[閒聊] 關於C++的雷

看板C_and_CPP (C/C++)作者PkmX (阿貓)時間7年前 (2017/09/25 22:14)推噓22(22推 0噓 7→)

留言29則, 21人參與討論串1/1

聽說最近大家在討論雷，我目前覺得最雷的應該就是這個了： int main() { while (true); // UB in C++11 or later } 是的，infinite loop 在 C++11 是 undefined behavior： 4.7.2 [intro.progress] The implementation may assume that any thread will eventually do one of the following: — terminate, — make a call to a library I/O function, — perform an access through a volatile glvalue, or — perform a synchronization operation or an atomic operation. ( 註：當標準說你可以 assume P 的時候，言下之意就是 not P 是 UB ) 很明顯上面的 loop 不屬於這四個的其中一個 ============================================================================== 於是國外就有無聊人士(?)造了一個例子用窮舉法找費式最後定理的反例，理論上當然是找不到的，所以該 loop 應該是個無窮迴圈： #include <cstdint> #include <iostream> bool fermat() { constexpr int32_t MAX = 1000; int32_t a = 1, b = 1, c = 1; // Infinite loop while (true) { if (((a*a*a) == ((b*b*b)+(c*c*c)))) return false; ++a; if (a > MAX) { a=1; ++b; } if (b > MAX) { b=1; ++c; } if (c > MAX) { c=1; } } return true; } int main() { if (!fermat()) std::cout << "Fermat's Last Theorem has been disproved."; else std::cout << "Fermat's Last Theorem has not been disproved."; std::cout << std::endl; } $ clang++ -O2 test.cpp && ./a.out Fermat's Last Theorem has been disproved. Oops. ( 如果用 -O0 或是 GCC 的確是會進入無窮迴圈 ) ============================================================================== 那在 C 底下的行為是怎麼樣呢？C11 的標準如此說： 6.8.5 Iteration statements 6 An iteration statement whose controlling expression is not a constant expression (156) that performs no input/output operations, does not access volatile objects, and performs no synchronization or atomic operations in its body, controlling expression, or (in the case of for statement) its expression-3, may be assumed by the implementation to terminate. (157) 157) This is intended to allow compiler transformations such as removal of empty loops even when termination cannot be proven while(1); 的 1 剛好是一個 constant expression ，所以這條不適用，但是稍微修改一下變成 while(1,1); 多了 comma op 就不是 constant expression 了，這樣的話 compiler 的確是可以把 while(1,1); 拿掉的 ============================================================================== 同場加映，踩到 UB 的下場： #include <stdio.h> static void (*fp)(void); void kerker(void) { puts("rm -rf /"); } void never_called(void) { fp = kerker; } int main(void) { fp(); return 0; } $ clang test.c -O2 && ./a.out rm -rf / -- ※ 發信站: 批踢踢實業坊(ptt.cc), 來自: 140.113.193.217 ※ 文章網址: https://www.ptt.cc/bbs/C_and_CPP/M.1506348868.A.0C3.html

推

freef1y3

09/25 23:19, , 1^F

09/25 23:19, 1^F

→

james732

09/25 23:20, , 2^F

09/25 23:20, 2^F

→

asilzheng

09/25 23:49, , 3^F

09/25 23:49, 3^F

推

stucode

09/25 23:51, , 4^F

09/25 23:51, 4^F

推

LPH66

09/25 23:56, , 5^F

09/25 23:56, 5^F

→

LPH66

09/25 23:57, , 6^F

09/25 23:57, 6^F

當然也要剛好 fp 是 static 且它的 address 沒有被 escape 到 TU 之外，註解裡面的寫法都會讓這個「最佳化」失效：https://godbolt.org/g/1uwjBQ 因為 fp 可能的值只有 { NULL, kerker }，而呼叫 NULL 是 UB，所以編譯器可以直接認定 fp 一定是 kerker 然後直接 inline 進去

推

KAOKAOKAO

09/26 00:09, , 7^F

09/26 00:09, 7^F

→

KAOKAOKAO

09/26 00:09, , 8^F

09/26 00:09, 8^F

→

KAOKAOKAO

09/26 00:09, , 9^F

09/26 00:09, 9^F