3 ms·

Clang is mathematically wrong in all but the first case. I'm not sure what it says about C++ conformance; the problem is likely Clang but I'm not sure how sound

by Tobu 13y ago

Clang is mathematically wrong in all but the first case. I'm not sure what it says about C++ conformance; the problem is likely Clang but I'm not sure how sound template metaprogramming or C++ templates are supposed to be.

aidenn0 13y ago
As others have noted, infinite template recursion is undefined. It could produce a program that does whatever it wants and still be conforming.
- Tobu 13y ago
  So the lack of soundness is in the C++ templates spec. Nevertheless, I think it's bad form for a compiler to take full advantage of undefined behaviour. Reinterpreting undefined behaviour as “should not compile” (failing that, “must crash”) is possible for almost all of C99; CompCert (formally verified C compiler) obviously does it, and the implementation is the easy part (formal verification being the complicated part).
  - cbsmith 13y ago
    > So the lack of soundness is in the C++ templates spec. That's not a lack of soundness. It's a lack of specificity. For cases like this, that's actually a feature, not a bug. > Nevertheless, I think it's bad form for a compiler to take full advantage of undefined behaviour. What exactly is "take full advantage of undefined behaviour"? Isn't any behaviour just as different from "undefined" as anything else? > Reinterpreting undefined behaviour as “should not compile” (failing that, “must crash”) is possible for almost all of C99; CompCert (formally verified C compiler) obviously does it, and the implementation is the easy part (formal verification being the complicated part). Clang not only has an ability to do this, it includes a flag to do a quick check specifically for undefined behaviour as well as an ability to provide a trap for undefined behaviour, which is terribly useful for tool builders.
  - aidenn0 13y ago
    So a compiler must emit a check for signed integer overflow on every integer operation? That seems absurd. It makes sense to optionally instrument for that (as clang offers) but is otherwise ridiculous.

by Tobu 13y ago

aidenn0 13y ago

As others have noted, infinite template recursion is undefined. It could produce a program that does whatever it wants and still be conforming.

Tobu 13y ago
So the lack of soundness is in the C++ templates spec. Nevertheless, I think it's bad form for a compiler to take full advantage of undefined behaviour. Reinterpreting undefined behaviour as “should not compile” (failing that, “must crash”) is possible for almost all of C99; CompCert (formally verified C compiler) obviously does it, and the implementation is the easy part (formal verification being the complicated part).
- cbsmith 13y ago
  > So the lack of soundness is in the C++ templates spec. That's not a lack of soundness. It's a lack of specificity. For cases like this, that's actually a feature, not a bug. > Nevertheless, I think it's bad form for a compiler to take full advantage of undefined behaviour. What exactly is "take full advantage of undefined behaviour"? Isn't any behaviour just as different from "undefined" as anything else? > Reinterpreting undefined behaviour as “should not compile” (failing that, “must crash”) is possible for almost all of C99; CompCert (formally verified C compiler) obviously does it, and the implementation is the easy part (formal verification being the complicated part). Clang not only has an ability to do this, it includes a flag to do a quick check specifically for undefined behaviour as well as an ability to provide a trap for undefined behaviour, which is terribly useful for tool builders.
- aidenn0 13y ago
  So a compiler must emit a check for signed integer overflow on every integer operation? That seems absurd. It makes sense to optionally instrument for that (as clang offers) but is otherwise ridiculous.