5 ms·

> If a situation has been statically determined to invoke UB that should be a compile time error. That's simply not how the compiler works. There is (presumab

by tpush 4y ago

> If a situation has been statically determined to invoke UB that should be a compile time error. That's simply not how the compiler works. There is (presumably, I haven't actually looked) no boolean function in GCC called is_undefined_behavior(). It's just that each optimization part of the compiler can (and does) assume that UB doesn't happen, and results like the article's are then essentially emergent behavior. See also: https://blog.regehr.org/archives/213 https://blog.regehr.org/archives/213

benj111 4y ago
It is undefined behaviour if I write GCC --hlep Does that mean it's acceptable for GCC to reformat my hard drive? Just because something is UD doesn't give anyone a license to do crazy things. If I misspell --help I expect the program to do something reasonable. If I invoke UD I still expect the program to do something reasonable. Removing checks for an overflow because overflows 'can't happen' is just crazy. UD is supposed to allow C to be implemented on different architectures if you don't know whether it will overflow to INT_MIN it makes sense to leave the implementation open. If I, the user knows what happens when an int overflows then I should be able to make use of that and guard against it myself. A compiler undermining that is a bug and user hostile.
- tpush 4y ago
  > It is undefined behaviour if I write GCC --hlep No, it's not, and I don't know why you'd think so. UB is a concept applying to C programs, not GCC invocations. > UD is supposed to allow C to be implemented on different architectures if you don't know whether it will overflow to INT_MIN it makes sense to leave the implementation open. If I, the user knows what happens when an int overflows then I should be able to make use of that and guard against it myself. I think you're confusing UB with unspecified and implementation defined behavior. It's fine if you think something shouldn't be UB, but you have to go lobbying the C standard for that. Compiler writers aren't to blame here.
  - formerly_proven 4y ago
    This has come up before, because, in some technical sense, the C standard does indeed not define what a "gcc" is, so "gcc --help" is undefined behavior according to the C standard, because the C standard does not define the behavior. By the same token, instrument flight rules are undefined behavior. A slightly less textualist approach to language recognizes that when we talk about C and UB, we mean behavior, which is undefined, of operations otherwise defined by the C standard.
    - tpush 4y ago
      I think this is confusing undefined behavior with behavior of something that is undefined. And either way, the C standard explicitly applies to C programs, so even this cute "textualist" interpretation would be wrong, IMO.
    - benj111 4y ago
      Do you know what a metaphor is? No GCC --hlep isn't in the c standard. But it is a simple example to illustrate how programs react when it receives something that isn't in the spec. GCC could do anything with Gcc --hlep just like it could do anything with INT_MAX + 1. That doesnt mean that all options open to it are reasonable. If I typed in GCC --hlep I would be reasonably pissed that it deleted my hard drive. You pointing out that GCC never made any claims about what would happen if I did that doesn't make it ok. If you come across UD, there's reasonable and unreasonable ways to deal with that. Reformatting your hard drive which is presumably allowed by the C standard isn't reasonable. I would contend that removing checks is also unreasonable.
      - ehvatum 4y ago
        > I would contend that removing checks is also unreasonable. Yeah, but removing a null check after a dereference has a solid rationale, so it’s very different from GCC taking it upon itself to format your drive.
