13

C++17 (expr.add/4) say:

When an expression that has integral type is added to or subtracted from a pointer, the result has the type of the pointer operand. If the expression P points to element x[i] of an array object x with n elements, the expressions P + J and J + P (where J has the value j) point to the (possibly-hypothetical) element x[i+j] if 0≤i+j≤n; otherwise, the behavior is undefined. Likewise, the expression P - J points to the (possibly-hypothetical) element x[i−j] if 0≤i−j≤n; otherwise, the behavior is undefined.

struct Foo {
    float x, y, z;
};

Foo f;
char *p = reinterpret_cast<char*>(&f) + offsetof(Foo, z); // (*)
*reinterpret_cast<float*>(p) = 42.0f;

Has the line marked with (*) UB? reinterpret_cast<char*>(&f) doesn't point to a char array, but to a float, so it should UB according to the cited paragraph. But, if it is UB, then offsetof's usefulness would be limited.

Is it UB? If not, why not?

18
  • [basic.lval]/8 Nov 26, 2017 at 16:48
  • @StoryTeller: line (*) doesn't access it, it is just a pointer manipulation.
    – geza
    Nov 26, 2017 at 16:50
  • It isn't UB.. You are only taking the address of a variable and casting it to a char* then back to its original type. It points to a valid object (address of z).
    – Brandon
    Nov 26, 2017 at 16:52
  • 1
    You alias f with p, that's allowed already. The storage of the object can be viewed as specified in [intro.object] (an array of characters or std::byte). So what's the problem? Nov 26, 2017 at 16:56
  • 1
    @StoryTeller I gave a very specific counter-example of contiguous objects that clearly cannot be taken as an array. Or am I wrong and are you saying they can be?
    – user743382
    Nov 26, 2017 at 17:12

5 Answers 5

6

The addition is intended to be valid, but I do not believe the standard manages to say so clearly enough. Quoting N4140 (roughly C++14):

3.9 Types [basic.types]

2 For any object (other than a base-class subobject) of trivially copyable type T, whether or not the object holds a valid value of type T, the underlying bytes (1.7) making up the object can be copied into an array of char or unsigned char.42 [...]

42) By using, for example, the library functions (17.6.1.2) std::memcpy or std::memmove.

It says "for example" because std::memcpy and std::memmove are not the only ways in which the underlying bytes are intended to be allowed to be copied. A simple for loop which copies byte by byte manually is supposed to be valid as well.

In order for that to work, addition has to be defined for pointers to the raw bytes that make up an object, and the way definedness of expressions works, the addition's definedness cannot depend on whether the addition's result will subsequently be used to copy the bytes into an array.

Whether that means those bytes form an array already or whether this is a special exception to the general rules for the + operator that is somehow omitted in the operator description, is not clear to me (I suspect the former), but either way would make the addition you're performing in your code valid.

7
  • Your wording seems to imply it is valid even under the current wording, although your comments seems to say otherwise? Can you clarify?
    – Passer By
    Dec 15, 2017 at 13:05
  • @PasserBy Do you mean my comments on the question, in response to StoryTeller? In those, I'm saying I believe StoryTeller's logic is flawed, but that says nothing about the conclusion. Flawed logic can lead to a correct conclusion just as well as an incorrect one.
    – user743382
    Dec 15, 2017 at 13:35
  • I think the other bit from [basic.types], the one that talks about object storage, is more relevant as that talks about all objects and defines the object storage as sequence of unsigned chars. That's closest to saying any object can be treated as an (unsigned) char array the specification gets.
    – Jan Hudec
    May 29, 2018 at 15:11
  • @JanHudec That implies more, but I think it guarantees less: an array is a sequence of objects, but there isn't anything that says that all sequences of objects are arrays, is there?
    – user743382
    May 29, 2018 at 16:13
  • IMHO, the only really consistent way to resolve issues like this is to recognize that neither C89 nor its successors attempt to describe everything an implementation must do to be suitable for any particular purpose, and thus--possibly to "save ink"--they don't always bother to define the behavior of actions that should obviously (at least by the standards of the day) be handled usefully by quality implementations intended for various targets and purposes, or in some cases, by essentially all non-garbage implementations.
    – supercat
    Aug 29, 2018 at 20:26
6

Any interpretation that disallows the intended usage of offsetof must be wrong:

#include <assert.h>
#include <stddef.h>
struct S { float a, b, c; };

const size_t idx_S[] = {
    offsetof(struct S, a),
    offsetof(struct S, b),
    offsetof(struct S, c),
};

float read_S(struct S *sp, unsigned int idx)
{
    assert(idx < 3);
    return *(float *)(((char *)sp) + idx_S[idx]); // intended to be valid
}

However, any interpretation that allows one to step past the end of an explicitly-declared array must also be wrong:

#include <assert.h>
#include <stddef.h>
struct S { float a[2]; float b[2]; };

static_assert(offsetof(struct S, b) == sizeof(float)*2,
    "padding between S.a and S.b -- should be impossible");

float read_S(struct S *sp, unsigned int idx)
{
    assert(idx < 4);
    return sp->a[idx]; // undefined behavior if idx >= 2,
                       // reading past end of array
}

And we are now on the horns of a dilemma, because the wording in both the C and C++ standards, that was intended to disallow the second case, probably also disallows the first case.

