation-defined pragmas should have no semantic effect
  for error-free programs; that is, if the implementation-defined pragmas
  are removed from a working program, the program should still be legal,
  and should still have the same semantics."

The following implementation defined pragmas are exceptions to this
rule:

+--------------------+-------------------+
| Pragma             | Explanation       |
+====================+===================+
| *Abort_Defer*      | Affects semantics |
+--------------------+-------------------+
|*Ada_83*            | Affects legality  |
+--------------------+-------------------+
|*Assert*            | Affects semantics |
+--------------------+-------------------+
|*CPP_Class*         | Affects semantics |
+--------------------+-------------------+
|*CPP_Constructor*   | Affects semantics |
+--------------------+-------------------+
|*Debug*             | Affects semantics |
+--------------------+-------------------+
|*Interface_Name*    | Affects semantics |
+--------------------+-------------------+
|*Machine_Attribute* | Affects semantics |
+--------------------+-------------------+
|*Unimplemented_Unit*| Affects legality  |
+--------------------+-------------------+
|*Unchecked_Union*   | Affects semantics |
+--------------------+-------------------+

In each of the above cases, it is essential to the purpose of the pragma
that this advice not be followed.  For details see
:ref:`Implementation_Defined_Pragmas`.

RM 2.8(17-19): Pragmas
======================

  "Normally, an implementation should not define pragmas that can
  make an illegal program legal, except as follows:

  * A pragma used to complete a declaration, such as a pragma ``Import``;

  * A pragma used to configure the environment by adding, removing, or
 replacing ``library_items``."

See :ref:`RM_2_8_16_Pragmas`.

.. index:: Character Sets

.. index:: Alternative Character Sets

RM 3.5.2(5): Alternative Character Sets
=======================================

  "If an implementation supports a mode with alternative interpretations
  for ``Character`` and ``Wide_Character``, the set of graphic
  characters of ``Character`` should nevertheless remain a proper
  subset of the set of graphic characters of ``Wide_Character``.  Any
  character set 'localizations' should be reflected in the results of
  the subprograms defined in the language-defined package
  ``Characters.Handling`` (see A.3) available in such a mode.  In a mode with
  an alternative interpretation of ``Character``, the implementation should
  also support a corresponding change in what is a legal
  ``identifier_letter``."

Not all wide character modes follow this advice, in particular the JIS
and IEC modes reflect standard usage in Japan, and in these encoding,
the upper half of the Latin-1 set is not part of the wide-character
subset, since the most significant bit is used for wide character
encoding.  However, this only applies to the external forms.  Internally
there is no such restriction.

.. index:: Integer types

RM 3.5.4(28): Integer Types
===========================

  "An implementation should support ``Long_Integer`` in addition to
  ``Integer`` if the target machine supports 32-bit (or longer)
  arithmetic.  No other named integer subtypes are recommended for package
  ``Standard``.  Instead, appropriate named integer subtypes should be
  provided in the library package ``Interfaces`` (see B.2)."

``Long_Integer`` is supported.  Other standard integer types are supported
so this advice is not fully followed.  These types
are supported for convenient interface to C, and so that all hardware
types of the machine are easily available.

RM 3.5.4(29): Integer Types
===========================

  "An implementation for a two's complement machine should support
  modular types with a binary modulus up to ``System.Max_Int*2+2``.  An
  implementation should support a non-binary modules up to ``Integer'Last``."

Followed.

.. index:: Enumeration values

RM 3.5.5(8): Enumeration Values
===============================

  "For the evaluation of a call on ``S'Pos`` for an enumeration
  subtype, if the value of the operand does not correspond to the internal
  code for any enumeration literal of its type (perhaps due to an
  un-initialized variable), then the implementation should raise
  ``Program_Error``.  This is particularly important for enumeration
  types with noncontiguous internal codes specified by an
  enumeration_representation_clause."

Followed.

.. index:: Float types

RM 3.5.7(17): Float Types
=========================

  "An implementation should support ``Long_Float`` in addition to
  ``Float`` if the target machine supports 11 or more digits of
  precision.  No other named floating point subtypes are recommended for
  package ``Standard``.  Instead, appropriate named floating point subtypes
  should be provided in the library package ``Interfaces`` (see B.2)."

``Short_Float`` and ``Long_Long_Float`` are also provided.  The
former provides improved compatibility with other implementations
supporting this type.  The latter corresponds to the highest precision
floating-point type supported by the hardware.  On most machines, this
will be the same as ``Long_Float``, but on some machines, it will
correspond to the IEEE extended form.  The notable case is all x86
implementations, where ``Long_Long_Float`` corresponds to the 80-bit
extended precision format supported in hardware on this processor.
Note that the 128-bit format on SPARC is not supported, since this
is a software rather than a hardware format.

.. index:: Multidimensional arrays

.. index:: Arrays, multidimensional

RM 3.6.2(11): Multidimensional Arrays
=====================================

  "An implementation should normally represent multidimensional arrays in
  row-major order, consistent with the notation used for multidimensional
  array aggregates (see 4.3.3).  However, if a pragma ``Convention``
  (``Fortran``, ...) applies to a multidimensional array type, then
  column-major order should be used instead (see B.5, *Interfacing with Fortran*)."

Followed.

.. index:: Duration'Small

RM 9.6(30-31): Duration'Small
=============================

  "Whenever possible in an implementation, the value of ``Duration'Small``
  should be no greater than 100 microseconds."

Followed.  (``Duration'Small`` = 10**(-9)).

  "The time base for ``delay_relative_statements`` should be monotonic;
  it need not be the same time base as used for ``Calendar.Clock``."

Followed.

RM 10.2.1(12): Consistent Representation
========================================

  "In an implementation, a type declared in a pre-elaborated package should
  have the same representation in every elaboration of a given version of
  the package, whether the elaborations occur in distinct executions of
  the same program, or in executions of distinct programs or partitions
  that include the given version."

Followed, except in the case of tagged types.  Tagged types involve
implicit pointers to a local copy of a dispatch table, and these pointers
have representations which thus depend on a particular elaboration of the
package.  It is not easy to see how it would be possible to follow this
advice without severely impacting efficiency of execution.

.. index:: Exception information

RM 11.4.1(19): Exception Information
====================================

  "``Exception_Message`` by default and ``Exception_Information``
  should produce information useful for
  debugging.  ``Exception_Message`` should be short, about one
  line.  ``Exception_Information`` can be long.  ``Exception_Message``
  should not include the
  ``Exception_Name``.  ``Exception_Information`` should include both
  the ``Exception_Name`` and the ``Exception_Message``."

Followed.  For each exception that doesn't have a specified
``Exception_Message``, the compiler generates one containing the location
of the raise statement.  This location has the form 'file_name:line', where
file_name is the short file name (without path information) and line is the line
number in the file.  Note that in the case of the Zero Cost Exception
mechanism, these messages become redundant with the Exception_Information that
contains a full backtrace of the calling sequence, so they are disabled.
To disable explicitly the generation of the source location message, use the
Pragma ``Discard_Names``.

.. index:: Suppression of checks

.. index:: Checks, suppression of

RM 11.5(28): Suppression of Checks
==================================

  "The implementation should minimize the code executed for checks that
  have been suppressed."

Followed.

.. index:: Representation clauses

RM 13.1 (21-24): Representation Clauses
=======================================

  "The recommended level of support for all representation items is
  qualified as follows:

  An implementation need not support representation items containing
  nonstatic expressions, except that an implementation should support a
  representation item for a given entity if each nonstatic expression in
  the representation item is a name that statically denotes a constant
  declared before the entity."

Followed.  In fact, GNAT goes beyond the recommended level of support
by allowing nonstatic expressions in some representation clauses even
without the need to declare constants initialized with the values of
such expressions. For example:

.. code-block:: ada

 X : Integer;
 Y : Float;
 for Y'Address use X'Address;

is accepted directly by GNAT.


  "An implementation need not support a specification for the ``Size``
  for a given composite subtype, nor the size or storage place for an
  object (including a component) of a given composite subtype, unless the
  constraints on the subtype and its composite subcomponents (if any) are
  all static constraints."

Followed.  Size Clauses are not permitted on nonstatic components, as
described above.


  "An aliased component, or a component whose type is by-reference, should
  always be allocated at an addressable location."

Followed.

.. index:: Packed types

RM 13.2(6-8): Packed Types
==========================

  "If a type is packed, then the implementation should try to minimize
  storage allocated to objects of the type, possibly at the expense of
  speed of accessing components, subject to reasonable complexity in
  addressing calculations.

  The recommended level of support pragma ``Pack`` is:

  For a packed record type, the components should be packed as tightly as
  possible subject to the Sizes of the component subtypes, and subject to
  any *record_representation_clause* that applies to the type; the
  implementation may, but need not, reorder components or cross aligned
  word boundaries to improve the packing.  A component whose ``Size`` is
  greater than the word size may be allocated an integral number of words."

Followed.  Tight packing of arrays is supported for all component sizes
up to 64-bits. If the array component size is 1 (that is to say, if
the component is a boolean type or an enumeration type with two values)
then values of the type are implicitly initialized to zero. This
happens both for objects of the packed type, and for objects that have a
subcomponent of the packed type.

.. index:: Address clauses

RM 13.3(14-19): Address Clauses
===============================

  "For an array ``X``, ``X'Address`` should point at the first
  component of the array, and not at the array bounds."

Followed.

  "The recommended level of support for the ``Address`` attribute is:

  ``X'Address`` should produce a useful result if ``X`` is an
  object that is aliased or of a by-reference type, or is an entity whose
  ``Address`` has been specified."

Followed.  A valid address will be produced even if none of those
conditions have been met.  If necessary, the object is forced into
memory to ensure the address is valid.

  "An implementation should support ``Address`` clauses for imported
  subprograms."

Followed.

  "Objects (including subcomponents) that are aliased or of a by-reference
  type should be allocated on storage element boundaries."

Followed.

  "If the ``Address`` of an object is specified, or it is imported or exported,
  then the implementation should not perform optimizations based on
  assumptions of no aliases."

Followed.

.. index:: Alignment clauses

RM 13.3(29-35): Alignment Clauses
=================================

  "The recommended level of support for the ``Alignment`` attribute for
  subtypes is:

  An implementation should support specified Alignments that are factors
  and multiples of the number of storage elements per word, subject to the
  following:"

Followed.

  "An implementation need not support specified Alignments for
  combinations of Sizes and Alignments that cannot be easily
  loaded and stored by available machine instructions."

Followed.

  "An implementation need not support specified Alignments that are
  greater than the maximum ``Alignment`` the implementation ever returns by
  default."

Followed.

  "The recommended level of support for the ``Alignment`` attribute for
  objects is:

  Same as above, for subtypes, but in addition:"

Followed.

  "For stand-alone library-level objects of statically constrained
  subtypes, the implementation should support all alignments
  supported by the target linker.  For example, page alignment is likely to
  be supported for such objects, but not for subtypes."

Followed.

.. index:: Size clauses

RM 13.3(42-43): Size Clauses
============================

  "The recommended level of support for the ``Size`` attribute of
  objects is:

  A ``Size`` clause should be supported for an object if the specified
  ``Size`` is at least as large as its subtype's ``Size``, and
  corresponds to a size in storage elements that is a multiple of the
  object's ``Alignment`` (if the ``Alignment`` is nonzero)."

Followed.

RM 13.3(50-56): Size Clauses
============================

  "If the ``Size`` of a subtype is specified, and allows for efficient
  independent addressability (see 9.10) on the target architecture, then
  the ``Size`` of the following objects of the subtype should equal the
  ``Size`` of the subtype:

  Aliased objects (including components)."

Followed.

  "`Size` clause on a composite subtype should not affect the
  internal layout of components."

Followed. But note that this can be overridden by use of the implementation
pragma Implicit_Packing in the case of packed arrays.

  "The recommended level of support for the ``Size`` attribute of subtypes is:

  The ``Size`` (if not specified) of a static discrete or fixed point
  subtype should be the number of bits needed to represent each value
  belonging to the subtype using an unbiased representation, leaving space
  for a sign bit only if the subtype contains negative values.  If such a
  subtype is a first subtype, then an implementation should support a
  specified ``Size`` for it that reflects this representation."

Followed.

  "For a subtype implemented with levels of indirection, the ``Size``
  should include the size of the pointers, but not the size of what they
  point at."

Followed.

.. index:: Component_Size clauses

RM 13.3(71-73): Component Size Clauses
======================================

  "The recommended level of support for the ``Component_Size``
  attribute is:

  An implementation need not support specified ``Component_Sizes`` that are
  less than the ``Size`` of the component subtype."

Followed.

  "An implementation should support specified Component_Sizes that
  are factors and multiples of the word size.  For such
  Component_Sizes, the array should contain no gaps between
  components.  For other Component_Sizes (if supported), the array
  should contain no gaps between components when packing is also
  specified; the implementation should forbid this combination in cases
  where it cannot support a no-gaps representation."

Followed.

.. index:: Enumeration representation clauses

.. index:: Representation clauses, enumeration

RM 13.4(9-10): Enumeration Representation Clauses
=================================================

  "The recommended level of support for enumeration representation clauses
  is:

  An implementation need not support enumeration representation clauses
  for boolean types, but should at minimum support the internal codes in
  the range ``System.Min_Int .. System.Max_Int``."

Followed.

.. index:: Record representation clauses

.. index:: Representation clauses, records

RM 13.5.1(17-22): Record Representation Clauses
===============================================

  "The recommended level of support for
  *record_representation_clause*\ s is:

  An implementation should support storage places that can be extracted
  with a load, mask, shift sequence of machine code, and set with a load,
  shift, mask, store sequence, given the available machine instructions
  and run-time model."

Followed.

  "A storage place should be supported if its size is equal to the
  ``Size`` of the component subtype, and it starts and ends on a
  boundary that obeys the ``Alignment`` of the component subtype."

Followed.

  "If the default bit ordering applies to the declaration of a given type,
  then for a component whose subtype's ``Size`` is less than the word
  size, any storage place that does not cross an aligned word boundary
  should be supported."

Followed.

  "An implementation may reserve a storage place for the tag field of a
  tagged type, and disallow other components from overlapping that place."

Followed.  The storage place for the tag field is the beginning of the tagged
record, and its size is Address'Size.  GNAT will reject an explicit component
clause for the tag field.

  "An implementation need not support a *component_clause* for a
  component of an extension part if the storage place is not after the
  storage places of all components of the parent type, whether or not
  those storage places had been specified."

Followed.  The above advice on record representation clauses is followed,
and all mentioned features are implemented.

.. index:: Storage place attributes

RM 13.5.2(5): Storage Place Attributes
======================================

  "If a component is represented using some form of pointer (such as an
  offset) to the actual data of the component, and this data is contiguous
  with the rest of the object, then the storage place attributes should
  reflect the place of the actual data, not the pointer.  If a component is
  allocated discontinuously from the rest of the object, then a warning
  should be generated upon reference to one of its storage place
  attributes."

Followed.  There are no such components in GNAT.

.. index:: Bit ordering

RM 13.5.3(7-8): Bit Ordering
============================

  "The recommended level of support for the non-default bit ordering is:

  The implementation should support the nondefault bit ordering in addition
  to the default bit ordering."

Followed.

.. index:: Address, as private type

RM 13.7(37): Address as Private
===============================

  "`Address` should be of a private type."

Followed.

.. index:: Operations, on ``Address``

.. index:: Address, operations of

RM 13.7.1(16): Address Operations
=================================

  "Operations in ``System`` and its children should reflect the target
  environment semantics as closely as is reasonable.  For example, on most
  machines, it makes sense for address arithmetic to 'wrap around'.
  Operations that do not make sense should raise ``Program_Error``."

Followed.  Address arithmetic is modular arithmetic that wraps around.  No
operation raises ``Program_Error``, since all operations make sense.

.. index:: Unchecked conversion

RM 13.9(14-17): Unchecked Conversion
====================================

  "The ``Size`` of an array object should not include its bounds; hence,
  the bounds should not be part of the converted data."

Followed.

  "The implementation should not generate unnecessary run-time checks to
  ensure that the representation of ``S`` is a representation of the
  target type.  It should take advantage of the permission to return by
  reference when possible.  Restrictions on unchecked conversions should be
  avoided unless required by the target environment."

Followed.  There are no restrictions on unchecked conversion.  A warning is
generated if the source and target types do not have the same size since
the semantics in this case may be target dependent.

  "The recommended level of support for unchecked conversions is:

  Unchecked conversions should be supported and should be reversible in
  the cases where this clause defines the result.  To enable meaningful use
  of unchecked conversion, a contiguous representation should be used for
  elementary subtypes, for statically constrained array subtypes whose
  component subtype is one of the subtypes described in this paragraph,
  and for record subtypes without discriminants whose component subtypes
  are described in this paragraph."

Followed.

.. index:: Heap usage, implicit

RM 13.11(23-25): Implicit Heap Usage
====================================

  "An implementation should document any cases in which it dynamically
  allocates heap storage for a purpose other than the evaluation of an
  allocator."

Followed, the only other points at which heap storage is dynamically
allocated are as follows:

*
  At initial elaboration time, to allocate dynamically sized global
  objects.

*
  To allocate space for a task when a task is created.

*
  To extend the secondary stack dynamically when needed.  The secondary
  stack is used for returning variable length results.

..

  "A default (implementation-provided) storage pool for an
  access-to-constant type should not have overhead to support deallocation of
  individual objects."

Followed.

  "A storage pool for an anonymous access type should be created at the
  point of an allocator for the type, and be reclaimed when the designated
  object becomes inaccessible."

Followed.

.. index:: Unchecked deallocation

RM 13.11.2(17): Unchecked Deallocation
======================================

  "For a standard storage pool, ``Free`` should actually reclaim the
  storage."

Followed.

.. index:: Stream oriented attributes

RM 13.13.2(1.6): Stream Oriented Attributes
===========================================

  "If not specified, the value of Stream_Size for an elementary type
  should be the number of bits that corresponds to the minimum number of
  stream elements required by the first subtype of the type, rounded up
  to the nearest factor or multiple of the word size that is also a
  multiple of the stream element size."

Followed, except that the number of stream elements is 1, 2, 3, 4 or 8.
The Stream_Size may be used to override the default choice.

The default implementation is based on direct binary representations and is
therefore target- and endianness-dependent.  To address this issue, GNAT also
supplies an alternate implementation of the stream attributes ``Read`` and
``Write``, which uses the target-independent XDR standard representation for
scalar types. This XDR alternative can be enabled via the binder switch -xdr.

.. index:: XDR representation
.. index:: Read attribute
.. index:: Write attribute
.. index:: Stream oriented attributes

RM A.1(52): Names of Predefined Numeric Types
=============================================

  "If an implementation provides additional named predefined integer types,
  then the names should end with ``Integer`` as in
  ``Long_Integer``.  If an implementation provides additional named
  predefined floating point types, then the names should end with
  ``Float`` as in ``Long_Float``."

Followed.

.. index:: Ada.Characters.Handling

RM A.3.2(49): ``Ada.Characters.Handling``
=========================================

  "If an implementation provides a localized definition of ``Character``
  or ``Wide_Character``, then the effects of the subprograms in
  ``Characters.Handling`` should reflect the localizations.
  See also 3.5.2."

Followed.  GNAT provides no such localized definitions.

.. index:: Bounded-length strings

RM A.4.4(106): Bounded-Length String Handling
=============================================

  "Bounded string objects should not be implemented by implicit pointers
  and dynamic allocation."

Followed.  No implicit pointers or dynamic allocation are used.

.. index:: Random number generation

RM A.5.2(46-47): Random Number Generation
=========================================

  "Any storage associated with an object of type ``Generator`` should be
  reclaimed on exit from the scope of the object."

Followed.

  "If the generator period is sufficiently long in relation to the number
  of distinct initiator values, then each possible value of
  ``Initiator`` passed to ``Reset`` should initiate a sequence of
  random numbers that does not, in a practical sense, overlap the sequence
  initiated by any other value.  If this is not possible, then the mapping
  between initiator values and generator states should be a rapidly
  varying function of the initiator value."

Followed.  The generator period is sufficiently long for the first
condition here to hold true.

.. index:: Get_Immediate

RM A.10.7(23): ``Get_Immediate``
================================

  "The ``Get_Immediate`` procedures should be implemented with
  unbuffered input.  For a device such as a keyboard, input should be
  available if a key has already been typed, whereas for a disk
  file, input should always be available except at end of file.  For a file
  associated with a keyboard-like device, any line-editing features of the
  underlying operating system should be disabled during the execution of
  ``Get_Immediate``."

Followed on all targets except VxWorks. For VxWorks, there is no way to
provide this functionality that does not result in the input buffer being
flushed before the ``Get_Immediate`` call. A special unit
``Interfaces.Vxworks.IO`` is provided that contains routines to enable
this functionality.

.. index:: Containers

RM A.18: ``Containers``
================================

All implementation advice pertaining to Ada.Containers and its
child units (that is, all implementation advice occurring within
section A.18 and its subsections) is followed except for A.18.24(17):

"Bounded ordered set objects should be implemented without implicit pointers or dynamic allocation. "

The implementations of the two Reference_Preserving_Key functions of
the generic package Ada.Containers.Bounded_Ordered_Sets each currently make
use of dynamic allocation; other operations on bounded ordered set objects
follow the implementation advice.

.. index:: Export

RM B.1(39-41): Pragma ``Export``
================================

  "If an implementation supports pragma ``Export`` to a given language,
  then it should also allow the main subprogram to be written in that
  language.  It should support some mechanism for invoking the elaboration
  of the Ada library units included in the system, and for invoking the
  finalization of the environment task.  On typical systems, the
  recommended mechanism is to provide two subprograms whose link names are
  ``adainit`` and ``adafinal``.  ``adainit`` should contain the
  elaboration code for library units.  ``adafinal`` should contain the
  finalization code.  These subprograms should have no effect the second
  and subsequent time they are called."

Followed.

  "Automatic elaboration of pre-elaborated packages should be
  provided when pragma ``Export`` is supported."

Followed when the main program is in Ada.  If the main program is in a
foreign language, then
``adainit`` must be called to elaborate pre-elaborated
packages.

  "For each supported convention *L* other than ``Intrinsic``, an
  implementation should support ``Import`` and ``Export`` pragmas
  for objects of *L*\ -compatible types and for subprograms, and pragma
  `Convention` for *L*\ -eligible types and for subprograms,
  presuming the other language has corresponding features.  Pragma
  ``Convention`` need not be supported for scalar types."

Followed.

.. index:: Package Interfaces

.. index:: Interfaces

RM B.2(12-13): Package ``Interfaces``
=====================================

  "For each implementation-defined convention identifier, there should be a
  child package of package Interfaces with the corresponding name.  This
  package should contain any declarations that would be useful for
  interfacing to the language (implementation) represented by the
  convention.  Any declarations useful for interfacing to any language on
  the given hardware architecture should be provided directly in
  ``Interfaces``."

Followed.

  "An implementation supporting an interface to C, COBOL, or Fortran should
  provide the corresponding package or packages described in the following
  clauses."

Followed.  GNAT provides all the packages described in this section.

.. index:: C, interfacing with

RM B.3(63-71): Interfacing with C
=================================

  "An implementation should support the following interface correspondences
  between Ada and C."

Followed.

  "An Ada procedure corresponds to a void-returning C function."

Followed.

  "An Ada function corresponds to a non-void C function."

Followed.

  "An Ada ``in`` scalar parameter is passed as a scalar argument to a C
  function."

Followed.

  "An Ada ``in`` parameter of an access-to-object type with designated
  type ``T`` is passed as a ``t*`` argument to a C function,
  where ``t`` is the C type corresponding to the Ada type ``T``."

Followed.

  "An Ada access ``T`` parameter, or an Ada ``out`` or ``in out``
  parameter of an elementary type ``T``, is passed as a ``t*``
  argument to a C function, where ``t`` is the C type corresponding to
  the Ada type ``T``.  In the case of an elementary ``out`` or
  ``in out`` parameter, a pointer to a temporary copy is used to
  preserve by-copy semantics."

Followed.

  "An Ada parameter of a record type ``T``, of any mode, is passed as a
  ``t*`` argument to a C function, where ``t`` is the C
  structure corresponding to the Ada type ``T``."

Followed.  This convention may be overridden by the use of the C_Pass_By_Copy
pragma, or Convention, or by explicitly specifying the mechanism for a given
call using an extended import or export pragma.

  "An Ada parameter of an array type with component type ``T``, of any
  mode, is passed as a ``t*`` argument to a C function, where
  ``t`` is the C type corresponding to the Ada type ``T``."

Followed.

  "An Ada parameter of an access-to-subprogram type is passed as a pointer
  to a C function whose prototype corresponds to the designated
  subprogram's specification."

Followed.

.. index:: COBOL, interfacing with

RM B.4(95-98): Interfacing with COBOL
=====================================

  "An Ada implementation should support the following interface
  correspondences between Ada and COBOL."

Followed.

  "An Ada access ``T`` parameter is passed as a ``BY REFERENCE`` data item of
  the COBOL type corresponding to ``T``."

Followed.

  "An Ada in scalar parameter is passed as a ``BY CONTENT`` data item of
  the corresponding COBOL type."

Followed.

  "Any other Ada parameter is passed as a ``BY REFERENCE`` data item of the
  COBOL type corresponding to the Ada parameter type; for scalars, a local
  copy is used if necessary to ensure by-copy semantics."

Followed.

.. index:: Fortran, interfacing with

RM B.5(22-26): Interfacing with Fortran
=======================================

  "An Ada implementation should support the following interface
  correspondences between Ada and Fortran:"

Followed.

  "An Ada procedure corresponds to a Fortran subroutine."

Followed.

  "An Ada function corresponds to a Fortran function."

Followed.

  "An Ada parameter of an elementary, array, or record type ``T`` is
  passed as a ``T`` argument to a Fortran procedure, where ``T`` is
  the Fortran type corresponding to the Ada type ``T``, and where the
  INTENT attribute of the corresponding dummy argument matches the Ada
  formal parameter mode; the Fortran implementation's parameter passing
  conventions are used.  For elementary types, a local copy is used if
  necessary to ensure by-copy semantics."

Followed.

  "An Ada parameter of an access-to-subprogram type is passed as a
  reference to a Fortran procedure whose interface corresponds to the
  designated subprogram's specification."

Followed.

.. index:: Machine operations

RM C.1(3-5): Access to Machine Operations
=========================================

  "The machine code or intrinsic support should allow access to all
  operations normally available to assembly language programmers for the
  target environment, including privileged instructions, if any."

Followed.

  "The interfacing pragmas (see Annex B) should support interface to
  assembler; the default assembler should be associated with the
  convention identifier ``Assembler``."

Followed.

  "If an entity is exported to assembly language, then the implementation
  should allocate it at an addressable location, and should ensure that it
  is retained by the linking process, even if not otherwise referenced
  from the Ada code.  The implementation should assume that any call to a
  machine code or assembler subprogram is allowed to read or update every
  object that is specified as exported."

Followed.

RM C.1(10-16): Access to Machine Operations
===========================================

  "The implementation should ensure that little or no overhead is
  associated with calling intrinsic and machine-code subprograms."

Followed for both intrinsics and machine-code subprograms.

  "It is recommended that intrinsic subprograms be provided for convenient
  access to any machine operations that provide special capabilities or
  efficiency and that are not otherwise available through the language
  constructs."

Followed.  A full set of machine operation intrinsic subprograms is provided.

  "Atomic read-modify-write operations---e.g., test and set, compare and
  swap, decrement and test, enqueue/dequeue."

Followed on any target supporting such operations.

  "Standard numeric functions---e.g.:, sin, log."

Followed on any target supporting such operations.

  "String manipulation operations---e.g.:, translate and test."

Followed on any target supporting such operations.

  "Vector operations---e.g.:, compare vector against thresholds."

Followed on any target supporting such operations.

  "Direct operations on I/O ports."

Followed on any target supporting such operations.

.. index:: Interrupt support

RM C.3(28): Interrupt Support
=============================

  "If the ``Ceiling_Locking`` policy is not in effect, the
  implementation should provide means for the application to specify which
  interrupts are to be blocked during protected actions, if the underlying
  system allows for a finer-grain control of interrupt blocking."

Followed.  The underlying system does not allow for finer-grain control
of interrupt blocking.

.. index:: Protected procedure handlers

RM C.3.1(20-21): Protected Procedure Handlers
=============================================

  "Whenever possible, the implementation should allow interrupt handlers to
  be called directly by the hardware."

Followed on any target where the underlying operating system permits
such direct calls.

  "Whenever practical, violations of any
  implementation-defined restrictions should be detected before run time."

Followed.  Compile time warnings are given when possible.

.. index:: Package ``Interrupts``

.. index:: Interrupts

RM C.3.2(25): Package ``Interrupts``
====================================

  "If implementation-defined forms of interrupt handler procedures are
  supported, such as protected procedures with parameters, then for each
  such form of a handler, a type analogous to ``Parameterless_Handler``
  should be specified in a child package of ``Interrupts``, with the
  same operations as in the predefined package Interrupts."

Followed.

.. index:: Pre-elaboration requirements

RM C.4(14): Pre-elaboration Requirements
========================================

  "It is recommended that pre-elaborated packages be implemented in such a
  way that there should be little or no code executed at run time for the
  elaboration of entities not already covered by the Implementation
  Requirements."

Followed.  Executable code is generated in some cases, e.g., loops
to initialize large arrays.

RM C.5(8): Pragma ``Discard_Names``
===================================

  "If the pragma applies to an entity, then the implementation should
  reduce the amount of storage used for storing names associated with that
  entity."

Followed.

.. index:: Package Task_Attributes

.. index:: Task_Attributes

RM C.7.2(30): The Package Task_Attributes
=========================================

  "Some implementations are targeted to domains in which memory use at run
  time must be completely deterministic.  For such implementations, it is
  recommended that the storage for task attributes will be pre-allocated
  statically and not from the heap.  This can be accomplished by either
  placing restrictions on the number and the size of the task's
  attributes, or by using the pre-allocated storage for the first ``N``
  attribute objects, and the heap for the others.  In the latter case,
  ``N`` should be documented."

Not followed.  This implementation is not targeted to such a domain.

.. index:: Locking Policies

RM D.3(17): Locking Policies
============================

  "The implementation should use names that end with ``_Locking`` for
  locking policies defined by the implementation."

Followed.  Two implementation-defined locking policies are defined,
whose names (``Inheritance_Locking`` and
``Concurrent_Readers_Locking``) follow this suggestion.

.. index:: Entry queuing policies

RM D.4(16): Entry Queuing Policies
==================================

  "Names that end with ``_Queuing`` should be used
  for all implementation-defined queuing policies."

Followed.  No such implementation-defined queuing policies exist.

.. index:: Preemptive abort

RM D.6(9-10): Preemptive Abort
==============================

  "Even though the *abort_statement* is included in the list of
  potentially blocking operations (see 9.5.1), it is recommended that this
  statement be implemented in a way that never requires the task executing
  the *abort_statement* to block."

Followed.

  "On a multi-processor, the delay associated with aborting a task on
  another processor should be bounded; the implementation should use
  periodic polling, if necessary, to achieve this."

Followed.

.. index:: Tasking restrictions

RM D.7(21): Tasking Restrictions
================================

  "When feasible, the implementation should take advantage of the specified
  restrictions to produce a more efficient implementation."

GNAT currently takes advantage of these restrictions by providing an optimized
run time when the Ravenscar profile and the GNAT restricted run time set
of restrictions are specified.  See pragma ``Profile (Ravenscar)`` and
pragma ``Profile (Restricted)`` for more details.

.. index:: Time, monotonic

RM D.8(47-49): Monotonic Time
=============================

  "When appropriate, implementations should provide configuration
  mechanisms to change the value of ``Tick``."

Such configuration mechanisms are not appropriate to this implementation
and are thus not supported.

  "It is recommended that ``Calendar.Clock`` and ``Real_Time.Clock``
  be implemented as transformations of the same time base."

Followed.


  "It is recommended that the best time base which exists in
  the underlying system be available to the application through
  ``Clock``.  `Best` may mean highest accuracy or largest range."

Followed.

.. index:: Partition communication subsystem

.. index:: PCS

RM E.5(28-29): Partition Communication Subsystem
================================================

  "Whenever possible, the PCS on the called partition should allow for
  multiple tasks to call the RPC-receiver with different messages and
  should allow them to block until the corresponding subprogram body
  returns."

A separately supplied PCS that can be used with GNAT when combined with the PolyORB product (NB! See the note in :ref:`polyORB` regarding the lifetime
of this product).

  "The ``Write`` operation on a stream of type ``Params_Stream_Type``
  should raise ``Storage_Error`` if it runs out of space trying to
  write the ``Item`` into the stream."

.. index:: COBOL support

RM F(7): COBOL Support
======================

  "If COBOL (respectively, C) is widely supported in the target
  environment, implementations supporting the Information Systems Annex
  should provide the child package ``Interfaces.COBOL`` (respectively,
  ``Interfaces.C``) specified in Annex B and should support a
  ``convention_identifier`` of COBOL (respectively, C) in the interfacing
  pragmas (see Annex B), thus allowing Ada programs to interface with
  programs written in that language."

Followed.

.. index:: Decimal radix support

RM F.1(2): Decimal Radix Support
================================

  "Packed decimal should be used as the internal representation for objects
  of subtype ``S`` when ``S``'Machine_Radix = 10."

Not followed.  GNAT ignores ``S``'Machine_Radix and always uses binary
representations.

.. index:: Numerics

RM G: Numerics
==============

  "If Fortran (respectively, C) is widely supported in the target
  environment, implementations supporting the Numerics Annex
  should provide the child package ``Interfaces.Fortran`` (respectively,
  ``Interfaces.C``) specified in Annex B and should support a
  ``convention_identifier`` of Fortran (respectively, C) in the interfacing
  pragmas (see Annex B), thus allowing Ada programs to interface with
  programs written in that language."

Followed.

.. index:: Complex types

RM G.1.1(56-58): Complex Types
==============================

  "Because the usual mathematical meaning of multiplication of a complex
  operand and a real operand is that of the scaling of both components of
  the former by the latter, an implementation should not perform this
  operation by first promoting the real operand to complex type and then
  performing a full complex multiplication.  In systems that, in the
  future, support an Ada binding to IEC 559:1989, the latter technique
  will not generate the required result when one of the components of the
  complex operand is infinite.  (Explicit multiplication of the infinite
  component by the zero component obtained during promotion yields a NaN
  that propagates into the final result.) Analogous advice applies in the
  case of multiplication of a complex operand and a pure-imaginary
  operand, and in the case of division of a complex operand by a real or
  pure-imaginary operand."

Not followed.

  "Similarly, because the usual mathematical meaning of addition of a
  complex operand and a real operand is that the imaginary operand remains
  unchanged, an implementation should not perform this operation by first
  promoting the real operand to complex type and then performing a full
  complex addition.  In implementations in which the ``Signed_Zeros``
  attribute of the component type is ``True`` (and which therefore
  conform to IEC 559:1989 in regard to the handling of the sign of zero in
  predefined arithmetic operations), the latter technique will not
  generate the required result when the imaginary component of the complex
  operand is a negatively signed zero.  (Explicit addition of the negative
  zero to the zero obtained during promotion yields a positive zero.)
  Analogous advice applies in the case of addition of a complex operand
  and a pure-imaginary operand, and in the case of subtraction of a
  complex operand and a real or pure-imaginary operand."

Not followed.

  "Implementations in which ``Real'Signed_Zeros`` is ``True`` should
  attempt to provide a rational treatment of the signs of zero results and
  result components.  As one example, the result of the ``Argument``
  function should have the sign of the imaginary component of the
  parameter ``X`` when the point represented by that parameter lies on
  the positive real axis; as another, the sign of the imaginary component
  of the ``Compose_From_Polar`` function should be the same as
  (respectively, the opposite of) that of the ``Argument`` parameter when that
  parameter has a value of zero and the ``Modulus`` parameter has a
  nonnegative (respectively, negative) value."

Followed.

.. index:: Complex elementary functions

RM G.1.2(49): Complex Elementary Functions
==========================================

  "Implementations in which ``Complex_Types.Real'Signed_Zeros`` is
  ``True`` should attempt to provide a rational treatment of the signs
  of zero results and result components.  For example, many of the complex
  elementary functions have components that are odd functions of one of
  the parameter components; in these cases, the result component should
  have the sign of the parameter component at the origin.  Other complex
  elementary functions have zero components whose sign is opposite that of
  a parameter component at the origin, or is always positive or always
  negative."

Followed.

.. index:: Accuracy requirements

RM G.2.4(19): Accuracy Requirements
===================================

  "The versions of the forward trigonometric functions without a
  ``Cycle`` parameter should not be implemented by calling the
  corresponding version with a ``Cycle`` parameter of
  ``2.0*Numerics.Pi``, since this will not provide the required
  accuracy in some portions of the domain.  For the same reason, the
  version of ``Log`` without a ``Base`` parameter should not be
  implemented by calling the corresponding version with a ``Base``
  parameter of ``Numerics.e``."

Followed.

.. index:: Complex arithmetic accuracy

.. index:: Accuracy, complex arithmetic

RM G.2.6(15): Complex Arithmetic Accuracy
=========================================

  "The version of the ``Compose_From_Polar`` function without a
  ``Cycle`` parameter should not be implemented by calling the
  corresponding version with a ``Cycle`` parameter of
  ``2.0*Numerics.Pi``, since this will not provide the required
  accuracy in some portions of the domain."

Followed.

.. index:: Sequential elaboration policy

RM H.6(15/2): Pragma Partition_Elaboration_Policy
=================================================

  "If the partition elaboration policy is ``Sequential`` and the
  Environment task becomes permanently blocked during elaboration then the
  partition is deadlocked and it is recommended that the partition be
  immediately terminated."

Not followed.

---

### Gcc Ada Doc Gnat Rm Implementation Defined Aspects (`gcc/ada/doc/gnat_rm/implementation_defined_aspects.rst`)

.. _Implementation_Defined_Aspects:

******************************
Implementation Defined Aspects
******************************

Ada defines (throughout the Ada 2012 reference manual, summarized
in Annex K) a set of aspects that can be specified for certain entities.
These language defined aspects are implemented in GNAT in Ada 2012 mode
and work as described in the Ada 2012 Reference Manual.

In addition, Ada 2012 allows implementations to define additional aspects
whose meaning is defined by the implementation.  GNAT provides
a number of these implementation-defined aspects which can be used
to extend and enhance the functionality of the compiler.  This section of
the GNAT reference manual describes these additional aspects.

Note that any program using these aspects may not be portable to
other compilers (although GNAT implements this set of aspects on all
platforms).  Therefore if portability to other compilers is an important
consideration, you should minimize the use of these aspects.

Note that for many of these aspects, the effect is essentially similar
to the use of a pragma or attribute specification with the same name
applied to the entity. For example, if we write:


.. code-block:: ada

  type R is range 1 .. 100
 with Value_Size => 10;


then the effect is the same as:

.. code-block:: ada

  type R is range 1 .. 100;
  for R'Value_Size use 10;


and if we write:

.. code-block:: ada

  type R is new Integer
 with Shared => True;


then the effect is the same as:

.. code-block:: ada

  type R is new Integer;
  pragma Shared (R);


In the documentation below, such cases are simply marked
as being boolean aspects equivalent to the corresponding pragma
or attribute definition clause.

