6 ms·

Enumerating Core Undefined Behavior

46 points by luu 7y ago

pjmlp 7y ago
Good to see this going forward.
mmmrk 7y ago
I don't know why, but I immensely enjoyed the use of that single emoji in the opening paragraph.
- silasdavis 7y ago
  Agreed a nice splash of figurative colour in a somewhat arid document...
taneq 7y ago
For years I've been growing steadily more worried about UB and its nebulous, Heisenfootgun nature. I got a few paragraphs into this noble work, scrolled down to check how much was yet to go, and decided to try reading the Rust book again. I mean, I'll stick with C/C++ for now. I can write 'good enough' code which does what I expect and seems to be reliable. I just hate the feeling that without spending a truly ungodly amount of time on it, even the best code is peppered with unknown unknowns waiting to bite me at some critical moment.
- quietbritishjim 7y ago
  I can highly recommend "Programming Rust" by Jim Blandy. Personally I found it got to the differences from C/C++ a lot quicker than the official Rust book. Of course Rust still has plenty of undefined behaviour, it is just restricted to unsafe blocks. (There are occasional exceptions, such as the infamous floating point cast bug [1].) [1] https://github.com/rust-lang/rust/issues/10184 https://github.com/rust-lang/rust/issues/10184
  - taneq 7y ago
    Thanks, I'll check it out! I don't mind there being some UB (in fact sometimes it's necessary, especially as I eventually want to use it on embedded targets that need to do all sorts of weird memory jiggery-pokery). I don't even mind bugs; all software has bugs. What I want to move away from is a language which embraces widespread and subtle UB as a design philosophy.
- classified 7y ago
  ++your_comment; Just the other day I saw an article here titled "Rust Lang in a nutshell" and I was thinking, "Rust" and "in a nutshell" have become a contradiction in terms, what with all the language's complexity. But seeing this litany of UB in C++ puts that very much in perspective. FWIW, I welcome this enumeration as a good overview but, wow, does it motivate me to consider alternatives.
- benibela 7y ago
  That is why I am using Pascal
- pingyong 7y ago
  Is this really such a big deal mentally? Idealized there are only two behaviors: Expected and unexpected. Whether that unexpected behavior is a result of UB, or implementation defined behavior, or logic errors, or unforeseen corner cases, doesn't in practice actually matter. Your computer isn't actually any more likely to cause a nuclear explosion because it hit UB than it is to do that because it hit some other kind of bug. Of course reducing and any kind of bug class is a plus, Rust is great, but I never had the feeling that my C++ code is more error prone than my Java or Python code just because some things are completely UB. What actually happens with UB is that the application crashes and/or data gets scrambled - I've yet to see my PC to feel free to stand up and walk away just because it was technically allowed to.
  - gpderetta 7y ago
    As someone that writes a lot of C++ and quite likes the language, I think it is feasible, given a team of experienced c++ programmers and a good testing infrastructure to write programs that trigger almost no UB for any reasonable input. What I worry about is the unreasonable (i.e. hostile) input.
    - fulafel 7y ago
      Thete are fewer amd fewer programs that only handle trusted input, as almost everything is networked.
    - dirtydroog 7y ago
      Really? Isn't is still the case that signed integer arithmetic can lead to UB? Despite this, there's a push for Almost Always Int from the C++ powers-that-be. https://stackoverflow.com/questions/16188263/is-signed-integer-overflow-still-undefined-behavior-in-c https://stackoverflow.com/questions/16188263/is-signed-integ...
      - shakna 7y ago
        C++20 specifies two's complement for signed integer arithmetic, like it was already for unsigned, which means most (basically everything except -INT_MIN) is now no longer UB. [0] http://www.open-std.org/jtc1/sc22/wg21/docs/papers/2018/p0907r4.html http://www.open-std.org/jtc1/sc22/wg21/docs/papers/2018/p090...
yaghmour 7y ago
For those interested in the four examples of crazy undefined behavior, you can see my tweet here: https://twitter.com/shafikyaghmour/status/1146028351666229250 https://twitter.com/shafikyaghmour/status/114602835166622925... Also there is an R1 version which hopefully will get discussed in the next meeting here: http://www.open-std.org/jtc1/sc22/wg21/docs/papers/2019/p1705r1.html http://www.open-std.org/jtc1/sc22/wg21/docs/papers/2019/p170...