        benj111 4y ago
- roblabla 4y ago
  > UD is supposed to allow C to be implemented on different architectures No, that's wrong. Implementation-Defined Behavior is supposed to allow C to be implemented on different architectures. In those cases, the implementation must define the behavior itself, and stick with it. UB, on the other hand, exists for compiler authors to optimize. If you want to be mad at someone, be mad at the C standard for defining so much stuff as UB instead of implementation-defined behavior. Integer overflow should really be implementation-defined instead.
  - astrange 4y ago
    Not only to optimize but to write safety tools. If you defined all the behavior, and then someone used some rare behavior like integer overflow by accident, it'd be harder to detect that since you have to assume it was intentional.
  - fps_doug 4y ago
    But then again, UB doesn't mean the compiler author can't treat it as implementation-defined and do something reasonable.
    - dzaima 4y ago
      And sanitizers that throw warnings on undefined behavior do indeed exist.
    - tuyiown 4y ago
      You're getting it backward. UB doesn't immediately stop compilation only due to implementation defined backward compatibility, just because you don't want to break compilation of existing programs each time the compiler converges to the C spec and identified an implementation of undefined behavior. And since you want some cross-compiler compatibility, you also import's third parties implementation defined UB. This is not some conceptual reasonable decision, the proper way would be to throw out compilation on each UB behavior. The reality is that the proper way would be too harsh on existing codebase, making people use a less strict compiler or not updating version, which are non-desirable effects for compilers writers.
- tmtvl 4y ago
  It is undefined behaviour if I write GCC --hlep Well no, it's a compilation error, you need at the very least a semicolon after hlep and from there on it depends on what GCC is. If it's a function you need parentheses around --hlep, if it's a type you need to remove the --, if it's a variable you need to put a semicolon after it,... Because GCC is all-caps I'm guessing it's a macro, so here's an example of how you could write it (though it won't be UB): https://godbolt.org/z/dYMddrTjj https://godbolt.org/z/dYMddrTjj
  - benj111 4y ago
    I'm not sure if you're supporting my pov by showing the absurdity of the other position??? Yeah sure, if my phone auto incorrects gcc to GCC then that is technically meaningless so you're completely free to interpret my comment how you want. ..... Although..... GCC stands for GNU Compiler Collection so it can be reasonably capitalised, so maybe then, rather than saying anything goes we should do something reasonable because then you aren't left saying something really stupid if you're wrong???
    - gpderetta 4y ago
      Parent point is when the standard talks about UB it refers about translating C code. So parent cheekly interpreted your comment about command line flags (which are outside the remit of the standard) as code instead. I thought it was fitting.
deleted 4y ago
[deleted]
MichaelBurge 4y ago
C++ bans undefined behavior in constexpr, so you can force GCC to prove that code has no undefined behavior by sprinkling it in declarations where applicable: https://shafik.github.io/c++/undefined%20behavior/2019/05/11/explporing_undefined_behavior_using_constexpr.html https://shafik.github.io/c++/undefined%20behavior/2019/05/11...
- account42 4y ago
  Constant-evaluated expressions with undefined behavior are ill-formed but constexpr annotated functions which may in some invocations result in undefined behavior are not.