Aspect Abstract_State
=====================

.. index:: Abstract_State

This aspect is equivalent to :ref:`pragma Abstract_State`.

Aspect Always_Terminates
========================
.. index:: Always_Terminates

This boolean aspect is equivalent to :ref:`pragma Always_Terminates`.

Aspect Annotate
===============

.. index:: Annotate

There are three forms of this aspect (where ID is an identifier,
and ARG is a general expression),
corresponding to :ref:`pragma Annotate`.



*Annotate => ID*
  Equivalent to ``pragma Annotate (ID, Entity => Name);``


*Annotate => (ID)*
  Equivalent to ``pragma Annotate (ID, Entity => Name);``


*Annotate => (ID ,ID {, ARG})*
  Equivalent to ``pragma Annotate (ID, ID {, ARG}, Entity => Name);``

Aspect Async_Readers
====================
.. index:: Async_Readers

This boolean aspect is equivalent to :ref:`pragma Async_Readers`.

Aspect Async_Writers
====================
.. index:: Async_Writers

This boolean aspect is equivalent to :ref:`pragma Async_Writers`.

Aspect Constant_After_Elaboration
=================================
.. index:: Constant_After_Elaboration

This aspect is equivalent to :ref:`pragma Constant_After_Elaboration`.

Aspect Contract_Cases
=====================
.. index:: Contract_Cases

This aspect is equivalent to :ref:`pragma Contract_Cases`, the sequence
of clauses being enclosed in parentheses so that syntactically it is an
aggregate.

Aspect Depends
==============
.. index:: Depends

This aspect is equivalent to :ref:`pragma Depends`.

Aspect Default_Initial_Condition
================================
.. index:: Default_Initial_Condition

This aspect is equivalent to :ref:`pragma Default_Initial_Condition`.

Aspect Dimension
================
.. index:: Dimension

The ``Dimension`` aspect is used to specify the dimensions of a given
subtype of a dimensioned numeric type. The aspect also specifies a symbol
used when doing formatted output of dimensioned quantities. The syntax is::

  with Dimension =>
 ([Symbol =>] SYMBOL, DIMENSION_VALUE {, DIMENSION_Value})

  SYMBOL ::= STRING_LITERAL | CHARACTER_LITERAL

  DIMENSION_VALUE ::=
 RATIONAL
  | others               => RATIONAL
  | DISCRETE_CHOICE_LIST => RATIONAL

  RATIONAL ::= [-] NUMERIC_LITERAL [/ NUMERIC_LITERAL]


This aspect can only be applied to a subtype whose parent type has
a ``Dimension_System`` aspect. The aspect must specify values for
all dimensions of the system. The rational values are the powers of the
corresponding dimensions that are used by the compiler to verify that
physical (numeric) computations are dimensionally consistent. For example,
the computation of a force must result in dimensions (L => 1, M => 1, T => -2).
For further examples of the usage
of this aspect, see package ``System.Dim.Mks``.
Note that when the dimensioned type is an integer type, then any
dimension value must be an integer literal.

Aspect Dimension_System
=======================
.. index:: Dimension_System

The ``Dimension_System`` aspect is used to define a system of
dimensions that will be used in subsequent subtype declarations with
``Dimension`` aspects that reference this system. The syntax is::

  with Dimension_System => (DIMENSION {, DIMENSION});

  DIMENSION ::= ([Unit_Name   =>] IDENTIFIER,
              [Unit_Symbol =>] SYMBOL,
              [Dim_Symbol  =>] SYMBOL)

  SYMBOL ::= CHARACTER_LITERAL | STRING_LITERAL


This aspect is applied to a type, which must be a numeric derived type
(typically a floating-point type), that
will represent values within the dimension system. Each ``DIMENSION``
corresponds to one particular dimension. A maximum of 7 dimensions may
be specified. ``Unit_Name`` is the name of the dimension (for example
``Meter``). ``Unit_Symbol`` is the shorthand used for quantities
of this dimension (for example ``m`` for ``Meter``).
``Dim_Symbol`` gives
the identification within the dimension system (typically this is a
single letter, e.g. ``L`` standing for length for unit name ``Meter``).
The ``Unit_Symbol`` is used in formatted output of dimensioned quantities.
The ``Dim_Symbol`` is used in error messages when numeric operations have
inconsistent dimensions.

GNAT provides the standard definition of the International MKS system in
the run-time package ``System.Dim.Mks``. You can easily define
similar packages for cgs units or British units, and define conversion factors
between values in different systems. The MKS system is characterized by the
following aspect:

.. code-block:: ada

  type Mks_Type is new Long_Long_Float with
    Dimension_System => (
      (Unit_Name => Meter,    Unit_Symbol => 'm',   Dim_Symbol => 'L'),
      (Unit_Name => Kilogram, Unit_Symbol => "kg",  Dim_Symbol => 'M'),
      (Unit_Name => Second,   Unit_Symbol => 's',   Dim_Symbol => 'T'),
      (Unit_Name => Ampere,   Unit_Symbol => 'A',   Dim_Symbol => 'I'),
      (Unit_Name => Kelvin,   Unit_Symbol => 'K',   Dim_Symbol => '@'),
      (Unit_Name => Mole,     Unit_Symbol => "mol", Dim_Symbol => 'N'),
      (Unit_Name => Candela,  Unit_Symbol => "cd",  Dim_Symbol => 'J'));


Note that in the above type definition, we use the ``at`` symbol (``@``) to
represent a theta character (avoiding the use of extended Latin-1
characters in this context).

See section 'Performing Dimensionality Analysis in GNAT' in the GNAT Users
Guide for detailed examples of use of the dimension system.

Aspect Disable_Controlled
=========================
.. index:: Disable_Controlled

The aspect  ``Disable_Controlled`` is defined for controlled record types. If
active, this aspect causes suppression of all related calls to ``Initialize``,
``Adjust``, and ``Finalize``. The intended use is for conditional compilation,
where for example you might want a record to be controlled or not depending on
whether some run-time check is enabled or suppressed.

Aspect Effective_Reads
======================
.. index:: Effective_Reads

This aspect is equivalent to :ref:`pragma Effective_Reads`.

Aspect Effective_Writes
=======================
.. index:: Effective_Writes

This aspect is equivalent to :ref:`pragma Effective_Writes`.

Aspect Exceptional_Cases
========================
.. index:: Exceptional_Cases

This aspect may be specified for procedures and functions with side effects;
it can be used to list exceptions that might be propagated by the subprogram
with side effects in the context of its precondition, and associate them
with a specific postcondition.

For the syntax and semantics of this aspect, see the SPARK 2014 Reference
Manual, section 6.1.9.

Aspect Exit_Cases
=================
.. index:: Exit_Cases

This aspect may be specified for procedures and functions with side effects;
it can be used to partition the input state into a list of cases and specify,
for each case, how the subprogram is allowed to terminate (i.e. return normally
or propagate an exception).

For the syntax and semantics of this aspect, see the SPARK 2014 Reference
Manual, section 6.1.10.

Aspect Extended_Access
======================

This nonoverridable boolean-valued type-related representation aspect can be
specified as part of a full_type_declaration for a general access type
designating an unconstrained array subtype.

The absence of an Extended_Access aspect specification for such a
full_type_declaration is equivalent to an explicit
"Extended_Access => False" specification. This implies
that the aspect is never unspecified for an eligible access type.
An access type for which this aspect is True is said to be an extended access
type; this includes the case of a type derived from an extended access type.
Similarly, a value of such a type is said to be an extended access value.

The representation of an extended access value is different than that of
other access values. This representation makes it possible to designate
objects that cannot be designated using the usual "thin" or "fat" access
representations for an access type designating an unconstrained array
subtype (notably slices and array objects imported from other languages).

In particular, two rules are modified in determining the legality of an Access
or Unchecked_Access attribute reference if the expected access type is
an extended access type:

* A slice of an aliased array object of a non-bitpacked type (more precisely,
  of an array type having independently addressable components) is considered
  to be aliased (and the accessibility level of a slice of an array object is
  defined to be that of the array object); this also applies to renamings
  of such slices, slices of such renamings, etc.

* The requirement that the nominal subtype of the prefix shall statically
  match the designated subtype of the access type need not be met.

The Size aspect (and other aspects including Stream_Size, Object_Size,
and Alignment) of an extended access type may depend on the properties of the
designated type. Further details of this dependence are not documented.

An extended access value is not convertible to a non-extended access type,
although conversions in the opposite direction are allowed. We don't want
to allow

.. code-block:: ada

type Big_Ref is access all String with Extended_Access;
type Small_Ref is access all String;
Obj : aliased String := "abcde";
Big_Ptr : Big_Ref := Obj (2 .. 4)'Access; -- OK
Small_Ptr : Small_Ref := Small_Ref (Big_Ptr); -- ERROR: illegal conversion

because there is no way to represent the result of such a conversion.

A dereference of an extended access value (or a reference to a renaming
thereof) shall not occur in any of the following contexts:

* as an operative constituent of the prefix of an Access or
  Unchecked_Access attribute reference whose expected type is not extended; or

* as an operative constituent of an actual parameter in a call where
  the corresponding formal parameter is explicitly aliased.

For the same reasons that explicit conversions from an extended access type to a
non-extended access type are forbidden, we also need to disallow getting the
same effect via a Extended_Ptr.all'Access reference; this includes the case
of passing Extended_Ptr.all as an actual parameter in a call where the
corresponding formal parameter is explicitly aliased (because the callee
could evaluate Formal_Parameter'Access). This goal is accomplished by
adjusting the definition of the term "aliased". A dereference of an extended
value occurring in one of these contexts is defined to denote
a nonaliased view. This has the desired effect because these contexts require
an aliased view. Continuing the preceding example, this rule disallows

.. code-block:: ada

Sneaky_1 : Small_Ptr := Big_Ptr.all'Access; -- ERROR: illegal 'Access prefix

function Make (Str : aliased in out String) return Small_Ptr
  is (Str'Access); -- OK

Sneaky_2 : Small_Ptr := Make (Str => Big_Ptr.all); -- ERROR: bad parameter

for the same reason given above in the case of an explicit type conversion.

Aspect Extensions_Visible
=========================
.. index:: Extensions_Visible

This aspect is equivalent to :ref:`pragma Extensions_Visible`.

Aspect Favor_Top_Level
======================
.. index:: Favor_Top_Level

This boolean aspect is equivalent to :ref:`pragma Favor_Top_Level`.

Aspect Ghost
=============
.. index:: Ghost

This aspect is equivalent to :ref:`pragma Ghost`.

Aspect Ghost_Predicate
======================
.. index:: Ghost_Predicate

This aspect introduces a subtype predicate that can reference ghost
entities. The subtype cannot appear as a subtype_mark in a membership test.

For the detailed semantics of this aspect, see the entry for subtype predicates
in the SPARK Reference Manual, section 3.2.4.

Aspect Global
=============
.. index:: Global

This aspect is equivalent to :ref:`pragma Global`.

Aspect Initial_Condition
========================
.. index:: Initial_Condition

This aspect is equivalent to :ref:`pragma Initial_Condition`.

Aspect Initializes
==================
.. index:: Initializes

This aspect is equivalent to :ref:`pragma Initializes`.

Aspect Inline_Always
====================
.. index:: Inline_Always

This boolean aspect is equivalent to :ref:`pragma Inline_Always`.

Aspect Invariant
================
.. index:: Invariant

This aspect is equivalent to :ref:`pragma Invariant`. It is a
synonym for the language defined aspect ``Type_Invariant`` except
that it is separately controllable using pragma ``Assertion_Policy``.

Aspect Invariant'Class
======================
.. index:: Invariant'Class

This aspect is equivalent to :ref:`pragma Type_Invariant_Class`. It is a
synonym for the language defined aspect ``Type_Invariant'Class`` except
that it is separately controllable using pragma ``Assertion_Policy``.

Aspect Iterable
===============
.. index:: Iterable

This aspect provides a light-weight mechanism for loops and quantified
expressions over container types, without the overhead imposed by the tampering
checks of standard Ada 2012 iterators. The value of the aspect is an aggregate
with six named components, of which the last four are optional: ``First``,
``Next``, ``Has_Element``, ``Element``, ``Constant_Reference``, ``Last``, and
``Previous``.
When only the first three components are specified, only the
``for .. in`` form of iteration over cursors is available. When either
``Element`` or ``Constant_Reference`` is specified, both this form and the
``for .. of`` form of iteration over elements are available. ``Element``
and ``Constant_Reference`` cannot be specified together.
If the last two components are specified, reverse
iterations over the container can be specified (analogous to what can be done
over predefined containers that support the ``Reverse_Iterator`` interface).
The following is a typical example of use:

.. code-block:: ada

  type List is private with
   Iterable => (First              => First_Cursor,
                Next               => Advance,
                Has_Element        => Cursor_Has_Element
              [,Element            => Get_Element]
              [,Constant_Reference => Element_Constant_Access]
              [,Last               => Last_Cursor]
              [,Previous           => Retreat]);

* The values of ``First`` and ``Last`` are primitive operations of the
  container type that return a ``Cursor``, which must be a type declared in
  the container package or visible from it. For example:

.. code-block:: ada

  function First_Cursor (Cont : Container) return Cursor;
  function Last_Cursor  (Cont : Container) return Cursor;

* The values of ``Next`` and ``Previous`` are primitive operations of the container type that take
  both a container and a cursor and yield a cursor. For example:

.. code-block:: ada

  function Advance (Cont : Container; Position : Cursor) return Cursor;
  function Retreat (Cont : Container; Position : Cursor) return Cursor;

* The value of ``Has_Element`` is a primitive operation of the container type
  that takes both a container and a cursor and yields a boolean. For example:

.. code-block:: ada

  function Cursor_Has_Element (Cont : Container; Position : Cursor) return Boolean;

* The value of ``Element`` is a primitive operation of the container type that
  takes both a container and a cursor and yields an ``Element_Type``, which must
  be a type declared in the container package or visible from it. For example:

.. code-block:: ada

  function Get_Element (Cont : Container; Position : Cursor) return Element_Type;

* The value of ``Constant_Reference`` is a primitive operation of the container
  type that
  takes both a container and a cursor and yields an anonymous access-to-constant
  type designating ``Element_Type`` with null exclusion, which must
  be a type declared in the container package or visible from it. For example:

.. code-block:: ada

  function Element_Constant_Access (Cont : Container; Position : Cursor) return not null access constant Element_Type;

This aspect is used in the GNAT-defined formal container packages.

Aspect Linker_Section
=====================
.. index:: Linker_Section

This aspect is equivalent to :ref:`pragma Linker_Section`.

Aspect Local_Restrictions
=========================
.. index:: Local_Restrictions

This aspect may be specified for a subprogram (and for other declarations
as described below). It is used to specify that a particular subprogram does
not violate one or more local restrictions, nor can it call a subprogram
that is not subject to the same requirement. Positional aggregate syntax
(with parentheses, not square brackets) may be used to specify more than one
local restriction, as in

.. code-block:: ada

  procedure Do_Something
 with Local_Restrictions => (Some_Restriction, Another_Restriction);

Parentheses are currently required even in the case of specifying a single
local restriction (this requirement may be relaxed in the future).
Supported local restrictions currently include (only) No_Heap_Allocations and
No_Secondary_Stack.
No_Secondary_Stack corresponds to the GNAT-defined (global) restriction
of the same name. No_Heap_Allocations corresponds to the conjunction of the
Ada-defined restrictions No_Allocators and No_Implicit_Heap_Allocations.

Additional requirements are imposed in order to ensure that restriction
violations cannot be achieved via overriding dispatching operations,
calling through an access-to-subprogram value, calling a generic formal
subprogram, or calling through a subprogram renaming.
For a dispatching operation, an overrider must be subject to (at least) the
same restrictions as the overridden inherited subprogram; similarly, the
actual subprogram corresponding to a generic formal subprogram
in an instantiation must be subject to (at least) the same restrictions
as the formal subprogram. A call through an access-to-subprogram value
is conservatively assumed to violate all local restrictions; tasking-related
constructs (notably entry calls) are treated similarly. A renaming-as-body is
treated like a subprogram body containing a call to the renamed subprogram.

The Local_Restrictions aspect can be specified for a package specification,
in which case the aspect specification also applies to all eligible entities
declared with the package. This includes types. Default initialization of an
object of a given type is treated like a call to an implicitly-declared
initialization subprogram. Such a "call" is subject to the same local
restriction checks as any other call. If a type is subject to a local
restriction, then any violations of that restriction within the default
initialization expressions (if any) of the type are rejected. This may
include "calls" to the default initialization subprograms of other types.

Local_Restrictions aspect specifications are additive (for example, in the
case of a declaration that occurs within nested packages that each have
a Local_Restrictions specification).


Aspect Lock_Free
================
.. index:: Lock_Free

This boolean aspect is equivalent to :ref:`pragma Lock_Free`.

Aspect Max_Queue_Length
=======================
.. index:: Max_Queue_Length

This aspect is equivalent to :ref:`pragma Max_Queue_Length`.

Aspect Modifies
===============
.. index:: Modifies

For the syntax and semantics of this aspect, see the SPARK 2014 Reference
Manual, section TBD.

Aspect No_Caching
=================
.. index:: No_Caching

This boolean aspect is equivalent to :ref:`pragma No_Caching`.

Aspect No_Elaboration_Code_All
==============================
.. index:: No_Elaboration_Code_All

This aspect is equivalent to :ref:`pragma No_Elaboration_Code_All`
for a program unit.

Aspect No_Inline
================
.. index:: No_Inline

This boolean aspect is equivalent to :ref:`pragma No_Inline`.

Aspect No_Raise
===============
.. index:: No_Raise

This boolean aspect is equivalent to :ref:`pragma No_Raise`.

Aspect No_Tagged_Streams
========================
.. index:: No_Tagged_Streams

This aspect is equivalent to :ref:`pragma No_Tagged_Streams` with an
argument specifying a root tagged type (thus this aspect can only be
applied to such a type).

Aspect No_Task_Parts
========================
.. index:: No_Task_Parts

Applies to a type. If True, requires that the type and any descendants
do not have any task parts. The rules for this aspect are the same as
for the language-defined No_Controlled_Parts aspect (see RM-H.4.1),
replacing "controlled" with "task".

If No_Task_Parts is True for a type T, then the compiler can optimize
away certain tasking-related code that would otherwise be needed
for T'Class, because descendants of T might contain tasks.

Aspect Object_Size
==================
.. index:: Object_Size

This aspect is equivalent to :ref:`attribute Object_Size<Attribute-Object_Size>`.

Aspect Obsolescent
==================
.. index:: Obsolescent

This aspect is equivalent to :ref:`pragma Obsolescent`. Note that the
evaluation of this aspect happens at the point of occurrence, it is not
delayed until the freeze point.

Aspect Part_Of
==============
.. index:: Part_Of

This aspect is equivalent to :ref:`pragma Part_Of`.

Aspect Persistent_BSS
=====================
.. index:: Persistent_BSS

This boolean aspect is equivalent to :ref:`pragma Persistent_BSS`.

Aspect Potentially_Invalid
==========================
.. index:: Potentially_Invalid

For the syntax and semantics of this aspect, see the SPARK 2014 Reference
Manual, section 13.9.1.


Aspect Predicate
================
.. index:: Predicate

This aspect is equivalent to :ref:`pragma Predicate`. It is thus
similar to the language defined aspects ``Dynamic_Predicate``
and ``Static_Predicate`` except that whether the resulting
predicate is static or dynamic is controlled by the form of the
expression. It is also separately controllable using pragma
``Assertion_Policy``.

Aspect Program_Exit
===================
.. index:: Program_Exit

This boolean aspect is equivalent to :ref:`pragma Program_Exit`.

Aspect Pure_Function
====================
.. index:: Pure_Function

This boolean aspect is equivalent to :ref:`pragma Pure_Function`.

Aspect Refined_Depends
======================
.. index:: Refined_Depends

This aspect is equivalent to :ref:`pragma Refined_Depends`.

Aspect Refined_Global
=====================
.. index:: Refined_Global

This aspect is equivalent to :ref:`pragma Refined_Global`.

Aspect Refined_Post
===================
.. index:: Refined_Post

This aspect is equivalent to :ref:`pragma Refined_Post`.

Aspect Refined_State
====================
.. index:: Refined_State

This aspect is equivalent to :ref:`pragma Refined_State`.

Aspect Relaxed_Initialization
=============================
.. index:: Refined_Initialization

For the syntax and semantics of this aspect, see the SPARK 2014 Reference
Manual, section 6.10.

Aspect Remote_Access_Type
=========================
.. index:: Remote_Access_Type

This aspect is equivalent to :ref:`pragma Remote_Access_Type`.

Aspect Scalar_Storage_Order
===========================
.. index:: Scalar_Storage_Order

This aspect is equivalent to a :ref:`attribute Scalar_Storage_Order<Attribute-Scalar_Storage_Order>`.

Aspect Secondary_Stack_Size
===========================

.. index:: Secondary_Stack_Size

This aspect is equivalent to :ref:`pragma Secondary_Stack_Size`.

Aspect Shared
=============
.. index:: Shared

This boolean aspect is equivalent to :ref:`pragma Shared`
and is thus a synonym for aspect ``Atomic``.

Aspect Side_Effects
===================
.. index:: Side_Effects

This aspect is equivalent to :ref:`pragma Side_Effects`.

Aspect Simple_Storage_Pool
==========================
.. index:: Simple_Storage_Pool

This aspect is equivalent to :ref:`attribute Simple_Storage_Pool<Attribute_Simple_Storage_Pool>`.

Aspect Simple_Storage_Pool_Type
===============================
.. index:: Simple_Storage_Pool_Type

This boolean aspect is equivalent to :ref:`pragma Simple_Storage_Pool_Type`.

Aspect SPARK_Mode
=================
.. index:: SPARK_Mode

This aspect is equivalent to :ref:`pragma SPARK_Mode` and
may be specified for either or both of the specification and body
of a subprogram or package.

Aspect Subprogram_Variant
=========================
.. index:: Subprogram_Variant

For the syntax and semantics of this aspect, see the SPARK 2014 Reference
Manual, section 6.1.8.

Aspect Suppress_Debug_Info
==========================
.. index:: Suppress_Debug_Info

This boolean aspect is equivalent to :ref:`pragma Suppress_Debug_Info`.

Aspect Suppress_Initialization
==============================
.. index:: Suppress_Initialization

This boolean aspect is equivalent to :ref:`pragma Suppress_Initialization`.

Aspect Test_Case
================
.. index:: Test_Case

This aspect is equivalent to :ref:`pragma Test_Case`.

Aspect Thread_Local_Storage
===========================
.. index:: Thread_Local_Storage

This boolean aspect is equivalent to :ref:`pragma Thread_Local_Storage`.

Aspect Universal_Aliasing
=========================
.. index:: Universal_Aliasing

This boolean aspect is equivalent to :ref:`pragma Universal_Aliasing`.

Aspect Unmodified
=================
.. index:: Unmodified

This boolean aspect is equivalent to :ref:`pragma Unmodified`.

Aspect Unreferenced
===================
.. index:: Unreferenced

This boolean aspect is equivalent to :ref:`pragma Unreferenced`.

When using the ``-gnat2022`` switch, this aspect is also supported on formal
parameters, which is in particular the only form possible for expression
functions.

Aspect Unreferenced_Objects
===========================
.. index:: Unreferenced_Objects

This boolean aspect is equivalent to :ref:`pragma Unreferenced_Objects`.

Aspect User_Aspect
==================
.. index:: User_Aspect

This aspect takes an argument that is the name of an aspect defined by a
User_Aspect_Definition configuration pragma.
A User_Aspect aspect specification is semantically equivalent to
replicating the set of aspect specifications associated with the named
pragma-defined aspect.

Aspect Value_Size
=================
.. index:: Value_Size

This aspect is equivalent to :ref:`attribute Value_Size<Attribute-Value_Size>`.

Aspect Volatile_Full_Access
===========================
.. index:: Volatile_Full_Access

This boolean aspect is equivalent to :ref:`pragma Volatile_Full_Access`.

Aspect Volatile_Function
===========================
.. index:: Volatile_Function

This boolean aspect is equivalent to :ref:`pragma Volatile_Function`.

Aspect Warnings
===============
.. index:: Warnings

This aspect is equivalent to the two argument form of :ref:`pragma Warnings`,
where the first argument is ``ON`` or ``OFF`` and the second argument
is the entity.

---

### Gcc Ada Doc Gnat Rm Implementation Defined Attributes (`gcc/ada/doc/gnat_rm/implementation_defined_attributes.rst`)

.. _Implementation_Defined_Attributes:

*********************************
Implementation Defined Attributes
*********************************

Ada defines (throughout the Ada reference manual,
summarized in Annex K),
a set of attributes that provide useful additional functionality in all
areas of the language.  These language defined attributes are implemented
in GNAT and work as described in the Ada Reference Manual.

In addition, Ada allows implementations to define additional
attributes whose meaning is defined by the implementation.  GNAT provides
a number of these implementation-dependent attributes which can be used
to extend and enhance the functionality of the compiler.  This section of
the GNAT reference manual describes these additional attributes.  It also
describes additional implementation-dependent features of standard
language-defined attributes.

Note that any program using these attributes may not be portable to
other compilers (although GNAT implements this set of attributes on all
platforms).  Therefore if portability to other compilers is an important
consideration, you should minimize the use of these attributes.

Attribute Abort_Signal
======================
.. index:: Abort_Signal

``Standard'Abort_Signal`` (``Standard`` is the only allowed
prefix) provides the entity for the special exception used to signal
task abort or asynchronous transfer of control.  Normally this attribute
should only be used in the tasking runtime (it is highly peculiar, and
completely outside the normal semantics of Ada, for a user program to
intercept the abort exception).

Attribute Address_Size
======================
.. index:: Size of ``Address``

.. index:: Address_Size

``Standard'Address_Size`` (``Standard`` is the only allowed
prefix) is a static constant giving the number of bits in an
``Address``. It is the same value as System.Address'Size,
but has the advantage of being static, while a direct
reference to System.Address'Size is nonstatic because Address
is a private type.

Attribute Asm_Input
===================
.. index:: Asm_Input

The ``Asm_Input`` attribute denotes a function that takes two
parameters.  The first is a string, the second is an expression of the
type designated by the prefix.  The first (string) argument is required
to be a static expression, and is the constraint for the parameter,
(e.g., what kind of register is required).  The second argument is the
value to be used as the input argument.  The possible values for the
constant are the same as those used in the RTL, and are dependent on
the configuration file used to built the GCC back end.
:ref:`Machine_Code_Insertions`

Attribute Asm_Output
====================
.. index:: Asm_Output

The ``Asm_Output`` attribute denotes a function that takes two
parameters.  The first is a string, the second is the name of a variable
of the type designated by the attribute prefix.  The first (string)
argument is required to be a static expression and designates the
constraint for the parameter (e.g., what kind of register is
required).  The second argument is the variable to be updated with the
result.  The possible values for constraint are the same as those used in
the RTL, and are dependent on the configuration file used to build the
GCC back end.  If there are no output operands, then this argument may
either be omitted, or explicitly given as ``No_Output_Operands``.
:ref:`Machine_Code_Insertions`

Attribute Atomic_Always_Lock_Free
=================================
.. index:: Atomic_Always_Lock_Free

The prefix of the ``Atomic_Always_Lock_Free`` attribute is a type. The
result indicates whether atomic operations are supported by the target
for the given type.

Attribute Bit
=============
.. index:: Bit

``obj'Bit``, where ``obj`` is any object, yields the bit
offset within the storage unit (byte) that contains the first bit of
storage allocated for the object.  The value of this attribute is of the
type *universal_integer* and is always a nonnegative number smaller
than ``System.Storage_Unit``.

For an object that is a variable or a constant allocated in a register,
the value is zero.  (The use of this attribute does not force the
allocation of a variable to memory).

For an object that is a formal parameter, this attribute applies
to either the matching actual parameter or to a copy of the
matching actual parameter.

For an access object the value is zero.  Note that
``obj.all'Bit`` is subject to an ``Access_Check`` for the
designated object.  Similarly for a record component
``X.C'Bit`` is subject to a discriminant check and
``X(I).Bit`` and ``X(I1..I2)'Bit``
are subject to index checks.

This attribute is designed to be compatible with the DEC Ada 83 definition
and implementation of the ``Bit`` attribute.

Attribute Bit_Position
======================
.. index:: Bit_Position

``R.C'Bit_Position``, where ``R`` is a record object and ``C`` is one
of the fields of the record type, yields the bit
offset within the record contains the first bit of
storage allocated for the object.  The value of this attribute is of the
type *universal_integer*.  The value depends only on the field
``C`` and is independent of the alignment of
the containing record ``R``.

Attribute Code_Address
======================
.. index:: Code_Address
.. index:: Subprogram address

.. index:: Address of subprogram code

The ``'Address``
attribute may be applied to subprograms in Ada 95 and Ada 2005, but the
intended effect seems to be to provide
an address value which can be used to call the subprogram by means of
an address clause as in the following example:

.. code-block:: ada

  procedure K is ...

  procedure L;
  for L'Address use K'Address;
  pragma Import (Ada, L);


A call to ``L`` is then expected to result in a call to ``K``.
In Ada 83, where there were no access-to-subprogram values, this was
a common work-around for getting the effect of an indirect call.
GNAT implements the above use of ``Address`` and the technique
illustrated by the example code works correctly.

However, for some purposes, it is useful to have the address of the start
of the generated code for the subprogram.  On some architectures, this is
not necessarily the same as the ``Address`` value described above.
For example, the ``Address`` value may reference a subprogram
descriptor rather than the subprogram itself.

The ``'Code_Address`` attribute, which can only be applied to
subprogram entities, always returns the address of the start of the
generated code of the specified subprogram, which may or may not be
the same value as is returned by the corresponding ``'Address``
attribute.

Attribute Compiler_Version
==========================
.. index:: Compiler_Version

``Standard'Compiler_Version`` (``Standard`` is the only allowed
prefix) yields a static string identifying the version of the compiler
being used to compile the unit containing the attribute reference.

Attribute Constrained
=====================
.. index:: Constrained

In addition to the usage of this attribute in the Ada RM, GNAT
also permits the use of the ``'Constrained`` attribute
in a generic template
for any type, including types without discriminants. The value of this
attribute in the generic instance when applied to a scalar type or a
record type without discriminants is always ``True``. This usage is
compatible with older Ada compilers, including notably DEC Ada.


Attribute Default_Bit_Order
===========================
.. index:: Big endian

.. index:: Little endian

.. index:: Default_Bit_Order

``Standard'Default_Bit_Order`` (``Standard`` is the only
allowed prefix), provides the value ``System.Default_Bit_Order``
as a ``Pos`` value (0 for ``High_Order_First``, 1 for
``Low_Order_First``).  This is used to construct the definition of
``Default_Bit_Order`` in package ``System``.

Attribute Default_Scalar_Storage_Order
======================================
.. index:: Big endian

.. index:: Little endian

.. index:: Default_Scalar_Storage_Order

``Standard'Default_Scalar_Storage_Order`` (``Standard`` is the only
allowed prefix), provides the current value of the default scalar storage
order (as specified using pragma ``Default_Scalar_Storage_Order``, or
equal to ``Default_Bit_Order`` if unspecified) as a
``System.Bit_Order`` value. This is a static attribute.

Attribute Deref
===============
.. index:: Deref

The attribute ``typ'Deref(expr)`` where ``expr`` is of type ``System.Address`` yields
the variable of type ``typ`` that is located at the given address. It is similar
to ``(totyp (expr).all)``, where ``totyp`` is an unchecked conversion from address to
a named access-to-`typ` type, except that it yields a variable, so it can be
used on the left side of an assignment.

Attribute Descriptor_Size
=========================
.. index:: Descriptor

.. index:: Dope vector

.. index:: Descriptor_Size

Nonstatic attribute ``Descriptor_Size`` returns the size in bits of the
descriptor allocated for a type.  The result is non-zero only for unconstrained
array types and the returned value is of type universal integer.  In GNAT, an
array descriptor contains bounds information and is located immediately before
the first element of the array.

.. code-block:: ada

  type Unconstr_Array is array (Short_Short_Integer range <>) of Positive;
  Put_Line ("Descriptor size = " & Unconstr_Array'Descriptor_Size'Img);


The attribute takes into account any padding due to the alignment of the
component type. In the example above, the descriptor contains two values
of type ``Short_Short_Integer`` representing the low and high bound. But,
since ``Positive`` has an alignment of 4, the size of the descriptor is
``2 * Short_Short_Integer'Size`` rounded up to the next multiple of 32,
which yields a size of 32 bits, i.e. including 16 bits of padding.

Attribute Elaborated
====================
.. index:: Elaborated

The prefix of the ``'Elaborated`` attribute must be a unit name.  The
value is a Boolean which indicates whether or not the given unit has been
elaborated.  This attribute is primarily intended for internal use by the
generated code for dynamic elaboration checking, but it can also be used
in user programs.  The value will always be True once elaboration of all
units has been completed.  An exception is for units which need no
elaboration, the value is always False for such units.

Attribute Elab_Body
===================
.. index:: Elab_Body

This attribute can only be applied to a program unit name.  It returns
the entity for the corresponding elaboration procedure for elaborating
the body of the referenced unit.  This is used in the main generated
elaboration procedure by the binder and is not normally used in any
other context.  However, there may be specialized situations in which it
is useful to be able to call this elaboration procedure from Ada code,
e.g., if it is necessary to do selective re-elaboration to fix some
error.

Attribute Elab_Spec
===================
.. index:: Elab_Spec

This attribute can only be applied to a program unit name.  It returns
the entity for the corresponding elaboration procedure for elaborating
the spec of the referenced unit.  This is used in the main
generated elaboration procedure by the binder and is not normally used
in any other context.  However, there may be specialized situations in
which it is useful to be able to call this elaboration procedure from
Ada code, e.g., if it is necessary to do selective re-elaboration to fix
some error.

Attribute Elab_Subp_Body
========================
.. index:: Elab_Subp_Body

This attribute can only be applied to a library level subprogram
name and is only allowed in CodePeer mode. It returns the entity
for the corresponding elaboration procedure for elaborating the body
of the referenced subprogram unit. This is used in the main generated
elaboration procedure by the binder in CodePeer mode only and is unrecognized
otherwise.

Attribute Emax
==============
.. index:: Ada 83 attributes

.. index:: Emax

The ``Emax`` attribute is provided for compatibility with Ada 83.  See
the Ada 83 reference manual for an exact description of the semantics of
this attribute.

Attribute Enabled
=================
.. index:: Enabled

The ``Enabled`` attribute allows an application program to check at compile
time to see if the designated check is currently enabled. The prefix is a
simple identifier, referencing any predefined check name (other than
``All_Checks``) or a check name introduced by pragma Check_Name. If
no argument is given for the attribute, the check is for the general state
of the check, if an argument is given, then it is an entity name, and the
check indicates whether an ``Suppress`` or ``Unsuppress`` has been
given naming the entity (if not, then the argument is ignored).

Note that instantiations inherit the check status at the point of the
instantiation, so a useful idiom is to have a library package that
introduces a check name with ``pragma Check_Name``, and then contains
generic packages or subprograms which use the ``Enabled`` attribute
to see if the check is enabled. A user of this package can then issue
a ``pragma Suppress`` or ``pragma Unsuppress`` before instantiating
the package or subprogram, controlling whether the check will be present.

Attribute Enum_Rep
==================
.. index:: Representation of enums

.. index:: Enum_Rep

Note that this attribute is now standard in Ada 202x and is available
as an implementation defined attribute for earlier Ada versions.

For every enumeration subtype ``S``, ``S'Enum_Rep`` denotes a
function with the following spec:

.. code-block:: ada

  function S'Enum_Rep (Arg : S'Base) return ;


It is also allowable to apply ``Enum_Rep`` directly to an object of an
enumeration type or to a non-overloaded enumeration
literal.  In this case ``S'Enum_Rep`` is equivalent to
``typ'Enum_Rep(S)`` where ``typ`` is the type of the
enumeration literal or object.

The function returns the representation value for the given enumeration
value.  This will be equal to value of the ``Pos`` attribute in the
absence of an enumeration representation clause.  This is a static
attribute (i.e., the result is static if the argument is static).

``S'Enum_Rep`` can also be used with integer types and objects,
in which case it simply returns the integer value.  The reason for this
is to allow it to be used for ``(<>)`` discrete formal arguments in
a generic unit that can be instantiated with either enumeration types
or integer types.  Note that if ``Enum_Rep`` is used on a modular
type whose upper bound exceeds the upper bound of the largest signed
integer type, and the argument is a variable, so that the universal
integer calculation is done at run time, then the call to ``Enum_Rep``
may raise ``Constraint_Error``.

Attribute Enum_Val
==================
.. index:: Representation of enums

.. index:: Enum_Val

Note that this attribute is now standard in Ada 202x and is available
as an implementation defined attribute for earlier Ada versions.

For every enumeration subtype ``S``, ``S'Enum_Val`` denotes a
function with the following spec:

.. code-block:: ada

  function S'Enum_Val (Arg : ) return S'Base;


The function returns the enumeration value whose representation matches the
argument, or raises Constraint_Error if no enumeration literal of the type
has the matching value.
This will be equal to value of the ``Val`` attribute in the
absence of an enumeration representation clause.  This is a static
attribute (i.e., the result is static if the argument is static).

Attribute Epsilon
=================
.. index:: Ada 83 attributes

.. index:: Epsilon

The ``Epsilon`` attribute is provided for compatibility with Ada 83.  See
the Ada 83 reference manual for an exact description of the semantics of
this attribute.

Attribute Fast_Math
===================
.. index:: Fast_Math

``Standard'Fast_Math`` (``Standard`` is the only allowed
prefix) yields a static Boolean value that is True if pragma
``Fast_Math`` is active, and False otherwise.

Attribute Finalization_Size
===========================
.. index:: Finalization_Size

The prefix of attribute ``Finalization_Size`` must be an object or
a type. This attribute returns the size of any hidden data
reserved by the compiler to handle finalization-related actions. The type of
the attribute is *universal_integer*.

``Finalization_Size`` yields a value of zero for a type with no controlled
parts, an object whose type has no controlled parts, or an object of a
class-wide type whose tag denotes a type with no controlled parts.
For a class-wide type, ``Finalization_Size`` yields a non-zero value except
if a No_Finalization restriction is in effect, in which case it yields zero.

Note that only heap-allocated objects contain finalization data.

Attribute Fixed_Value
=====================
.. index:: Fixed_Value

For every fixed-point type ``S``, ``S'Fixed_Value`` denotes a
function with the following specification:

.. code-block:: ada

  function S'Fixed_Value (Arg : ) return S;

The value returned is the fixed-point value ``V`` such that::

  V = Arg * S'Small


The effect is thus similar to first converting the argument to the
integer type used to represent ``S``, and then doing an unchecked
conversion to the fixed-point type.  The difference is
that there are full range checks, to ensure that the result is in range.
This attribute is primarily intended for use in implementation of the
input-output functions for fixed-point values.