This is commonly known as the "what is an object?" problem. People, including members of the C and C++ committees, have been arguing about this and related issues since the 1990s, and there have been multiple attempts to fix the wording, and to the best of my knowledge none has succeeded (in the sense that all existing "reasonable" code is rendered definitely conforming and all existing "reasonable" optimizations are still allowed).

(Note: All of the above code is written as it would be written in C to emphasize that the same problem exists in both languages, and can be encountered without the use of any C++ constructs.)

9
  • I believe the wording intended to disallow the second case does, in fact, not disallow the first case, though it definitely could be clearer. In the first case, you take the memory occupied by S and cast it to effectively unsigned char[sizeof(S)]. That the “object storage” is such array is defined in [basic.types] paragraph 4. Therefore, you are within a char array and the arithmetic is well defined.
    – Jan Hudec
    May 29, 2018 at 13:00
  • @JanHudec A lot of people agree with you. About the same number of people disagree with you.
    – zwol
    May 29, 2018 at 14:07
  • Why is *(float *)(((char *)sp) + idx_S[idx]) intended to be valid? You can convert a pointer to uintptr_t and doing arithmetic, then convert it back to a pointer. This is well-defined behavior (though implementation-defined). I think offsetof is intended to be used in this way.
    – xskxzr
    Aug 28, 2018 at 9:48
  • 1
    A quick note about C and offsetof: Per C if "a null pointer is guaranteed to compare unequal to a pointer to any object" and "any two null pointers shall compare equal", then a null pointer is not a pointer to object. Hence, "a postfix expression followed by the -> operator and an identifier" does not designate a member of a structure object. Hence, ((st *)0)->m violates the semantics of the -> operator.
    – pmor
    Feb 22, 2022 at 18:15
  • 1
    @pmor Yes, however that is only an argument against defining offsetof yourself. If the programmer includes stddef.h they are entitled to treat offsetof as a black box that behaves as described in 7.19p3. (Implementations have moved away from the traditional definition that uses the construct you mention, but if an implementation does use that definition, then either it provides the correct semantics on that implementation, or the implementation is buggy. This is no different from, say, implementation-defined constructs buried in the expansion of getc.)
    – zwol
    Feb 23, 2022 at 2:17
2

See CWG 1314

According to 6.9 [basic.types] paragraph 4,

The object representation of an object of type T is the sequence of N unsigned char objects taken up by the object of type T, where N equals sizeof(T).

and 4.5 [intro.object] paragraph 5,

An object of trivially copyable or standard-layout type (6.9 [basic.types]) shall occupy contiguous bytes of storage.

Do these passages make pointer arithmetic (8.7 [expr.add] paragraph 5) within a standard-layout object well-defined (e.g., for writing one's own version of memcpy?

Rationale (August, 2011):

The current wording is sufficiently clear that this usage is permitted.

I strongly disagree with CWG's statement that "the current wording is sufficiently clear", but nevertheless, that's the ruling we have.

I interpret CWG's response as suggesting that a pointer to unsigned char into an object of trivially copyable or standard-layout type, for the purposes of pointer arithmetic, ought to be interpreted as a pointer to an array of unsigned char whose size equals the size of the object in question. I don't know whether they intended that it would also work using a char pointer or (as of C++17) a std::byte pointer. (Maybe if they had decided to actually clarify it instead of claiming the existing wording was clear enough, then I would know the answer.)

(A separate issue is whether std::launder is required to make the OP's code well-defined. I won't go into this here; I think it deserves a separate question.)

1
1

As far as I know, your code is valid. Aliasing an object as a char array is explicitly allowed as per § 3.10 ¶ 10.8:

If a program attempts to access the stored value of an object through a glvalue of other than one of the following types the behavior is undefined:

  • […]
  • a char or unsigned char type.

The other question is whether casting the char* pointer back to float* and assigning through it is valid. Since your Foo is a POD type, this is okay. You are allowed to compute the address of a POD's member (given that the computation itself is not UB) and then access the member through that address. You must not abuse this to, for example, gain access to a private member of a non-POD object. Furthermore, it would be UB if you'd, say, cast to int* or write at an address where no object of type float exists. The reasoning behind this can be found in the section quoted above.

2
  • 1
    They just say char, not char array. That's make the difference.
    – geza
    Nov 26, 2017 at 18:06
  • char[N] and its subobjects are different. Just as you wouldn't expect struct { char a0, a1; } to be able to alias int16_t even if it doesn't have any padding.
    – Passer By
    Dec 15, 2017 at 12:58
1

Yes, this is undefined. As you have stated in your question,

reinterpret_cast<char*>(&f) doesn't point to a char array, but to a float, ...

... reinterpret_cast<char*>(&f) does even not point to a char, so even if the object representation is a char array, the behavior is still undefined.

For offsetof, you can still use it like

struct Foo {
    float x, y, z;
};

Foo f;
auto p = reinterpret_cast<std::uintptr_t>(&f) + offsetof(Foo, z); 
                       // ^^^^^^^^^^^^^^
*reinterpret_cast<float*>(p) = 42.0f;
3

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.