by tpush 4y ago

benj111 4y ago

It is undefined behaviour if I write GCC --hlep Does that mean it's acceptable for GCC to reformat my hard drive? Just because something is UD doesn't give anyone a license to do crazy things. If I misspell --help I expect the program to do something reasonable. If I invoke UD I still expect the program to do something reasonable. Removing checks for an overflow because overflows 'can't happen' is just crazy. UD is supposed to allow C to be implemented on different architectures if you don't know whether it will overflow to INT_MIN it makes sense to leave the implementation open. If I, the user knows what happens when an int overflows then I should be able to make use of that and guard against it myself. A compiler undermining that is a bug and user hostile.

tpush 4y ago
> It is undefined behaviour if I write GCC --hlep No, it's not, and I don't know why you'd think so. UB is a concept applying to C programs, not GCC invocations. > UD is supposed to allow C to be implemented on different architectures if you don't know whether it will overflow to INT_MIN it makes sense to leave the implementation open. If I, the user knows what happens when an int overflows then I should be able to make use of that and guard against it myself. I think you're confusing UB with unspecified and implementation defined behavior. It's fine if you think something shouldn't be UB, but you have to go lobbying the C standard for that. Compiler writers aren't to blame here.
- formerly_proven 4y ago
  This has come up before, because, in some technical sense, the C standard does indeed not define what a "gcc" is, so "gcc --help" is undefined behavior according to the C standard, because the C standard does not define the behavior. By the same token, instrument flight rules are undefined behavior. A slightly less textualist approach to language recognizes that when we talk about C and UB, we mean behavior, which is undefined, of operations otherwise defined by the C standard.
  - tpush 4y ago
    I think this is confusing undefined behavior with behavior of something that is undefined. And either way, the C standard explicitly applies to C programs, so even this cute "textualist" interpretation would be wrong, IMO.
  - benj111 4y ago
    Do you know what a metaphor is? No GCC --hlep isn't in the c standard. But it is a simple example to illustrate how programs react when it receives something that isn't in the spec. GCC could do anything with Gcc --hlep just like it could do anything with INT_MAX + 1. That doesnt mean that all options open to it are reasonable. If I typed in GCC --hlep I would be reasonably pissed that it deleted my hard drive. You pointing out that GCC never made any claims about what would happen if I did that doesn't make it ok. If you come across UD, there's reasonable and unreasonable ways to deal with that. Reformatting your hard drive which is presumably allowed by the C standard isn't reasonable. I would contend that removing checks is also unreasonable.
    - ehvatum 4y ago
      > I would contend that removing checks is also unreasonable. Yeah, but removing a null check after a dereference has a solid rationale, so it’s very different from GCC taking it upon itself to format your drive.
      - benj111 4y ago
roblabla 4y ago
> UD is supposed to allow C to be implemented on different architectures No, that's wrong. Implementation-Defined Behavior is supposed to allow C to be implemented on different architectures. In those cases, the implementation must define the behavior itself, and stick with it. UB, on the other hand, exists for compiler authors to optimize. If you want to be mad at someone, be mad at the C standard for defining so much stuff as UB instead of implementation-defined behavior. Integer overflow should really be implementation-defined instead.
- astrange 4y ago
  Not only to optimize but to write safety tools. If you defined all the behavior, and then someone used some rare behavior like integer overflow by accident, it'd be harder to detect that since you have to assume it was intentional.
- fps_doug 4y ago
  But then again, UB doesn't mean the compiler author can't treat it as implementation-defined and do something reasonable.
  - dzaima 4y ago
    And sanitizers that throw warnings on undefined behavior do indeed exist.
  - tuyiown 4y ago
    You're getting it backward. UB doesn't immediately stop compilation only due to implementation defined backward compatibility, just because you don't want to break compilation of existing programs each time the compiler converges to the C spec and identified an implementation of undefined behavior. And since you want some cross-compiler compatibility, you also import's third parties implementation defined UB. This is not some conceptual reasonable decision, the proper way would be to throw out compilation on each UB behavior. The reality is that the proper way would be too harsh on existing codebase, making people use a less strict compiler or not updating version, which are non-desirable effects for compilers writers.
tmtvl 4y ago
It is undefined behaviour if I write GCC --hlep Well no, it's a compilation error, you need at the very least a semicolon after hlep and from there on it depends on what GCC is. If it's a function you need parentheses around --hlep, if it's a type you need to remove the --, if it's a variable you need to put a semicolon after it,... Because GCC is all-caps I'm guessing it's a macro, so here's an example of how you could write it (though it won't be UB): https://godbolt.org/z/dYMddrTjj https://godbolt.org/z/dYMddrTjj
- benj111 4y ago
  I'm not sure if you're supporting my pov by showing the absurdity of the other position??? Yeah sure, if my phone auto incorrects gcc to GCC then that is technically meaningless so you're completely free to interpret my comment how you want. ..... Although..... GCC stands for GNU Compiler Collection so it can be reasonably capitalised, so maybe then, rather than saying anything goes we should do something reasonable because then you aren't left saying something really stupid if you're wrong???
  - gpderetta 4y ago
    Parent point is when the standard talks about UB it refers about translating C code. So parent cheekly interpreted your comment about command line flags (which are outside the remit of the standard) as code instead. I thought it was fitting.

deleted 4y ago

[deleted]

MichaelBurge 4y ago

C++ bans undefined behavior in constexpr, so you can force GCC to prove that code has no undefined behavior by sprinkling it in declarations where applicable: https://shafik.github.io/c++/undefined%20behavior/2019/05/11/explporing_undefined_behavior_using_constexpr.html https://shafik.github.io/c++/undefined%20behavior/2019/05/11...

account42 4y ago
Constant-evaluated expressions with undefined behavior are ill-formed but constexpr annotated functions which may in some invocations result in undefined behavior are not.