Attribute From_Address
======================
.. index:: From_Address

The prefix of this attribute must be a general access-to-array type (or
subtype); the attribute takes a System.Address argument and possibly some
additional arguments (described below) and yields a value of the given
access type that designates an array object located at the given address.
In the case of a non-null array this means that the given address is the
address of the first element of the array object (not the address of any sort
of bounds descriptor). This allows associating bounds with an address that is,
for example, passed in from C code.

If the designated array subtype is unconstrained (which is the usual case),
then for each dimension (in order) the attribute takes either one or two
additional arguments of the corresponding index type - one if the index
subtype is a fixed lower bound subtype, two (low bound first) otherwise.
In this case, the access type shall be an extended access type (see the
description of the Extended_Access aspect). These additional arguments
specify the bounds of the designated array object.

If the designated array subtype is constrained then no additional arguments
are provided and the bounds of the designated object are those of the
designated subtype.

Roughly speaking, My_Access_Type'From_Address (Addr, Lo, Hi) is equivalent to a
declare expression:

.. code-block:: ada

(declare
   Obj : aliased Designated_Array_Type (Lo .. Hi)
     with Import, Address => Addr;
begin
   My_Access_Type'(Obj'Unchecked_Access)
end)

Attribute From_Any
==================
.. index:: From_Any

This internal attribute is used for the generation of remote subprogram
stubs in the context of the Distributed Systems Annex.

Attribute Has_Access_Values
===========================
.. index:: Access values, testing for

.. index:: Has_Access_Values

The prefix of the ``Has_Access_Values`` attribute is a type.  The result
is a Boolean value which is True if the is an access type, or is a composite
type with a component (at any nesting depth) that is an access type, and is
False otherwise.
The intended use of this attribute is in conjunction with generic
definitions.  If the attribute is applied to a generic private type, it
indicates whether or not the corresponding actual type has access values.

Attribute Has_Discriminants
===========================
.. index:: Discriminants, testing for

.. index:: Has_Discriminants

The prefix of the ``Has_Discriminants`` attribute is a type.  The result
is a Boolean value which is True if the type has discriminants, and False
otherwise.  The intended use of this attribute is in conjunction with generic
definitions.  If the attribute is applied to a generic private type, it
indicates whether or not the corresponding actual type has discriminants.

Attribute Has_Tagged_Values
===========================
.. index:: Tagged values, testing for

.. index:: Has_Tagged_Values

The prefix of the ``Has_Tagged_Values`` attribute is a type. The result is a
Boolean value which is True if the type is a composite type (array or record)
that is either a tagged type or has a subcomponent that is tagged, and is False
otherwise. The intended use of this attribute is in conjunction with generic
definitions. If the attribute is applied to a generic private type, it
indicates whether or not the corresponding actual type has access values.

Attribute Img
=============
.. index:: Img

The ``Img`` attribute differs from ``Image`` in that, while both can be
applied directly to an object, ``Img`` cannot be applied to types.

Example usage of the attribute:

.. code-block:: ada

  Put_Line ("X = " & X'Img);


which has the same meaning as the more verbose:

.. code-block:: ada

  Put_Line ("X = " & T'Image (X));

where ``T`` is the (sub)type of the object ``X``.

Note that technically, in analogy to ``Image``,
``X'Img`` returns a parameterless function
that returns the appropriate string when called. This means that
``X'Img`` can be renamed as a function-returning-string, or used
in an instantiation as a function parameter.

Attribute Initialized
=====================
.. index:: Initialized

For the syntax and semantics of this attribute, see the SPARK 2014 Reference
Manual, section 6.10.

Attribute Integer_Value
=======================
.. index:: Integer_Value

For every integer type ``S``, ``S'Integer_Value`` denotes a
function with the following spec:

.. code-block:: ada

  function S'Integer_Value (Arg : ) return S;

The value returned is the integer value ``V``, such that::

  Arg = V * T'Small


where ``T`` is the type of ``Arg``.
The effect is thus similar to first doing an unchecked conversion from
the fixed-point type to its corresponding implementation type, and then
converting the result to the target integer type.  The difference is
that there are full range checks, to ensure that the result is in range.
This attribute is primarily intended for use in implementation of the
standard input-output functions for fixed-point values.

Attribute Invalid_Value
=======================
.. index:: Invalid_Value

For every scalar type S, S'Invalid_Value returns an undefined value of the
type. If possible this value is an invalid representation for the type. The
value returned is identical to the value used to initialize an otherwise
uninitialized value of the type if pragma Initialize_Scalars is used,
including the ability to modify the value with the binder -Sxx flag and
relevant environment variables at run time.

Attribute Large
===============
.. index:: Ada 83 attributes

.. index:: Large

The ``Large`` attribute is provided for compatibility with Ada 83.  See
the Ada 83 reference manual for an exact description of the semantics of
this attribute.

Attribute Library_Level
=======================
.. index:: Library_Level

``P'Library_Level``, where P is an entity name,
returns a Boolean value which is True if the entity is declared
at the library level, and False otherwise. Note that within a
generic instantiation, the name of the generic unit denotes the
instance, which means that this attribute can be used to test
if a generic is instantiated at the library level, as shown
in this example:

.. code-block:: ada

  generic
 ...
  package Gen is
 pragma Compile_Time_Error
   (not Gen'Library_Level,
    "Gen can only be instantiated at library level");
 ...
  end Gen;


Attribute Loop_Entry
====================
.. index:: Loop_Entry

Syntax::

  X'Loop_Entry [(loop_name)]


The ``Loop_Entry`` attribute is used to refer to the value that an
expression had upon entry to a given loop in much the same way that the
``Old`` attribute in a subprogram postcondition can be used to refer
to the value an expression had upon entry to the subprogram. The
relevant loop is either identified by the given loop name, or it is the
innermost enclosing loop when no loop name is given.

A ``Loop_Entry`` attribute can only occur within an ``Assert``,
``Assert_And_Cut``, ``Assume``, ``Loop_Variant`` or ``Loop_Invariant`` pragma.
In addition, such a pragma must be one of the items in the sequence
of statements of a loop body, or nested inside block statements that
appear in the sequence of statements of a loop body.
A common use of ``Loop_Entry`` is to compare the current value of objects with
their initial value at loop entry, in a ``Loop_Invariant`` pragma.

The effect of using ``X'Loop_Entry`` is the same as declaring
a constant initialized with the initial value of ``X`` at loop
entry. This copy is not performed if the loop is not entered, or if the
corresponding pragmas are ignored or disabled.

Attribute Machine_Size
======================
.. index:: Machine_Size

This attribute is identical to the ``Object_Size`` attribute.  It is
provided for compatibility with the DEC Ada 83 attribute of this name.

Attribute Mantissa
==================
.. index:: Ada 83 attributes

.. index:: Mantissa

The ``Mantissa`` attribute is provided for compatibility with Ada 83.  See
the Ada 83 reference manual for an exact description of the semantics of
this attribute.

.. _Attribute_Maximum_Alignment:

Attribute Maximum_Alignment
===========================
.. index:: Alignment, maximum

.. index:: Maximum_Alignment

``Standard'Maximum_Alignment`` (``Standard`` is the only allowed prefix)
provides the maximum default alignment value for the target, that is to
say the maximum alignment that the compiler may choose by default for a
type or an object. Larger alignments are supported up to some maximum
value dependent on the target, but may require specific mechanisms that
are not needed up to ``Standard'Maximum_Alignment``.

Attribute Max_Integer_Size
==========================
.. index:: Max_Integer_Size

``Standard'Max_Integer_Size`` (``Standard`` is the only allowed
prefix) provides the size of the largest supported integer type for
the target. The result is a static constant.

Attribute Mechanism_Code
========================
.. index:: Return values, passing mechanism

.. index:: Parameters, passing mechanism

.. index:: Mechanism_Code

``func'Mechanism_Code`` yields an integer code for the
mechanism used for the result of function ``func``, and
``subprog'Mechanism_Code (n)`` yields the mechanism
used for formal parameter number *n* (a static integer value, with 1
meaning the first parameter) of subprogram ``subprog``.  The code returned is:



*1*
  by copy (value)

*2*
  by reference

Attribute Null_Parameter
========================
.. index:: Zero address, passing

.. index:: Null_Parameter

A reference ``T'Null_Parameter`` denotes an imaginary object of
type or subtype ``T`` allocated at machine address zero.  The attribute
is allowed only as the default expression of a formal parameter, or as
an actual expression of a subprogram call.  In either case, the
subprogram must be imported.

The identity of the object is represented by the address zero in the
argument list, independent of the passing mechanism (explicit or
default).

This capability is needed to specify that a zero address should be
passed for a record or other composite object passed by reference.
There is no way of indicating this without the ``Null_Parameter``
attribute.

.. _Attribute-Object_Size:

Attribute Object_Size
=====================
.. index:: Size, used for objects

.. index:: Object_Size

The size of an object is not necessarily the same as the size of the type
of an object.  This is because by default object sizes are increased to be
a multiple of the alignment of the object.  For example,
``Natural'Size`` is
31, but by default objects of type ``Natural`` will have a size of 32 bits.
Similarly, a record containing an integer and a character:

.. code-block:: ada

  type Rec is record
  I : Integer;
  C : Character;
  end record;


will have a size of 40 (that is ``Rec'Size`` will be 40).  The
alignment will be 4, because of the
integer field, and so the default size of record objects for this type
will be 64 (8 bytes).

If the alignment of the above record is specified to be 1, then the
object size will be 40 (5 bytes). This is true by default, and also
an object size of 40 can be explicitly specified in this case.

A consequence of this capability is that different object sizes can be
given to subtypes that would otherwise be considered in Ada to be
statically matching.  But it makes no sense to consider such subtypes
as statically matching.  Consequently, GNAT adds a rule
to the static matching rules that requires object sizes to match.
Consider this example:

.. code-block:: ada

1. procedure BadAVConvert is
2.    type R is new Integer;
3.    subtype R1 is R range 1 .. 10;
4.    subtype R2 is R range 1 .. 10;
5.    for R1'Object_Size use 8;
6.    for R2'Object_Size use 16;
7.    type R1P is access all R1;
8.    type R2P is access all R2;
9.    R1PV : R1P := new R1'(4);
  10.    R2PV : R2P;
  11. begin
  12.    R2PV := R2P (R1PV);
              |
      >>> target designated subtype not compatible with
          type "R1" defined at line 3

  13. end;


In the absence of lines 5 and 6,
types ``R1`` and ``R2`` statically match and
hence the conversion on line 12 is legal. But since lines 5 and 6
cause the object sizes to differ, GNAT considers that types
``R1`` and ``R2`` are not statically matching, and line 12
generates the diagnostic shown above.

Similar additional checks are performed in other contexts requiring
statically matching subtypes.

Attribute Old
=============
.. index:: Old

In addition to the usage of ``Old`` defined in the Ada 2012 RM (usage
within ``Post`` aspect), GNAT also permits the use of this attribute
in implementation defined pragmas ``Postcondition``,
``Contract_Cases`` and ``Test_Case``. Also usages of
``Old`` which would be illegal according to the Ada 2012 RM
definition are allowed under control of
implementation defined pragma ``Unevaluated_Use_Of_Old``.

Attribute Passed_By_Reference
=============================
.. index:: Parameters, when passed by reference

.. index:: Passed_By_Reference

``typ'Passed_By_Reference`` for any subtype `typ` returns
a value of type ``Boolean`` value that is ``True`` if the type is
normally passed by reference and ``False`` if the type is normally
passed by copy in calls.  For scalar types, the result is always ``False``
and is static.  For non-scalar types, the result is nonstatic.

Attribute Pool_Address
======================
.. index:: Pool_Address

``X'Pool_Address`` for any object ``X`` returns the address
of X within its storage pool. This is the same as
``X'Address``, except that for an unconstrained array whose
bounds are allocated just before the first component,
``X'Pool_Address`` returns the address of those bounds,
whereas ``X'Address`` returns the address of the first
component.

Here, we are interpreting 'storage pool' broadly to mean
``wherever the object is allocated``, which could be a
user-defined storage pool,
the global heap, on the stack, or in a static memory area.
For an object created by ``new``, ``Ptr.all'Pool_Address`` is
what is passed to ``Allocate`` and returned from ``Deallocate``.

Attribute Range_Length
======================
.. index:: Range_Length

``typ'Range_Length`` for any discrete type `typ` yields
the number of values represented by the subtype (zero for a null
range).  The result is static for static subtypes.  ``Range_Length``
applied to the index subtype of a one dimensional array always gives the
same result as ``Length`` applied to the array itself.

Attribute Ref
=============

``System.Address'Ref`` (``Address`` is the only permissible prefix) is
equivalent to ``System'To_Address``, provided for compatibility with other
compilers.

Attribute Restriction_Set
=========================
.. index:: Restriction_Set
.. index:: Restrictions

This attribute allows compile time testing of restrictions that
are currently in effect. It is primarily intended for specializing
code in the run-time based on restrictions that are active (e.g.
don't need to save fpt registers if restriction No_Floating_Point
is known to be in effect), but can be used anywhere.

There are two forms:

.. code-block:: ada

  System'Restriction_Set (partition_boolean_restriction_NAME)
  System'Restriction_Set (No_Dependence => library_unit_NAME);


In the case of the first form, the only restriction names
allowed are parameterless restrictions that are checked
for consistency at bind time. For a complete list see the
subtype ``System.Rident.Partition_Boolean_Restrictions``.

The result returned is True if the restriction is known to
be in effect, and False if the restriction is known not to
be in effect. An important guarantee is that the value of
a Restriction_Set attribute is known to be consistent throughout
all the code of a partition.

This is trivially achieved if the entire partition is compiled
with a consistent set of restriction pragmas. However, the
compilation model does not require this. It is possible to
compile one set of units with one set of pragmas, and another
set of units with another set of pragmas. It is even possible
to compile a spec with one set of pragmas, and then WITH the
same spec with a different set of pragmas. Inconsistencies
in the actual use of the restriction are checked at bind time.

In order to achieve the guarantee of consistency for the
Restriction_Set pragma, we consider that a use of the pragma
that yields False is equivalent to a violation of the
restriction.

So for example if you write

.. code-block:: ada

  if System'Restriction_Set (No_Floating_Point) then
  ...
  else
  ...
  end if;


And the result is False, so that the else branch is executed,
you can assume that this restriction is not set for any unit
in the partition. This is checked by considering this use of
the restriction pragma to be a violation of the restriction
No_Floating_Point. This means that no other unit can attempt
to set this restriction (if some unit does attempt to set it,
the binder will refuse to bind the partition).

Technical note: The restriction name and the unit name are
interpreted entirely syntactically, as in the corresponding
Restrictions pragma, they are not analyzed semantically,
so they do not have a type.

Attribute Result
================
.. index:: Result

``function'Result`` can only be used with in a Postcondition pragma
for a function. The prefix must be the name of the corresponding function. This
is used to refer to the result of the function in the postcondition expression.
For a further discussion of the use of this attribute and examples of its use,
see the description of pragma Postcondition.

Attribute Round
=====================
.. index:: Round

In addition to the usage of this attribute in the Ada RM, GNAT
also permits the use of the ``'Round`` attribute for ordinary
fixed point types.

Attribute Safe_Emax
===================
.. index:: Ada 83 attributes

.. index:: Safe_Emax

The ``Safe_Emax`` attribute is provided for compatibility with Ada 83.  See
the Ada 83 reference manual for an exact description of the semantics of
this attribute.

Attribute Safe_Large
====================
.. index:: Ada 83 attributes

.. index:: Safe_Large

The ``Safe_Large`` attribute is provided for compatibility with Ada 83.  See
the Ada 83 reference manual for an exact description of the semantics of
this attribute.

Attribute Safe_Small
====================
.. index:: Ada 83 attributes

.. index:: Safe_Small

The ``Safe_Small`` attribute is provided for compatibility with Ada 83.  See
the Ada 83 reference manual for an exact description of the semantics of
this attribute.

.. _Attribute-Scalar_Storage_Order:

Attribute Scalar_Storage_Order
==============================
.. index:: Endianness

.. index:: Scalar storage order

.. index:: Scalar_Storage_Order

For every array or record type ``S``, the representation attribute
``Scalar_Storage_Order`` denotes the order in which storage elements
that make up scalar components are ordered within S. The value given must
be a static expression of type System.Bit_Order. The following is an example
of the use of this feature:

.. code-block:: ada

  --  Component type definitions

  subtype Yr_Type is Natural range 0 .. 127;
  subtype Mo_Type is Natural range 1 .. 12;
  subtype Da_Type is Natural range 1 .. 31;

  --  Record declaration

  type Date is record
     Years_Since_1980 : Yr_Type;
     Month            : Mo_Type;
     Day_Of_Month     : Da_Type;
  end record;

  --  Record representation clause

  for Date use record
     Years_Since_1980 at 0 range 0  ..  6;
     Month            at 0 range 7  .. 10;
     Day_Of_Month     at 0 range 11 .. 15;
  end record;

  --  Attribute definition clauses

  for Date'Bit_Order use System.High_Order_First;
  for Date'Scalar_Storage_Order use System.High_Order_First;
  --  If Scalar_Storage_Order is specified, it must be consistent with
  --  Bit_Order, so it's best to always define the latter explicitly if
  --  the former is used.


Other properties are as for the standard representation attribute ``Bit_Order``
defined by Ada RM 13.5.3(4). The default is ``System.Default_Bit_Order``.

For a record type ``T``, if ``T'Scalar_Storage_Order`` is
specified explicitly, it shall be equal to ``T'Bit_Order``. Note:
this means that if a ``Scalar_Storage_Order`` attribute definition
clause is not confirming, then the type's ``Bit_Order`` shall be
specified explicitly and set to the same value.

Derived types inherit an explicitly set scalar storage order from their parent
types. This may be overridden for the derived type by giving an explicit scalar
storage order for it. However, for a record extension, the derived type must
have the same scalar storage order as the parent type.

A component of a record type that is itself a record or an array and that does
not start and end on a byte boundary must have have the same scalar storage
order as the record type. A component of a bit-packed array type that is itself
a record or an array must have the same scalar storage order as the array type.

No component of a type that has an explicit ``Scalar_Storage_Order``
attribute definition may be aliased.

A confirming ``Scalar_Storage_Order`` attribute definition clause (i.e.
with a value equal to ``System.Default_Bit_Order``) has no effect.

If the opposite storage order is specified, then whenever the value of
a scalar component of an object of type ``S`` is read, the storage
elements of the enclosing machine scalar are first reversed (before
retrieving the component value, possibly applying some shift and mask
operations on the enclosing machine scalar), and the opposite operation
is done for writes.

In that case, the restrictions set forth in 13.5.1(10.3/2) for scalar components
are relaxed. Instead, the following rules apply:

* the underlying storage elements are those at positions
  ``(position + first_bit / storage_element_size) .. (position + (last_bit + storage_element_size - 1) / storage_element_size)``
* the sequence of underlying storage elements shall have
  a size no greater than the largest machine scalar
* the enclosing machine scalar is defined as the smallest machine
  scalar starting at a position no greater than
  ``position + first_bit / storage_element_size`` and covering
  storage elements at least up to ``position + (last_bit + storage_element_size - 1) / storage_element_size``
* the position of the component is interpreted relative to that machine
  scalar.

If no scalar storage order is specified for a type (either directly, or by
inheritance in the case of a derived type), then the default is normally
the native ordering of the target, but this default can be overridden using
pragma ``Default_Scalar_Storage_Order``.

If a component of ``T`` is itself of a record or array type, the specified
``Scalar_Storage_Order`` does *not* apply to that nested type: an explicit
attribute definition clause must be provided for the component type as well
if desired.

Representation changes that explicitly or implicitly toggle the scalar storage
order are not supported and may result in erroneous execution of the program,
except when performed by means of an instance of ``Ada.Unchecked_Conversion``.

In particular, overlays are not supported and a warning is given for them:

.. code-block:: ada

  type Rec_LE is record
     I : Integer;
  end record;

  for Rec_LE use record
     I at 0 range 0 .. 31;
  end record;

  for Rec_LE'Bit_Order use System.Low_Order_First;
  for Rec_LE'Scalar_Storage_Order use System.Low_Order_First;

  type Rec_BE is record
     I : Integer;
  end record;

  for Rec_BE use record
     I at 0 range 0 .. 31;
  end record;

  for Rec_BE'Bit_Order use System.High_Order_First;
  for Rec_BE'Scalar_Storage_Order use System.High_Order_First;

  R_LE : Rec_LE;

  R_BE : Rec_BE;
  for R_BE'Address use R_LE'Address;

``warning: overlay changes scalar storage order [enabled by default]``

In most cases, such representation changes ought to be replaced by an
instantiation of a function or procedure provided by ``GNAT.Byte_Swapping``.

Note that the scalar storage order only affects the in-memory data
representation. It has no effect on the representation used by stream
attributes.

Note that debuggers may be unable to display the correct value of scalar
components of a type for which the opposite storage order is specified.

.. _Attribute_Simple_Storage_Pool:

Attribute Simple_Storage_Pool
=============================
.. index:: Storage pool, simple

.. index:: Simple storage pool

.. index:: Simple_Storage_Pool

For every nonformal, nonderived access-to-object type ``Acc``, the
representation attribute ``Simple_Storage_Pool`` may be specified
via an attribute_definition_clause (or by specifying the equivalent aspect):

.. code-block:: ada

  My_Pool : My_Simple_Storage_Pool_Type;

  type Acc is access My_Data_Type;

  for Acc'Simple_Storage_Pool use My_Pool;



The name given in an attribute_definition_clause for the
``Simple_Storage_Pool`` attribute shall denote a variable of
a 'simple storage pool type' (see pragma `Simple_Storage_Pool_Type`).

The use of this attribute is only allowed for a prefix denoting a type
for which it has been specified. The type of the attribute is the type
of the variable specified as the simple storage pool of the access type,
and the attribute denotes that variable.

It is illegal to specify both ``Storage_Pool`` and ``Simple_Storage_Pool``
for the same access type.

If the ``Simple_Storage_Pool`` attribute has been specified for an access
type, then applying the ``Storage_Pool`` attribute to the type is flagged
with a warning and its evaluation raises the exception ``Program_Error``.

If the Simple_Storage_Pool attribute has been specified for an access
type ``S``, then the evaluation of the attribute ``S'Storage_Size``
returns the result of calling ``Storage_Size (S'Simple_Storage_Pool)``,
which is intended to indicate the number of storage elements reserved for
the simple storage pool. If the Storage_Size function has not been defined
for the simple storage pool type, then this attribute returns zero.

If an access type ``S`` has a specified simple storage pool of type
``SSP``, then the evaluation of an allocator for that access type calls
the primitive ``Allocate`` procedure for type ``SSP``, passing
``S'Simple_Storage_Pool`` as the pool parameter. The detailed
semantics of such allocators is the same as those defined for allocators
in section 13.11 of the :title:`Ada Reference Manual`, with the term
*simple storage pool* substituted for *storage pool*.

If an access type ``S`` has a specified simple storage pool of type
``SSP``, then a call to an instance of the ``Ada.Unchecked_Deallocation``
for that access type invokes the primitive ``Deallocate`` procedure
for type ``SSP``, passing ``S'Simple_Storage_Pool`` as the pool
parameter. The detailed semantics of such unchecked deallocations is the same
as defined in section 13.11.2 of the Ada Reference Manual, except that the
term *simple storage pool* is substituted for *storage pool*.

Attribute Small
===============
.. index:: Ada 83 attributes

.. index:: Small

The ``Small`` attribute is defined in Ada 95 (and Ada 2005) only for
fixed-point types.
GNAT also allows this attribute to be applied to floating-point types
for compatibility with Ada 83.  See
the Ada 83 reference manual for an exact description of the semantics of
this attribute when applied to floating-point types.

Attribute Small_Denominator
===========================
.. index:: Small

.. index:: Small_Denominator

``typ'Small_Denominator`` for any fixed-point subtype `typ` yields the
denominator in the representation of ``typ'Small`` as a rational number
with coprime factors (i.e. as an irreducible fraction).

Attribute Small_Numerator
=========================
.. index:: Small

.. index:: Small_Numerator

``typ'Small_Numerator`` for any fixed-point subtype `typ` yields the
numerator in the representation of ``typ'Small`` as a rational number
with coprime factors (i.e. as an irreducible fraction).

Attribute Storage_Unit
======================
.. index:: Storage_Unit

``Standard'Storage_Unit`` (``Standard`` is the only allowed
prefix) provides the same value as ``System.Storage_Unit``.

Attribute Stub_Type
===================
.. index:: Stub_Type

The GNAT implementation of remote access-to-classwide types is
organized as described in AARM section E.4 (20.t): a value of an RACW type
(designating a remote object) is represented as a normal access
value, pointing to a "stub" object which in turn contains the
necessary information to contact the designated remote object. A
call on any dispatching operation of such a stub object does the
remote call, if necessary, using the information in the stub object
to locate the target partition, etc.

For a prefix ``T`` that denotes a remote access-to-classwide type,
``T'Stub_Type`` denotes the type of the corresponding stub objects.

By construction, the layout of ``T'Stub_Type`` is identical to that of
type ``RACW_Stub_Type`` declared in the internal implementation-defined
unit ``System.Partition_Interface``. Use of this attribute will create
an implicit dependency on this unit.

Attribute System_Allocator_Alignment
====================================
.. index:: Alignment, allocator

.. index:: System_Allocator_Alignment

``Standard'System_Allocator_Alignment`` (``Standard`` is the only
allowed prefix) provides the observable guaranteed to be honored by
the system allocator (malloc). This is a static value that can be used
in user storage pools based on malloc either to reject allocation
with alignment too large or to enable a realignment circuitry if the
alignment request is larger than this value.

Attribute Target_Name
=====================
.. index:: Target_Name

``Standard'Target_Name`` (``Standard`` is the only allowed
prefix) provides a static string value that identifies the target
for the current compilation. For GCC implementations, this is the
standard gcc target name without the terminating slash (for
example, GNAT 5.0 on windows yields "i586-pc-mingw32msv").

Attribute To_Address
====================
.. index:: To_Address

The ``System'To_Address``
(``System`` is the only allowed prefix)
denotes a function identical to
``System.Storage_Elements.To_Address`` except that
it is a static attribute.  This means that if its argument is
a static expression, then the result of the attribute is a
static expression.  This means that such an expression can be
used in contexts (e.g., preelaborable packages) which require a
static expression and where the function call could not be used
(since the function call is always nonstatic, even if its
argument is static). The argument must be in the range
-(2**(m-1)) .. 2**m-1, where m is the memory size
(typically 32 or 64). Negative values are interpreted in a
modular manner (e.g., -1 means the same as 16#FFFF_FFFF# on
a 32 bits machine).

Attribute To_Any
================
.. index:: To_Any

This internal attribute is used for the generation of remote subprogram
stubs in the context of the Distributed Systems Annex.

Attribute Type_Class
====================
.. index:: Type_Class

``typ'Type_Class`` for any type or subtype `typ` yields
the value of the type class for the full type of `typ`.  If
`typ` is a generic formal type, the value is the value for the
corresponding actual subtype.  The value of this attribute is of type
``System.Aux_DEC.Type_Class``, which has the following definition:

.. code-block:: ada

  type Type_Class is
 (Type_Class_Enumeration,
  Type_Class_Integer,
  Type_Class_Fixed_Point,
  Type_Class_Floating_Point,
  Type_Class_Array,
  Type_Class_Record,
  Type_Class_Access,
  Type_Class_Task,
  Type_Class_Address);


Protected types yield the value ``Type_Class_Task``, which thus
applies to all concurrent types.  This attribute is designed to
be compatible with the DEC Ada 83 attribute of the same name.

Attribute Type_Key
==================
.. index:: Type_Key

The ``Type_Key`` attribute is applicable to a type or subtype and
yields a value of type Standard.String containing encoded information
about the type or subtype. This provides improved compatibility with
other implementations that support this attribute.

Attribute TypeCode
==================
.. index:: TypeCode

This internal attribute is used for the generation of remote subprogram
stubs in the context of the Distributed Systems Annex.

Attribute Unconstrained_Array
=============================
.. index:: Unconstrained_Array

The ``Unconstrained_Array`` attribute can be used with a prefix that
denotes any type or subtype. It is a static attribute that yields
``True`` if the prefix designates an unconstrained array,
and ``False`` otherwise. In a generic instance, the result is
still static, and yields the result of applying this test to the
generic actual.

Attribute Universal_Literal_String
==================================
.. index:: Named numbers, representation of

.. index:: Universal_Literal_String

The prefix of ``Universal_Literal_String`` must be a named
number.  The static result is the string consisting of the characters of
the number as defined in the original source.  This allows the user
program to access the actual text of named numbers without intermediate
conversions and without the need to enclose the strings in quotes (which
would preclude their use as numbers).

For example, the following program prints the first 50 digits of pi:

.. code-block:: ada

  with Text_IO; use Text_IO;
  with Ada.Numerics;
  procedure Pi is
  begin
  Put (Ada.Numerics.Pi'Universal_Literal_String);
  end;


Attribute Unrestricted_Access
=============================
.. index:: Access, unrestricted

.. index:: Unrestricted_Access

The ``Unrestricted_Access`` attribute is similar to ``Access``
except that all accessibility and aliased view checks are omitted.  This
is a user-beware attribute.

For objects, it is similar to ``Address``, for which it is a
desirable replacement where the value desired is an access type.
In other words, its effect is similar to first applying the
``Address`` attribute and then doing an unchecked conversion to a
desired access type.

For subprograms, ``P'Unrestricted_Access`` may be used where
``P'Access`` would be illegal, to construct a value of a
less-nested named access type that designates a more-nested
subprogram. This value may be used in indirect calls, so long as the
more-nested subprogram still exists; once the subprogram containing it
has returned, such calls are erroneous. For example:

.. code-block:: ada

  package body P is

  type Less_Nested is access procedure;
  Global : Less_Nested;

  procedure P1 is
  begin
     Global.all;
  end P1;

  procedure P2 is
     Local_Var : Integer;

     procedure More_Nested is
     begin
        ... Local_Var ...
     end More_Nested;
  begin
     Global := More_Nested'Unrestricted_Access;
     P1;
  end P2;

  end P;


When P1 is called from P2, the call via Global is OK, but if P1 were
called after P2 returns, it would be an erroneous use of a dangling
pointer.

For objects, it is possible to use ``Unrestricted_Access`` for any
type. However, if the result is of an access-to-unconstrained array
subtype, then the resulting pointer has the same scope as the context
of the attribute, and must not be returned to some enclosing scope.
For instance, if a function uses ``Unrestricted_Access`` to create
an access-to-unconstrained-array and returns that value to the caller,
the result will involve dangling pointers. In addition, it is only
valid to create pointers to unconstrained arrays using this attribute
if the pointer has the normal default 'fat' representation where a
pointer has two components, one points to the array and one points to
the bounds. If a size clause is used to force 'thin' representation
for a pointer to unconstrained where there is only space for a single
pointer, then the resulting pointer is not usable.

In the simple case where a direct use of Unrestricted_Access attempts
to make a thin pointer for a non-aliased object, the compiler will
reject the use as illegal, as shown in the following example:

.. code-block:: ada

  with System; use System;
  procedure SliceUA2 is
  type A is access all String;
  for A'Size use Standard'Address_Size;

  procedure P (Arg : A) is
  begin
     null;
  end P;

  X : String := "hello world!";
  X2 : aliased String := "hello world!";

  AV : A := X'Unrestricted_Access;    -- ERROR
            |
  >>> illegal use of Unrestricted_Access attribute
  >>> attempt to generate thin pointer to unaliased object

  begin
  P (X'Unrestricted_Access);          -- ERROR
     |
  >>> illegal use of Unrestricted_Access attribute
  >>> attempt to generate thin pointer to unaliased object

  P (X(7 .. 12)'Unrestricted_Access); -- ERROR
     |
  >>> illegal use of Unrestricted_Access attribute
  >>> attempt to generate thin pointer to unaliased object

  P (X2'Unrestricted_Access);         -- OK
  end;


but other cases cannot be detected by the compiler, and are
considered to be erroneous. Consider the following example:

.. code-block:: ada

  with System; use System;
  with System; use System;
  procedure SliceUA is
  type AF is access all String;

  type A is access all String;
  for A'Size use Standard'Address_Size;

  procedure P (Arg : A) is
  begin
     if Arg'Length /= 6 then
        raise Program_Error;
     end if;
  end P;

  X : String := "hello world!";
  Y : AF := X (7 .. 12)'Unrestricted_Access;

  begin
  P (A (Y));
  end;


A normal unconstrained array value
or a constrained array object marked as aliased has the bounds in memory
just before the array, so a thin pointer can retrieve both the data and
the bounds.  But in this case, the non-aliased object ``X`` does not have the
bounds before the string.  If the size clause for type ``A``
were not present, then the pointer
would be a fat pointer, where one component is a pointer to the bounds,
and all would be well.  But with the size clause present, the conversion from
fat pointer to thin pointer in the call loses the bounds, and so this
is erroneous, and the program likely raises a ``Program_Error`` exception.

In general, it is advisable to completely
avoid mixing the use of thin pointers and the use of
``Unrestricted_Access`` where the designated type is an
unconstrained array.  The use of thin pointers should be restricted to
cases of porting legacy code that implicitly assumes the size of pointers,
and such code should not in any case be using this attribute.

Another erroneous situation arises if the attribute is
applied to a constant. The resulting pointer can be used to access the
constant, but the effect of trying to modify a constant in this manner
is not well-defined. Consider this example:

.. code-block:: ada

  P : constant Integer := 4;
  type R is access all Integer;
  RV : R := P'Unrestricted_Access;
  ..
  RV.all := 3;


Here we attempt to modify the constant P from 4 to 3, but the compiler may
or may not notice this attempt, and subsequent references to P may yield
either the value 3 or the value 4 or the assignment may blow up if the
compiler decides to put P in read-only memory. One particular case where
``Unrestricted_Access`` can be used in this way is to modify the
value of an ``in`` parameter:

.. code-block:: ada

  procedure K (S : in String) is
  type R is access all Character;
  RV : R := S (3)'Unrestricted_Access;
  begin
  RV.all := 'a';
  end;


In general this is a risky approach. It may appear to "work" but such uses of
``Unrestricted_Access`` are potentially non-portable, even from one version
of GNAT to another, so are best avoided if possible.

Attribute Update
================
.. index:: Update

The ``Update`` attribute creates a copy of an array or record value
with one or more modified components. The syntax is::

  PREFIX'Update ( RECORD_COMPONENT_ASSOCIATION_LIST )
  PREFIX'Update ( ARRAY_COMPONENT_ASSOCIATION {, ARRAY_COMPONENT_ASSOCIATION } )
  PREFIX'Update ( MULTIDIMENSIONAL_ARRAY_COMPONENT_ASSOCIATION
               {, MULTIDIMENSIONAL_ARRAY_COMPONENT_ASSOCIATION } )

  MULTIDIMENSIONAL_ARRAY_COMPONENT_ASSOCIATION ::= INDEX_EXPRESSION_LIST_LIST => EXPRESSION
  INDEX_EXPRESSION_LIST_LIST                   ::= INDEX_EXPRESSION_LIST {| INDEX_EXPRESSION_LIST }
  INDEX_EXPRESSION_LIST                        ::= ( EXPRESSION {, EXPRESSION } )


where ``PREFIX`` is the name of an array or record object, the
association list in parentheses does not contain an ``others``
choice and the box symbol ``<>`` may not appear in any
expression. The effect is to yield a copy of the array or record value
which is unchanged apart from the components mentioned in the
association list, which are changed to the indicated value. The
original value of the array or record value is not affected. For
example:

.. code-block:: ada

  type Arr is Array (1 .. 5) of Integer;
  ...
  Avar1 : Arr := (1,2,3,4,5);
  Avar2 : Arr := Avar1'Update (2 => 10, 3 .. 4 => 20);


yields a value for ``Avar2`` of 1,10,20,20,5 with ``Avar1``
begin unmodified. Similarly:

.. code-block:: ada

  type Rec is A, B, C : Integer;
  ...
  Rvar1 : Rec := (A => 1, B => 2, C => 3);
  Rvar2 : Rec := Rvar1'Update (B => 20);


yields a value for ``Rvar2`` of (A => 1, B => 20, C => 3),
with ``Rvar1`` being unmodified.
Note that the value of the attribute reference is computed
completely before it is used. This means that if you write:

.. code-block:: ada

  Avar1 := Avar1'Update (1 => 10, 2 => Function_Call);


then the value of ``Avar1`` is not modified if ``Function_Call``
raises an exception, unlike the effect of a series of direct assignments
to elements of ``Avar1``. In general this requires that
two extra complete copies of the object are required, which should be
kept in mind when considering efficiency.

The ``Update`` attribute cannot be applied to prefixes of a limited
type, and cannot reference discriminants in the case of a record type.
The accessibility level of an Update attribute result object is defined
as for an aggregate.

In the record case, no component can be mentioned more than once. In
the array case, two overlapping ranges can appear in the association list,
in which case the modifications are processed left to right.

Multi-dimensional arrays can be modified, as shown by this example:

.. code-block:: ada

  A : array (1 .. 10, 1 .. 10) of Integer;
  ..
  A := A'Update ((1, 2) => 20, (3, 4) => 30);


which changes element (1,2) to 20 and (3,4) to 30.

Attribute Valid_Value
=======================
.. index:: Valid_Value

The ``'Valid_Value`` attribute is defined for enumeration types other than
those in package Standard or types derived from those types. This attribute is
a function that takes a String, and returns Boolean. ``T'Valid_Value (S)``
returns True if and only if ``T'Value (S)`` would not raise Constraint_Error.

Attribute Valid_Scalars
=======================
.. index:: Valid_Scalars

The ``'Valid_Scalars`` attribute is intended to make it easier to check the
validity of scalar subcomponents of composite objects. The attribute is defined
for any prefix ``P`` which denotes an object. Prefix ``P`` can be any type
except for ``Unchecked_Union`` types. The value of the attribute is of type
``Boolean``.

``P'Valid_Scalars`` yields ``True`` if and only if the evaluation of
``C'Valid`` yields ``True`` for every scalar subcomponent ``C`` of ``P``, or if
``P`` has no scalar subcomponents. Attribute ``'Valid_Scalars`` is equivalent
to attribute ``'Valid`` for scalar types.

It is not specified in what order the subcomponents are checked, nor whether
any more are checked after any one of them is determined to be invalid. If the
prefix ``P`` is of a class-wide type ``T'Class`` (where ``T`` is the associated
specific type), or if the prefix ``P`` is of a specific tagged type ``T``, then
only the subcomponents of ``T`` are checked; in other words, components of
extensions of ``T`` are not checked even if ``T'Class (P)'Tag /= T'Tag``.

The compiler will issue a warning if it can be determined at compile time that
the prefix of the attribute has no scalar subcomponents.

