7 ms·
This may be an instance of "you should really know the gcc/clang sanitizers and use them to test your code": clang test.c -O0 -fsanitize=undefined ./a.out [
by hannob 7y ago
This may be an instance of "you should really know the gcc/clang sanitizers and use them to test your code":
clang test.c -O0 -fsanitize=undefined
./a.out
[...]
test.c:17:12: runtime error: 9.22337e+18 is outside the range of representable values of type 'long'
Interestingly gcc doesn't throw that warning.
- htfy96 7y agoI Second this. Most weird behaviors in C++ today can be detected by ASAN and UBSAN. There also exists low-cost random-sampling-based ASAN implementation that can be enabled in production: Google uses GWP-ASAN for all server-side applications as well as Chrome on Windows/Mac. See https://www.youtube.com/watch?v=RQGWMLkwrKc https://www.youtube.com/watch?v=RQGWMLkwrKc for details.
- pjmlp 7y agoAccording to most surveys, they aren't used as much on real life. Here 14%, https://www.jetbrains.com/lp/devecosystem-2019/cpp/ https://www.jetbrains.com/lp/devecosystem-2019/cpp/ Here 40 - 55%, https://www.bfilipek.com/2019/12/cpp-status-2019.html https://www.bfilipek.com/2019/12/cpp-status-2019.html At CppCon 2015 or something, at Herb's question during his keynote, about 1% of the audience as per his comment on the video.
- htfy96 7y agoThis looks interesting. I was wondering if it's due to poor build tool support. In real life I found rr + sanitizer as a strictly better choice than plain gdb.
- tyingq 7y agoDoes that verifier have a strong possibility of false positives? I'm curious why C compilers have such a strong history of making reasonable checks optional and hidden behind a bunch of switches.
- jzwinck 7y agoUBSan and ASan have essentially zero false positives. They do point out undefined behavior which happens to work on your platform, but at the very least those are still portability bugs.
- Liquid_Fire 7y agoThis is a runtime check and so has a (small) performance overhead.
- hannob 7y agoNo, actually the false positive rate of these flags is practically zero. (I'm not sure if it's 100% zero, but I used those extensively, reported many bugs and every time a developer told me "this is a false positive" they were wrong.) The reason they aren't enabled by default is that that's not what they're designed for. They have a significant performance impact, you can't enable them all at once, they conflict with other security features and they may introduce security issues. These are developer features. They aren't there to run your production code, they are there to test during development and bug finding.
- saagarjha 7y agoHere's one that I encountered that I cannot figure out: $ g++ -x c++ -fsanitize=undefined - #include <iostream> int main() { int *a = nullptr; std::cout << std::addressof(*a) << std::endl; } ^D $ ./a.out <stdin>:5:29: runtime error: reference binding to null pointer of type 'int' 0
- lallysingh 7y agoDoesn't addressof() take a reference?
- Karliss 7y agoYou are not allowed to dereference a null pointer no matter how you use it even if you later convert it back to address.
- gameswithgo 7y agoor just start moving away from using c. the last five years have brought nice alternatives like zig and rust
- pjmlp 7y agoNot only the last 5 years, but I digress.
- Chlorus 7y agoYeah, it's kind of weird how little attention some of C's (historical)competitors in the systems programming space get. You'd think to see a lot of comparisons to whatever Ada* or Pascal would do in the same context. * Probably because the Ada practitioners are all trapped in Scifs somewhere in the inner mantle of the Earth.
- 0xdead 7y agoNo. I'd rather learn how to use my tools (that I have invested years to be comfortable with) properly than starting over.
- adamnemecek 7y agoC is not very productive.
- smabie 7y agoMaybe, but it’s super fun and elegant. C and Scheme are at the top of my “most elegant” list. Though, of course, for different reasons.
- erik_seaberg 7y agoI would have trouble convincing myself I'm capable of writing C that doesn't blow up randomly, when everyone else has been failing at that for my entire career and more.
- gnulinux 7y ago
- mulle_nat 7y agoThat's true. I am using memory sanitizers in my workflow, but I haven't been using the `undefined` sanitizer. This could have saved me a day worth of effort.
- ndesaulniers 7y agoJust yesterday I had upgraded the version of clang used to compile Android's emulator. It got reverted due to some post submit test failing suddenly. The test case was shifting values in a byte array into one value but the LHS of a left shift didn't have enough bits to represent the shift, which is explicit UB. The statement had multiple shift operations (and other sub expressions with templated types) so it wasn't immediately clear that was the issue. -fsanitize=undefined found it immediately. "Spot the UB" is seemingly becoming my pastime.