On 5/1/2017 2:16 PM, Hal Finkel via cfe-commits wrote:
On 05/01/2017 12:49 PM, Daniel Berlin wrote:
On 04/21/2017 06:03 AM, Hal Finkel via Phabricator wrote:
...
Our struct-path TBAA does the following:
struct X { int a, b; };
X x { 50, 100 };
X *o = (X*) (((int*) &x) + 1);
int a_is_b = o->a; // This is UB (or so we say)?
This is UB.
A good resource for this stuff is
http://www.cl.cam.ac.uk/~pes20/cerberus/
<http://www.cl.cam.ac.uk/%7Epes20/cerberus/> which has a long document
where they exlpore all of these and what various compilers do, along
with what the standard seems to say.
http://www.cl.cam.ac.uk/~pes20/cerberus/notes30-full.pdf is 172 pages,
and so I may have missed it, but I don't see this case. Also, I'd really
like to see where the standard says this is UB. I don't see it.
The last sentence of 8:
6.5.6 Additive operators
7 For the purposes of these operators, a pointer to an object that is
not an element of an array behaves the same as a pointer to the first
element of an array of length one with the type of the object as its
element type.
8 When an expression that has integer type is added to or subtracted
from a pointer, the result has the type of the pointer operand. If the
pointer operand points to an element of an array object, and the array
is large enough, the result points to an element offset from the
original element such that the difference of the subscripts of the
resulting and original array elements equals the integer expression. In
other words, if the expression P points to the i-th element of an array
object, the expressions (P)+N (equivalently, N+(P)) and (P)-N (where N
has the value n) point to, respectively, the i+n-th and i−n-th elements
of the array object, provided they exist. Moreover, if the expression P
points to the last element of an array object, the expression (P)+1
points one past the last element of the array object, and if the
expression Q points one past the last element of an array object, the
expression (Q)-1 points to the last element of the array object. If both
the pointer operand and the result point to elements of the same array
object, or one past the last element of the array object, the evaluation
shall not produce an overflow; otherwise, the behavior is undefined. If
the result points one past the last element of the array object, it
shall not be used as the operand of a unary * operator that is evaluated.
-Krzysztof
--
Qualcomm Innovation Center, Inc. is a member of Code Aurora Forum,
hosted by The Linux Foundation
_______________________________________________
cfe-commits mailing list
cfe-commits@lists.llvm.org
http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