Note: ``Valid_Scalars`` can generate a lot of code, especially in the case of
a large variant record. If the attribute is called in many places in the same
program applied to objects of the same type, it can reduce program size to
write a function with a single use of the attribute, and then call that
function from multiple places.

Attribute VADS_Size
===================
.. index:: Size, VADS compatibility

.. index:: VADS_Size

The ``'VADS_Size`` attribute is intended to make it easier to port
legacy code which relies on the semantics of ``'Size`` as implemented
by the VADS Ada 83 compiler.  GNAT makes a best effort at duplicating the
same semantic interpretation.  In particular, ``'VADS_Size`` applied
to a predefined or other primitive type with no Size clause yields the
Object_Size (for example, ``Natural'Size`` is 32 rather than 31 on
typical machines).  In addition ``'VADS_Size`` applied to an object
gives the result that would be obtained by applying the attribute to
the corresponding type.

.. _Attribute-Value_Size:

Attribute Value_Size
====================
.. index:: Size, setting for not-first subtype

.. index:: Value_Size

``type'Value_Size`` is the number of bits required to represent
a value of the given subtype.  It is the same as ``type'Size``,
but, unlike ``Size``, may be set for non-first subtypes.

Attribute Wchar_T_Size
======================
.. index:: Wchar_T_Size

``Standard'Wchar_T_Size`` (``Standard`` is the only allowed
prefix) provides the size in bits of the C ``wchar_t`` type
primarily for constructing the definition of this type in
package ``Interfaces.C``. The result is a static constant.

Attribute Word_Size
===================
.. index:: Word_Size

``Standard'Word_Size`` (``Standard`` is the only allowed
prefix) provides the value ``System.Word_Size``. The result is
a static constant.

---

### Gcc Ada Doc Gnat Rm Implementation Defined Characteristics (`gcc/ada/doc/gnat_rm/implementation_defined_characteristics.rst`)

.. _Implementation_Defined_Characteristics:

**************************************
Implementation Defined Characteristics
**************************************

In addition to the implementation dependent pragmas and attributes, and the
implementation advice, there are a number of other Ada features that are
potentially implementation dependent and are designated as
implementation-defined. These are mentioned throughout the Ada Reference
Manual, and are summarized in Annex M.

A requirement for conforming Ada compilers is that they provide
documentation describing how the implementation deals with each of these
issues.  In this chapter you will find each point in Annex M listed,
followed by a description of how GNAT handles the implementation dependence.

You can use this chapter as a guide to minimizing implementation
dependent features in your programs if portability to other compilers
and other operating systems is an important consideration.  The numbers
in each entry below correspond to the paragraph numbers in the Ada
Reference Manual.

*
  "Whether or not each recommendation given in Implementation
  Advice is followed.  See 1.1.2(37)."

See :ref:`Implementation_Advice`.

*
  "Capacity limitations of the implementation.  See 1.1.3(3)."

The complexity of programs that can be processed is limited only by the
total amount of available virtual memory, and disk space for the
generated object files.

*
  "Variations from the standard that are impractical to avoid
  given the implementation's execution environment.  See 1.1.3(6)."

There are no variations from the standard.

*
  "Which code_statements cause external
  interactions.  See 1.1.3(10)."

Any *code_statement* can potentially cause external interactions.

*
  "The coded representation for the text of an Ada
  program.  See 2.1(4)."

See separate section on source representation.

*
  "The semantics of an Ada program whose text is not in
  Normalization Form C.  See 2.1(4)."

See separate section on source representation.

*
  "The representation for an end of line.  See 2.2(2)."

See separate section on source representation.

*
  "Maximum supported line length and lexical element
  length.  See 2.2(15)."

The maximum line length is 255 characters and the maximum length of
a lexical element is also 255 characters. This is the default setting
if not overridden by the use of compiler switch *-gnaty* (which
sets the maximum to 79) or *-gnatyMnn* which allows the maximum
line length to be specified to be any value up to 32767. The maximum
length of a lexical element is the same as the maximum line length.

*
  "Implementation defined pragmas.  See 2.8(14)."

See :ref:`Implementation_Defined_Pragmas`.

*
  "Effect of pragma ``Optimize``.  See 2.8(27)."

Pragma ``Optimize``, if given with a ``Time`` or ``Space``
parameter, checks that the optimization flag is set, and aborts if it is
not.

*
  "The message string associated with the Assertion_Error exception raised
  by the failure of a predicate check if there is no applicable
  Predicate_Failure aspect.  See 3.2.4(31)."

In the case of a Dynamic_Predicate aspect, the string is
"Dynamic_Predicate failed at ", where
"" might be something like "foo.adb:123".
The Static_Predicate case is handled analogously.

*
  "The predefined integer types declared in
  ``Standard``.  See 3.5.4(25)."

.. tabularcolumns:: |l|L|

========================= =======================================
Type                       Representation
========================= =======================================
*Short_Short_Integer*      8-bit signed
*Short_Integer*            16-bit signed
*Integer*                  32-bit signed
*Long_Integer*             64-bit signed (on most 64-bit targets,
                        depending on the C definition of long)
                        32-bit signed (on all other targets)
*Long_Long_Integer*        64-bit signed
*Long_Long_Long_Integer*   128-bit signed (on 64-bit targets)
                        64-bit signed (on 32-bit targets)
========================= =======================================

*
  "Any nonstandard integer types and the operators defined
  for them.  See 3.5.4(26)."

There are no nonstandard integer types.

*
  "Any nonstandard real types and the operators defined for
  them.  See 3.5.6(8)."

There are no nonstandard real types.

*
  "What combinations of requested decimal precision and range
  are supported for floating point types.  See 3.5.7(7)."

The precision and range are defined by the IEEE Standard for Floating-Point
Arithmetic (IEEE 754-2019).

*
  "The predefined floating point types declared in
  ``Standard``.  See 3.5.7(16)."

====================== ===============================================
Type                   Representation
====================== ===============================================
*Short_Float*          IEEE Binary32 (Single)
*Float*                IEEE Binary32 (Single)
*Long_Float*           IEEE Binary64 (Double)
*Long_Long_Float*      IEEE Binary64 (Double) on non-x86 architectures
                    IEEE 80-bit Extended on x86 architecture
====================== ===============================================

The default rounding mode specified by the IEEE 754 Standard is assumed both
for static and dynamic computations (that is, round to nearest, ties to even).
The input routines yield correctly rounded values for Short_Float, Float, and
Long_Float at least. The output routines can compute up to twice as many exact
digits as the value of ``T'Digits`` for any type, for example 30 digits for
Long_Float; if more digits are requested, zeros are printed.

*
  "The small of an ordinary fixed point type.  See 3.5.9(8)."

The small is the largest power of two that does not exceed the delta.

*
  "What combinations of small, range, and digits are
  supported for fixed point types.  See 3.5.9(10)."

For an ordinary fixed point type, on 32-bit platforms, the small must lie in
2.0**(-80) .. 2.0**80 and the range in -9.0E+36 .. 9.0E+36; any combination
is permitted that does not result in a mantissa larger than 63 bits.

On 64-bit platforms, the small must lie in 2.0**(-127) .. 2.0**127 and the
range in -1.0E+76 .. 1.0E+76; any combination is permitted that does not
result in a mantissa larger than 63 bits, and any combination is permitted
that results in a mantissa between 64 and 127 bits if the small is the
ratio of two integers that lie in 1 .. 2.0**127.

If the small is the ratio of two integers with 64-bit magnitude on 32-bit
platforms and 128-bit magnitude on 64-bit platforms, which is the case if
no ``small`` clause is provided, then the operations of the fixed point
type are entirely implemented by means of integer instructions.  In the
other cases, some operations, in particular input and output, may be
implemented by means of floating-point instructions and may be affected
by accuracy issues on architectures other than x86.

For a decimal fixed point type, on 32-bit platforms, the small must lie in
1.0E-18 .. 1.0E+18 and the digits in 1 .. 18.  On 64-bit platforms, the
small must lie in 1.0E-38 .. 1.0E+38 and the digits in 1 .. 38.

*
  "The result of ``Tags.Expanded_Name`` for types declared
  within an unnamed *block_statement*.  See 3.9(10)."

Block numbers of the form :samp:`B{nnn}`, where *nnn* is a
decimal integer are allocated.

*
  "The sequence of characters of the value returned by Tags.Expanded_Name
  (respectively, Tags.Wide_Expanded_Name) when some of the graphic
  characters of Tags.Wide_Wide_Expanded_Name are not defined in Character
  (respectively, Wide_Character).  See 3.9(10.1)."

This is handled in the same way as the implementation-defined behavior
referenced in A.4.12(34).

*
  "Implementation-defined attributes.  See 4.1.4(12)."

See :ref:`Implementation_Defined_Attributes`.

*
  "The value of the parameter to Empty for some container aggregates.
  See 4.3.5(40)."

As per the suggestion given in the Annotated Ada RM, the default value
of the formal parameter is used if one exists and zero is used otherwise.

*
  "The maximum number of chunks for a parallel reduction expression without
  a chunk_specification.  See 4.5.10(21)."

Feature unimplemented.

*
  "Rounding of real static expressions which are exactly half-way between
  two machine numbers.  See 4.9(38)."

Round to even is used in all such cases.

*
  "The maximum number of chunks for a parallel generalized iterator without
  a chunk_specification.  See 5.5.2(10)."

Feature unimplemented.

*
  "The number of chunks for an array component iterator.  See 5.5.2(11)."

Feature unimplemented.

*
  "Any extensions of the Global aspect.  See 6.1.2(43)."

Feature unimplemented.

*
  "The circumstances the implementation passes in the null value for a view
  conversion of an access type used as an out parameter.  See 6.4.1(19)."

Difficult to characterize.

*
  "Any extensions of the Default_Initial_Condition aspect.  See 7.3.3(11)."

SPARK allows specifying *null* as the Default_Initial_Condition
aspect of a type. See the SPARK reference manual for further details.

*
  "Any implementation-defined time types.  See 9.6(6)."

There are no implementation-defined time types.

*
  "The time base associated with relative delays.  See 9.6(20)."

See 9.6(20).  The time base used is that provided by the C library
function ``gettimeofday``.

*
  "The time base of the type ``Calendar.Time``.  See 9.6(23)."

The time base used is that provided by the C library function
``gettimeofday``.

*
  "The time zone used for package ``Calendar``
  operations.  See 9.6(24)."

The time zone used by package ``Calendar`` is the current system time zone
setting for local time, as accessed by the C library function
``localtime``.

*
  "Any limit on *delay_until_statements* of
  *select_statements*.  See 9.6(29)."

There are no such limits.

*
  "The result of Calendar.Formatting.Image if its argument represents more
  than 100 hours.  See 9.6.1(86)."

Calendar.Time_Error is raised.

*
  "Implementation-defined conflict check policies.  See 9.10.1(5)."

There are no implementation-defined conflict check policies.

*
  "The representation for a compilation.  See 10.1(2)."

A compilation is represented by a sequence of files presented to the
compiler in a single invocation of the *gcc* command.

*
  "Any restrictions on compilations that contain multiple
  compilation_units.  See 10.1(4)."

No single file can contain more than one compilation unit, but any
sequence of files can be presented to the compiler as a single
compilation.

*
  "The mechanisms for creating an environment and for adding
  and replacing compilation units.  See 10.1.4(3)."

See separate section on compilation model.

*
  "The manner of explicitly assigning library units to a
  partition.  See 10.2(2)."

If a unit contains an Ada main program, then the Ada units for the partition
are determined by recursive application of the rules in the Ada Reference
Manual section 10.2(2-6).  In other words, the Ada units will be those that
are needed by the main program, and then this definition of need is applied
recursively to those units, and the partition contains the transitive
closure determined by this relationship.  In short, all the necessary units
are included, with no need to explicitly specify the list.  If additional
units are required, e.g., by foreign language units, then all units must be
mentioned in the context clause of one of the needed Ada units.

If the partition contains no main program, or if the main program is in
a language other than Ada, then GNAT
provides the binder options *-z* and *-n* respectively, and in
this case a list of units can be explicitly supplied to the binder for
inclusion in the partition (all units needed by these units will also
be included automatically).  For full details on the use of these
options, refer to *GNAT Make Program gnatmake* in the
:title:`GNAT User's Guide`.

*
  "The implementation-defined means, if any, of specifying which compilation
  units are needed by a given compilation unit.  See 10.2(2)."

The units needed by a given compilation unit are as defined in
the Ada Reference Manual section 10.2(2-6).  There are no
implementation-defined pragmas or other implementation-defined
means for specifying needed units.

*
  "The manner of designating the main subprogram of a
  partition.  See 10.2(7)."

The main program is designated by providing the name of the
corresponding :file:`ALI` file as the input parameter to the binder.

*
  "The order of elaboration of *library_items*.  See 10.2(18)."

The first constraint on ordering is that it meets the requirements of
Chapter 10 of the Ada Reference Manual.  This still leaves some
implementation-dependent choices, which are resolved by analyzing
the elaboration code of each unit and identifying implicit
elaboration-order dependencies.

*
  "Parameter passing and function return for the main
  subprogram.  See 10.2(21)."

The main program has no parameters.  It may be a procedure, or a function
returning an integer type.  In the latter case, the returned integer
value is the return code of the program (overriding any value that
may have been set by a call to ``Ada.Command_Line.Set_Exit_Status``).

*
  "The mechanisms for building and running partitions.  See 10.2(24)."

GNAT itself supports programs with only a single partition. The PolyORB product (which also includes an implementation of the PCS) provides a completely flexible method for building and running programs consisting of multiple partitions. **NB!** See the note in :ref:`polyORB` regarding the lifetime
of this product.

*
  "The details of program execution, including program
  termination.  See 10.2(25)."

See separate section on compilation model.

*
  "The semantics of any non-active partitions supported by the
  implementation.  See 10.2(28)."

Passive partitions are supported on targets where shared memory is
provided by the operating system. **NB!** See the note in :ref:`polyORB` regarding the lifetime of this product.

*
  "The information returned by ``Exception_Message``.  See 11.4.1(10)."

Exception message returns the null string unless a specific message has
been passed by the program.

*
  "The result of ``Exceptions.Exception_Name`` for types
  declared within an unnamed *block_statement*.  See 11.4.1(12)."

Blocks have implementation defined names of the form :samp:`B{nnn}`
where *nnn* is an integer.

*
  "The information returned by
  ``Exception_Information``.  See 11.4.1(13)."

``Exception_Information`` returns a string in the following format::

  *Exception_Name:* nnnnn
  *Message:* mmmmm
  *PID:* ppp
  *Load address:* 0xhhhh
  *Call stack traceback locations:*
  0xhhhh 0xhhhh 0xhhhh ... 0xhhh

where

  *  ``nnnn`` is the fully qualified name of the exception in all upper
  case letters. This line is always present.

  *  ``mmmm`` is the message (this line present only if message is non-null)

  *  ``ppp`` is the Process Id value as a decimal integer (this line is
  present only if the Process Id is nonzero). Currently we are
  not making use of this field.

  *  The Load address line, the Call stack traceback locations line and the
  following values are present only if at least one traceback location was
  recorded. The Load address indicates the address at which the main executable
  was loaded; this line may not be present if operating system hasn't relocated
  the main executable. The values are given in C style format, with lower case
  letters for a-f, and only as many digits present as are necessary.
  The line terminator sequence at the end of each line, including
  the last line is a single ``LF`` character (``16#0A#``).

*
  "The sequence of characters of the value returned by
  Exceptions.Exception_Name (respectively, Exceptions.Wide_Exception_Name)
  when some of the graphic characters of Exceptions.Wide_Wide_Exception_Name
  are not defined in Character (respectively, Wide_Character).
  See 11.4.1(12.1)."

This is handled in the same way as the implementation-defined behavior
referenced in A.4.12(34).

*
  "The information returned by Exception_Information.  See 11.4.1(13)."

The exception name and the source location at which the exception was
raised are included.

*
  "Implementation-defined policy_identifiers and assertion_aspect_marks
  allowed in a pragma Assertion_Policy.  See 11.4.2(9)."

Implementation-defined assertion_aspect_marks include Assert_And_Cut,
Assume, Contract_Cases, Debug, Ghost, Initial_Condition, Loop_Invariant,
Loop_Variant, Postcondition, Precondition, Predicate, Refined_Post,
Statement_Assertions, and Subprogram_Variant. Implementation-defined
policy_identifiers include Disable and Suppressible.

*
  "The default assertion policy.  See 11.4.2(10)."

The default assertion policy is Ignore, although this can be overridden
via compiler switches such as "-gnata".

*
  "Implementation-defined check names.  See 11.5(27)."

The implementation-defined check names include Alignment_Check,
Container_Checks, Duplicated_Tag_Check, Predicate_Check,
Raise_Check, Tampering_Check, and Validity_Check. In addition, a
user program can add implementation-defined check names by means
of the pragma Check_Name. See the description of pragma
``Suppress`` for details.

*
  "Existence and meaning of second parameter of pragma Unsuppress.
  See 11.5(27.1)."

The legality rules for and semantics of the second parameter of pragma
Unsuppress match those for the second argument of pragma Suppress.

*
  "The cases that cause conflicts between the representation of the
  ancestors of a type_declaration.  See 13.1(13.1)."

No such cases exist.

*
  "The interpretation of each representation aspect.  See 13.1(20)."

See separate section on data representations.

*
  "Any restrictions placed upon the specification of representation aspects.
  See 13.1(20)."

See separate section on data representations.

*
  "Implementation-defined aspects, including the syntax for specifying
  such aspects and the legality rules for such aspects.  See 13.1.1(38)."

See :ref:`Implementation_Defined_Aspects`.

*
  "The set of machine scalars.  See 13.3(8.1)."

See separate section on data representations.

*
  "The meaning of ``Size`` for indefinite subtypes.  See 13.3(48)."

The Size attribute of an indefinite subtype is not less than the Size
attribute of any object of that type.

*
  "The meaning of Object_Size for indefinite subtypes.  See 13.3(58)."

The Object_Size attribute of an indefinite subtype is not less than the
Object_Size attribute of any object of that type.

*
  "The default external representation for a type tag.  See 13.3(75)."

The default external representation for a type tag is the fully expanded
name of the type in upper case letters.

*
  "What determines whether a compilation unit is the same in
  two different partitions.  See 13.3(76)."

A compilation unit is the same in two different partitions if and only
if it derives from the same source file.

*
  "Implementation-defined components.  See 13.5.1(15)."

The only implementation defined component is the tag for a tagged type,
which contains a pointer to the dispatching table.

*
  "If ``Word_Size`` = ``Storage_Unit``, the default bit
  ordering.  See 13.5.3(5)."

``Word_Size`` does not equal ``Storage_Unit`` in this implementation.

*
  "The contents of the visible part of package ``System``.  See 13.7(2)."

See the definition of package System in :file:`system.ads`.
Note that two declarations are added to package System.

.. code-block:: ada

  Max_Priority           : constant Positive := Priority'Last;
  Max_Interrupt_Priority : constant Positive := Interrupt_Priority'Last;

*
  "The range of Storage_Elements.Storage_Offset, the modulus of
  Storage_Elements.Storage_Element, and the declaration of
  Storage_Elements.Integer_Address.  See 13.7.1(11)."

See the definition of package System.Storage_Elements in :file:`s-stoele.ads`.

*
  "The contents of the visible part of package ``System.Machine_Code``,
  and the meaning of *code_statements*.  See 13.8(7)."

See the definition and documentation in file :file:`s-maccod.ads`.

*
  "The result of unchecked conversion for instances with scalar result
  types whose result is not defined by the language.  See 13.9(11)."

Unchecked conversion between types of the same size
results in an uninterpreted transmission of the bits from one type
to the other.  If the types are of unequal sizes, then in the case of
discrete types, a shorter source is first zero or sign extended as
necessary, and a shorter target is simply truncated on the left.
For all non-discrete types, the source is first copied if necessary
to ensure that the alignment requirements of the target are met, then
a pointer is constructed to the source value, and the result is obtained
by dereferencing this pointer after converting it to be a pointer to the
target type. Unchecked conversions where the target subtype is an
unconstrained array are not permitted. If the target alignment is
greater than the source alignment, then a copy of the result is
made with appropriate alignment

*
  "The result of unchecked conversion for instances with nonscalar result
  types whose result is not defined by the language.  See 13.9(11)."

See preceding definition for the scalar result case.

*
  "Whether or not the implementation provides user-accessible
  names for the standard pool type(s).  See 13.11(17)."

There are 3 different standard pools used by the compiler when
``Storage_Pool`` is not specified depending whether the type is local
to a subprogram or defined at the library level and whether
``Storage_Size``is specified or not. See documentation in the runtime
library units ``System.Pool_Global``, ``System.Pool_Size`` and
``System.Pool_Local`` in files :file:`s-poosiz.ads`,
:file:`s-pooglo.ads` and :file:`s-pooloc.ads` for full details on the
default pools used.  All these pools are accessible by means of `with`\ ing
these units.

*
  "The meaning of ``Storage_Size`` when neither the Storage_Size nor the
  Storage_Pool is specified for an access type.  See 13.11(18)."

``Storage_Size`` is measured in storage units, and refers to the
total space available for an access type collection, or to the primary
stack space for a task.

*
  "The effect of specifying aspect Default_Storage_Pool on an instance
  of a language-defined generic unit.  See 13.11.3(5)."

Instances of language-defined generic units are treated the same as other
instances with respect to the Default_Storage_Pool aspect.

*
  "Implementation-defined restrictions allowed in a pragma
  ``Restrictions``.  See 13.12(8.7)."

See :ref:`Standard_and_Implementation_Defined_Restrictions`.

*
  "The consequences of violating limitations on
  ``Restrictions`` pragmas.  See 13.12(9)."

Restrictions that can be checked at compile time are enforced at
compile time; violations are illegal. For other restrictions, any
violation during program execution results in erroneous execution.

*
  "Implementation-defined usage profiles allowed in a pragma Profile.
  See 13.12(15)."

See :ref:`Implementation_Defined_Pragmas`.

*
  "The contents of the stream elements read and written by the Read and
  Write attributes of elementary types.  See 13.13.2(9)."

The representation is the in-memory representation of the base type of
the type, using the number of bits corresponding to the
``type'Size`` value, and the natural ordering of the machine.

*
  "The names and characteristics of the numeric subtypes
  declared in the visible part of package ``Standard``.  See A.1(3)."

See items describing the integer and floating-point types supported.

*
  "The values returned by Strings.Hash.  See A.4.9(3)."

This hash function has predictable collisions and is subject to
equivalent substring attacks. It is not suitable for construction of a
hash table keyed on possibly malicious user input.

*
  "The value returned by a call to a Text_Buffer Get procedure if any
  character in the returned sequence is not defined in Character.
  See A.4.12(34)."

The contents of a buffer is represented internally as a UTF_8 string.
The value return by Text_Buffer.Get is the result of passing that
UTF_8 string to UTF_Encoding.Strings.Decode.

*
  "The value returned by a call to a Text_Buffer Wide_Get procedure if
  any character in the returned sequence is not defined in Wide_Character.
  See A.4.12(34)."

The contents of a buffer is represented internally as a UTF_8 string.
The value return by Text_Buffer.Wide_Get is the result of passing that
UTF_8 string to UTF_Encoding.Wide_Strings.Decode.

*
  "The accuracy actually achieved by the elementary
  functions.  See A.5.1(1)."

The elementary functions correspond to the functions available in the C
library.  Only fast math mode is implemented.

*
  "The sign of a zero result from some of the operators or
  functions in ``Numerics.Generic_Elementary_Functions``, when
  ``Float_Type'Signed_Zeros`` is ``True``.  See A.5.1(46)."

The sign of zeroes follows the requirements of the IEEE 754 standard on
floating-point.

*
  "The value of
  ``Numerics.Float_Random.Max_Image_Width``.  See A.5.2(27)."

Maximum image width is 6864, see library file :file:`s-rannum.ads`.

*
  "The value of
  ``Numerics.Discrete_Random.Max_Image_Width``.  See A.5.2(27)."

Maximum image width is 6864, see library file :file:`s-rannum.ads`.

*
  "The string representation of a random number generator's
  state.  See A.5.2(38)."

The value returned by the Image function is the concatenation of
the fixed-width decimal representations of the 624 32-bit integers
of the state vector.

*
  "The values of the ``Model_Mantissa``,
  ``Model_Emin``, ``Model_Epsilon``, ``Model``,
  ``Safe_First``, and ``Safe_Last`` attributes, if the Numerics
  Annex is not supported.  See A.5.3(72)."

Running the compiler with *-gnatS* to produce a listing of package
``Standard`` displays the values of these attributes.

*
  "The value of ``Buffer_Size`` in ``Storage_IO``.  See A.9(10)."

All type representations are contiguous, and the ``Buffer_Size`` is
the value of ``type'Size`` rounded up to the next storage unit
boundary.

*
  "External files for standard input, standard output, and
  standard error See A.10(5)."

These files are mapped onto the files provided by the C streams
libraries. See source file :file:`i-cstrea.ads` for further details.

*
  "The accuracy of the value produced by ``Put``.  See A.10.9(36)."

If more digits are requested in the output than are represented by the
precision of the value, zeroes are output in the corresponding least
significant digit positions.

*
  "Current size for a stream file for which positioning is not supported.
  See A.12.1(1.1)."

Positioning is supported.

*
  "The meaning of ``Argument_Count``, ``Argument``, and
  ``Command_Name``.  See A.15(1)."

These are mapped onto the ``argv`` and ``argc`` parameters of the
main program in the natural manner.

*
  "The interpretation of file names and directory names.  See A.16(46)."

These names are interpreted consistently with the underlying file system.

*
  "The maximum value for a file size in Directories.  See A.16(87)."

Directories.File_Size'Last is equal to Long_Long_Integer'Last .

*
  "The result for Directories.Size for a directory or special file.
  See A.16(93)."

Name_Error is raised.

*
  "The result for Directories.Modification_Time for a directory or special file.
  See A.16(93)."

Name_Error is raised.

*
  "The interpretation of a nonnull search pattern in Directories.
  See A.16(104)."

When the ``Pattern`` parameter is not the null string, it is interpreted
according to the syntax of regular expressions as defined in the
``GNAT.Regexp`` package.

See :ref:`GNAT.Regexp_(g-regexp.ads)`.

*
  "The results of a Directories search if the contents of the directory are
  altered while a search is in progress.  See A.16(110)."

The effect of a call to Get_Next_Entry is determined by the current
state of the directory.

*
  "The definition and meaning of an environment variable.  See A.17(1)."

This definition is determined by the underlying operating system.

*
  "The circumstances where an environment variable cannot be defined.
  See A.17(16)."

There are no such implementation-defined circumstances.

*
  "Environment names for which Set has the effect of Clear.  See A.17(17)."

There are no such names.

*
  "The value of Containers.Hash_Type'Modulus. The value of
  Containers.Count_Type'Last.  See A.18.1(7)."

Containers.Hash_Type'Modulus is 2**32.
Containers.Count_Type'Last is 2**31 - 1.

*
  "Implementation-defined convention names.  See B.1(11)."

The following convention names are supported

.. tabularcolumns:: |l|L|

======================= ==============================================================================
Convention Name         Interpretation
======================= ==============================================================================
*Ada*                   Ada
*Ada_Pass_By_Copy*      Allowed for any types except by-reference types such as limited
                     records. Compatible with convention Ada, but causes any parameters
                     with this convention to be passed by copy.
*Ada_Pass_By_Reference* Allowed for any types except by-copy types such as scalars.
                     Compatible with convention Ada, but causes any parameters
                     with this convention to be passed by reference.
*Assembler*             Assembly language
*Asm*                   Synonym for Assembler
*Assembly*              Synonym for Assembler
*C*                     C
*C_Pass_By_Copy*        Allowed only for record types, like C, but also notes that record
                     is to be passed by copy rather than reference.
*COBOL*                 COBOL
*C_Plus_Plus (or CPP)*  C++
*Default*               Treated the same as C
*External*              Treated the same as C
*Fortran*               Fortran
*Intrinsic*             For support of pragma ``Import`` with convention Intrinsic, see
                     separate section on Intrinsic Subprograms.
*Stdcall*               Stdcall (used for Windows implementations only).  This convention correspond
                     to the WINAPI (previously called Pascal convention) C/C++ convention under
                     Windows.  A routine with this convention cleans the stack before
                     exit. This pragma cannot be applied to a dispatching call.
*DLL*                   Synonym for Stdcall
*Win32*                 Synonym for Stdcall
*Stubbed*               Stubbed is a special convention used to indicate that the body of the
                     subprogram will be entirely ignored.  Any call to the subprogram
                     is converted into a raise of the ``Program_Error`` exception.  If a
                     pragma ``Import`` specifies convention ``stubbed`` then no body need
                     be present at all.  This convention is useful during development for the
                     inclusion of subprograms whose body has not yet been written.
                     In addition, all otherwise unrecognized convention names are also
                     treated as being synonymous with convention C.  In all implementations,
                     use of such other names results in a warning.
======================= ==============================================================================

*
  "The meaning of link names.  See B.1(36)."

Link names are the actual names used by the linker.

*
  "The manner of choosing link names when neither the link name nor the
  address of an imported or exported entity is specified.  See B.1(36)."

The default linker name is that which would be assigned by the relevant
external language, interpreting the Ada name as being in all lower case
letters.

*
  "The effect of pragma ``Linker_Options``.  See B.1(37)."

The string passed to ``Linker_Options`` is presented uninterpreted as
an argument to the link command, unless it contains ASCII.NUL characters.
NUL characters if they appear act as argument separators, so for example

.. code-block:: ada

  pragma Linker_Options ("-labc" & ASCII.NUL & "-ldef");

causes two separate arguments ``-labc`` and ``-ldef`` to be passed to the
linker. The order of linker options is preserved for a given unit. The final
list of options passed to the linker is in reverse order of the elaboration
order. For example, linker options for a body always appear before the options
from the corresponding package spec.

*
  "The contents of the visible part of package
  ``Interfaces`` and its language-defined descendants.  See B.2(1)."

See files with prefix :file:`i-` in the distributed library.

*
  "Implementation-defined children of package
  ``Interfaces``.  The contents of the visible part of package
  ``Interfaces``.  See B.2(11)."

See files with prefix :file:`i-` in the distributed library.

*
  "The definitions of certain types and constants in Interfaces.C.
  See B.3(41)."

See source file :file:`i-c.ads`.

*
  "The types ``Floating``, ``Long_Floating``,
  ``Binary``, ``Long_Binary``, ``Decimal_ Element``, and
  ``COBOL_Character``; and the initialization of the variables
  ``Ada_To_COBOL`` and ``COBOL_To_Ada``, in
  ``Interfaces.COBOL``.  See B.4(50)."

===================== ====================================
COBOL                 Ada
===================== ====================================
*Floating*            Float
*Long_Floating*       (Floating) Long_Float
*Binary*              Integer
*Long_Binary*         Long_Long_Integer
*Decimal_Element*     Character
*COBOL_Character*     Character
===================== ====================================

For initialization, see the file :file:`i-cobol.ads` in the distributed library.

*
  "The types Fortran_Integer, Real, Double_Precision, and Character_Set
  in Interfaces.Fortran.  See B.5(17)."

See source file :file:`i-fortra.ads`. These types are derived, respectively,
from Integer, Float, Long_Float, and Character.

*
  "Implementation-defined intrinsic subprograms.  See C.1(1)."

See separate section on Intrinsic Subprograms.

*
  "Any restrictions on a protected procedure or its containing type when an
  aspect Attach_handler or Interrupt_Handler is specified.  See C.3.1(17)."

There are no such restrictions.

*
  "Any other forms of interrupt handler supported by the Attach_Handler and
  Interrupt_Handler aspects.  See C.3.1(19)."

There are no such forms.

*
  "The semantics of some attributes and functions of an entity for which
  aspect Discard_Names is True.  See C.5(7)."

If Discard_Names is True for an enumeration type, the Image attribute
provides the image of the Pos of the literal, and Value accepts
Pos values.

If both of the aspects``Discard_Names`` and ``No_Tagged_Streams`` are true
for a tagged type, its Expanded_Name and External_Tag values are
empty strings. This is useful to avoid exposing entity names at binary
level.

*
  "The modulus and size of Test_and_Set_Flag.  See C.6.3(8)."

The modulus is 2**8. The size is 8.

*
  "The value used to represent the set value for Atomic_Test_and_Set.
  See C.6.3(10)."

The value is 1.

*
  "The result of the ``Task_Identification.Image``
  attribute.  See C.7.1(7)."

The result of this attribute is a string that identifies
the object or component that denotes a given task. If a variable ``Var``
has a task type, the image for this task will have the form :samp:`Var_{XXXXXXXX}`,
where the suffix *XXXXXXXX*
is the hexadecimal representation of the virtual address of the corresponding
task control block. If the variable is an array of tasks, the image of each
task will have the form of an indexed component indicating the position of a
given task in the array, e.g., :samp:`Group(5)_{XXXXXXX}`. If the task is a
component of a record, the image of the task will have the form of a selected
component. These rules are fully recursive, so that the image of a task that
is a subcomponent of a composite object corresponds to the expression that
designates this task.

If a task is created by an allocator, its image depends on the context. If the
allocator is part of an object declaration, the rules described above are used
to construct its image, and this image is not affected by subsequent
assignments. If the allocator appears within an expression, the image
includes only the name of the task type.

If the configuration pragma Discard_Names is present, or if the restriction
No_Implicit_Heap_Allocation is in effect,  the image reduces to
the numeric suffix, that is to say the hexadecimal representation of the
virtual address of the control block of the task.

*
  "The value of ``Current_Task`` when in a protected entry
  or interrupt handler.  See C.7.1(17)."

Protected entries or interrupt handlers can be executed by any
convenient thread, so the value of ``Current_Task`` is undefined.

*
  "Granularity of locking for Task_Attributes.  See C.7.2(16)."

No locking is needed if the formal type Attribute has the size and
alignment of either Integer or System.Address and the bit representation
of Initial_Value is all zeroes. Otherwise, locking is performed.

*
  "The declarations of ``Any_Priority`` and
  ``Priority``.  See D.1(11)."

See declarations in file :file:`system.ads`.

*
  "Implementation-defined execution resources.  See D.1(15)."

There are no implementation-defined execution resources.

*
  "Whether, on a multiprocessor, a task that is waiting for
  access to a protected object keeps its processor busy.  See D.2.1(3)."

On a multi-processor, a task that is waiting for access to a protected
object does not keep its processor busy.

*
  "The affect of implementation defined execution resources
  on task dispatching.  See D.2.1(9)."

Tasks map to threads in the threads package used by GNAT.  Where possible
and appropriate, these threads correspond to native threads of the
underlying operating system.

*
  "Implementation-defined task dispatching policies.  See D.2.2(3)."

There are no implementation-defined task dispatching policies.

*
  "The value of Default_Quantum in Dispatching.Round_Robin.  See D.2.5(4)."

The value is 10 milliseconds.

*
  "Implementation-defined *policy_identifiers* allowed
  in a pragma ``Locking_Policy``.  See D.3(4)."

The two implementation defined policies permitted in GNAT are
``Inheritance_Locking`` and  ``Concurrent_Readers_Locking``. On
targets that support the ``Inheritance_Locking`` policy, locking is
implemented by inheritance, i.e., the task owning the lock operates
at a priority equal to the highest priority of any task currently
requesting the lock. On targets that support the
``Concurrent_Readers_Locking`` policy, locking is implemented with a
read/write lock allowing multiple protected object functions to enter
concurrently.

*
  "Default ceiling priorities.  See D.3(10)."

The ceiling priority of protected objects of the type
``System.Interrupt_Priority'Last`` as described in the Ada
Reference Manual D.3(10),

*
  "The ceiling of any protected object used internally by
  the implementation.  See D.3(16)."

The ceiling priority of internal protected objects is
``System.Priority'Last``.

*
  "Implementation-defined queuing policies.  See D.4(1)."

There are no implementation-defined queuing policies.

*
  "Implementation-defined admission policies.  See D.4.1(1)."

There are no implementation-defined admission policies.

*
  "Any operations that implicitly require heap storage
  allocation.  See D.7(8)."

The only operation that implicitly requires heap storage allocation is
task creation.

*
  "When restriction No_Dynamic_CPU_Assignment applies to a partition, the
  processor on which a task with a CPU value of a Not_A_Specific_CPU will
  execute.  See D.7(10)."

Unknown.

*
  "When restriction No_Task_Termination applies to a partition, what happens
  when a task terminates.  See D.7(15.1)."

Execution is erroneous in that case.

*
  "The behavior when restriction Max_Storage_At_Blocking is violated.
  See D.7(17)."

Execution is erroneous in that case.

*
  "The behavior when restriction Max_Asynchronous_Select_Nesting is violated.
  See D.7(18)."

Execution is erroneous in that case.

*
  "The behavior when restriction Max_Tasks is violated.  See D.7(19)."

Execution is erroneous in that case.

* "Whether the use of pragma Restrictions results in a reduction in program
  code or data size or execution time.  See D.7(20)."

Yes it can, but the precise circumstances and properties of such reductions
are difficult to characterize.

*
  "The value of Barrier_Limit'Last in Synchronous_Barriers.  See D.10.1(4)."

Synchronous_Barriers.Barrier_Limit'Last is Integer'Last .

*
  "When an aborted task that is waiting on a Synchronous_Barrier is aborted.
  See D.10.1(13)."

Difficult to characterize.

*
  "The value of Min_Handler_Ceiling in Execution_Time.Group_Budgets.
  See D.14.2(7)."

See source file :file:`a-etgrbu.ads`.

*
  "The value of CPU_Range'Last in System.Multiprocessors.  See D.16(4)."

See source file :file:`s-multip.ads`.

*
  "The processor on which the environment task executes in the absence
  of a value for the aspect CPU.  See D.16(13)."

Unknown.

*
  "The means for creating and executing distributed
  programs.  See E(5)."

The PolyORB product provides means creating and executing
distributed programs. **NB!** See the note in :ref:`polyORB` regarding the lifetime of this product.

*
  "Any events that can result in a partition becoming
  inaccessible.  See E.1(7)."

See the PolyORB user guide for full details on such events.
**NB!** Consider the note in :ref:`polyORB` regarding the lifetime
of this product.

*
  "The scheduling policies, treatment of priorities, and management of
  shared resources between partitions in certain cases.  See E.1(11)."

See the PolyORB user guide for full details on these aspects of
multi-partition execution. **NB!** Consider the note in :ref:`polyORB` regarding the lifetime of this product.

*
  "Whether the execution of the remote subprogram is
  immediately aborted as a result of cancellation.  See E.4(13)."

See the PolyORB user guide for details on the effect of abort in
a distributed application.  **NB!** Consider the note in :ref:`polyORB` regarding the lifetime of this product.

*
  "The range of type System.RPC.Partition_Id.  See E.5(14)."

System.RPC.Partition_ID'Last is Integer'Last. See source file :file:`s-rpc.ads`.

*
  "Implementation-defined interfaces in the PCS.  See E.5(26)."

See the PolyORB user guide for a full description of all
implementation defined interfaces.  **NB!** See the note in :ref:`polyORB` regarding the lifetime of this product.