46 points by luu 7y ago

pjmlp 7y ago

Good to see this going forward.

mmmrk 7y ago

I don't know why, but I immensely enjoyed the use of that single emoji in the opening paragraph.

silasdavis 7y ago
Agreed a nice splash of figurative colour in a somewhat arid document...

taneq 7y ago

For years I've been growing steadily more worried about UB and its nebulous, Heisenfootgun nature. I got a few paragraphs into this noble work, scrolled down to check how much was yet to go, and decided to try reading the Rust book again. I mean, I'll stick with C/C++ for now. I can write 'good enough' code which does what I expect and seems to be reliable. I just hate the feeling that without spending a truly ungodly amount of time on it, even the best code is peppered with unknown unknowns waiting to bite me at some critical moment.

quietbritishjim 7y ago
I can highly recommend "Programming Rust" by Jim Blandy. Personally I found it got to the differences from C/C++ a lot quicker than the official Rust book. Of course Rust still has plenty of undefined behaviour, it is just restricted to unsafe blocks. (There are occasional exceptions, such as the infamous floating point cast bug [1].) [1] https://github.com/rust-lang/rust/issues/10184 https://github.com/rust-lang/rust/issues/10184
- taneq 7y ago
  Thanks, I'll check it out! I don't mind there being some UB (in fact sometimes it's necessary, especially as I eventually want to use it on embedded targets that need to do all sorts of weird memory jiggery-pokery). I don't even mind bugs; all software has bugs. What I want to move away from is a language which embraces widespread and subtle UB as a design philosophy.
classified 7y ago
++your_comment; Just the other day I saw an article here titled "Rust Lang in a nutshell" and I was thinking, "Rust" and "in a nutshell" have become a contradiction in terms, what with all the language's complexity. But seeing this litany of UB in C++ puts that very much in perspective. FWIW, I welcome this enumeration as a good overview but, wow, does it motivate me to consider alternatives.
benibela 7y ago
That is why I am using Pascal
pingyong 7y ago
Is this really such a big deal mentally? Idealized there are only two behaviors: Expected and unexpected. Whether that unexpected behavior is a result of UB, or implementation defined behavior, or logic errors, or unforeseen corner cases, doesn't in practice actually matter. Your computer isn't actually any more likely to cause a nuclear explosion because it hit UB than it is to do that because it hit some other kind of bug. Of course reducing and any kind of bug class is a plus, Rust is great, but I never had the feeling that my C++ code is more error prone than my Java or Python code just because some things are completely UB. What actually happens with UB is that the application crashes and/or data gets scrambled - I've yet to see my PC to feel free to stand up and walk away just because it was technically allowed to.
- gpderetta 7y ago
  As someone that writes a lot of C++ and quite likes the language, I think it is feasible, given a team of experienced c++ programmers and a good testing infrastructure to write programs that trigger almost no UB for any reasonable input. What I worry about is the unreasonable (i.e. hostile) input.
  - fulafel 7y ago
    Thete are fewer amd fewer programs that only handle trusted input, as almost everything is networked.
  - dirtydroog 7y ago
    Really? Isn't is still the case that signed integer arithmetic can lead to UB? Despite this, there's a push for Almost Always Int from the C++ powers-that-be. https://stackoverflow.com/questions/16188263/is-signed-integer-overflow-still-undefined-behavior-in-c https://stackoverflow.com/questions/16188263/is-signed-integ...
    - shakna 7y ago
      C++20 specifies two's complement for signed integer arithmetic, like it was already for unsigned, which means most (basically everything except -INT_MIN) is now no longer UB. [0] http://www.open-std.org/jtc1/sc22/wg21/docs/papers/2018/p0907r4.html http://www.open-std.org/jtc1/sc22/wg21/docs/papers/2018/p090...

yaghmour 7y ago

For those interested in the four examples of crazy undefined behavior, you can see my tweet here: https://twitter.com/shafikyaghmour/status/1146028351666229250 https://twitter.com/shafikyaghmour/status/114602835166622925... Also there is an R1 version which hopefully will get discussed in the next meeting here: http://www.open-std.org/jtc1/sc22/wg21/docs/papers/2019/p1705r1.html http://www.open-std.org/jtc1/sc22/wg21/docs/papers/2019/p170...