6 ms·
Can I just suggest that... forcing programmers to become language lawyers just so their language-lawyer compilers don't get overly clever and optimise away half
by Filligree 11y ago
Can I just suggest that... forcing programmers to become language lawyers just so their language-lawyer compilers don't get overly clever and optimise away half their program is probably a bad thing?
- aciuix 11y agoFor that to happen the programmer had to be overly clever in the first place, in which case it is his own fault. If you stick to what is taught in any good tutorial/book, you don't even have to think about problems like this. But if you decide to play with fire, then you should read the Standard and understand it.
- rcfox 11y agoIt's not hard to get into undefined behaviour territory with seemingly correct code. For example: signed integer overflow is undefined in C.
- aciuix 11y agoChecking future result of arithmetic where a wraparound is undesired or undefined, is a basic skill every C programmer should know. C is not a scripting language. If you use the tools available to you, and don't abuse the language, then it is fairly hard to cause undefined behavior.
- rcfox 11y agoIt's not always cut-and-dried: http://blog.regehr.org/archives/1139 http://blog.regehr.org/archives/1139
- aciuix 11y agoYou really shouldn't trust every article about C on the internet. Most of them make mistakes. If you are using gcc, you can start with the flag: -ftrapv. It does everything for you.
- rcfox 11y agoAh, but then you're not writing C anymore, you're writing GCC-flavoured C. If it helps: The author of that article, John Regehr, is a professor of computer science who spends a great deal of time studying undefined behaviour.
- deleted 11y ago[deleted]
- aciuix 11y agoYou are really something else: -Strawman argument. -Appeal to authority. Next time stick to the issue, you will find the debate will be much more rewarding for both parties.
- pgeorgi 11y agoAnd with every discussion of undefined behavior in C on this site, there's bound to be some user who's telling the world how they're "holding it wrong". I guess the best solution is to move to other languages (IIRC Ada and rust are relatively free from surprises in their UB) and let language lawyers optimize C to death (by attrition).
- pif 11y agoI don't get your point. Integer numbers have a finite valid range, and if you don't ensure that your program works only in this range, you are wrong. Whatever the compiler may do, it can't correct your error.
- wolf550e 11y agoMany programmers assume 2s complement and would like C to rely on this.
- rcfox 11y agoI guess it helps to give some context: unsigned integer overflow is defined. Some algorithms even exploit this behaviour to allow for simpler code. But even making sure that you stay within the valid range of your integer isn't necessarily enough; you need to check that you're still within the range without going outside of it.
- arielby 11y agoC's automatic conversions are more problematic than signed overflow itself.
- mikeash 11y agoWhat is seemingly correct about code that causes a signed integer overflow?
- cremno 11y agoOr just read the diagnostics and fix the code (or use UBSan). Clang outputs: >variable 'c' is used uninitialized whenever 'if' condition is false [-Wsometimes-uninitialized]
- userbinator 11y agoIn fact, I'd say that such optimisations which assume no UB and remove code as a result are probably working against the programmer's intention. From its origins as a "portable assembler", C was never supposed to be a very high-level language anyway; I think the compiler should optimise only with respect to things like instruction selection, and UB should be treated as "behaving during translation or program execution in a documented manner characteristic of the environment" (this is an actual quote from the standard.)
- rcfox 11y agoSure, but then we'd just be discussing undefined behaviour in the language that sprung up out of the desire to take advantage of the optimizations that the neutered C leaves on the table.
- Peaker 11y agoIf I write a bunch of code in a macro, or a function that happens to get inlined -- much of its code may be irrelevant in the specific context into which it was inlined. I don't want to duplicate the code for every single context it is used in -- so I'm happy the compiler can throw away pieces of the code that aren't relevant in each inlined context. OTOH, for ordinary non-inlined code, I really want a warning if my code is thrown away or optimized in a surprising manner. Indeed, gcc and clang try to behave according to the two ideas above. gcc violates this terribly with its removal of dead code warnings -- which may be eliminated but no warnings are generated.
- rcfox 11y agoSomeone says this every time the topic of undefined behaviour comes up. Ignoring the original portability concerns, there's a large of set of optimizations that are only possible if you can assume that no undefined behaviour occurs. Accessing past the bounds of an array is undefined, and generally a bad thing to do. If the compiler decides that a block of code could only run if you access outside of the array, why not delete that code? Surely, it'll never run! Even eliminating array bounds checking is an optimization that requires the assumption that you don't go past the end of the array. Languages like Java and Python pay a premium to ensure you don't do this on each iteration of your for loops.
- titzer 11y agoThere is essentially no C compiler that bounds checks arrays, so your comment is a total red herring. This is not an instance where exploiting UB leads to faster code. And, for Java, JITs do a lot of work to remove bounds checks from loops over arrays so that you end up with the fastest possible machine code.
- pm215 11y agoThe compilers not doing array bounds checks is exactly exploiting UB to give faster code. If out-of-bounds accesses were not UB (ie they had a defined behaviour) the compiler would be required to insert a bounds check in order to catch the case and ensure that the result was whatever the defined behaviour said it had to be. As you say, these days smart compilers can optimise to reduce the overhead of the bounds check; but the original 70s C compilers didn't try to be that smart.
- _yosefk 11y agoThe thing is, reading past the bounds of an array can be harmless at the machine level and useful for optimization. So it being UB means you've got a compiler which can optimize better but the cost is that you tied the programmer's hands, so the programmer's optimization opportunities are in fact reduced. And you didn't even tie them, the annoying thing is, rather you laid traps that they can fall into because of failing to notice them. (I'm not saying C made the wrong tradeoff with declaring this or that UB, just that the tradeoff exists.)
- EliRivers 11y agoIf you aren't happy with the trade-offs of using such languages, don't use them.
- ge0rg 11y agoThis is especially true when the compiler removes security-relevant range checks from the code because the developer used the wrong type / parameter order and thus caused UB.