*
  "The values of named numbers in the package
  ``Decimal``.  See F.2(7)."

==================== ==========
Named Number         Value
==================== ==========
*Max_Scale*           +18
*Min_Scale*           -18
*Min_Delta*           1.0E-18
*Max_Delta*           1.0E+18
*Max_Decimal_Digits*  18
==================== ==========

*
  "The value of ``Max_Picture_Length`` in the package
  ``Text_IO.Editing``.  See F.3.3(16)."

  64

*
  "The value of ``Max_Picture_Length`` in the package
  ``Wide_Text_IO.Editing``.  See F.3.4(5)."

  64

*
  "The accuracy actually achieved by the complex elementary
  functions and by other complex arithmetic operations.  See G.1(1)."

Standard library functions are used for the complex arithmetic
operations.  Only fast math mode is currently supported.

*
  "The sign of a zero result (or a component thereof) from
  any operator or function in ``Numerics.Generic_Complex_Types``, when
  ``Real'Signed_Zeros`` is True.  See G.1.1(53)."

The signs of zero values are as recommended by the relevant
implementation advice.

*
  "The sign of a zero result (or a component thereof) from
  any operator or function in
  ``Numerics.Generic_Complex_Elementary_Functions``, when
  ``Real'Signed_Zeros`` is ``True``.  See G.1.2(45)."

The signs of zero values are as recommended by the relevant
implementation advice.

*
  "Whether the strict mode or the relaxed mode is the
  default.  See G.2(2)."

The strict mode is the default.  There is no separate relaxed mode.  GNAT
provides a highly efficient implementation of strict mode.

*
  "The result interval in certain cases of fixed-to-float
  conversion.  See G.2.1(10)."

For cases where the result interval is implementation dependent, the
accuracy is that provided by performing all operations in 64-bit IEEE
floating-point format.

*
  "The result of a floating point arithmetic operation in
  overflow situations, when the ``Machine_Overflows`` attribute of the
  result type is ``False``.  See G.2.1(13)."

Infinite and NaN values are produced as dictated by the IEEE
floating-point standard.
Note that on machines that are not fully compliant with the IEEE
floating-point standard, such as Alpha, the *-mieee* compiler flag
must be used for achieving IEEE conforming behavior (although at the cost
of a significant performance penalty), so infinite and NaN values are
properly generated.

*
  "The result interval for division (or exponentiation by a
  negative exponent), when the floating point hardware implements division
  as multiplication by a reciprocal.  See G.2.1(16)."

Not relevant, division is IEEE exact.

*
  "The definition of close result set, which determines the accuracy of
  certain fixed point multiplications and divisions.  See G.2.3(5)."

Operations in the close result set are performed using IEEE long format
floating-point arithmetic.  The input operands are converted to
floating-point, the operation is done in floating-point, and the result
is converted to the target type.

*
  "Conditions on a *universal_real* operand of a fixed
  point multiplication or division for which the result shall be in the
  perfect result set.  See G.2.3(22)."

The result is only defined to be in the perfect result set if the result
can be computed by a single scaling operation involving a scale factor
representable in 64 bits.

*
  "The result of a fixed point arithmetic operation in
  overflow situations, when the ``Machine_Overflows`` attribute of the
  result type is ``False``.  See G.2.3(27)."

Not relevant, ``Machine_Overflows`` is ``True`` for fixed-point
types.

*
  "The result of an elementary function reference in
  overflow situations, when the ``Machine_Overflows`` attribute of the
  result type is ``False``.  See G.2.4(4)."

IEEE infinite and Nan values are produced as appropriate.

*
  "The value of the angle threshold, within which certain
  elementary functions, complex arithmetic operations, and complex
  elementary functions yield results conforming to a maximum relative
  error bound.  See G.2.4(10)."

Information on this subject is not yet available.

*
  "The accuracy of certain elementary functions for
  parameters beyond the angle threshold.  See G.2.4(10)."

Information on this subject is not yet available.

*
  "The result of a complex arithmetic operation or complex
  elementary function reference in overflow situations, when the
  ``Machine_Overflows`` attribute of the corresponding real type is
  ``False``.  See G.2.6(5)."

IEEE infinite and Nan values are produced as appropriate.

*
  "The accuracy of certain complex arithmetic operations and
  certain complex elementary functions for parameters (or components
  thereof) beyond the angle threshold.  See G.2.6(8)."

Information on those subjects is not yet available.

*
  "The accuracy requirements for the subprograms Solve, Inverse,
  Determinant, Eigenvalues and Eigensystem for type Real_Matrix.
  See G.3.1(81)."

Information on those subjects is not yet available.

*
  "The accuracy requirements for the subprograms Solve, Inverse,
  Determinant, Eigenvalues and Eigensystem for type Complex_Matrix.
  See G.3.2(149)."

Information on those subjects is not yet available.

*
  "The consequences of violating No_Hidden_Indirect_Globals.  See H.4(23.9)."

Execution is erroneous in that case.

---

### Gcc Ada Doc Gnat Rm Implementation Defined Pragmas (`gcc/ada/doc/gnat_rm/implementation_defined_pragmas.rst`)

.. role:: switch(samp)

.. _Implementation_Defined_Pragmas:

******************************
Implementation Defined Pragmas
******************************

Ada defines a set of pragmas that can be used to supply additional
information to the compiler.  These language defined pragmas are
implemented in GNAT and work as described in the Ada Reference Manual.

In addition, Ada allows implementations to define additional pragmas
whose meaning is defined by the implementation.  GNAT provides a number
of these implementation-defined pragmas, which can be used to extend
and enhance the functionality of the compiler.  This section of the GNAT
Reference Manual describes these additional pragmas.

Note that any program using these pragmas might not be portable to other
compilers (although GNAT implements this set of pragmas on all
platforms).  Therefore if portability to other compilers is an important
consideration, the use of these pragmas should be minimized.

Pragma Abort_Defer
==================

.. index:: Deferring aborts

Syntax:

.. code-block:: ada

  pragma Abort_Defer;


This pragma must appear at the start of the statement sequence of a
handled sequence of statements (right after the ``begin``).  It has
the effect of deferring aborts for the sequence of statements (but not
for the declarations or handlers, if any, associated with this statement
sequence). This can also be useful for adding a polling point in Ada code,
where asynchronous abort of tasks is checked when leaving the statement
sequence, and is lighter than, for example, using ``delay 0.0;``, since with
zero-cost exception handling, propagating exceptions (implicitly used to
implement task abort) cannot be done reliably in an asynchronous way.

An example of usage would be:

.. code-block:: ada

  --  Add a polling point to check for task aborts

  begin
  pragma Abort_Defer;
  end;

.. _Pragma-Abstract_State:

Pragma Abstract_State
=====================

Syntax:

.. code-block:: ada

  pragma Abstract_State (ABSTRACT_STATE_LIST);

  ABSTRACT_STATE_LIST ::=
    null
 |  STATE_NAME_WITH_OPTIONS
 | (STATE_NAME_WITH_OPTIONS {, STATE_NAME_WITH_OPTIONS} )

  STATE_NAME_WITH_OPTIONS ::=
    STATE_NAME
 | (STATE_NAME with OPTION_LIST)

  OPTION_LIST ::= OPTION {, OPTION}

  OPTION ::=
   SIMPLE_OPTION
 | NAME_VALUE_OPTION

  SIMPLE_OPTION ::= Ghost | Synchronous

  NAME_VALUE_OPTION ::=
   Part_Of => ABSTRACT_STATE
 | External [=> EXTERNAL_PROPERTY_LIST]

  EXTERNAL_PROPERTY_LIST ::=
    EXTERNAL_PROPERTY
 | (EXTERNAL_PROPERTY {, EXTERNAL_PROPERTY} )

  EXTERNAL_PROPERTY ::=
   Async_Readers    [=> static_boolean_EXPRESSION]
 | Async_Writers    [=> static_boolean_EXPRESSION]
 | Effective_Reads  [=> static_boolean_EXPRESSION]
 | Effective_Writes [=> static_boolean_EXPRESSION]
   others            => static_boolean_EXPRESSION

  STATE_NAME ::= defining_identifier

  ABSTRACT_STATE ::= name

For the semantics of this pragma, see the entry for aspect ``Abstract_State`` in
the SPARK 2014 Reference Manual, section 7.1.4.

Pragma Ada_83
=============

Syntax:

.. code-block:: ada

  pragma Ada_83;


A configuration pragma that establishes Ada 83 mode for the unit to
which it applies, regardless of the mode set by the command line
switches.  In Ada 83 mode, GNAT attempts to be as compatible with
the syntax and semantics of Ada 83, as defined in the original Ada
83 Reference Manual as possible.  In particular, the keywords added by Ada 95
and Ada 2005 are not recognized, optional package bodies are allowed,
and generics may name types with unknown discriminants without using
the ``(<>)`` notation.  In addition, some but not all of the additional
restrictions of Ada 83 are enforced.

Like all configuration pragmas, if the pragma is placed before a library
level package specification it is not propagated to the corresponding
package body (see RM 10.1.5(8)); it must be added explicitly to the
package body.

Ada 83 mode is intended for two purposes.  Firstly, it allows existing
Ada 83 code to be compiled and adapted to GNAT with less effort.
Secondly, it aids in keeping code backwards compatible with Ada 83.
However, there is no guarantee that code that is processed correctly
by GNAT in Ada 83 mode will in fact compile and execute with an Ada
83 compiler, since GNAT does not enforce all the additional checks
required by Ada 83.

Pragma Ada_95
=============

Syntax:

.. code-block:: ada

  pragma Ada_95;


A configuration pragma that establishes Ada 95 mode for the unit to which
it applies, regardless of the mode set by the command line switches.
This mode is set automatically for the ``Ada`` and ``System``
packages and their children, so you need not specify it in these
contexts.  This pragma is useful when writing a reusable component that
itself uses Ada 95 features, but which is intended to be usable from
either Ada 83 or Ada 95 programs.

Like all configuration pragmas, if the pragma is placed before a library
level package specification it is not propagated to the corresponding
package body (see RM 10.1.5(8)); it must be added explicitly to the
package body.

Pragma Ada_05
=============

Syntax:

.. code-block:: ada

  pragma Ada_05;
  pragma Ada_05 (local_NAME);


A configuration pragma that establishes Ada 2005 mode for the unit to which
it applies, regardless of the mode set by the command line switches.
This pragma is useful when writing a reusable component that
itself uses Ada 2005 features, but which is intended to be usable from
either Ada 83 or Ada 95 programs.

Like all configuration pragmas, if the pragma is placed before a library
level package specification it is not propagated to the corresponding
package body (see RM 10.1.5(8)); it must be added explicitly to the
package body.

The one argument form (which is not a configuration pragma)
is used for managing the transition from
Ada 95 to Ada 2005 in the run-time library. If an entity is marked
as Ada_2005 only, then referencing the entity in Ada_83 or Ada_95
mode will generate a warning. In addition, in Ada_83 or Ada_95
mode, a preference rule is established which does not choose
such an entity unless it is unambiguously specified. This avoids
extra subprograms marked this way from generating ambiguities in
otherwise legal pre-Ada_2005 programs. The one argument form is
intended for exclusive use in the GNAT run-time library.

Pragma Ada_2005
===============

Syntax:

.. code-block:: ada

  pragma Ada_2005;


This configuration pragma is a synonym for pragma Ada_05 and has the
same syntax and effect.

Pragma Ada_12
=============

Syntax:

.. code-block:: ada

  pragma Ada_12;
  pragma Ada_12 (local_NAME);


A configuration pragma that establishes Ada 2012 mode for the unit to which
it applies, regardless of the mode set by the command line switches.
This mode is set automatically for the ``Ada`` and ``System``
packages and their children, so you need not specify it in these
contexts.  This pragma is useful when writing a reusable component that
itself uses Ada 2012 features, but which is intended to be usable from
Ada 83, Ada 95, or Ada 2005 programs.

Like all configuration pragmas, if the pragma is placed before a library
level package specification it is not propagated to the corresponding
package body (see RM 10.1.5(8)); it must be added explicitly to the
package body.

The one argument form, which is not a configuration pragma,
is used for managing the transition from Ada
2005 to Ada 2012 in the run-time library. If an entity is marked
as Ada_2012 only, then referencing the entity in any pre-Ada_2012
mode will generate a warning. In addition, in any pre-Ada_2012
mode, a preference rule is established which does not choose
such an entity unless it is unambiguously specified. This avoids
extra subprograms marked this way from generating ambiguities in
otherwise legal pre-Ada_2012 programs. The one argument form is
intended for exclusive use in the GNAT run-time library.

Pragma Ada_2012
===============

Syntax:

.. code-block:: ada

  pragma Ada_2012;


This configuration pragma is a synonym for pragma Ada_12 and has the
same syntax and effect.

Pragma Ada_2022
===============

Syntax:

.. code-block:: ada

  pragma Ada_2022;
  pragma Ada_2022 (local_NAME);


A configuration pragma that establishes Ada 2022 mode for the unit to which
it applies, regardless of the mode set by the command line switches.
This mode is set automatically for the ``Ada`` and ``System``
packages and their children, so you need not specify it in these
contexts.  This pragma is useful when writing a reusable component that
itself uses Ada 2022 features, but which is intended to be usable from
Ada 83, Ada 95, Ada 2005 or Ada 2012 programs.

Like all configuration pragmas, if the pragma is placed before a library
level package specification it is not propagated to the corresponding
package body (see RM 10.1.5(8)); it must be added explicitly to the
package body.

The one argument form, which is not a configuration pragma,
is used for managing the transition from Ada
2012 to Ada 2022 in the run-time library. If an entity is marked
as Ada_2022 only, then referencing the entity in any pre-Ada_2022
mode will generate a warning. In addition, in any pre-Ada_2012
mode, a preference rule is established which does not choose
such an entity unless it is unambiguously specified. This avoids
extra subprograms marked this way from generating ambiguities in
otherwise legal pre-Ada_2022 programs. The one argument form is
intended for exclusive use in the GNAT run-time library.

Pragma Aggregate_Individually_Assign
====================================

Syntax:

.. code-block:: ada

  pragma Aggregate_Individually_Assign;

Where possible, GNAT will store the binary representation of a record aggregate
in memory for space and performance reasons. This configuration pragma changes
this behavior so that record aggregates are instead always converted into
individual assignment statements.


Pragma Allow_Integer_Address
============================

Syntax:

.. code-block:: ada

  pragma Allow_Integer_Address;


In almost all versions of GNAT, ``System.Address`` is a private
type in accordance with the implementation advice in the RM. This
means that integer values,
in particular integer literals, are not allowed as address values.
If the configuration pragma
``Allow_Integer_Address`` is given, then integer expressions may
be used anywhere a value of type ``System.Address`` is required.
The effect is to introduce an implicit unchecked conversion from the
integer value to type ``System.Address``. The reverse case of using
an address where an integer type is required is handled analogously.
The following example compiles without errors:


.. code-block:: ada

  pragma Allow_Integer_Address;
  with System; use System;
  package AddrAsInt is
  X : Integer;
  Y : Integer;
  for X'Address use 16#1240#;
  for Y use at 16#3230#;
  m : Address := 16#4000#;
  n : constant Address := 4000;
  p : constant Address := Address (X + Y);
  v : Integer := y'Address;
  w : constant Integer := Integer (Y'Address);
  type R is new integer;
  RR : R := 1000;
  Z : Integer;
  for Z'Address use RR;
  end AddrAsInt;


Note that pragma ``Allow_Integer_Address`` is ignored if ``System.Address``
is not a private type. In implementations of ``GNAT`` where
System.Address is a visible integer type,
this pragma serves no purpose but is ignored
rather than rejected to allow common sets of sources to be used
in the two situations.

.. _Pragma-Always_Terminates:

Pragma Always_Terminates
========================

Syntax:

.. code-block:: ada

  pragma Always_Terminates [ (boolean_EXPRESSION) ];

For the semantics of this pragma, see the entry for aspect ``Always_Terminates``
in the SPARK 2014 Reference Manual, section 6.1.11.

.. _Pragma-Annotate:

Pragma Annotate
===============

Syntax::

  pragma Annotate (IDENTIFIER [, IDENTIFIER {, ARG}] [, entity => local_NAME]);

  ARG ::= NAME | EXPRESSION


This pragma is used to annotate programs.  IDENTIFIER identifies
the type of annotation.  GNAT verifies that it is an identifier, but does
not otherwise analyze it. The second optional identifier is also left
unanalyzed, and by convention is used to control the action of the tool to
which the annotation is addressed.  The remaining ARG arguments
can be either string literals or more generally expressions.
String literals (and concatenations of string literals) are assumed to be
either of type
``Standard.String`` or else ``Wide_String`` or ``Wide_Wide_String``
depending on the character literals they contain.
All other kinds of arguments are analyzed as expressions, and must be
unambiguous. The last argument if present must have the identifier
``Entity`` and GNAT verifies that a local name is given.

The analyzed pragma is retained in the tree, but not otherwise processed
by any part of the GNAT compiler, except to generate corresponding note
lines in the generated ALI file. For the format of these note lines, see
the compiler source file lib-writ.ads. This pragma is intended for use by
external tools. The use of pragma Annotate does not affect the compilation
process in any way. This pragma may be used as a configuration pragma.

Pragma Assert
=============

Syntax::

  pragma Assert (
 boolean_EXPRESSION
 [, string_EXPRESSION]);


The effect of this pragma depends on whether the corresponding command
line switch is set to activate assertions.  The pragma expands into code
equivalent to the following:

.. code-block:: ada

  if assertions-enabled then
  if not boolean_EXPRESSION then
     System.Assertions.Raise_Assert_Failure
       (string_EXPRESSION);
  end if;
  end if;


The string argument, if given, is the message that will be associated
with the exception occurrence if the exception is raised.  If no second
argument is given, the default message is ``file``:``nnn``,
where ``file`` is the name of the source file containing the assert,
and ``nnn`` is the line number of the assert.

Note that, as with the ``if`` statement to which it is equivalent, the
type of the expression is either ``Standard.Boolean``, or any type derived
from this standard type.

Assert checks can be either checked or ignored. By default they are ignored.
They will be checked if either the command line switch *-gnata* is
used, or if an ``Assertion_Policy`` or ``Check_Policy`` pragma is used
to enable ``Assert_Checks``.

If assertions are ignored, then there
is no run-time effect (and in particular, any side effects from the
expression will not occur at run time).  (The expression is still
analyzed at compile time, and may cause types to be frozen if they are
mentioned here for the first time).

If assertions are checked, then the given expression is tested, and if
it is ``False`` then ``System.Assertions.Raise_Assert_Failure`` is called
which results in the raising of ``Assert_Failure`` with the given message.

You should generally avoid side effects in the expression arguments of
this pragma, because these side effects will turn on and off with the
setting of the assertions mode, resulting in assertions that have an
effect on the program.  However, the expressions are analyzed for
semantic correctness whether or not assertions are enabled, so turning
assertions on and off cannot affect the legality of a program.

Note that the implementation defined policy ``DISABLE``, given in a
pragma ``Assertion_Policy``, can be used to suppress this semantic analysis.

Note: this is a standard language-defined pragma in versions
of Ada from 2005 on. In GNAT, it is implemented in all versions
of Ada, and the DISABLE policy is an implementation-defined
addition.

This is an assertion kind pragma that can associate a set of its arguments
with an assertion level. See SPARK 2014 Reference Manual, section
11.4.2.

Pragma Assert_And_Cut
=====================

Syntax::

  pragma Assert_And_Cut (
 boolean_EXPRESSION
 [, string_EXPRESSION]);


The effect of this pragma is identical to that of pragma ``Assert``,
except that in an ``Assertion_Policy`` pragma, the identifier
``Assert_And_Cut`` is used to control whether it is ignored or checked
(or disabled).

The intention is that this be used within a subprogram when the
given test expression sums up all the work done so far in the
subprogram, so that the rest of the subprogram can be verified
(informally or formally) using only the entry preconditions,
and the expression in this pragma. This allows dividing up
a subprogram into sections for the purposes of testing or
formal verification. The pragma also serves as useful
documentation.

This is an assertion kind pragma that can associate a set of its arguments
with an assertion level. See SPARK 2014 Reference Manual, section
11.4.2.

Pragma Assertion_Level
=======================

Syntax::

  pragma Assertion_Level (LEVEL_IDENTIFIER
                       [, depends => DEPENDENCY_DESCRIPTOR]);

  DEPENDENCY_DESCRIPTOR ::= LEVEL_IDENTIFIER | LEVEL_IDENTIFIER_LIST

  LEVEL_IDENTIFIER_LIST ::= '[' LEVEL_IDENTIFIER {, LEVEL_IDENTIFIER} ']'

For the semantics of this pragma, see the SPARK 2014 Reference Manual,
section 11.4.3.

Pragma Assertion_Policy
=======================

Syntax::

  pragma Assertion_Policy (CHECK | DISABLE | IGNORE | SUPPRESSIBLE);

  pragma Assertion_Policy (
   ASSERTION_KIND => POLICY_IDENTIFIER
{, ASSERTION_KIND => POLICY_IDENTIFIER});

  ASSERTION_KIND ::= RM_ASSERTION_KIND | ID_ASSERTION_KIND | ASSERTION_LEVEL

  RM_ASSERTION_KIND ::= Assert                    |
                     Static_Predicate          |
                     Dynamic_Predicate         |
                     Pre                       |
                     Pre'Class                 |
                     Post                      |
                     Post'Class                |
                     Type_Invariant            |
                     Type_Invariant'Class      |
                     Default_Initial_Condition

  ID_ASSERTION_KIND ::= Assertions           |
                     Assert_And_Cut       |
                     Assume               |
                     Contract_Cases       |
                     Debug                |
                     Ghost                |
                     Initial_Condition    |
                     Invariant            |
                     Invariant'Class      |
                     Loop_Invariant       |
                     Loop_Variant         |
                     Postcondition        |
                     Precondition         |
                     Predicate            |
                     Refined_Post         |
                     Statement_Assertions |
                     Subprogram_Variant

  POLICY_IDENTIFIER ::= Check | Disable | Ignore | Suppressible


This is a standard Ada 2012 pragma that is available as an
implementation-defined pragma in earlier versions of Ada.
The assertion kinds ``RM_ASSERTION_KIND`` are those defined in
the Ada standard. The assertion kinds ``ID_ASSERTION_KIND``
are implementation defined additions recognized by the GNAT compiler.

Additionally the pragma can apply to an assertion level defined by the
``Assertion_Level`` pragma. For more details see the SPARK 2014 Reference
Manual, section 11.4.2.

The pragma applies in both cases to pragmas and aspects with matching
names, e.g. ``Pre`` applies to the Pre aspect, and ``Precondition``
applies to both the ``Precondition`` pragma
and the aspect ``Precondition``. Note that the identifiers for
pragmas Pre_Class and Post_Class are Pre'Class and Post'Class (not
Pre_Class and Post_Class), since these pragmas are intended to be
identical to the corresponding aspects.

If the policy is ``CHECK``, then assertions are enabled, i.e.
the corresponding pragma or aspect is activated.
If the policy is ``IGNORE``, then assertions are ignored, i.e.
the corresponding pragma or aspect is deactivated.
This pragma overrides the effect of the *-gnata* switch on the
command line.
If the policy is ``SUPPRESSIBLE``, then assertions are enabled by default,
however, if the *-gnatp* switch is specified all assertions are ignored.

The implementation defined policy ``DISABLE`` is like
``IGNORE`` except that it completely disables semantic
checking of the corresponding pragma or aspect. This is
useful when the pragma or aspect argument references subprograms
in a with'ed package which is replaced by a dummy package
for the final build.

The implementation defined assertion kind ``Assertions`` applies to all
assertion kinds. The form with no assertion kind given implies this
choice, so it applies to all assertion kinds (RM defined, and
implementation defined).

The implementation defined assertion kind ``Statement_Assertions``
applies to ``Assert``, ``Assert_And_Cut``,
``Assume``, ``Loop_Invariant``, and ``Loop_Variant``.

Pragma Assume
=============

Syntax:

::

  pragma Assume (
 boolean_EXPRESSION
 [, string_EXPRESSION]);


The effect of this pragma is identical to that of pragma ``Assert``,
except that in an ``Assertion_Policy`` pragma, the identifier
``Assume`` is used to control whether it is ignored or checked
(or disabled).

The intention is that this be used for assumptions about the
external environment. So you cannot expect to verify formally
or informally that the condition is met, this must be
established by examining things outside the program itself.
For example, we may have code that depends on the size of
``Long_Long_Integer`` being at least 64. So we could write:

.. code-block:: ada

  pragma Assume (Long_Long_Integer'Size >= 64);


This assumption cannot be proved from the program itself,
but it acts as a useful run-time check that the assumption
is met, and documents the need to ensure that it is met by
reference to information outside the program.

This is an assertion kind pragma that can associate a set of its arguments
with an assertion level. See SPARK 2014 Reference Manual, section
11.4.2.

Pragma Assume_No_Invalid_Values
===============================
.. index:: Invalid representations

.. index:: Invalid values

Syntax:

.. code-block:: ada

  pragma Assume_No_Invalid_Values (On | Off);


This is a configuration pragma that controls the assumptions made by the
compiler about the occurrence of invalid representations (invalid values)
in the code.

The default behavior (corresponding to an Off argument for this pragma), is
to assume that values may in general be invalid unless the compiler can
prove they are valid. Consider the following example:

.. code-block:: ada

  V1 : Integer range 1 .. 10;
  V2 : Integer range 11 .. 20;
  ...
  for J in V2 .. V1 loop
  ...
  end loop;


if V1 and V2 have valid values, then the loop is known at compile
time not to execute since the lower bound must be greater than the
upper bound. However in default mode, no such assumption is made,
and the loop may execute. If ``Assume_No_Invalid_Values (On)``
is given, the compiler will assume that any occurrence of a variable
other than in an explicit ``'Valid`` test always has a valid
value, and the loop above will be optimized away.

The use of ``Assume_No_Invalid_Values (On)`` is appropriate if
you know your code is free of uninitialized variables and other
possible sources of invalid representations, and may result in
more efficient code. A program that accesses an invalid representation
with this pragma in effect is erroneous, so no guarantees can be made
about its behavior.

It is peculiar though permissible to use this pragma in conjunction
with validity checking (-gnatVa). In such cases, accessing invalid
values will generally give an exception, though formally the program
is erroneous so there are no guarantees that this will always be the
case, and it is recommended that these two options not be used together.

.. _Pragma-Async_Readers:

Pragma Async_Readers
====================

Syntax:

.. code-block:: ada

  pragma Async_Readers [ (static_boolean_EXPRESSION) ];

For the semantics of this pragma, see the entry for aspect ``Async_Readers`` in
the SPARK 2014 Reference Manual, section 7.1.2.

.. _Pragma-Async_Writers:

Pragma Async_Writers
====================

Syntax:

.. code-block:: ada

  pragma Async_Writers [ (static_boolean_EXPRESSION) ];

For the semantics of this pragma, see the entry for aspect ``Async_Writers`` in
the SPARK 2014 Reference Manual, section 7.1.2.

Pragma Attribute_Definition
===========================

Syntax:

::

  pragma Attribute_Definition
 ([Attribute  =>] ATTRIBUTE_DESIGNATOR,
  [Entity     =>] LOCAL_NAME,
  [Expression =>] EXPRESSION | NAME);


If ``Attribute`` is a known attribute name, this pragma is equivalent to
the attribute definition clause:


.. code-block:: ada

 for Entity'Attribute use Expression;


If ``Attribute`` is not a recognized attribute name, the pragma is
ignored, and a warning is emitted. This allows source
code to be written that takes advantage of some new attribute, while remaining
compilable with earlier compilers.

Pragma C_Pass_By_Copy
=====================
.. index:: Passing by copy


Syntax:

::

  pragma C_Pass_By_Copy
 ([Max_Size =>] static_integer_EXPRESSION);


Normally the default mechanism for passing C convention records to C
convention subprograms is to pass them by reference, as suggested by RM
B.3(69).  Use the configuration pragma ``C_Pass_By_Copy`` to change
this default, by requiring that record formal parameters be passed by
copy if all of the following conditions are met:

*
  The size of the record type does not exceed the value specified for
  ``Max_Size``.
*
  The record type has ``Convention C``.
*
  The formal parameter has this record type, and the subprogram has a
  foreign (non-Ada) convention.

If these conditions are met the argument is passed by copy; i.e., in a
manner consistent with what C expects if the corresponding formal in the
C prototype is a struct (rather than a pointer to a struct).

You can also pass records by copy by specifying the convention
``C_Pass_By_Copy`` for the record type, or by using the extended
``Import`` and ``Export`` pragmas, which allow specification of
passing mechanisms on a parameter by parameter basis.

Pragma Check
============
.. index:: Assertions

.. index:: Named assertions


Syntax:

::

  pragma Check (
    [Name    =>] CHECK_KIND,
    [Check   =>] Boolean_EXPRESSION
 [, [Message =>] string_EXPRESSION] );

  CHECK_KIND ::= IDENTIFIER           |
              Pre'Class            |
              Post'Class           |
              Type_Invariant'Class |
              Invariant'Class


This pragma is similar to the predefined pragma ``Assert`` except that an
extra identifier argument is present. In conjunction with pragma
``Check_Policy``, this can be used to define groups of assertions that can
be independently controlled. The identifier ``Assertion`` is special, it
refers to the normal set of pragma ``Assert`` statements.

Checks introduced by this pragma are normally deactivated by default. They can
be activated either by the command line option *-gnata*, which turns on
all checks, or individually controlled using pragma ``Check_Policy``.

The identifiers ``Assertions`` and ``Statement_Assertions`` are not
permitted as check kinds, since this would cause confusion with the use
of these identifiers in ``Assertion_Policy`` and ``Check_Policy``
pragmas, where they are used to refer to sets of assertions.

Pragma Check_Float_Overflow
===========================
.. index:: Floating-point overflow


Syntax:

.. code-block:: ada

  pragma Check_Float_Overflow;


In Ada, the predefined floating-point types (``Short_Float``,
``Float``, ``Long_Float``, ``Long_Long_Float``) are
defined to be *unconstrained*. This means that even though each
has a well-defined base range, an operation that delivers a result
outside this base range is not required to raise an exception.
This implementation permission accommodates the notion
of infinities in IEEE floating-point, and corresponds to the
efficient execution mode on most machines. GNAT will not raise
overflow exceptions on these machines; instead it will generate
infinities and NaN's as defined in the IEEE standard.

Generating infinities, although efficient, is not always desirable.
Often the preferable approach is to check for overflow, even at the
(perhaps considerable) expense of run-time performance.
This can be accomplished by defining your own constrained floating-point subtypes -- i.e., by supplying explicit
range constraints -- and indeed such a subtype
can have the same base range as its base type. For example:


.. code-block:: ada

  subtype My_Float is Float range Float'Range;


Here ``My_Float`` has the same range as
``Float`` but is constrained, so operations on
``My_Float`` values will be checked for overflow
against this range.

This style will achieve the desired goal, but
it is often more convenient to be able to simply use
the standard predefined floating-point types as long
as overflow checking could be guaranteed.
The ``Check_Float_Overflow``
configuration pragma achieves this effect. If a unit is compiled
subject to this configuration pragma, then all operations
on predefined floating-point types including operations on
base types of these floating-point types will be treated as
though those types were constrained, and overflow checks
will be generated. The ``Constraint_Error``
exception is raised if the result is out of range.

This mode can also be set by use of the compiler
switch *-gnateF*.

Pragma Check_Name
=================
.. index:: Defining check names

.. index:: Check names, defining


Syntax:

.. code-block:: ada

  pragma Check_Name (check_name_IDENTIFIER);


This is a configuration pragma that defines a new implementation
defined check name (unless IDENTIFIER matches one of the predefined
check names, in which case the pragma has no effect). Check names
are global to a partition, so if two or more configuration pragmas
are present in a partition mentioning the same name, only one new
check name is introduced.

An implementation defined check name introduced with this pragma may
be used in only three contexts: ``pragma Suppress``,
``pragma Unsuppress``,
and as the prefix of a ``Check_Name'Enabled`` attribute reference. For
any of these three cases, the check name must be visible. A check
name is visible if it is in the configuration pragmas applying to
the current unit, or if it appears at the start of any unit that
is part of the dependency set of the current unit (e.g., units that
are mentioned in ``with`` clauses).

Check names introduced by this pragma are subject to control by compiler
switches (in particular -gnatp) in the usual manner.

Pragma Check_Policy
===================
.. index:: Controlling assertions

.. index:: Assertions, control

.. index:: Check pragma control

.. index:: Named assertions


Syntax:

::

  pragma Check_Policy
([Name   =>] CHECK_KIND,
 [Policy =>] POLICY_IDENTIFIER);

  pragma Check_Policy (
   CHECK_KIND => POLICY_IDENTIFIER
{, CHECK_KIND => POLICY_IDENTIFIER});

  ASSERTION_KIND ::= RM_ASSERTION_KIND | ID_ASSERTION_KIND

  CHECK_KIND ::= IDENTIFIER           |
              Pre'Class            |
              Post'Class           |
              Type_Invariant'Class |
              Invariant'Class

  The identifiers Name and Policy are not allowed as CHECK_KIND values. This
  avoids confusion between the two possible syntax forms for this pragma.

  POLICY_IDENTIFIER ::= ON | OFF | CHECK | DISABLE | IGNORE


This pragma is used to set the checking policy for assertions (specified
by aspects or pragmas), the ``Debug`` pragma, or additional checks
to be checked using the ``Check`` pragma. It may appear either as
a configuration pragma, or within a declarative part of package. In the
latter case, it applies from the point where it appears to the end of
the declarative region (like pragma ``Suppress``).

The ``Check_Policy`` pragma is similar to the
predefined ``Assertion_Policy`` pragma,
and if the check kind corresponds to one of the assertion kinds that
are allowed by ``Assertion_Policy``, then the effect is identical.

If the first argument is Debug, then the policy applies to Debug pragmas,
disabling their effect if the policy is ``OFF``, ``DISABLE``, or
``IGNORE``, and allowing them to execute with normal semantics if
the policy is ``ON`` or ``CHECK``. In addition if the policy is
``DISABLE``, then the procedure call in ``Debug`` pragmas will
be totally ignored and not analyzed semantically.

Finally the first argument may be some other identifier than the above
possibilities, in which case it controls a set of named assertions
that can be checked using pragma ``Check``. For example, if the pragma:


.. code-block:: ada

  pragma Check_Policy (Critical_Error, OFF);


is given, then subsequent ``Check`` pragmas whose first argument is also
``Critical_Error`` will be disabled.

The check policy is ``OFF`` to turn off corresponding checks, and ``ON``
to turn on corresponding checks. The default for a set of checks for which no
``Check_Policy`` is given is ``OFF`` unless the compiler switch
*-gnata* is given, which turns on all checks by default.

The check policy settings ``CHECK`` and ``IGNORE`` are recognized
as synonyms for ``ON`` and ``OFF``. These synonyms are provided for
compatibility with the standard ``Assertion_Policy`` pragma. The check
policy setting ``DISABLE`` causes the second argument of a corresponding
``Check`` pragma to be completely ignored and not analyzed.

Pragma Comment
==============

Syntax:


.. code-block:: ada

  pragma Comment (static_string_EXPRESSION);


This is almost identical in effect to pragma ``Ident``.  It allows the
placement of a comment into the object file and hence into the
executable file if the operating system permits such usage.  The
difference is that ``Comment``, unlike ``Ident``, has
no limitations on placement of the pragma (it can be placed
anywhere in the main source unit), and if more than one pragma
is used, all comments are retained.

Pragma Common_Object
====================

Syntax:


::

  pragma Common_Object (
    [Internal =>] LOCAL_NAME
 [, [External =>] EXTERNAL_SYMBOL]
 [, [Size     =>] EXTERNAL_SYMBOL] );

  EXTERNAL_SYMBOL ::=
 IDENTIFIER
  | static_string_EXPRESSION


This pragma enables the shared use of variables stored in overlaid
linker areas corresponding to the use of ``COMMON``
in Fortran.  The single
object ``LOCAL_NAME`` is assigned to the area designated by
the ``External`` argument.
You may define a record to correspond to a series
of fields.  The ``Size`` argument
is syntax checked in GNAT, but otherwise ignored.

``Common_Object`` is not supported on all platforms.  If no
support is available, then the code generator will issue a message
indicating that the necessary attribute for implementation of this
pragma is not available.

.. _Compile_Time_Error:

Pragma Compile_Time_Error
=========================

Syntax:


.. code-block:: ada

  pragma Compile_Time_Error
        (boolean_EXPRESSION, static_string_EXPRESSION);


This pragma can be used to generate additional compile time
error messages. It
is particularly useful in generics, where errors can be issued for
specific problematic instantiations. The first parameter is a boolean
expression. The pragma ensures that the value of an expression
is known at compile time, and has the value False. The set of expressions
whose values are known at compile time includes all static boolean
expressions, and also other values which the compiler can determine
at compile time (e.g., the size of a record type set by an explicit
size representation clause, or the value of a variable which was
initialized to a constant and is known not to have been modified).
If these conditions are not met, an error message is generated using
the value given as the second argument. This string value may contain
embedded ASCII.LF characters to break the message into multiple lines.

Pragma Compile_Time_Warning
===========================

Syntax:


.. code-block:: ada

  pragma Compile_Time_Warning
        (boolean_EXPRESSION, static_string_EXPRESSION);


Same as pragma Compile_Time_Error, except a warning is issued instead
of an error message. If switch *-gnatw_C* is used, a warning is only issued
if the value of the expression is known to be True at compile time, not when
the value of the expression is not known at compile time.
Note that if this pragma is used in a package that
is with'ed by a client, the client will get the warning even though it
is issued by a with'ed package (normally warnings in with'ed units are
suppressed, but this is a special exception to that rule).

One typical use is within a generic where compile time known characteristics
of formal parameters are tested, and warnings given appropriately. Another use
with a first parameter of True is to warn a client about use of a package,
for example that it is not fully implemented.

In previous versions of the compiler, combining *-gnatwe* with
Compile_Time_Warning resulted in a fatal error. Now the compiler always emits
a warning. You can use :ref:`Compile_Time_Error` to force the generation of
an error.

Pragma Complete_Representation
==============================

Syntax:


.. code-block:: ada

  pragma Complete_Representation;


This pragma must appear immediately within a record representation
clause. Typical placements are before the first component clause
or after the last component clause. The effect is to give an error
message if any component is missing a component clause. This pragma
may be used to ensure that a record representation clause is
complete, and that this invariant is maintained if fields are
added to the record in the future.

Pragma Complex_Representation
=============================

Syntax:


::

  pragma Complex_Representation
       ([Entity =>] LOCAL_NAME);


The ``Entity`` argument must be the name of a record type which has
two fields of the same floating-point type.  The effect of this pragma is
to force gcc to use the special internal complex representation form for
this record, which may be more efficient.  Note that this may result in
the code for this type not conforming to standard ABI (application
binary interface) requirements for the handling of record types.  For
example, in some environments, there is a requirement for passing
records by pointer, and the use of this pragma may result in passing
this type in floating-point registers.

Pragma Component_Alignment
==========================
.. index:: Alignments of components
.. index:: Pragma Component_Alignment


Syntax:

::

  pragma Component_Alignment (
    [Form =>] ALIGNMENT_CHOICE
 [, [Name =>] type_LOCAL_NAME]);

  ALIGNMENT_CHOICE ::=
 Component_Size
  | Component_Size_4
  | Storage_Unit
  | Default


Specifies the alignment of components in array or record types.
The meaning of the ``Form`` argument is as follows:


  .. index:: Component_Size (in pragma Component_Alignment)

*Component_Size*
  Aligns scalar components and subcomponents of the array or record type
  on boundaries appropriate to their inherent size (naturally
  aligned).  For example, 1-byte components are aligned on byte boundaries,
  2-byte integer components are aligned on 2-byte boundaries, 4-byte
  integer components are aligned on 4-byte boundaries and so on.  These
  alignment rules correspond to the normal rules for C compilers on all
  machines except the VAX.

  .. index:: Component_Size_4 (in pragma Component_Alignment)

*Component_Size_4*
  Naturally aligns components with a size of four or fewer
  bytes.  Components that are larger than 4 bytes are placed on the next
  4-byte boundary.

  .. index:: Storage_Unit (in pragma Component_Alignment)

*Storage_Unit*
  Specifies that array or record components are byte aligned, i.e.,
  aligned on boundaries determined by the value of the constant
  ``System.Storage_Unit``.

  .. index:: Default (in pragma Component_Alignment)

*Default*
  Specifies that array or record components are aligned on default
  boundaries, appropriate to the underlying hardware or operating system or
  both. The ``Default`` choice is the same as ``Component_Size`` (natural
  alignment).

If the ``Name`` parameter is present, ``type_LOCAL_NAME`` must
refer to a local record or array type, and the specified alignment
choice applies to the specified type.  The use of
``Component_Alignment`` together with a pragma ``Pack`` causes the
``Component_Alignment`` pragma to be ignored.  The use of
``Component_Alignment`` together with a record representation clause
is only effective for fields not specified by the representation clause.

If the ``Name`` parameter is absent, the pragma can be used as either
a configuration pragma, in which case it applies to one or more units in
accordance with the normal rules for configuration pragmas, or it can be
used within a declarative part, in which case it applies to types that
are declared within this declarative part, or within any nested scope
within this declarative part.  In either case it specifies the alignment
to be applied to any record or array type which has otherwise standard
representation.

If the alignment for a record or array type is not specified (using
pragma ``Pack``, pragma ``Component_Alignment``, or a record rep
clause), the GNAT uses the default alignment as described previously.

.. _Pragma-Constant_After_Elaboration:

Pragma Constant_After_Elaboration
=================================

Syntax:

.. code-block:: ada

  pragma Constant_After_Elaboration [ (static_boolean_EXPRESSION) ];

For the semantics of this pragma, see the entry for aspect
``Constant_After_Elaboration`` in the SPARK 2014 Reference Manual, section 3.3.1.

.. _Pragma-Contract_Cases:

Pragma Contract_Cases
=====================
.. index:: Contract cases

Syntax:

.. code-block:: ada

  pragma Contract_Cases (CONTRACT_CASE {, CONTRACT_CASE});

  CONTRACT_CASE ::= CASE_GUARD => CONSEQUENCE

  CASE_GUARD ::= boolean_EXPRESSION | others

  CONSEQUENCE ::= boolean_EXPRESSION

The ``Contract_Cases`` pragma allows defining fine-grain specifications
that can complement or replace the contract given by a precondition and a
postcondition. Additionally, the ``Contract_Cases`` pragma can be used
by testing and formal verification tools. The compiler checks its validity and,
depending on the assertion policy at the point of declaration of the pragma,
it may insert a check in the executable. For code generation, the contract
cases


.. code-block:: ada

  pragma Contract_Cases (
 Cond1 => Pred1,
 Cond2 => Pred2);


are equivalent to


.. code-block:: ada

  C1 : constant Boolean := Cond1;  --  evaluated at subprogram entry
  C2 : constant Boolean := Cond2;  --  evaluated at subprogram entry
  pragma Precondition ((C1 and not C2) or (C2 and not C1));
  pragma Postcondition (if C1 then Pred1);
  pragma Postcondition (if C2 then Pred2);


The precondition ensures that one and only one of the case guards is
satisfied on entry to the subprogram.
The postcondition ensures that for the case guard that was True on entry,
the corresponding consequence is True on exit. Other consequence expressions
are not evaluated.

A precondition ``P`` and postcondition ``Q`` can also be
expressed as contract cases:

.. code-block:: ada

  pragma Contract_Cases (P => Q);


The placement and visibility rules for ``Contract_Cases`` pragmas are
identical to those described for preconditions and postconditions.

The compiler checks that boolean expressions given in case guards and
consequences are valid, where the rules for case guards are the same as
the rule for an expression in ``Precondition`` and the rules for
consequences are the same as the rule for an expression in
``Postcondition``. In particular, attributes ``'Old`` and
``'Result`` can only be used within consequence expressions.
The case guard for the last contract case may be ``others``, to denote
any case not captured by the previous cases. The
following is an example of use within a package spec:


.. code-block:: ada

  package Math_Functions is
  ...
  function Sqrt (Arg : Float) return Float;
  pragma Contract_Cases (((Arg in 0.0 .. 99.0) => Sqrt'Result < 10.0,
                          Arg >= 100.0         => Sqrt'Result >= 10.0,
                          others               => Sqrt'Result = 0.0));
  ...
  end Math_Functions;


The meaning of contract cases is that only one case should apply at each
call, as determined by the corresponding case guard evaluating to True,
and that the consequence for this case should hold when the subprogram
returns.

This is an assertion kind pragma that can associate a set of its arguments
with an assertion level. See SPARK 2014 Reference Manual, section
11.4.2.

Pragma Convention_Identifier
============================
.. index:: Conventions, synonyms

Syntax:


::

  pragma Convention_Identifier (
        [Name =>]       IDENTIFIER,
        [Convention =>] convention_IDENTIFIER);


This pragma provides a mechanism for supplying synonyms for existing
convention identifiers. The ``Name`` identifier can subsequently
be used as a synonym for the given convention in other pragmas (including
for example pragma ``Import`` or another ``Convention_Identifier``
pragma). As an example of the use of this, suppose you had legacy code
which used Fortran77 as the identifier for Fortran. Then the pragma:


.. code-block:: ada

  pragma Convention_Identifier (Fortran77, Fortran);


would allow the use of the convention identifier ``Fortran77`` in
subsequent code, avoiding the need to modify the sources. As another
example, you could use this to parameterize convention requirements
according to systems. Suppose you needed to use ``Stdcall`` on
windows systems, and ``C`` on some other system, then you could
define a convention identifier ``Library`` and use a single
``Convention_Identifier`` pragma to specify which convention
would be used system-wide.

Pragma CPP_Class
================
.. index:: Interfacing with C++

Syntax:


::

  pragma CPP_Class ([Entity =>] LOCAL_NAME);


The argument denotes an entity in the current declarative region that is
declared as a record type. It indicates that the type corresponds to an
externally declared C++ class type, and is to be laid out the same way
that C++ would lay out the type. If the C++ class has virtual primitives
then the record must be declared as a tagged record type.

Types for which ``CPP_Class`` is specified do not have assignment or
equality operators defined (such operations can be imported or declared
as subprograms as required). Initialization is allowed only by constructor
functions (see pragma ``CPP_Constructor``). Such types are implicitly
limited if not explicitly declared as limited or derived from a limited
type, and an error is issued in that case.

See :ref:`Interfacing_to_C++` for related information.

Note: Pragma ``CPP_Class`` is currently obsolete. It is supported
for backward compatibility but its functionality is available
using pragma ``Import`` with ``Convention`` = ``CPP``.

Pragma CPP_Constructor
======================
.. index:: Interfacing with C++


Syntax:


::

  pragma CPP_Constructor ([Entity =>] LOCAL_NAME
 [, [External_Name =>] static_string_EXPRESSION ]
 [, [Link_Name     =>] static_string_EXPRESSION ]);


This pragma identifies an imported function (imported in the usual way
with pragma ``Import``) as corresponding to a C++ constructor. If
``External_Name`` and ``Link_Name`` are not specified then the
``Entity`` argument is a name that must have been previously mentioned
in a pragma ``Import`` with ``Convention`` = ``CPP``. Such name
must be of one of the following forms:

*
  **function** ``Fname`` **return** T`

*
  **function** ``Fname`` **return** T'Class

*
  **function** ``Fname`` (...) **return** T`

*
  **function** ``Fname`` (...) **return** T'Class

where ``T`` is a limited record type imported from C++ with pragma
``Import`` and ``Convention`` = ``CPP``.

The first two forms import the default constructor, used when an object
of type ``T`` is created on the Ada side with no explicit constructor.
The latter two forms cover all the non-default constructors of the type.
See the GNAT User's Guide for details.

If no constructors are imported, it is impossible to create any objects
on the Ada side and the type is implicitly declared abstract.

Pragma ``CPP_Constructor`` is intended primarily for automatic generation
using an automatic binding generator tool (such as the :switch:`-fdump-ada-spec`
GCC switch).
See :ref:`Interfacing_to_C++` for more related information.

Note: The use of functions returning class-wide types for constructors is
currently obsolete. They are supported for backward compatibility. The
use of functions returning the type T leave the Ada sources more clear
because the imported C++ constructors always return an object of type T;
that is, they never return an object whose type is a descendant of type T.

Pragma CPP_Virtual
==================
.. index:: Interfacing to C++


This pragma is now obsolete and, other than generating a warning if warnings
on obsolescent features are enabled, is completely ignored.
It is retained for compatibility
purposes. It used to be required to ensure compatibility with C++, but
is no longer required for that purpose because GNAT generates
the same object layout as the G++ compiler by default.

See :ref:`Interfacing_to_C++` for related information.

Pragma CPP_Vtable
=================
.. index:: Interfacing with C++


This pragma is now obsolete and, other than generating a warning if warnings
on obsolescent features are enabled, is completely ignored.
It used to be required to ensure compatibility with C++, but
is no longer required for that purpose because GNAT generates
the same object layout as the G++ compiler by default.

See :ref:`Interfacing_to_C++` for related information.

Pragma CPU
==========

Syntax:


.. code-block:: ada

  pragma CPU (EXPRESSION);


This pragma is standard in Ada 2012, but is available in all earlier
versions of Ada as an implementation-defined pragma.
See Ada 2012 Reference Manual for details.

Pragma Deadline_Floor
=====================

Syntax:


.. code-block:: ada

  pragma Deadline_Floor (time_span_EXPRESSION);


This pragma applies only to protected types and specifies the floor
deadline inherited by a task when the task enters a protected object.
It is effective only when the EDF scheduling policy is used.

Pragma Debug
============

Syntax:


::

  pragma Debug ([CONDITION, ]PROCEDURE_CALL_WITHOUT_SEMICOLON);

  PROCEDURE_CALL_WITHOUT_SEMICOLON ::=
 PROCEDURE_NAME
  | PROCEDURE_PREFIX ACTUAL_PARAMETER_PART


The procedure call argument has the syntactic form of an expression, meeting
the syntactic requirements for pragmas.

If debug pragmas are not enabled or if the condition is present and evaluates
to False, this pragma has no effect. If debug pragmas are enabled, the
semantics of the pragma is exactly equivalent to the procedure call statement
corresponding to the argument with a terminating semicolon. Pragmas are
permitted in sequences of declarations, so you can use pragma ``Debug`` to
intersperse calls to debug procedures in the middle of declarations. Debug
pragmas can be enabled either by use of the command line switch *-gnata*
or by use of the pragma ``Check_Policy`` with a first argument of
``Debug``.

This is an assertion kind pragma that can associate a set of its arguments
with an assertion level. See SPARK 2014 Reference Manual, section
11.4.2.

Pragma Debug_Policy
===================

Syntax:


.. code-block:: ada

  pragma Debug_Policy (CHECK | DISABLE | IGNORE | ON | OFF);


This pragma is equivalent to a corresponding ``Check_Policy`` pragma
with a first argument of ``Debug``. It is retained for historical
compatibility reasons.

.. _Pragma-Default_Initial_Condition:

Pragma Default_Initial_Condition
================================

Syntax:

.. code-block:: ada

  pragma Default_Initial_Condition [ (null | boolean_EXPRESSION) ];

For the semantics of this pragma, see the entry for aspect
``Default_Initial_Condition`` in the SPARK 2014 Reference Manual, section 7.3.3.

This is an assertion kind pragma that can associate a set of its arguments
with an assertion level. See SPARK 2014 Reference Manual, section
11.4.2.

Pragma Default_Scalar_Storage_Order
===================================
.. index:: Default_Scalar_Storage_Order

.. index:: Scalar_Storage_Order


Syntax:


.. code-block:: ada

  pragma Default_Scalar_Storage_Order (High_Order_First | Low_Order_First);


Normally if no explicit ``Scalar_Storage_Order`` is given for a record
type or array type, then the scalar storage order defaults to the ordinary
default for the target. But this default may be overridden using this pragma.
The pragma may appear as a configuration pragma, or locally within a package
spec or declarative part. In the latter case, it applies to all subsequent
types declared within that package spec or declarative part.

The following example shows the use of this pragma:


.. code-block:: ada

  pragma Default_Scalar_Storage_Order (High_Order_First);
  with System; use System;
  package DSSO1 is
  type H1 is record
     a : Integer;
  end record;

  type L2 is record
     a : Integer;
  end record;
  for L2'Scalar_Storage_Order use Low_Order_First;

  type L2a is new L2;

  package Inner is
     type H3 is record
        a : Integer;
     end record;

     pragma Default_Scalar_Storage_Order (Low_Order_First);

     type L4 is record
        a : Integer;
     end record;
  end Inner;

  type H4a is new Inner.L4;

  type H5 is record
     a : Integer;
  end record;
  end DSSO1;


In this example record types with names starting with *L* have `Low_Order_First` scalar
storage order, and record types with names starting with *H* have ``High_Order_First``.
Note that in the case of ``H4a``, the order is not inherited
from the parent type. Only an explicitly set ``Scalar_Storage_Order``
gets inherited on type derivation.

If this pragma is used as a configuration pragma which appears within a
configuration pragma file (as opposed to appearing explicitly at the start
of a single unit), then the binder will require that all units in a partition
be compiled in a similar manner, other than run-time units, which are not
affected by this pragma. Note that the use of this form is discouraged because
it may significantly degrade the run-time performance of the software, instead
the default scalar storage order ought to be changed only on a local basis.

Pragma Default_Storage_Pool
===========================
.. index:: Default_Storage_Pool


Syntax:


.. code-block:: ada

  pragma Default_Storage_Pool (storage_pool_NAME | null);


This pragma is standard in Ada 2012, but is available in all earlier
versions of Ada as an implementation-defined pragma.
See Ada 2012 Reference Manual for details.

.. _Pragma-Depends:

Pragma Depends
==============

Syntax:

.. code-block:: ada

  pragma Depends (DEPENDENCY_RELATION);

  DEPENDENCY_RELATION ::=
    null
 | (DEPENDENCY_CLAUSE {, DEPENDENCY_CLAUSE})

  DEPENDENCY_CLAUSE ::=
   OUTPUT_LIST =>[+] INPUT_LIST
 | NULL_DEPENDENCY_CLAUSE

  NULL_DEPENDENCY_CLAUSE ::= null => INPUT_LIST

  OUTPUT_LIST ::= OUTPUT | (OUTPUT {, OUTPUT})

  INPUT_LIST ::= null | INPUT | (INPUT {, INPUT})

  OUTPUT ::= NAME | FUNCTION_RESULT
  INPUT  ::= NAME

  where FUNCTION_RESULT is a function Result attribute_reference

For the semantics of this pragma, see the entry for aspect ``Depends`` in the
SPARK 2014 Reference Manual, section 6.1.5.

Pragma Detect_Blocking
======================

Syntax:

.. code-block:: ada

  pragma Detect_Blocking;


This is a standard pragma in Ada 2005, that is available in all earlier
versions of Ada as an implementation-defined pragma.

This is a configuration pragma that forces the detection of potentially
blocking operations within a protected operation, and to raise Program_Error
if that happens.

Pragma Disable_Atomic_Synchronization
=====================================

.. index:: Atomic Synchronization

Syntax:

::

  pragma Disable_Atomic_Synchronization [(Entity)];

  pragma Enable_Atomic_Synchronization [(Entity)];

Ada requires that accesses (reads or writes) of an atomic variable be
regarded as synchronization points in the case of multiple tasks.
Particularly in the case of multi-processors this may require special
handling, e.g. the generation of memory barriers. This synchronization
is performed by default, but can be turned off using pragma
``Disable_Atomic_Synchronization``.
The ``Enable_Atomic_Synchronization`` pragma turns it back on.

The placement and scope rules for these pragmas are the same as those
for ``pragma Suppress``. In particular they can be used as
configuration pragmas, or in a declaration sequence where they apply
until the end of the scope. If an ``Entity`` argument is present,
the action applies only to that entity.

Pragma Dispatching_Domain
=========================

Syntax:


.. code-block:: ada

  pragma Dispatching_Domain (EXPRESSION);


This pragma is standard in Ada 2012, but is available in all earlier
versions of Ada as an implementation-defined pragma.
See Ada 2012 Reference Manual for details.

.. _Pragma-Effective_Reads:

Pragma Effective_Reads
======================

Syntax:

.. code-block:: ada

  pragma Effective_Reads [ (static_boolean_EXPRESSION) ];

For the semantics of this pragma, see the entry for aspect ``Effective_Reads`` in
the SPARK 2014 Reference Manual, section 7.1.2.

.. _Pragma-Effective_Writes:

Pragma Effective_Writes
=======================

Syntax:

.. code-block:: ada

  pragma Effective_Writes [ (static_boolean_EXPRESSION) ];

For the semantics of this pragma, see the entry for aspect ``Effective_Writes``
in the SPARK 2014 Reference Manual, section 7.1.2.

Pragma Elaboration_Checks
=========================
.. index:: Elaboration control


Syntax:


.. code-block:: ada

  pragma Elaboration_Checks (Dynamic | Static);


This is a configuration pragma which specifies the elaboration model to be
used during compilation. For more information on the elaboration models of
GNAT, consult the chapter on elaboration order handling in the *GNAT User's
Guide*.

The pragma may appear in the following contexts:

* Configuration pragmas file

* Prior to the context clauses of a compilation unit's initial declaration

Any other placement of the pragma will result in a warning and the effects of
the offending pragma will be ignored.

If the pragma argument is ``Dynamic``, then the dynamic elaboration model is in
effect. If the pragma argument is ``Static``, then the static elaboration model
is in effect.

Pragma Eliminate
================
.. index:: Elimination of unused subprograms


Syntax:


::

pragma Eliminate (
            [  Unit_Name       => ] IDENTIFIER | SELECTED_COMPONENT ,
            [  Entity          => ] IDENTIFIER |
                                    SELECTED_COMPONENT |
                                    STRING_LITERAL
            [, Source_Location =>   SOURCE_TRACE ] );

        SOURCE_TRACE    ::= STRING_LITERAL


This pragma indicates that the given entity is not used in the program to be
compiled and built, thus allowing the compiler to
eliminate the code or data associated with the named entity. Any reference to
an eliminated entity causes a compile-time or link-time error.

The pragma has the following semantics, where ``U`` is the unit specified by
the ``Unit_Name`` argument and ``E`` is the entity specified by the ``Entity``
argument:

* ``E`` must be a subprogram that is explicitly declared either:

  * Within ``U``, or
  * Within a generic package that is instantiated in ``U``, or
  * As an instance of generic subprogram instantiated in ``U``.

  Otherwise the pragma is ignored.

* If ``E`` is overloaded within ``U`` then, in the absence of a
  ``Source_Location`` argument, all overloadings are eliminated.
* If ``E`` is overloaded within ``U`` and only some overloadings
  are to be eliminated, then each overloading to be eliminated
  must be specified in a corresponding pragma ``Eliminate``
  with a ``Source_Location`` argument identifying the line where the
  declaration appears, as described below.
* If ``E`` is declared as the result of a generic instantiation, then
  a ``Source_Location`` argument is needed, as described below.

Pragma ``Eliminate`` allows a program to be compiled in a system-independent
manner, so that unused entities are eliminated but without
needing to modify the source text. Normally the required set of
``Eliminate`` pragmas is constructed automatically using the ``gnatelim`` tool.

Any source file change that removes, splits, or
adds lines may make the set of ``Eliminate`` pragmas invalid because their
``Source_Location`` argument values may get out of date.

Pragma ``Eliminate`` may be used where the referenced entity is a dispatching
operation. In this case all the subprograms to which the given operation can
dispatch are considered to be unused (are never called as a result of a direct
or a dispatching call).

The string literal given for the source location specifies the line number
of the declaration of the entity, using the following syntax for ``SOURCE_TRACE``:

::

SOURCE_TRACE     ::= SOURCE_REFERENCE [ LBRACKET SOURCE_TRACE RBRACKET ]

LBRACKET         ::= '['
RBRACKET         ::= ']'

SOURCE_REFERENCE ::= FILE_NAME : LINE_NUMBER

LINE_NUMBER      ::= DIGIT {DIGIT}


Spaces around the colon in a ``SOURCE_REFERENCE`` are optional.

The source trace that is given as the ``Source_Location`` must obey the
following rules (or else the pragma is ignored), where ``U`` is
the unit ``U`` specified by the ``Unit_Name`` argument and ``E`` is the
subprogram specified by the ``Entity`` argument:

*  ``FILE_NAME`` is the short name (with no directory
information) of the Ada source file for ``U``, using the required syntax
for the underlying file system (e.g. case is significant if the underlying
operating system is case sensitive).
If ``U`` is a package and ``E`` is a subprogram declared in the package
specification and its full declaration appears in the package body,
then the  relevant source file is the one for the package specification;
analogously if ``U`` is a generic package.

*  If ``E`` is not declared in a generic instantiation (this includes
generic subprogram instances), the source trace includes only one source
line reference. ``LINE_NUMBER`` gives the line number of the occurrence
of the declaration of ``E`` within the source file (as a decimal literal
without an exponent or point).

*  If ``E`` is declared by a generic instantiation, its source trace
(from left to right) starts with the source location of the
declaration of ``E`` in the generic unit and ends with the source
location of the instantiation, given in square brackets. This approach is
applied recursively with nested instantiations: the rightmost (nested
most deeply in square brackets) element of the source trace is the location
of the outermost instantiation, and the leftmost element (that is, outside
of any square brackets) is the location of the declaration of ``E`` in
the generic unit.

Examples:

.. code-block:: ada

   pragma Eliminate (Pkg0, Proc);
   -- Eliminate (all overloadings of) Proc in Pkg0

   pragma Eliminate (Pkg1, Proc,
                     Source_Location => "pkg1.ads:8");
   -- Eliminate overloading of Proc at line 8 in pkg1.ads

   -- Assume the following file contents:
   --   gen_pkg.ads
   --   1: generic
   --   2:   type T is private;
   --   3: package Gen_Pkg is
   --   4:   procedure Proc(N : T);
   --  ...   ...
   --  ... end Gen_Pkg;
   --
   --    q.adb
   --   1: with Gen_Pkg;
   --   2: procedure Q is
   --   3:   package Inst_Pkg is new Gen_Pkg(Integer);
   --  ...   -- No calls on Inst_Pkg.Proc
   --  ... end Q;

   -- The following pragma eliminates Inst_Pkg.Proc from Q
   pragma Eliminate (Q, Proc,
                     Source_Location => "gen_pkg.ads:4[q.adb:3]");



Pragma Enable_Atomic_Synchronization
====================================
.. index:: Atomic Synchronization


Syntax:


::

  pragma Enable_Atomic_Synchronization [(Entity)];

Reenables atomic synchronization; see ``pragma Disable_Atomic_Synchronization``
for details.

Pragma Exceptional_Cases
========================
.. index:: Exceptional_Cases

Syntax:


::

  pragma Exceptional_Cases (EXCEPTIONAL_CASE_LIST);

  EXCEPTIONAL_CASE_LIST ::= EXCEPTIONAL_CASE {, EXCEPTIONAL_CASE}
  EXCEPTIONAL_CASE      ::= exception_choice {'|' exception_choice} => CONSEQUENCE
  CONSEQUENCE           ::= Boolean_expression

For the semantics of this aspect, see the SPARK 2014 Reference Manual, section
6.1.9.

Pragma Exit_Cases
=================
.. index:: Exit_Cases

Syntax:

::

  pragma Exit_Cases (EXIT_CASE_LIST);

  EXIT_CASE_LIST ::= EXIT_CASE {, EXIT_CASE}
  EXIT_CASE      ::= GUARD => EXIT_KIND
  EXIT_KIND      ::= Normal_Return
                | Exception_Raised
                | (Exception_Raised => exception_name)
                | Program_Exit
  GUARD          ::= Boolean_expression

For the semantics of this aspect, see the SPARK 2014 Reference Manual, section
6.1.10.

Pragma Export_Function
======================
.. index:: Argument passing mechanisms


Syntax:


::

  pragma Export_Function (
    [Internal         =>] LOCAL_NAME
 [, [External         =>] EXTERNAL_SYMBOL]
 [, [Parameter_Types  =>] PARAMETER_TYPES]
 [, [Result_Type      =>] result_SUBTYPE_MARK]
 [, [Mechanism        =>] MECHANISM]
 [, [Result_Mechanism =>] MECHANISM_NAME]);

  EXTERNAL_SYMBOL ::=
 IDENTIFIER
  | static_string_EXPRESSION
  | ""

  PARAMETER_TYPES ::=
 null
  | TYPE_DESIGNATOR {, TYPE_DESIGNATOR}

  TYPE_DESIGNATOR ::=
 subtype_NAME
  | subtype_Name ' Access

  MECHANISM ::=
 MECHANISM_NAME
  | (MECHANISM_ASSOCIATION {, MECHANISM_ASSOCIATION})

  MECHANISM_ASSOCIATION ::=
 [formal_parameter_NAME =>] MECHANISM_NAME

  MECHANISM_NAME ::= Value | Reference


Use this pragma to make a function externally callable and optionally
provide information on mechanisms to be used for passing parameter and
result values.  We recommend, for the purposes of improving portability,
this pragma always be used in conjunction with a separate pragma
``Export``, which must precede the pragma ``Export_Function``.
GNAT does not require a separate pragma ``Export``, but if none is
present, ``Convention Ada`` is assumed, which is usually
not what is wanted, so it is usually appropriate to use this
pragma in conjunction with a ``Export`` or ``Convention``
pragma that specifies the desired foreign convention.
Pragma ``Export_Function``
(and ``Export``, if present) must appear in the same declarative
region as the function to which they apply.

The ``internal_name`` must uniquely designate the function to which the
pragma applies.  If more than one function name exists of this name in
the declarative part you must use the ``Parameter_Types`` and
``Result_Type`` parameters to achieve the required
unique designation.  The `subtype_mark`\ s in these parameters must
exactly match the subtypes in the corresponding function specification,
using positional notation to match parameters with subtype marks.
The form with an ``'Access`` attribute can be used to match an
anonymous access parameter.

.. index:: Suppressing external name

Special treatment is given if the EXTERNAL is an explicit null
string or a static string expressions that evaluates to the null
string. In this case, no external name is generated. This form
still allows the specification of parameter mechanisms.

Pragma Export_Object
====================

Syntax:


::

  pragma Export_Object (
     [Internal =>] LOCAL_NAME
  [, [External =>] EXTERNAL_SYMBOL]
  [, [Size     =>] EXTERNAL_SYMBOL]);

  EXTERNAL_SYMBOL ::=
 IDENTIFIER
  | static_string_EXPRESSION


This pragma designates an object as exported, and apart from the
extended rules for external symbols, is identical in effect to the use of
the normal ``Export`` pragma applied to an object.  You may use a
separate Export pragma (and you probably should from the point of view
of portability), but it is not required.  ``Size`` is syntax checked,
but otherwise ignored by GNAT.

Pragma Export_Procedure
=======================

Syntax:


::

  pragma Export_Procedure (
    [Internal        =>] LOCAL_NAME
 [, [External        =>] EXTERNAL_SYMBOL]
 [, [Parameter_Types =>] PARAMETER_TYPES]
 [, [Mechanism       =>] MECHANISM]);

  EXTERNAL_SYMBOL ::=
 IDENTIFIER
  | static_string_EXPRESSION
  | ""

  PARAMETER_TYPES ::=
 null
  | TYPE_DESIGNATOR {, TYPE_DESIGNATOR}

  TYPE_DESIGNATOR ::=
 subtype_NAME
  | subtype_Name ' Access

  MECHANISM ::=
 MECHANISM_NAME
  | (MECHANISM_ASSOCIATION {, MECHANISM_ASSOCIATION})

  MECHANISM_ASSOCIATION ::=
 [formal_parameter_NAME =>] MECHANISM_NAME

  MECHANISM_NAME ::= Value | Reference


This pragma is identical to ``Export_Function`` except that it
applies to a procedure rather than a function and the parameters
``Result_Type`` and ``Result_Mechanism`` are not permitted.
GNAT does not require a separate pragma ``Export``, but if none is
present, ``Convention Ada`` is assumed, which is usually
not what is wanted, so it is usually appropriate to use this
pragma in conjunction with a ``Export`` or ``Convention``
pragma that specifies the desired foreign convention.

.. index:: Suppressing external name

Special treatment is given if the EXTERNAL is an explicit null
string or a static string expressions that evaluates to the null
string. In this case, no external name is generated. This form
still allows the specification of parameter mechanisms.

Pragma Export_Valued_Procedure
==============================

Syntax:


::

  pragma Export_Valued_Procedure (
    [Internal        =>] LOCAL_NAME
 [, [External        =>] EXTERNAL_SYMBOL]
 [, [Parameter_Types =>] PARAMETER_TYPES]
 [, [Mechanism       =>] MECHANISM]);

  EXTERNAL_SYMBOL ::=
 IDENTIFIER
  | static_string_EXPRESSION
  | ""

  PARAMETER_TYPES ::=
 null
  | TYPE_DESIGNATOR {, TYPE_DESIGNATOR}

  TYPE_DESIGNATOR ::=
 subtype_NAME
  | subtype_Name ' Access

  MECHANISM ::=
 MECHANISM_NAME
  | (MECHANISM_ASSOCIATION {, MECHANISM_ASSOCIATION})

  MECHANISM_ASSOCIATION ::=
 [formal_parameter_NAME =>] MECHANISM_NAME

  MECHANISM_NAME ::= Value | Reference


This pragma is identical to ``Export_Procedure`` except that the
first parameter of ``LOCAL_NAME``, which must be present, must be of
mode ``out``, and externally the subprogram is treated as a function
with this parameter as the result of the function.  GNAT provides for
this capability to allow the use of ``out`` and ``in out``
parameters in interfacing to external functions (which are not permitted
in Ada functions).
GNAT does not require a separate pragma ``Export``, but if none is
present, ``Convention Ada`` is assumed, which is almost certainly
not what is wanted since the whole point of this pragma is to interface
with foreign language functions, so it is usually appropriate to use this
pragma in conjunction with a ``Export`` or ``Convention``
pragma that specifies the desired foreign convention.

.. index:: Suppressing external name

Special treatment is given if the EXTERNAL is an explicit null
string or a static string expressions that evaluates to the null
string. In this case, no external name is generated. This form
still allows the specification of parameter mechanisms.

Pragma Extend_System
====================
.. index:: System, extending

.. index:: DEC Ada 83


Syntax:


::

  pragma Extend_System ([Name =>] IDENTIFIER);


This pragma is used to provide backwards compatibility with other
implementations that extend the facilities of package ``System``.  In
GNAT, ``System`` contains only the definitions that are present in
the Ada RM.  However, other implementations, notably the DEC Ada 83
implementation, provide many extensions to package ``System``.

For each such implementation accommodated by this pragma, GNAT provides a
package :samp:`Aux_{xxx}`, e.g., ``Aux_DEC`` for the DEC Ada 83
implementation, which provides the required additional definitions.  You
can use this package in two ways.  You can ``with`` it in the normal
way and access entities either by selection or using a ``use``
clause.  In this case no special processing is required.

However, if existing code contains references such as
:samp:`System.{xxx}` where *xxx* is an entity in the extended
definitions provided in package ``System``, you may use this pragma
to extend visibility in ``System`` in a non-standard way that
provides greater compatibility with the existing code.  Pragma
``Extend_System`` is a configuration pragma whose single argument is
the name of the package containing the extended definition
(e.g., ``Aux_DEC`` for the DEC Ada case).  A unit compiled under
control of this pragma will be processed using special visibility
processing that looks in package :samp:`System.Aux_{xxx}` where
:samp:`Aux_{xxx}` is the pragma argument for any entity referenced in
package ``System``, but not found in package ``System``.

You can use this pragma either to access a predefined ``System``
extension supplied with the compiler, for example ``Aux_DEC`` or
you can construct your own extension unit following the above
definition.  Note that such a package is a child of ``System``
and thus is considered part of the implementation.
To compile it you will have to use the *-gnatg* switch
for compiling System units, as explained in the
GNAT User's Guide.

.. _Pragma_Extensions_Allowed:

Pragma Extensions_Allowed
=========================
.. index:: Ada Extensions

.. index:: GNAT Extensions


Syntax:

.. code-block:: ada

  pragma Extensions_Allowed (On | Off | All_Extensions);


This configuration pragma enables (via the "On" or "All_Extensions" argument)
or disables (via the "Off" argument) the implementation extension mode; the
pragma takes precedence over the ``-gnatX`` and ``-gnatX0`` command switches.

If an argument of ``"On"`` is specified, the latest version of the Ada language
is implemented (currently Ada 2022) and, in addition, a curated set of GNAT
specific extensions are recognized. (See the list here
:ref:`here<Curated_Language_Extensions>`)

An argument of ``"All_Extensions"`` has the same effect except that some extra
experimental extensions are enabled (See the list here
:ref:`here<Experimental_Language_Extensions>`)

.. _Pragma-Extensions_Visible:

Pragma Extensions_Visible
=========================

Syntax:

.. code-block:: ada

  pragma Extensions_Visible [ (static_boolean_EXPRESSION) ];

For the semantics of this pragma, see the entry for aspect ``Extensions_Visible``
in the SPARK 2014 Reference Manual, section 6.1.7.

Pragma External
===============

Syntax:


::

  pragma External (
 [   Convention    =>] convention_IDENTIFIER,
 [   Entity        =>] LOCAL_NAME
 [, [External_Name =>] static_string_EXPRESSION ]
 [, [Link_Name     =>] static_string_EXPRESSION ]);


This pragma is identical in syntax and semantics to pragma
``Export`` as defined in the Ada Reference Manual.  It is
provided for compatibility with some Ada 83 compilers that
used this pragma for exactly the same purposes as pragma
``Export`` before the latter was standardized.

Pragma External_Name_Casing
===========================
.. index:: Dec Ada 83 casing compatibility

.. index:: External Names, casing

.. index:: Casing of External names


Syntax:


::

  pragma External_Name_Casing (
 Uppercase | Lowercase
 [, Uppercase | Lowercase | As_Is]);


This pragma provides control over the casing of external names associated
with Import and Export pragmas.  There are two cases to consider:



* Implicit external names

  Implicit external names are derived from identifiers.  The most common case
  arises when a standard Ada Import or Export pragma is used with only two
  arguments, as in:

  .. code-block:: ada

    pragma Import (C, C_Routine);

  Since Ada is a case-insensitive language, the spelling of the identifier in
  the Ada source program does not provide any information on the desired
  casing of the external name, and so a convention is needed.  In GNAT the
  default treatment is that such names are converted to all lower case
  letters.  This corresponds to the normal C style in many environments.
  The first argument of pragma ``External_Name_Casing`` can be used to
  control this treatment.  If ``Uppercase`` is specified, then the name
  will be forced to all uppercase letters.  If ``Lowercase`` is specified,
  then the normal default of all lower case letters will be used.

  This same implicit treatment is also used in the case of extended DEC Ada 83
  compatible Import and Export pragmas where an external name is explicitly
  specified using an identifier rather than a string.


* Explicit external names

  Explicit external names are given as string literals.  The most common case
  arises when a standard Ada Import or Export pragma is used with three
  arguments, as in:

  .. code-block:: ada

 pragma Import (C, C_Routine, "C_routine");

  In this case, the string literal normally provides the exact casing required
  for the external name.  The second argument of pragma
  ``External_Name_Casing`` may be used to modify this behavior.
  If ``Uppercase`` is specified, then the name
  will be forced to all uppercase letters.  If ``Lowercase`` is specified,
  then the name will be forced to all lowercase letters.  A specification of
  ``As_Is`` provides the normal default behavior in which the casing is
  taken from the string provided.

This pragma may appear anywhere that a pragma is valid. In particular, it
can be used as a configuration pragma in the :file:`gnat.adc` file, in which
case it applies to all subsequent compilations, or it can be used as a program
unit pragma, in which case it only applies to the current unit, or it can
be used more locally to control individual Import/Export pragmas.

It was primarily intended for use with OpenVMS systems, where many
compilers convert all symbols to upper case by default.  For interfacing to
such compilers (e.g., the DEC C compiler), it may be convenient to use
the pragma:

.. code-block:: ada

  pragma External_Name_Casing (Uppercase, Uppercase);


to enforce the upper casing of all external symbols.

Pragma Fast_Math
================

Syntax:


.. code-block:: ada

  pragma Fast_Math;


This is a configuration pragma which activates a mode in which speed is
considered more important for floating-point operations than absolutely
accurate adherence to the requirements of the standard. Currently the
following operations are affected:



*Complex Multiplication*
  The normal simple formula for complex multiplication can result in intermediate
  overflows for numbers near the end of the range. The Ada standard requires that
  this situation be detected and corrected by scaling, but in Fast_Math mode such
  cases will simply result in overflow. Note that to take advantage of this you
  must instantiate your own version of ``Ada.Numerics.Generic_Complex_Types``
  under control of the pragma, rather than use the preinstantiated versions.

.. _Pragma-Favor_Top_Level:

Pragma Favor_Top_Level
======================

Syntax:


.. code-block:: ada

  pragma Favor_Top_Level (type_LOCAL_NAME);


The argument of pragma ``Favor_Top_Level`` must be a named access-to-subprogram
type. This pragma is an efficiency hint to the compiler, regarding the use of
``'Access`` or ``'Unrestricted_Access`` on nested (non-library-level) subprograms.
The pragma means that nested subprograms are not used with this type, or are
rare, so that the generated code should be efficient in the top-level case.
When this pragma is used, dynamically generated trampolines may be used on some
targets for nested subprograms. See restriction ``No_Implicit_Dynamic_Code``.

Pragma Finalize_Storage_Only
============================

Syntax:


.. code-block:: ada

  pragma Finalize_Storage_Only (first_subtype_LOCAL_NAME);


The argument of pragma ``Finalize_Storage_Only`` must denote a local type which
is derived from ``Ada.Finalization.Controlled`` or ``Limited_Controlled``. The
pragma suppresses the call to ``Finalize`` for declared library-level objects
of the argument type. This is mostly useful for types where finalization is
only used to deal with storage reclamation since in most environments it is
not necessary to reclaim memory just before terminating execution, hence the
name. Note that this pragma does not suppress Finalize calls for library-level
heap-allocated objects (see pragma ``No_Heap_Finalization``).

Pragma Float_Representation
===========================

Syntax::

  pragma Float_Representation (FLOAT_REP[, float_type_LOCAL_NAME]);

  FLOAT_REP ::= VAX_Float | IEEE_Float


In the one argument form, this pragma is a configuration pragma which
allows control over the internal representation chosen for the predefined
floating point types declared in the packages ``Standard`` and
``System``. This pragma is only provided for compatibility and has no effect.

The two argument form specifies the representation to be used for
the specified floating-point type. The argument must
be ``IEEE_Float`` to specify the use of IEEE format, as follows:

*
  For a digits value of 6, 32-bit IEEE short format will be used.
*
  For a digits value of 15, 64-bit IEEE long format will be used.
*
  No other value of digits is permitted.

.. _Pragma-Ghost:

Pragma Ghost
============

Syntax:

.. code-block:: ada

  pragma Ghost [ (static_boolean_EXPRESSION) ];

For the semantics of this pragma, see the entry for aspect ``Ghost`` in the SPARK
2014 Reference Manual, section 6.9.

.. _Pragma-Global:

Pragma Global
=============

Syntax:

.. code-block:: ada

  pragma Global (GLOBAL_SPECIFICATION);

  GLOBAL_SPECIFICATION ::=
    null
 | (GLOBAL_LIST)
 | (MODED_GLOBAL_LIST {, MODED_GLOBAL_LIST})

  MODED_GLOBAL_LIST ::= MODE_SELECTOR => GLOBAL_LIST

  MODE_SELECTOR ::= In_Out | Input | Output | Proof_In
  GLOBAL_LIST   ::= GLOBAL_ITEM | (GLOBAL_ITEM {, GLOBAL_ITEM})
  GLOBAL_ITEM   ::= NAME

For the semantics of this pragma, see the entry for aspect ``Global`` in the
SPARK 2014 Reference Manual, section 6.1.4.

Pragma Ident
============

Syntax:


.. code-block:: ada

  pragma Ident (static_string_EXPRESSION);


This pragma is identical in effect to pragma ``Comment``. It is provided
for compatibility with other Ada compilers providing this pragma.

Pragma Ignore_Pragma
====================

Syntax:


.. code-block:: ada

  pragma Ignore_Pragma (pragma_IDENTIFIER);

This is a configuration pragma
that takes a single argument that is a simple identifier. Any subsequent
use of a pragma whose pragma identifier matches this argument will be
silently ignored. Any preceding use of a pragma whose pragma identifier
matches this argument will be parsed and then ignored.
This may be useful when legacy code or code intended
for compilation with some other compiler contains pragmas that match the
name, but not the exact implementation, of a GNAT pragma. The use of this
pragma allows such pragmas to be ignored, which may be useful in CodePeer
mode, or during porting of legacy code.

Pragma Implementation_Defined
=============================

Syntax:


.. code-block:: ada

  pragma Implementation_Defined (local_NAME);


This pragma marks a previously declared entity as implementation-defined.
For an overloaded entity, applies to the most recent homonym.


.. code-block:: ada

  pragma Implementation_Defined;


The form with no arguments appears anywhere within a scope, most
typically a package spec, and indicates that all entities that are
defined within the package spec are Implementation_Defined.

This pragma is used within the GNAT runtime library to identify
implementation-defined entities introduced in language-defined units,
for the purpose of implementing the No_Implementation_Identifiers
restriction.

Pragma Implemented
==================

Syntax:


::

  pragma Implemented (procedure_LOCAL_NAME, implementation_kind);

  implementation_kind ::= By_Entry | By_Protected_Procedure | By_Any


This is an Ada 2012 representation pragma which applies to protected, task
and synchronized interface primitives. The use of pragma Implemented provides
a way to impose a static requirement on the overriding operation by adhering
to one of the three implementation kinds: entry, protected procedure or any of
the above. This pragma is available in all earlier versions of Ada as an
implementation-defined pragma.


.. code-block:: ada

  type Synch_Iface is synchronized interface;
  procedure Prim_Op (Obj : in out Iface) is abstract;
  pragma Implemented (Prim_Op, By_Protected_Procedure);

  protected type Prot_1 is new Synch_Iface with
  procedure Prim_Op;  --  Legal
  end Prot_1;

  protected type Prot_2 is new Synch_Iface with
  entry Prim_Op;      --  Illegal
  end Prot_2;

  task type Task_Typ is new Synch_Iface with
  entry Prim_Op;      --  Illegal
  end Task_Typ;


When applied to the procedure_or_entry_NAME of a requeue statement, pragma
Implemented determines the runtime behavior of the requeue. Implementation kind
By_Entry guarantees that the action of requeueing will proceed from an entry to
another entry. Implementation kind By_Protected_Procedure transforms the
requeue into a dispatching call, thus eliminating the chance of blocking. Kind
By_Any shares the behavior of By_Entry and By_Protected_Procedure depending on
the target's overriding subprogram kind.

Pragma Implicit_Packing
=======================
.. index:: Rational Profile

Syntax:


.. code-block:: ada

  pragma Implicit_Packing;


This is a configuration pragma that requests implicit packing for packed
arrays for which a size clause is given but no explicit pragma Pack or
specification of Component_Size is present. It also applies to records
where no record representation clause is present. Consider this example:


.. code-block:: ada

  type R is array (0 .. 7) of Boolean;
  for R'Size use 8;


In accordance with the recommendation in the RM (RM 13.3(53)), a Size clause
does not change the layout of a composite object. So the Size clause in the
above example is normally rejected, since the default layout of the array uses
8-bit components, and thus the array requires a minimum of 64 bits.

If this declaration is compiled in a region of code covered by an occurrence
of the configuration pragma Implicit_Packing, then the Size clause in this
and similar examples will cause implicit packing and thus be accepted. For
this implicit packing to occur, the type in question must be an array of small
components whose size is known at compile time, and the Size clause must
specify the exact size that corresponds to the number of elements in the array
multiplied by the size in bits of the component type (both single and
multi-dimensioned arrays can be controlled with this pragma).

.. index:: Array packing

Similarly, the following example shows the use in the record case


.. code-block:: ada

  type r is record
  a, b, c, d, e, f, g, h : boolean;
  chr                    : character;
  end record;
  for r'size use 16;


Without a pragma Pack, each Boolean field requires 8 bits, so the
minimum size is 72 bits, but with a pragma Pack, 16 bits would be
sufficient. The use of pragma Implicit_Packing allows this record
declaration to compile without an explicit pragma Pack.

Pragma Import_Function
======================

Syntax:


::

  pragma Import_Function (
    [Internal         =>] LOCAL_NAME,
 [, [External         =>] EXTERNAL_SYMBOL]
 [, [Parameter_Types  =>] PARAMETER_TYPES]
 [, [Result_Type      =>] SUBTYPE_MARK]
 [, [Mechanism        =>] MECHANISM]
 [, [Result_Mechanism =>] MECHANISM_NAME]);

  EXTERNAL_SYMBOL ::=
 IDENTIFIER
  | static_string_EXPRESSION

  PARAMETER_TYPES ::=
 null
  | TYPE_DESIGNATOR {, TYPE_DESIGNATOR}

  TYPE_DESIGNATOR ::=
 subtype_NAME
  | subtype_Name ' Access

  MECHANISM ::=
 MECHANISM_NAME
  | (MECHANISM_ASSOCIATION {, MECHANISM_ASSOCIATION})

  MECHANISM_ASSOCIATION ::=
 [formal_parameter_NAME =>] MECHANISM_NAME

  MECHANISM_NAME ::=
 Value
  | Reference


This pragma is used in conjunction with a pragma ``Import`` to
specify additional information for an imported function.  The pragma
``Import`` (or equivalent pragma ``Interface``) must precede the
``Import_Function`` pragma and both must appear in the same
declarative part as the function specification.

The ``Internal`` argument must uniquely designate
the function to which the
pragma applies.  If more than one function name exists of this name in
the declarative part you must use the ``Parameter_Types`` and
``Result_Type`` parameters to achieve the required unique
designation.  Subtype marks in these parameters must exactly match the
subtypes in the corresponding function specification, using positional
notation to match parameters with subtype marks.
The form with an ``'Access`` attribute can be used to match an
anonymous access parameter.

You may optionally use the ``Mechanism`` and ``Result_Mechanism``
parameters to specify passing mechanisms for the
parameters and result.  If you specify a single mechanism name, it
applies to all parameters.  Otherwise you may specify a mechanism on a
parameter by parameter basis using either positional or named
notation.  If the mechanism is not specified, the default mechanism
is used.

Pragma Import_Object
====================

Syntax:


::

  pragma Import_Object (
    [Internal =>] LOCAL_NAME
 [, [External =>] EXTERNAL_SYMBOL]
 [, [Size     =>] EXTERNAL_SYMBOL]);

  EXTERNAL_SYMBOL ::=
 IDENTIFIER
  | static_string_EXPRESSION


This pragma designates an object as imported, and apart from the
extended rules for external symbols, is identical in effect to the use of
the normal ``Import`` pragma applied to an object.  Unlike the
subprogram case, you need not use a separate ``Import`` pragma,
although you may do so (and probably should do so from a portability
point of view).  ``size`` is syntax checked, but otherwise ignored by
GNAT.

Pragma Import_Procedure
=======================

Syntax:


::

  pragma Import_Procedure (
    [Internal        =>] LOCAL_NAME
 [, [External        =>] EXTERNAL_SYMBOL]
 [, [Parameter_Types =>] PARAMETER_TYPES]
 [, [Mechanism       =>] MECHANISM]);

  EXTERNAL_SYMBOL ::=
 IDENTIFIER
  | static_string_EXPRESSION

  PARAMETER_TYPES ::=
 null
  | TYPE_DESIGNATOR {, TYPE_DESIGNATOR}

  TYPE_DESIGNATOR ::=
 subtype_NAME
  | subtype_Name ' Access

  MECHANISM ::=
 MECHANISM_NAME
  | (MECHANISM_ASSOCIATION {, MECHANISM_ASSOCIATION})

  MECHANISM_ASSOCIATION ::=
 [formal_parameter_NAME =>] MECHANISM_NAME

  MECHANISM_NAME ::= Value | Reference


This pragma is identical to ``Import_Function`` except that it
applies to a procedure rather than a function and the parameters
``Result_Type`` and ``Result_Mechanism`` are not permitted.

Pragma Import_Valued_Procedure
==============================

Syntax:


::

  pragma Import_Valued_Procedure (
    [Internal        =>] LOCAL_NAME
 [, [External        =>] EXTERNAL_SYMBOL]
 [, [Parameter_Types =>] PARAMETER_TYPES]
 [, [Mechanism       =>] MECHANISM]);

  EXTERNAL_SYMBOL ::=
 IDENTIFIER
  | static_string_EXPRESSION

  PARAMETER_TYPES ::=
 null
  | TYPE_DESIGNATOR {, TYPE_DESIGNATOR}

  TYPE_DESIGNATOR ::=
 subtype_NAME
  | subtype_Name ' Access

  MECHANISM ::=
 MECHANISM_NAME
  | (MECHANISM_ASSOCIATION {, MECHANISM_ASSOCIATION})

  MECHANISM_ASSOCIATION ::=
 [formal_parameter_NAME =>] MECHANISM_NAME

  MECHANISM_NAME ::= Value | Reference


This pragma is identical to ``Import_Procedure`` except that the
first parameter of ``LOCAL_NAME``, which must be present, must be of
mode ``out``, and externally the subprogram is treated as a function
with this parameter as the result of the function.  The purpose of this
capability is to allow the use of ``out`` and ``in out``
parameters in interfacing to external functions (which are not permitted
in Ada functions).  You may optionally use the ``Mechanism``
parameters to specify passing mechanisms for the parameters.
If you specify a single mechanism name, it applies to all parameters.
Otherwise you may specify a mechanism on a parameter by parameter
basis using either positional or named notation.  If the mechanism is not
specified, the default mechanism is used.

Note that it is important to use this pragma in conjunction with a separate
pragma Import that specifies the desired convention, since otherwise the
default convention is Ada, which is almost certainly not what is required.

Pragma Independent
==================

Syntax:


.. code-block:: ada

  pragma Independent (component_LOCAL_NAME);


This pragma is standard in Ada 2012 mode (which also provides an aspect
of the same name). It is also available as an implementation-defined
pragma in all earlier versions. It specifies that the
designated object or all objects of the designated type must be
independently addressable. This means that separate tasks can safely
manipulate such objects. For example, if two components of a record are
independent, then two separate tasks may access these two components.
This may place
constraints on the representation of the object (for instance prohibiting
tight packing).

Pragma Independent_Components
=============================

Syntax:


.. code-block:: ada

  pragma Independent_Components (Local_NAME);


This pragma is standard in Ada 2012 mode (which also provides an aspect
of the same name). It is also available as an implementation-defined
pragma in all earlier versions. It specifies that the components of the
designated object, or the components of each object of the designated
type, must be
independently addressable. This means that separate tasks can safely
manipulate separate components in the composite object. This may place
constraints on the representation of the object (for instance prohibiting
tight packing).

.. _Pragma-Initial_Condition:

Pragma Initial_Condition
========================

Syntax:

.. code-block:: ada

  pragma Initial_Condition (boolean_EXPRESSION);

For the semantics of this pragma, see the entry for aspect ``Initial_Condition``
in the SPARK 2014 Reference Manual, section 7.1.6.

This is an assertion kind pragma that can associate a set of its arguments
with an assertion level. See SPARK 2014 Reference Manual, section
11.4.2.

Pragma Initialize_Scalars
=========================
.. index:: debugging with Initialize_Scalars

Syntax:


.. code-block:: ada

  pragma Initialize_Scalars
 [ ( TYPE_VALUE_PAIR {, TYPE_VALUE_PAIR} ) ];

  TYPE_VALUE_PAIR ::=
 SCALAR_TYPE => static_EXPRESSION

  SCALAR_TYPE :=
 Short_Float
  | Float
  | Long_Float
  | Long_Long_Flat
  | Signed_8
  | Signed_16
  | Signed_32
  | Signed_64
  | Unsigned_8
  | Unsigned_16
  | Unsigned_32
  | Unsigned_64


This pragma is similar to ``Normalize_Scalars`` conceptually but has two
important differences.

First, there is no requirement for the pragma to be used uniformly in all units
of a partition. In particular, it is fine to use this just for some or all of
the application units of a partition, without needing to recompile the run-time
library. In the case where some units are compiled with the pragma, and some
without, then a declaration of a variable where the type is defined in package
Standard or is locally declared will always be subject to initialization, as
will any declaration of a scalar variable. For composite variables, whether the
variable is initialized may also depend on whether the package in which the
type of the variable is declared is compiled with the pragma.

The other important difference is that the programmer can control the value
used for initializing scalar objects. This effect can be achieved in several
different ways:

* At compile time, the programmer can specify the invalid value for a
  particular family of scalar types using the optional arguments of the pragma.

  The compile-time approach is intended to optimize the generated code for the
  pragma, by possibly using fast operations such as ``memset``. Note that such
  optimizations require using values where the bytes all have the same binary
  representation.

* At bind time, the programmer has several options:

  * Initialization with invalid values (similar to Normalize_Scalars, though
 for Initialize_Scalars it is not always possible to determine the invalid
 values in complex cases like signed component fields with nonstandard
 sizes).

  * Initialization with high values.

  * Initialization with low values.

  * Initialization with a specific bit pattern.

  See the GNAT User's Guide for binder options for specifying these cases.

  The bind-time approach is intended to provide fast turnaround for testing
  with different values, without having to recompile the program.

* At execution time, the programmer can specify the invalid values using an
  environment variable. See the GNAT User's Guide for details.

  The execution-time approach is intended to provide fast turnaround for
  testing with different values, without having to recompile and rebind the
  program.

Note that pragma ``Initialize_Scalars`` is particularly useful in conjunction
with the enhanced validity checking that is now provided in GNAT, which checks
for invalid values under more conditions. Using this feature (see description
of the *-gnatV* flag in the GNAT User's Guide) in conjunction with pragma
``Initialize_Scalars`` provides a powerful new tool to assist in the detection
of problems caused by uninitialized variables.

Note: the use of ``Initialize_Scalars`` has a fairly extensive effect on the
generated code. This may cause your code to be substantially larger. It may
also cause an increase in the amount of stack required, so it is probably a
good idea to turn on stack checking (see description of stack checking in the
GNAT User's Guide) when using this pragma.

.. _Pragma-Initializes:

Pragma Initializes
==================

Syntax:

.. code-block:: ada

  pragma Initializes (INITIALIZATION_LIST);

  INITIALIZATION_LIST ::=
    null
 | (INITIALIZATION_ITEM {, INITIALIZATION_ITEM})

  INITIALIZATION_ITEM ::= name [=> INPUT_LIST]

  INPUT_LIST ::=
    null
 |  INPUT
 | (INPUT {, INPUT})

  INPUT ::= name

For the semantics of this pragma, see the entry for aspect ``Initializes`` in the
SPARK 2014 Reference Manual, section 7.1.5.

.. _Pragma-Inline_Always:

Pragma Inline_Always
====================

Syntax:


::

  pragma Inline_Always (NAME [, NAME]);


Similar to pragma ``Inline`` except that inlining is unconditional.
Inline_Always instructs the compiler to inline every direct call to the
subprogram or else to emit a compilation error, independently of any
option, in particular *-gnatn* or *-gnatN* or the optimization level.
It is an error to take the address or access of ``NAME``. It is also an error to
apply this pragma to a primitive operation of a tagged type. Thanks to such
restrictions, the compiler is allowed to remove the out-of-line body of ``NAME``.

Pragma Inline_Generic
=====================

Syntax:


::

  pragma Inline_Generic (GNAME {, GNAME});

  GNAME ::= generic_unit_NAME | generic_instance_NAME


This pragma is provided for compatibility with Dec Ada 83. It has
no effect in GNAT (which always inlines generics), other
than to check that the given names are all names of generic units or
generic instances.

Pragma Interface
================

Syntax:


::

  pragma Interface (
    [Convention    =>] convention_identifier,
    [Entity        =>] local_NAME
 [, [External_Name =>] static_string_expression]
 [, [Link_Name     =>] static_string_expression]);


This pragma is identical in syntax and semantics to
the standard Ada pragma ``Import``.  It is provided for compatibility
with Ada 83.  The definition is upwards compatible both with pragma
``Interface`` as defined in the Ada 83 Reference Manual, and also
with some extended implementations of this pragma in certain Ada 83
implementations.  The only difference between pragma ``Interface``
and pragma ``Import`` is that there is special circuitry to allow
both pragmas to appear for the same subprogram entity (normally it
is illegal to have multiple ``Import`` pragmas). This is useful in
maintaining Ada 83/Ada 95 compatibility and is compatible with other
Ada 83 compilers.

Pragma Interface_Name
=====================

Syntax:


::

  pragma Interface_Name (
    [Entity        =>] LOCAL_NAME
 [, [External_Name =>] static_string_EXPRESSION]
 [, [Link_Name     =>] static_string_EXPRESSION]);


This pragma provides an alternative way of specifying the interface name
for an interfaced subprogram, and is provided for compatibility with Ada
83 compilers that use the pragma for this purpose.  You must provide at
least one of ``External_Name`` or ``Link_Name``.

Pragma Interrupt_Handler
========================

Syntax:


.. code-block:: ada

  pragma Interrupt_Handler (procedure_LOCAL_NAME);


This program unit pragma is supported for parameterless protected procedures
as described in Annex C of the Ada Reference Manual.

Pragma Interrupt_State
======================

Syntax:


::

  pragma Interrupt_State
([Name  =>] value,
 [State =>] SYSTEM | RUNTIME | USER);


Normally certain interrupts are reserved to the implementation.  Any attempt
to attach an interrupt causes Program_Error to be raised, as described in
RM C.3.2(22).  A typical example is the ``SIGINT`` interrupt used in
many systems for an :kbd:`Ctrl-C` interrupt.  Normally this interrupt is
reserved to the implementation, so that :kbd:`Ctrl-C` can be used to
interrupt execution.  Additionally, signals such as ``SIGSEGV``,
``SIGABRT``, ``SIGFPE`` and ``SIGILL`` are often mapped to specific
Ada exceptions, or used to implement run-time functions such as the
``abort`` statement and stack overflow checking.

Pragma ``Interrupt_State`` provides a general mechanism for overriding
such uses of interrupts.  It subsumes the functionality of pragma
``Unreserve_All_Interrupts``.  Pragma ``Interrupt_State`` is not
available on Windows.  On all other platforms than VxWorks,
it applies to signals; on VxWorks, it applies to vectored hardware interrupts
and may be used to mark interrupts required by the board support package
as reserved.

Interrupts can be in one of three states:

* System

  The interrupt is reserved (no Ada handler can be installed), and the
  Ada run-time may not install a handler. As a result you are guaranteed
  standard system default action if this interrupt is raised. This also allows
  installing a low level handler via C APIs such as sigaction(), outside
  of Ada control.

* Runtime

  The interrupt is reserved (no Ada handler can be installed). The run time
  is allowed to install a handler for internal control purposes, but is
  not required to do so.

* User

  The interrupt is unreserved.  The user may install an Ada handler via
  Ada.Interrupts and pragma Interrupt_Handler or Attach_Handler to provide
  some other action.

These states are the allowed values of the ``State`` parameter of the
pragma.  The ``Name`` parameter is a value of the type
``Ada.Interrupts.Interrupt_ID``.  Typically, it is a name declared in
``Ada.Interrupts.Names``.

This is a configuration pragma, and the binder will check that there
are no inconsistencies between different units in a partition in how a
given interrupt is specified. It may appear anywhere a pragma is legal.

The effect is to move the interrupt to the specified state.

By declaring interrupts to be SYSTEM, you guarantee the standard system
action, such as a core dump.

By declaring interrupts to be USER, you guarantee that you can install
a handler.

Note that certain signals on many operating systems cannot be caught and
handled by applications.  In such cases, the pragma is ignored.  See the
operating system documentation, or the value of the array ``Reserved``
declared in the spec of package ``System.OS_Interface``.

Overriding the default state of signals used by the Ada runtime may interfere
with an application's runtime behavior in the cases of the synchronous signals,
and in the case of the signal used to implement the ``abort`` statement.

Pragma Interrupts_System_By_Default
===================================

Syntax:


::

  pragma Interrupts_System_By_Default;

Default all interrupts to the System state as defined above in pragma
``Interrupt_State``. This is a configuration pragma.

.. _Pragma-Invariant:

Pragma Invariant
================

Syntax:


::

  pragma Invariant
 ([Entity =>]    private_type_LOCAL_NAME,
  [Check  =>]    EXPRESSION
  [,[Message =>] String_Expression]);


This pragma provides exactly the same capabilities as the Type_Invariant aspect
defined in AI05-0146-1, and in the Ada 2012 Reference Manual. The
Type_Invariant aspect is fully implemented in Ada 2012 mode, but since it
requires the use of the aspect syntax, which is not available except in 2012
mode, it is not possible to use the Type_Invariant aspect in earlier versions
of Ada. However the Invariant pragma may be used in any version of Ada. Also
note that the aspect Invariant is a synonym in GNAT for the aspect
Type_Invariant, but there is no pragma Type_Invariant.

The pragma must appear within the visible part of the package specification,
after the type to which its Entity argument appears. As with the Invariant
aspect, the Check expression is not analyzed until the end of the visible
part of the package, so it may contain forward references. The Message
argument, if present, provides the exception message used if the invariant
is violated. If no Message parameter is provided, a default message that
identifies the line on which the pragma appears is used.

It is permissible to have multiple Invariants for the same type entity, in
which case they are and'ed together. It is permissible to use this pragma
in Ada 2012 mode, but you cannot have both an invariant aspect and an
invariant pragma for the same entity.

For further details on the use of this pragma, see the Ada 2012 documentation
of the Type_Invariant aspect.

This is an assertion kind pragma that can associate a set of its arguments
with an assertion level. See SPARK 2014 Reference Manual, section
11.4.2.

Pragma Keep_Names
=================

Syntax:


::

  pragma Keep_Names ([On =>] enumeration_first_subtype_LOCAL_NAME);


The ``LOCAL_NAME`` argument
must refer to an enumeration first subtype
in the current declarative part. The effect is to retain the enumeration
literal names for use by ``Image`` and ``Value`` even if a global
``Discard_Names`` pragma applies. This is useful when you want to
generally suppress enumeration literal names and for example you therefore
use a ``Discard_Names`` pragma in the :file:`gnat.adc` file, but you
want to retain the names for specific enumeration types.

Pragma License
==============
.. index:: License checking

Syntax:


.. code-block:: ada

  pragma License (Unrestricted | GPL | Modified_GPL | Restricted);


This pragma is provided to allow automated checking for appropriate license
conditions with respect to the standard and modified GPL.  A pragma
``License``, which is a configuration pragma that typically appears at
the start of a source file or in a separate :file:`gnat.adc` file, specifies
the licensing conditions of a unit as follows:

* Unrestricted
  This is used for a unit that can be freely used with no license restrictions.
  Examples of such units are public domain units, and units from the Ada
  Reference Manual.

* GPL
  This is used for a unit that is licensed under the unmodified GPL, and which
  therefore cannot be ``with``\ ed by a restricted unit.

* Modified_GPL
  This is used for a unit licensed under the GNAT modified GPL that includes
  a special exception paragraph that specifically permits the inclusion of
  the unit in programs without requiring the entire program to be released
  under the GPL.

* Restricted
  This is used for a unit that is restricted in that it is not permitted to
  depend on units that are licensed under the GPL.  Typical examples are
  proprietary code that is to be released under more restrictive license
  conditions.  Note that restricted units are permitted to ``with`` units
  which are licensed under the modified GPL (this is the whole point of the
  modified GPL).


Normally a unit with no ``License`` pragma is considered to have an
unknown license, and no checking is done.  However, standard GNAT headers
are recognized, and license information is derived from them as follows.

A GNAT license header starts with a line containing 78 hyphens.  The following
comment text is searched for the appearance of any of the following strings.

If the string 'GNU General Public License' is found, then the unit is assumed
to have GPL license, unless the string 'As a special exception' follows, in
which case the license is assumed to be modified GPL.

If one of the strings
'This specification is adapted from the Ada Semantic Interface' or
'This specification is derived from the Ada Reference Manual' is found
then the unit is assumed to be unrestricted.

These default actions means that a program with a restricted license pragma
will automatically get warnings if a GPL unit is inappropriately
``with``\ ed.  For example, the program:

.. code-block:: ada

  with Sem_Ch3;
  with GNAT.Sockets;
  procedure Secret_Stuff is
 ...
  end Secret_Stuff


if compiled with pragma ``License`` (``Restricted``) in a
:file:`gnat.adc` file will generate the warning::

  1.  with Sem_Ch3;
       |
  >>> license of withed unit "Sem_Ch3" is incompatible

  2.  with GNAT.Sockets;
  3.  procedure Secret_Stuff is


Here we get a warning on ``Sem_Ch3`` since it is part of the GNAT
compiler and is licensed under the
GPL, but no warning for ``GNAT.Sockets`` which is part of the GNAT
run time, and is therefore licensed under the modified GPL.

Pragma Link_With
================

Syntax:


::

  pragma Link_With (static_string_EXPRESSION {,static_string_EXPRESSION});


This pragma is provided for compatibility with certain Ada 83 compilers.
It has exactly the same effect as pragma ``Linker_Options`` except
that spaces occurring within one of the string expressions are treated
as separators. For example, in the following case:

.. code-block:: ada

  pragma Link_With ("-labc -ldef");


results in passing the strings ``-labc`` and ``-ldef`` as two
separate arguments to the linker. In addition pragma Link_With allows
multiple arguments, with the same effect as successive pragmas.

Pragma Linker_Alias
===================

Syntax:


::

  pragma Linker_Alias (
 [Entity =>] LOCAL_NAME,
 [Target =>] static_string_EXPRESSION);


``LOCAL_NAME`` must refer to an object that is declared at the library
level. This pragma establishes the given entity as a linker alias for the
given target. It is equivalent to ``__attribute__((alias))`` in GNU C
and causes ``LOCAL_NAME`` to be emitted as an alias for the symbol
``static_string_EXPRESSION`` in the object file, that is to say no space
is reserved for ``LOCAL_NAME`` by the assembler and it will be resolved
to the same address as ``static_string_EXPRESSION`` by the linker.

The actual linker name for the target must be used (e.g., the fully
encoded name with qualification in Ada, or the mangled name in C++),
or it must be declared using the C convention with ``pragma Import``
or ``pragma Export``.

Not all target machines support this pragma. On some of them it is accepted
only if ``pragma Weak_External`` has been applied to ``LOCAL_NAME``.


.. code-block:: ada

  --  Example of the use of pragma Linker_Alias

  package p is
 i : Integer := 1;
 pragma Export (C, i);

 new_name_for_i : Integer;
 pragma Linker_Alias (new_name_for_i, "i");
  end p;


Pragma Linker_Constructor
=========================

Syntax:


.. code-block:: ada

  pragma Linker_Constructor (procedure_LOCAL_NAME);


``procedure_LOCAL_NAME`` must refer to a parameterless procedure that
is declared at the library level. A procedure to which this pragma is
applied will be treated as an initialization routine by the linker.
It is equivalent to ``__attribute__((constructor))`` in GNU C and
causes ``procedure_LOCAL_NAME`` to be invoked before the entry point
of the executable is called (or immediately after the shared library is
loaded if the procedure is linked in a shared library), in particular
before the Ada run-time environment is set up.

Because of these specific contexts, the set of operations such a procedure
can perform is very limited and the type of objects it can manipulate is
essentially restricted to the elementary types. In particular, it must only
contain code to which pragma Restrictions (No_Elaboration_Code) applies.

This pragma is used by GNAT to implement auto-initialization of shared Stand
Alone Libraries, which provides a related capability without the restrictions
listed above. Where possible, the use of Stand Alone Libraries is preferable
to the use of this pragma.

Pragma Linker_Destructor
========================

Syntax:


.. code-block:: ada

  pragma Linker_Destructor (procedure_LOCAL_NAME);


``procedure_LOCAL_NAME`` must refer to a parameterless procedure that
is declared at the library level. A procedure to which this pragma is
applied will be treated as a finalization routine by the linker.
It is equivalent to ``__attribute__((destructor))`` in GNU C and
causes ``procedure_LOCAL_NAME`` to be invoked after the entry point
of the executable has exited (or immediately before the shared library
is unloaded if the procedure is linked in a shared library), in particular
after the Ada run-time environment is shut down.

See ``pragma Linker_Constructor`` for the set of restrictions that apply
because of these specific contexts.

.. _Pragma-Linker_Section:

Pragma Linker_Section
=====================

Syntax:


::

  pragma Linker_Section (
 [Entity  =>] LOCAL_NAME,
 [Section =>] static_string_EXPRESSION);


``LOCAL_NAME`` must refer to an object, type, or subprogram that is
declared at the library level. This pragma specifies the name of the
linker section for the given entity. It is equivalent to
``__attribute__((section))`` in GNU C and causes ``LOCAL_NAME`` to
be placed in the ``static_string_EXPRESSION`` section of the
executable (assuming the linker doesn't rename the section).
GNAT also provides an implementation defined aspect of the same name.

In the case of specifying this aspect for a type, the effect is to
specify the corresponding section for all library-level objects of
the type that do not have an explicit linker section set. Note that
this only applies to whole objects, not to components of composite objects.

In the case of a subprogram, the linker section applies to all previously
declared matching overloaded subprograms in the current declarative part
which do not already have a linker section assigned. The linker section
aspect is useful in this case for specifying different linker sections
for different elements of such an overloaded set.

Note that an empty string specifies that no linker section is specified.
This is not quite the same as omitting the pragma or aspect, since it
can be used to specify that one element of an overloaded set of subprograms
has the default linker section, or that one object of a type for which a
linker section is specified should has the default linker section.

The compiler normally places library-level entities in standard sections
depending on the class: procedures and functions generally go in the
``.text`` section, initialized variables in the ``.data`` section
and uninitialized variables in the ``.bss`` section.

Other, special sections may exist on given target machines to map special
hardware, for example I/O ports or flash memory. This pragma is a means to
defer the final layout of the executable to the linker, thus fully working
at the symbolic level with the compiler.

Some file formats do not support arbitrary sections so not all target
machines support this pragma. The use of this pragma may cause a program
execution to be erroneous if it is used to place an entity into an
inappropriate section (e.g., a modified variable into the ``.text``
section). See also ``pragma Persistent_BSS``.


.. code-block:: ada

  --  Example of the use of pragma Linker_Section

  package IO_Card is
 Port_A : Integer;
 pragma Volatile (Port_A);
 pragma Linker_Section (Port_A, ".bss.port_a");

 Port_B : Integer;
 pragma Volatile (Port_B);
 pragma Linker_Section (Port_B, ".bss.port_b");

 type Port_Type is new Integer with Linker_Section => ".bss";
 PA : Port_Type with Linker_Section => ".bss.PA";
 PB : Port_Type; --  ends up in linker section ".bss"

 procedure Q with Linker_Section => "Qsection";
  end IO_Card;

.. _Pragma-Lock_Free:

Pragma Lock_Free
================

Syntax:

.. code-block:: ada

  pragma Lock_Free [ (static_boolean_EXPRESSION) ];

This pragma may be specified for protected types or objects. It specifies that
the implementation of protected operations must be implemented without locks.
Compilation fails if the compiler cannot generate lock-free code for the
operations.

The current conditions required to support this pragma are:

* Protected type declarations may not contain entries
* Protected subprogram declarations may not have nonelementary parameters

In addition, each protected subprogram body must satisfy:

* May reference only one protected component
* May not reference nonconstant entities outside the protected subprogram
  scope
* May not contain address representation items, allocators, or quantified
  expressions
* May not contain delay, goto, loop, or procedure-call statements
* May not contain exported and imported entities
* May not dereferenced access values
* Function calls and attribute references must be static

If the Lock_Free aspect is specified to be True for a protected unit
and the Ceiling_Locking locking policy is in effect, then the run-time
actions associated with the Ceiling_Locking locking policy (described in
Ada RM D.3) are not performed when a protected operation of the protected
unit is executed.

Pragma Loop_Invariant
=====================

Syntax:


.. code-block:: ada

  pragma Loop_Invariant ( boolean_EXPRESSION );


The effect of this pragma is similar to that of pragma ``Assert``,
except that in an ``Assertion_Policy`` pragma, the identifier
``Loop_Invariant`` is used to control whether it is ignored or checked
(or disabled).

``Loop_Invariant`` can only appear as one of the items in the sequence
of statements of a loop body, or nested inside block statements that
appear in the sequence of statements of a loop body.
The intention is that it be used to
represent a "loop invariant" assertion, i.e. something that is true each
time through the loop, and which can be used to show that the loop is
achieving its purpose.

Multiple ``Loop_Invariant`` and ``Loop_Variant`` pragmas that
apply to the same loop should be grouped in the same sequence of
statements.

To aid in writing such invariants, the special attribute ``Loop_Entry``
may be used to refer to the value of an expression on entry to the loop. This
attribute can only be used within the expression of a ``Loop_Invariant``
pragma. For full details, see documentation of attribute ``Loop_Entry``.

This is an assertion kind pragma that can associate a set of its arguments
with an assertion level. See SPARK 2014 Reference Manual, section
11.4.2.

Pragma Loop_Optimize
====================

Syntax:


::

  pragma Loop_Optimize (OPTIMIZATION_HINT {, OPTIMIZATION_HINT});

  OPTIMIZATION_HINT ::= Ivdep | No_Unroll | Unroll | No_Vector | Vector


This pragma must appear immediately within a loop statement.  It allows the
programmer to specify optimization hints for the enclosing loop.  The hints
are not mutually exclusive and can be freely mixed, but not all combinations
will yield a sensible outcome.

There are five supported optimization hints for a loop:

* Ivdep

  The programmer asserts that there are no loop-carried dependencies
  which would prevent consecutive iterations of the loop from being
  executed simultaneously.

* No_Unroll

  The loop must not be unrolled.  This is a strong hint: the compiler will not
  unroll a loop marked with this hint.

* Unroll

  The loop should be unrolled.  This is a weak hint: the compiler will try to
  apply unrolling to this loop preferably to other optimizations, notably
  vectorization, but there is no guarantee that the loop will be unrolled.

* No_Vector

  The loop must not be vectorized.  This is a strong hint: the compiler will not
  vectorize a loop marked with this hint.

* Vector

  The loop should be vectorized.  This is a weak hint: the compiler will try to
  apply vectorization to this loop preferably to other optimizations, notably
  unrolling, but there is no guarantee that the loop will be vectorized.


These hints do not remove the need to pass the appropriate switches to the
compiler in order to enable the relevant optimizations, that is to say
*-funroll-loops* for unrolling and *-ftree-vectorize* for
vectorization.

Pragma Loop_Variant
===================

Syntax:


::

  pragma Loop_Variant ( LOOP_VARIANT_ITEM {, LOOP_VARIANT_ITEM } );
  LOOP_VARIANT_ITEM ::= CHANGE_DIRECTION => discrete_EXPRESSION
  CHANGE_DIRECTION ::= Increases | Decreases


``Loop_Variant`` can only appear as one of the items in the sequence
of statements of a loop body, or nested inside block statements that
appear in the sequence of statements of a loop body.
It allows the specification of quantities which must always
decrease or increase in successive iterations of the loop. In its simplest
form, just one expression is specified, whose value must increase or decrease
on each iteration of the loop.

In a more complex form, multiple arguments can be given which are interpreted
in a nesting lexicographic manner. For example:

.. code-block:: ada

  pragma Loop_Variant (Increases => X, Decreases => Y);


specifies that each time through the loop either X increases, or X stays
the same and Y decreases. A ``Loop_Variant`` pragma ensures that the
loop is making progress. It can be useful in helping to show informally
or prove formally that the loop always terminates.

``Loop_Variant`` is an assertion whose effect can be controlled using
an ``Assertion_Policy`` with a check name of ``Loop_Variant``. The
policy can be ``Check`` to enable the loop variant check, ``Ignore``
to ignore the check (in which case the pragma has no effect on the program),
or ``Disable`` in which case the pragma is not even checked for correct
syntax.

Multiple ``Loop_Invariant`` and ``Loop_Variant`` pragmas that
apply to the same loop should be grouped in the same sequence of
statements.

The ``Loop_Entry`` attribute may be used within the expressions of the
``Loop_Variant`` pragma to refer to values on entry to the loop.

This is an assertion kind pragma that can associate a set of its arguments
with an assertion level. See SPARK 2014 Reference Manual, section
11.4.2.

Pragma Machine_Attribute
========================

Syntax:


::

  pragma Machine_Attribute (
    [Entity         =>] LOCAL_NAME,
    [Attribute_Name =>] static_string_EXPRESSION
 [, [Info           =>] static_EXPRESSION {, static_EXPRESSION}] );


Machine-dependent attributes can be specified for types and/or
declarations.  This pragma is semantically equivalent to
:samp:`__attribute__(({attribute_name}))` (if ``info`` is not
specified) or :samp:`__attribute__(({attribute_name(info})))`
or :samp:`__attribute__(({attribute_name(info,...})))` in GNU C,
where *attribute_name* is recognized by the compiler middle-end
or the ``TARGET_ATTRIBUTE_TABLE`` machine specific macro.  Note
that a string literal for the optional parameter ``info`` or the
following ones is transformed by default into an identifier,
which may make this pragma unusable for some attributes.
For further information see :title:`GNU Compiler Collection (GCC) Internals`.

Pragma Main
===========

Syntax::

  pragma Main
(MAIN_OPTION [, MAIN_OPTION]);

  MAIN_OPTION ::=
 [Stack_Size              =>] static_integer_EXPRESSION
  | [Task_Stack_Size_Default =>] static_integer_EXPRESSION
  | [Time_Slicing_Enabled    =>] static_boolean_EXPRESSION


This pragma is provided for compatibility with OpenVMS VAX Systems.  It has
no effect in GNAT, other than being syntax checked.

Pragma Main_Storage
===================

Syntax::

  pragma Main_Storage
 (MAIN_STORAGE_OPTION [, MAIN_STORAGE_OPTION]);

  MAIN_STORAGE_OPTION ::=
 [WORKING_STORAGE =>] static_SIMPLE_EXPRESSION
  | [TOP_GUARD       =>] static_SIMPLE_EXPRESSION


This pragma is provided for compatibility with OpenVMS VAX Systems.  It has
no effect in GNAT, other than being syntax checked.

.. _Pragma-Max_Queue_Length:

Pragma Max_Queue_Length
=======================

Syntax::

pragma Max_Queue_Length (static_integer_EXPRESSION);


This pragma is used to specify the maximum callers per entry queue for
individual protected entries and entry families. It accepts a single
integer (-1 or more) as a parameter and must appear after the declaration of an
entry.

A value of -1 represents no additional restriction on queue length.

Pragma Modifies
===============
.. index:: Modifies

Syntax:


::

  pragma Modifies (MODIFIES_SPECIFICATION);

  MODIFIES_SPECIFICATION ::=
   MODIFIES_CLAUSE
 | (MODIFIES_CLAUSE {, MODIFIES_CLAUSE});

  MODIFIES_CLAUSE ::= MODIFIED_OBJECTS { when GUARD }

  GUARD ::= boolean_EXPRESSION

  MODIFIED_OBJECTS ::= MODIFIED_OBJECT | (MODIFIED_OBJECT {, MODIFIED_OBJECT})

  MODIFIED_OBJECT ::=
   name
 | MODIFIED_OBJECT . all
 | MODIFIED_OBJECT . component_selector_name
 | MODIFIED_OBJECT (expression {, expression})

The ``Modifies`` pragma is intended to be an exact replacement for the
implementation-defined ``Modifies`` aspect, and shares its restrictions
and semantics.

This is an assertion kind pragma that can associate a set of its arguments
with an assertion level. See SPARK 2014 Reference Manual, section TBD.

Pragma No_Body
==============

Syntax:


.. code-block:: ada

  pragma No_Body;


There are a number of cases in which a package spec does not require a body,
and in fact a body is not permitted. GNAT will not permit the spec to be
compiled if there is a body around. The pragma No_Body allows you to provide
a body file, even in a case where no body is allowed. The body file must
contain only comments and a single No_Body pragma. This is recognized by
the compiler as indicating that no body is logically present.

This is particularly useful during maintenance when a package is modified in
such a way that a body needed before is no longer needed. The provision of a
dummy body with a No_Body pragma ensures that there is no interference from
earlier versions of the package body.

.. _Pragma-No_Caching:

Pragma No_Caching
=================

Syntax:

.. code-block:: ada

  pragma No_Caching [ (static_boolean_EXPRESSION) ];

For the semantics of this pragma, see the entry for aspect ``No_Caching`` in
the SPARK 2014 Reference Manual, section 7.1.2.

Pragma No_Component_Reordering
==============================

Syntax:


::

  pragma No_Component_Reordering [([Entity =>] type_LOCAL_NAME)];


``type_LOCAL_NAME`` must refer to a record type declaration in the current
declarative part. The effect is to preclude any reordering of components
for the layout of the record, i.e. the record is laid out by the compiler
in the order in which the components are declared textually. The form with
no argument is a configuration pragma which applies to all record types
declared in units to which the pragma applies and there is a requirement
that this pragma be used consistently within a partition.

.. _Pragma-No_Elaboration_Code_All:

Pragma No_Elaboration_Code_All
==============================

Syntax:


::

  pragma No_Elaboration_Code_All [(program_unit_NAME)];


This is a program unit pragma (there is also an equivalent aspect of the
same name) that establishes the restriction ``No_Elaboration_Code`` for
the current unit and any extended main source units (body and subunits).
It also has the effect of enforcing a transitive application of this
aspect, so that if any unit is implicitly or explicitly with'ed by the
current unit, it must also have the `No_Elaboration_Code_All` aspect set.
It may be applied to package or subprogram specs or their generic versions.

Pragma No_Heap_Finalization
===========================

Syntax:


::

  pragma No_Heap_Finalization [ (first_subtype_LOCAL_NAME) ];


Pragma ``No_Heap_Finalization`` may be used as a configuration pragma or as a
type-specific pragma.

In its configuration form, the pragma must appear within a configuration file
such as gnat.adc, without an argument. The pragma suppresses the call to
``Finalize`` for heap-allocated objects created through library-level named
access-to-object types in cases where the designated type requires finalization
actions.

In its type-specific form, the argument of the pragma must denote a
library-level named access-to-object type. The pragma suppresses the call to
``Finalize`` for heap-allocated objects created through the specific access type
in cases where the designated type requires finalization actions.

It is still possible to finalize such heap-allocated objects by explicitly
deallocating them.

A library-level named access-to-object type declared within a generic unit will
lose its ``No_Heap_Finalization`` pragma when the corresponding instance does not
appear at the library level.

.. _Pragma-No_Inline:

Pragma No_Inline
================

Syntax:


::

  pragma No_Inline (NAME {, NAME});


This pragma suppresses inlining for the callable entity or the instances of
the generic subprogram designated by ``NAME``, including inlining that
results from the use of pragma ``Inline``.  This pragma is always active,
in particular it is not subject to the use of option *-gnatn* or
*-gnatN*.  It is illegal to specify both pragma ``No_Inline`` and
pragma ``Inline_Always`` for the same ``NAME``.

.. _Pragma-No_Raise:

Pragma No_Raise
===============

Syntax:


::

  pragma No_Raise (subprogram_LOCAL_NAME {, subprogram_LOCAL_NAME});


Each ``subprogram_LOCAL_NAME`` argument must refer to one or more subprogram
declarations in the current declarative part.  A subprogram to which this
pragma is applied may not raise an exception that is not caught within it.
An implementation-defined check named `Raise_Check` is associated with the
pragma, and `Program_Error` is raised upon its failure (see RM 11.5(19/5)).

Pragma No_Return
================

Syntax:


::

  pragma No_Return (procedure_LOCAL_NAME {, procedure_LOCAL_NAME});


Each ``procedure_LOCAL_NAME`` argument must refer to one or more procedure
declarations in the current declarative part.  A procedure to which this
pragma is applied may not contain any explicit ``return`` statements.
In addition, if the procedure contains any implicit returns from falling
off the end of a statement sequence, then execution of that implicit
return will cause Program_Error to be raised.

One use of this pragma is to identify procedures whose only purpose is to raise
an exception. Another use of this pragma is to suppress incorrect warnings
about missing returns in functions, where the last statement of a function
statement sequence is a call to such a procedure.

Note that in Ada 2005 mode, this pragma is part of the language. It is
available in all earlier versions of Ada as an implementation-defined
pragma.

Pragma No_Strict_Aliasing
=========================

Syntax:


::

  pragma No_Strict_Aliasing [([Entity =>] type_LOCAL_NAME)];


``type_LOCAL_NAME`` must refer to an access type
declaration in the current declarative part.  The effect is to inhibit
strict aliasing optimization for the given type.  The form with no
arguments is a configuration pragma which applies to all access types
declared in units to which the pragma applies. For a detailed
description of the strict aliasing optimization, and the situations
in which it must be suppressed, see the section on Optimization and Strict Aliasing
in the :title:`GNAT User's Guide`.

This pragma currently has no effects on access to unconstrained array types.

.. _Pragma-No_Tagged_Streams:

Pragma No_Tagged_Streams
========================

Syntax:


::

  pragma No_Tagged_Streams [([Entity =>] tagged_type_LOCAL_NAME)];


Normally when a tagged type is introduced using a full type declaration,
part of the processing includes generating stream access routines to be
used by stream attributes referencing the type (or one of its subtypes
or derived types). This can involve the generation of significant amounts
of code which is wasted space if stream routines are not needed for the
type in question.

The ``No_Tagged_Streams`` pragma causes the generation of these stream
routines to be skipped, and any attempt to use stream operations on
types subject to this pragma will be statically rejected as illegal.

There are two forms of the pragma. The form with no arguments must appear
in a declarative sequence or in the declarations of a package spec. This
pragma affects all subsequent root tagged types declared in the declaration
sequence, and specifies that no stream routines be generated. The form with
an argument (for which there is also a corresponding aspect) specifies a
single root tagged type for which stream routines are not to be generated.

Once the pragma has been given for a particular root tagged type, all subtypes
and derived types of this type inherit the pragma automatically, so the effect
applies to a complete hierarchy (this is necessary to deal with the class-wide
dispatching versions of the stream routines).

When pragmas ``Discard_Names`` and ``No_Tagged_Streams`` are simultaneously
applied to a tagged type its Expanded_Name and External_Tag are initialized
with empty strings. This is useful to avoid exposing entity names at binary
level but has a negative impact on the debuggability of tagged types.

Pragma Normalize_Scalars
========================

Syntax:


.. code-block:: ada

  pragma Normalize_Scalars;


This is a language defined pragma which is fully implemented in GNAT.  The
effect is to cause all scalar objects that are not otherwise initialized
to be initialized.  The initial values are implementation dependent and
are as follows:



*Standard.Character*
  Objects whose root type is Standard.Character are initialized to
  Character'Last unless the subtype range excludes NUL (in which case
  NUL is used). This choice will always generate an invalid value if
  one exists.


*Standard.Wide_Character*
  Objects whose root type is Standard.Wide_Character are initialized to
  Wide_Character'Last unless the subtype range excludes NUL (in which case
  NUL is used). This choice will always generate an invalid value if
  one exists.


*Standard.Wide_Wide_Character*
  Objects whose root type is Standard.Wide_Wide_Character are initialized to
  the invalid value 16#FFFF_FFFF# unless the subtype range excludes NUL (in
  which case NUL is used). This choice will always generate an invalid value if
  one exists.


*Integer types*
  Objects of an integer type are treated differently depending on whether
  negative values are present in the subtype. If no negative values are
  present, then all one bits is used as the initial value except in the
  special case where zero is excluded from the subtype, in which case
  all zero bits are used. This choice will always generate an invalid
  value if one exists.

  For subtypes with negative values present, the largest negative number
  is used, except in the unusual case where this largest negative number
  is in the subtype, and the largest positive number is not, in which case
  the largest positive value is used. This choice will always generate
  an invalid value if one exists.


*Floating-Point Types*
  Objects of all floating-point types are initialized to all 1-bits. For
  standard IEEE format, this corresponds to a NaN (not a number) which is
  indeed an invalid value.


*Fixed-Point Types*
  Objects of all fixed-point types are treated as described above for integers,
  with the rules applying to the underlying integer value used to represent
  the fixed-point value.


*Modular types*
  Objects of a modular type are initialized to all one bits, except in
  the special case where zero is excluded from the subtype, in which
  case all zero bits are used. This choice will always generate an
  invalid value if one exists.


*Enumeration types*
  Objects of an enumeration type are initialized to all one-bits, i.e., to
  the value ``2 ** typ'Size - 1`` unless the subtype excludes the literal
  whose Pos value is zero, in which case a code of zero is used. This choice
  will always generate an invalid value if one exists.

.. _Pragma_Obsolescent:

Pragma Obsolescent
==================

Syntax:


::

  pragma Obsolescent;

  pragma Obsolescent (
 [Message =>] static_string_EXPRESSION
  [,[Version =>] Ada_05]);

  pragma Obsolescent (
 [Entity  =>] NAME
  [,[Message =>] static_string_EXPRESSION
  [,[Version =>] Ada_05]]);


This pragma can occur immediately following a declaration of an entity,
including the case of a record component. If no Entity argument is present,
then this declaration is the one to which the pragma applies. If an Entity
parameter is present, it must either match the name of the entity in this
declaration, or alternatively, the pragma can immediately follow an enumeration
type declaration, where the Entity argument names one of the enumeration
literals.

This pragma is used to indicate that the named entity
is considered obsolescent and should not be used. Typically this is
used when an API must be modified by eventually removing or modifying
existing subprograms or other entities. The pragma can be used at an
intermediate stage when the entity is still present, but will be
removed later.

The effect of this pragma is to output a warning message on a reference to
an entity thus marked that the subprogram is obsolescent if the appropriate
warning option in the compiler is activated. If the ``Message`` parameter is
present, then a second warning message is given containing this text. In
addition, a reference to the entity is considered to be a violation of pragma
``Restrictions (No_Obsolescent_Features)``.

This pragma can also be used as a program unit pragma for a package,
in which case the entity name is the name of the package, and the
pragma indicates that the entire package is considered
obsolescent. In this case a client ``with``\ ing such a package
violates the restriction, and the ``with`` clause is
flagged with warnings if the warning option is set.

If the ``Version`` parameter is present (which must be exactly
the identifier ``Ada_05``, no other argument is allowed), then the
indication of obsolescence applies only when compiling in Ada 2005
mode. This is primarily intended for dealing with the situations
in the predefined library where subprograms or packages
have become defined as obsolescent in Ada 2005
(e.g., in ``Ada.Characters.Handling``), but may be used anywhere.

The following examples show typical uses of this pragma:


.. code-block:: ada

  package p is
  pragma Obsolescent (p, Message => "use pp instead of p");
  end p;

  package q is
  procedure q2;
  pragma Obsolescent ("use q2new instead");

  type R is new integer;
  pragma Obsolescent
    (Entity  => R,
     Message => "use RR in Ada 2005",
     Version => Ada_05);

  type M is record
     F1 : Integer;
     F2 : Integer;
     pragma Obsolescent;
     F3 : Integer;
  end record;

  type E is (a, bc, 'd', quack);
  pragma Obsolescent (Entity => bc)
  pragma Obsolescent (Entity => 'd')

  function "+"
    (a, b : character) return character;
  pragma Obsolescent (Entity => "+");
  end;


Note that, as for all pragmas, if you use a pragma argument identifier,
then all subsequent parameters must also use a pragma argument identifier.
So if you specify ``Entity =>`` for the ``Entity`` argument, and a ``Message``
argument is present, it must be preceded by ``Message =>``.

Pragma Optimize_Alignment
=========================
.. index:: Alignment, default settings

Syntax:


.. code-block:: ada

  pragma Optimize_Alignment (TIME | SPACE | OFF);


This is a configuration pragma which affects the choice of default alignments
for types and objects where no alignment is explicitly specified. There is a
time/space trade-off in the selection of these values. Large alignments result
in more efficient code, at the expense of larger data space, since sizes have
to be increased to match these alignments. Smaller alignments save space, but
the access code is slower. The normal choice of default alignments for types
and individual alignment promotions for objects (which is what you get if you
do not use this pragma, or if you use an argument of OFF), tries to balance
these two requirements.

Specifying SPACE causes smaller default alignments to be chosen in two cases.
First any packed record is given an alignment of 1. Second, if a size is given
for the type, then the alignment is chosen to avoid increasing this size. For
example, consider:


.. code-block:: ada

  type R is record
     X : Integer;
     Y : Character;
  end record;

  for R'Size use 5*8;


In the default mode, this type gets an alignment of 4, so that access to the
Integer field X are efficient. But this means that objects of the type end up
with a size of 8 bytes. This is a valid choice, since sizes of objects are
allowed to be bigger than the size of the type, but it can waste space if for
example fields of type R appear in an enclosing record. If the above type is
compiled in ``Optimize_Alignment (Space)`` mode, the alignment is set to 1.

However, there is one case in which SPACE is ignored. If a variable length
record (that is a discriminated record with a component which is an array
whose length depends on a discriminant), has a pragma Pack, then it is not
in general possible to set the alignment of such a record to one, so the
pragma is ignored in this case (with a warning).

Specifying SPACE also disables alignment promotions for standalone objects,
which occur when the compiler increases the alignment of a specific object
without changing the alignment of its type.

Specifying SPACE also disables component reordering in unpacked record types,
which can result in larger sizes in order to meet alignment requirements.

Specifying TIME causes larger default alignments to be chosen in the case of
small types with sizes that are not a power of 2. For example, consider:


.. code-block:: ada

  type R is record
     A : Character;
     B : Character;
     C : Boolean;
  end record;

  pragma Pack (R);
  for R'Size use 17;


The default alignment for this record is normally 1, but if this type is
compiled in ``Optimize_Alignment (Time)`` mode, then the alignment is set
to 4, which wastes space for objects of the type, since they are now 4 bytes
long, but results in more efficient access when the whole record is referenced.

As noted above, this is a configuration pragma, and there is a requirement
that all units in a partition be compiled with a consistent setting of the
optimization setting. This would normally be achieved by use of a configuration
pragma file containing the appropriate setting. The exception to this rule is
that units with an explicit configuration pragma in the same file as the source
unit are excluded from the consistency check, as are all predefined units. The
latter are compiled by default in pragma Optimize_Alignment (Off) mode if no
pragma appears at the start of the file.

Pragma Ordered
==============

Syntax:


.. code-block:: ada

  pragma Ordered (enumeration_first_subtype_LOCAL_NAME);


Most enumeration types are from a conceptual point of view unordered.
For example, consider:


.. code-block:: ada

  type Color is (Red, Blue, Green, Yellow);


By Ada semantics ``Blue > Red`` and ``Green > Blue``,
but really these relations make no sense; the enumeration type merely
specifies a set of possible colors, and the order is unimportant.

For unordered enumeration types, it is generally a good idea if
clients avoid comparisons (other than equality or inequality) and
explicit ranges. (A *client* is a unit where the type is referenced,
other than the unit where the type is declared, its body, and its subunits.)
For example, if code buried in some client says:


.. code-block:: ada

  if Current_Color < Yellow then ...
  if Current_Color in Blue .. Green then ...


then the client code is relying on the order, which is undesirable.
It makes the code hard to read and creates maintenance difficulties if
entries have to be added to the enumeration type. Instead,
the code in the client should list the possibilities, or an
appropriate subtype should be declared in the unit that declares
the original enumeration type. E.g., the following subtype could
be declared along with the type ``Color``:


.. code-block:: ada

  subtype RBG is Color range Red .. Green;


and then the client could write:


.. code-block:: ada

  if Current_Color in RBG then ...
  if Current_Color = Blue or Current_Color = Green then ...


However, some enumeration types are legitimately ordered from a conceptual
point of view. For example, if you declare:


.. code-block:: ada

  type Day is (Mon, Tue, Wed, Thu, Fri, Sat, Sun);


then the ordering imposed by the language is reasonable, and
clients can depend on it, writing for example:


.. code-block:: ada

  if D in Mon .. Fri then ...
  if D < Wed then ...


The pragma *Ordered* is provided to mark enumeration types that
are conceptually ordered, alerting the reader that clients may depend
on the ordering. GNAT provides a pragma to mark enumerations as ordered
rather than one to mark them as unordered, since in our experience,
the great majority of enumeration types are conceptually unordered.

The types ``Boolean``, ``Character``, ``Wide_Character``,
and ``Wide_Wide_Character``
are considered to be ordered types, so each is declared with a
pragma ``Ordered`` in package ``Standard``.

Normally pragma ``Ordered`` serves only as documentation and a guide for
coding standards, but GNAT provides a warning switch *-gnatw.u* that
requests warnings for inappropriate uses (comparisons and explicit
subranges) for unordered types. If this switch is used, then any
enumeration type not marked with pragma ``Ordered`` will be considered
as unordered, and will generate warnings for inappropriate uses.

Note that generic types are not considered ordered or unordered (since the
template can be instantiated for both cases), so we never generate warnings
for the case of generic enumerated types.

For additional information please refer to the description of the
*-gnatw.u* switch in the GNAT User's Guide.

Pragma Overflow_Mode
====================

Syntax:


::

  pragma Overflow_Mode
(  [General    =>] MODE
 [,[Assertions =>] MODE]);

  MODE ::= STRICT | MINIMIZED | ELIMINATED


This pragma sets the current overflow mode to the given setting. For details
of the meaning of these modes, please refer to the
'Overflow Check Handling in GNAT' appendix in the
GNAT User's Guide. If only the ``General`` parameter is present,
the given mode applies to all expressions. If both parameters are present,
the ``General`` mode applies to expressions outside assertions, and
the ``Eliminated`` mode applies to expressions within assertions.

The case of the ``MODE`` parameter is ignored,
so ``MINIMIZED``, ``Minimized`` and
``minimized`` all have the same effect.

The ``Overflow_Mode`` pragma has the same scoping and placement
rules as pragma ``Suppress``, so it can occur either as a
configuration pragma, specifying a default for the whole
program, or in a declarative scope, where it applies to the
remaining declarations and statements in that scope.

The pragma ``Suppress (Overflow_Check)`` suppresses
overflow checking, but does not affect the overflow mode.

The pragma ``Unsuppress (Overflow_Check)`` unsuppresses (enables)
overflow checking, but does not affect the overflow mode.

Pragma Overriding_Renamings
===========================
.. index:: Rational profile

.. index:: Rational compatibility

Syntax:


.. code-block:: ada

  pragma Overriding_Renamings;


This is a GNAT configuration pragma to simplify porting
legacy code accepted by the Rational
Ada compiler. In the presence of this pragma, a renaming declaration that
renames an inherited operation declared in the same scope is legal if selected
notation is used as in:


.. code-block:: ada

  pragma Overriding_Renamings;
  ...
  package R is
 function F (..);
 ...
 function F (..) renames R.F;
  end R;


even though
RM 8.3 (15) stipulates that an overridden operation is not visible within the
declaration of the overriding operation.

.. _Pragma-Part_Of:

Pragma Part_Of
==============

Syntax:

.. code-block:: ada

  pragma Part_Of (ABSTRACT_STATE);

  ABSTRACT_STATE ::= NAME

For the semantics of this pragma, see the entry for aspect ``Part_Of`` in the
SPARK 2014 Reference Manual, section 7.2.6.

Pragma Partition_Elaboration_Policy
===================================

Syntax:


::

  pragma Partition_Elaboration_Policy (POLICY_IDENTIFIER);

  POLICY_IDENTIFIER ::= Concurrent | Sequential


This pragma is standard in Ada 2005, but is available in all earlier
versions of Ada as an implementation-defined pragma.
See Ada 2012 Reference Manual for details.

Pragma Passive
==============

Syntax:


::

  pragma Passive [(Semaphore | No)];


Syntax checked, but otherwise ignored by GNAT.  This is recognized for
compatibility with DEC Ada 83 implementations, where it is used within a
task definition to request that a task be made passive.  If the argument
``Semaphore`` is present, or the argument is omitted, then DEC Ada 83
treats the pragma as an assertion that the containing task is passive
and that optimization of context switch with this task is permitted and
desired.  If the argument ``No`` is present, the task must not be
optimized.  GNAT does not attempt to optimize any tasks in this manner
(since protected objects are available in place of passive tasks).

For more information on the subject of passive tasks, see the section
'Passive Task Optimization' in the GNAT Users Guide.

.. _Pragma-Persistent_BSS:

Pragma Persistent_BSS
=====================

Syntax:


::

  pragma Persistent_BSS [(object_LOCAL_NAME)]


This pragma allows selected objects to be placed in the ``.persistent_bss``
section. On some targets the linker and loader provide for special
treatment of this section, allowing a program to be reloaded without
affecting the contents of this data (hence the name persistent).

There are two forms of usage. If an argument is given, it must be the
local name of a library-level object, with no explicit initialization
and whose type is potentially persistent. If no argument is given, then
the pragma is a configuration pragma, and applies to all library-level
objects with no explicit initialization of potentially persistent types.

A potentially persistent type is a scalar type, or an untagged,
non-discriminated record, all of whose components have no explicit
initialization and are themselves of a potentially persistent type,
or an array, all of whose constraints are static, and whose component
type is potentially persistent.

If this pragma is used on a target where this feature is not supported,
then the pragma will be ignored. See also ``pragma Linker_Section``.

Pragma Post
===========
.. index:: Post

.. index:: Checks, postconditions


Syntax:


.. code-block:: ada

  pragma Post (Boolean_Expression);


The ``Post`` pragma is intended to be an exact replacement for
the language-defined
``Post`` aspect, and shares its restrictions and semantics.
It must appear either immediately following the corresponding
subprogram declaration (only other pragmas may intervene), or
if there is no separate subprogram declaration, then it can
appear at the start of the declarations in a subprogram body
(preceded only by other pragmas).

This is an assertion kind pragma that can associate a set of its arguments
with an assertion level. See SPARK 2014 Reference Manual, section
11.4.2.

Pragma Postcondition
====================
.. index:: Postcondition

.. index:: Checks, postconditions


Syntax:


::

  pragma Postcondition (
  [Check   =>] Boolean_Expression
[,[Message =>] String_Expression]);


The ``Postcondition`` pragma allows specification of automatic
postcondition checks for subprograms. These checks are similar to
assertions, but are automatically inserted just prior to the return
statements of the subprogram with which they are associated (including
implicit returns at the end of procedure bodies and associated
exception handlers).

In addition, the boolean expression which is the condition which
must be true may contain references to function'Result in the case
of a function to refer to the returned value.

``Postcondition`` pragmas may appear either immediately following the
(separate) declaration of a subprogram, or at the start of the
declarations of a subprogram body. Only other pragmas may intervene
(that is appear between the subprogram declaration and its
postconditions, or appear before the postcondition in the
declaration sequence in a subprogram body). In the case of a
postcondition appearing after a subprogram declaration, the
formal arguments of the subprogram are visible, and can be
referenced in the postcondition expressions.

The postconditions are collected and automatically tested just
before any return (implicit or explicit) in the subprogram body.
A postcondition is only recognized if postconditions are active
at the time the pragma is encountered. The compiler switch *gnata*
turns on all postconditions by default, and pragma ``Check_Policy``
with an identifier of ``Postcondition`` can also be used to
control whether postconditions are active.

The general approach is that postconditions are placed in the spec
if they represent functional aspects which make sense to the client.
For example we might have:


.. code-block:: ada

  function Direction return Integer;
  pragma Postcondition
   (Direction'Result = +1
      or else
    Direction'Result = -1);


which serves to document that the result must be +1 or -1, and
will test that this is the case at run time if postcondition
checking is active.

Postconditions within the subprogram body can be used to
check that some internal aspect of the implementation,
not visible to the client, is operating as expected.
For instance if a square root routine keeps an internal
counter of the number of times it is called, then we
might have the following postcondition:


.. code-block:: ada

  Sqrt_Calls : Natural := 0;

  function Sqrt (Arg : Float) return Float is
    pragma Postcondition
      (Sqrt_Calls = Sqrt_Calls'Old + 1);
    ...
  end Sqrt


As this example, shows, the use of the ``Old`` attribute
is often useful in postconditions to refer to the state on
entry to the subprogram.

Note that postconditions are only checked on normal returns
from the subprogram. If an abnormal return results from
raising an exception, then the postconditions are not checked.

If a postcondition fails, then the exception
``System.Assertions.Assert_Failure`` is raised. If
a message argument was supplied, then the given string
will be used as the exception message. If no message
argument was supplied, then the default message has
the form "Postcondition failed at file_name:line". The
exception is raised in the context of the subprogram
body, so it is possible to catch postcondition failures
within the subprogram body itself.

Within a package spec, normal visibility rules
in Ada would prevent forward references within a
postcondition pragma to functions defined later in
the same package. This would introduce undesirable
ordering constraints. To avoid this problem, all
postcondition pragmas are analyzed at the end of
the package spec, allowing forward references.

The following example shows that this even allows
mutually recursive postconditions as in:


.. code-block:: ada

  package Parity_Functions is
  function Odd  (X : Natural) return Boolean;
  pragma Postcondition
    (Odd'Result =
       (x = 1
         or else
       (x /= 0 and then Even (X - 1))));

  function Even (X : Natural) return Boolean;
  pragma Postcondition
    (Even'Result =
       (x = 0
         or else
       (x /= 1 and then Odd (X - 1))));

  end Parity_Functions;


There are no restrictions on the complexity or form of
conditions used within ``Postcondition`` pragmas.
The following example shows that it is even possible
to verify performance behavior.


.. code-block:: ada

  package Sort is

  Performance : constant Float;
  --  Performance constant set by implementation
  --  to match target architecture behavior.

  procedure Treesort (Arg : String);
  --  Sorts characters of argument using N*logN sort
  pragma Postcondition
    (Float (Clock - Clock'Old) <=
       Float (Arg'Length) *
       log (Float (Arg'Length)) *
       Performance);
  end Sort;


Note: postcondition pragmas associated with subprograms that are
marked as Inline_Always, or those marked as Inline with front-end
inlining (-gnatN option set) are accepted and legality-checked
by the compiler, but are ignored at run-time even if postcondition
checking is enabled.

Note that pragma ``Postcondition`` differs from the language-defined
``Post`` aspect (and corresponding ``Post`` pragma) in allowing
multiple occurrences, allowing occurrences in the body even if there
is a separate spec, and allowing a second string parameter, and the
use of the pragma identifier ``Check``. Historically, pragma
``Postcondition`` was implemented prior to the development of
Ada 2012, and has been retained in its original form for
compatibility purposes.

This is an assertion kind pragma that can associate a set of its arguments
with an assertion level. See SPARK 2014 Reference Manual, section
11.4.2.

Pragma Post_Class
=================
.. index:: Post

.. index:: Checks, postconditions


Syntax:


.. code-block:: ada

  pragma Post_Class (Boolean_Expression);


The ``Post_Class`` pragma is intended to be an exact replacement for
the language-defined
``Post'Class`` aspect, and shares its restrictions and semantics.
It must appear either immediately following the corresponding
subprogram declaration (only other pragmas may intervene), or
if there is no separate subprogram declaration, then it can
appear at the start of the declarations in a subprogram body
(preceded only by other pragmas).

Note: This pragma is called ``Post_Class`` rather than
``Post'Class`` because the latter would not be strictly
conforming to the allowed syntax for pragmas. The motivation
for providing pragmas equivalent to the aspects is to allow a program
to be written using the pragmas, and then compiled if necessary
using an Ada compiler that does not recognize the pragmas or
aspects, but is prepared to ignore the pragmas. The assertion
policy that controls this pragma is ``Post'Class``, not
``Post_Class``.

This is an assertion kind pragma that can associate a set of its arguments
with an assertion level. See SPARK 2014 Reference Manual, section
11.4.2.

Pragma Pre
==========
.. index:: Pre

.. index:: Checks, preconditions


Syntax:


.. code-block:: ada

  pragma Pre (Boolean_Expression);


The ``Pre`` pragma is intended to be an exact replacement for
the language-defined
``Pre`` aspect, and shares its restrictions and semantics.
It must appear either immediately following the corresponding
subprogram declaration (only other pragmas may intervene), or
if there is no separate subprogram declaration, then it can
appear at the start of the declarations in a subprogram body
(preceded only by other pragmas).

This is an assertion kind pragma that can associate a set of its arguments
with an assertion level. See SPARK 2014 Reference Manual, section
11.4.2.

Pragma Precondition
===================
.. index:: Preconditions

.. index:: Checks, preconditions


Syntax:


::

  pragma Precondition (
  [Check   =>] Boolean_Expression
[,[Message =>] String_Expression]);


The ``Precondition`` pragma is similar to ``Postcondition``
except that the corresponding checks take place immediately upon
entry to the subprogram, and if a precondition fails, the exception
is raised in the context of the caller, and the attribute 'Result
cannot be used within the precondition expression.

Otherwise, the placement and visibility rules are identical to those
described for postconditions. The following is an example of use
within a package spec:


.. code-block:: ada

  package Math_Functions is
  ...
  function Sqrt (Arg : Float) return Float;
  pragma Precondition (Arg >= 0.0)
  ...
  end Math_Functions;


``Precondition`` pragmas may appear either immediately following the
(separate) declaration of a subprogram, or at the start of the
declarations of a subprogram body. Only other pragmas may intervene
(that is appear between the subprogram declaration and its
postconditions, or appear before the postcondition in the
declaration sequence in a subprogram body).

Note: precondition pragmas associated with subprograms that are
marked as Inline_Always, or those marked as Inline with front-end
inlining (-gnatN option set) are accepted and legality-checked
by the compiler, but are ignored at run-time even if precondition
checking is enabled.

Note that pragma ``Precondition`` differs from the language-defined
``Pre`` aspect (and corresponding ``Pre`` pragma) in allowing
multiple occurrences, allowing occurrences in the body even if there
is a separate spec, and allowing a second string parameter, and the
use of the pragma identifier ``Check``. Historically, pragma
``Precondition`` was implemented prior to the

Technical Documentation: gcc-mirror/gcc

Gcc Ada Doc Gnat Style (`gcc/ada/doc/gnat-style.rst`) Copy Section

GNAT Coding Style: A Guide for GNAT Developers

General Copy Chapter

Lexical Elements Copy Chapter

Declarations and Types Copy Chapter

Expressions and Names Copy Chapter

Statements Copy Chapter

Subprograms Copy Chapter

Packages and Visibility Rules Copy Chapter

Program Structure and Compilation Issues Copy Chapter

Gcc Ada Doc Gnat Rm (`gcc/ada/doc/gnat_rm.rst`) Copy Section

GNAT Reference Manual

Gcc Ada Doc Gnat Ugn (`gcc/ada/doc/gnat_ugn.rst`) Copy Section

GNAT User's Guide for Native Platforms

Gcc Doc Libgdiagnostics Index (`gcc/doc/libgdiagnostics/index.rst`) Copy Section

libgdiagnostics

Gcc Jit Docs Index (`gcc/jit/docs/index.rst`) Copy Section

libgccjit

Indices and tables

Gcc Ada Doc Gnat Rm About This Guide (`gcc/ada/doc/gnat_rm/about_this_guide.rst`) Copy Section

What This Reference Manual Contains

Conventions

Related Information

Gcc Ada Doc Gnat Rm Compatibility And Porting Guide (`gcc/ada/doc/gnat_rm/compatibility_and_porting_guide.rst`) Copy Section

Writing Portable Fixed-Point Declarations

Compatibility with Ada 83

Legal Ada 83 programs that are illegal in Ada 95 Copy Chapter

More deterministic semantics Copy Chapter

Changed semantics Copy Chapter

Other language compatibility issues Copy Chapter

Compatibility between Ada 95 and Ada 2005

Implementation-dependent characteristics

Implementation-defined pragmas Copy Chapter

Implementation-defined attributes Copy Chapter

Libraries Copy Chapter

Elaboration order Copy Chapter

Target-specific aspects Copy Chapter

Compatibility with Other Ada Systems

Representation Clauses

Compatibility with HP Ada 83

Gcc Ada Doc Gnat Rm Gnat Implementation Mode (`gcc/ada/doc/gnat_rm/gnat_implementation_mode.rst`) Copy Section

Language & Semantic Changes

Ada Version and Identifier Rules Copy Chapter

Limited Types Copy Chapter

Preelaboration and Categorization Copy Chapter

Overflow Copy Chapter

Miscellaneous Copy Chapter

ALI Files and Recompilation Copy Chapter

Gcc Ada Doc Gnat Rm Gnat Language Extensions (`gcc/ada/doc/gnat_rm/gnat_language_extensions.rst`) Copy Section

How to activate the extended GNAT Ada superset

Curated Extensions

Local Declarations Without Block Copy Chapter

Deep delta Aggregates Copy Chapter

Fixed lower bounds for array types and subtypes Copy Chapter

Prefixed-view notation for calls to primitive subprograms of untagged types Copy Chapter

Expression defaults for generic formal functions Copy Chapter

String interpolation Copy Chapter

Constrained attribute for generic objects Copy Chapter

``Static`` aspect on intrinsic functions Copy Chapter

First Controlling Parameter Copy Chapter

``Unsigned_Base_Range`` aspect Copy Chapter

Generalized Finalization Copy Chapter

Experimental Language Extensions

Conditional when constructs Copy Chapter

Implicit With Copy Chapter

Storage Model Copy Chapter

Attribute Super Copy Chapter

Simpler Accessibility Model Copy Chapter

Explore Related Technologies & Topics

Gcc Ada Doc Gnat Style (`gcc/ada/doc/gnat-style.rst`)

General

Lexical Elements

Declarations and Types

Expressions and Names

Statements

Subprograms

Packages and Visibility Rules

Program Structure and Compilation Issues

Gcc Ada Doc Gnat Rm (`gcc/ada/doc/gnat_rm.rst`)

Gcc Ada Doc Gnat Ugn (`gcc/ada/doc/gnat_ugn.rst`)

Gcc Doc Libgdiagnostics Index (`gcc/doc/libgdiagnostics/index.rst`)

Gcc Jit Docs Index (`gcc/jit/docs/index.rst`)

Gcc Ada Doc Gnat Rm About This Guide (`gcc/ada/doc/gnat_rm/about_this_guide.rst`)

Gcc Ada Doc Gnat Rm Compatibility And Porting Guide (`gcc/ada/doc/gnat_rm/compatibility_and_porting_guide.rst`)

Legal Ada 83 programs that are illegal in Ada 95

More deterministic semantics

Changed semantics

Other language compatibility issues

Implementation-defined pragmas

Implementation-defined attributes

Libraries

Elaboration order

Target-specific aspects

Gcc Ada Doc Gnat Rm Gnat Implementation Mode (`gcc/ada/doc/gnat_rm/gnat_implementation_mode.rst`)

Ada Version and Identifier Rules

Limited Types

Preelaboration and Categorization

Overflow

Miscellaneous

ALI Files and Recompilation

Gcc Ada Doc Gnat Rm Gnat Language Extensions (`gcc/ada/doc/gnat_rm/gnat_language_extensions.rst`)

Local Declarations Without Block

Deep delta Aggregates

Fixed lower bounds for array types and subtypes

Prefixed-view notation for calls to primitive subprograms of untagged types

Expression defaults for generic formal functions

String interpolation

Constrained attribute for generic objects

``Static`` aspect on intrinsic functions

First Controlling Parameter

``Unsigned_Base_Range`` aspect

Generalized Finalization

Conditional when constructs

Implicit With

Storage Model

Attribute Super

Simpler Accessibility Model