23

The example bellows compiles, but the output is rather strange :

#include <iostream>
#include <cstring>

struct A
{
    int a;
    char b;
    bool c;
};

int main()
{
    A v;
    std::memset( &v, 0xff, sizeof(v) );

    std::cout << std::boolalpha << ( true == v.c ) << std::endl;
    std::cout << std::boolalpha << ( false == v.c ) << std::endl;
}

the output is :

true
true

Can someone explains why?

If it matters, I am using g++ 4.3.0

1
  • 1
    Don't use memset like that. It completely ignores the types you are writing over.
    – Neil Kirk
    Mar 7, 2013 at 16:37

5 Answers 5

11

Found this in the C++ standard, section 3.9.1 "Fundamental types" (note the magic footnote 42):

6. Values of type bool are either true or false. 42)

42) Using a bool value in ways described by this International Standard as ‘‘undefined,’’ such as by examining the value of an uninitialized automatic variable, might cause it to behave as if it is neither true nor false.

This is not perfectly clear for me, but seems to answer the question.

7
  • It means that it can be anything, like a third state of a boolean variable. UB is just like that. Could have caused nasal demons :P Dec 23, 2010 at 13:39
  • Note that the footnote 42 does not apply here, as the memory has been initialized with the memset to all 1s Dec 23, 2010 at 16:47
  • 1
    @David Rodríguez - dribeas: I think uninitialized variable is only an example of "undefined" usage (note the "such as")
    – Roman L
    Dec 23, 2010 at 19:11
  • 2
    The bool member in the structure is assigned an undefined value by the memset function. This is a good example to stop using memset and use constructors instead. Dec 23, 2010 at 19:29
  • @VJo: The uninitialized example does not apply as the execution of memset initializes the memory. The problem is with the initialization itself as it is not setting the variable to true or false, but rather to 0xff. Dec 30, 2010 at 0:43
2

The result of overwriting memory location used by v is undefined behaviour. Everything may happen, according to the standard (including your computer flying off and eating your breakfast).

10
  • 4
    I believe that it's actually legal to do this, as v is a POD.
    – Puppy
    Dec 23, 2010 at 13:05
  • @DeadMG: I doubt about that. The optimizer might have its assumptions about the possible contents of bool.
    – Vlad
    Dec 23, 2010 at 13:07
  • 1
    The structure A is POD, therefore you can do whatever you like with it, including filling some random values into memory location occupied by objects of such types. Dec 23, 2010 at 13:19
  • 3
    @VJo: 3.9/2 says, "For any object (other than a base-class subobject) of POD type T, whether or not the object holds a valid value of type T, the underlying bytes (1.7) making up the object can be copied into an array of char or unsigned char. If the content of the array of char or unsigned char is copied back into the object, the object shall subsequently hold its original value.". It doesn't say, "you can do whatever you like with it", and in particular it doesn't say that you can write whatever bytes you like and the result be a valid value of the object (in this case, bool). Dec 23, 2010 at 14:27
  • 2
    There's a defect report on the standard that it doesn't properly say how invalid values lead to undefined behavior, but it certainly doesn't define the behavior when you read memory that isn't a valid value representation for the type you read it as. All-bits-1 presumably is not a valid value representation of bool on your implementation. Dec 23, 2010 at 14:31
2

A boolean value whose memory is set to a value that is not one or zero has undefined behaviour.

1
  • 11
    Could you please share your reference on that?
    – Marcin
    Dec 23, 2010 at 13:11
2

I thing I found the answer. 3.9.1-6 says :

Values of type bool are either true or false.42) [Note: there are no signed, unsigned, short, or long bool types or values. ] As described below, bool values behave as integral types. Values of type bool participate in integral promotions (4.5).

Where the note 42 says :

42) Using a bool value in ways described by this International Standard as ‘‘undefined,’’ such as by examining the value of an uninitialized automatic variable, might cause it to behave as if it is neither true nor false.

1
  • Be aware that notes are informative, not normative. Using the value of any uninitialized automatic variable is undefined behavior, whether its type is bool or something else. Dec 23, 2010 at 14:29
1

I can't seem to find anything in the standard that indicates why this would happen (most possibly my fault here) -- this does include the reference provided by 7vies, which is not in itself very helpful. It is definitely undefined behavior, but I can't explain the specific behavior that is observed by the OP.

As a practical matter, I 'm very surprised that the output is

true
true

Using VS2010, the output is the much more easy to explain:

false
false

In this latter case, what happens is:

  • comparisons to boolean true are implemented by the compiler as tests for equality to 0x01, and since 0xff != 0x01 the result is false.
  • same goes for comparisons to boolean false, only the value compared with is now 0x00.

I can't think of any implementation detail that would cause false to compared equal to the value 0xff when interpreted as bool. Anyone have any ideas about that?

6
  • Nice point, but this is really compiler-specific. UB allows it to do whatever optimizations it wants, and for that specific compiler this leads to a true. Your 0xff != 0x01 is far not the only way to check it...
    – Roman L
    Dec 23, 2010 at 13:55
  • @7vies: sure. I think we all agree this is UB, and you can't use this code to produce meaningful results. But it is still interesting to know why it behaves that way.
    – Jon
    Dec 23, 2010 at 13:56
  • @Jon, for example instead of doing x == true it could do x != false which is equivalent when you consider booleans, but will result in a different behavior for ints (0xff == 1 is false but 0xff != 0 is true).
    – Roman L
    Dec 23, 2010 at 14:02
  • @7vies: We still agree on all of that. I 'm just wondering what GCC is doing in this case and comes up with this result.
    – Jon
    Dec 23, 2010 at 14:03
  • 6
    @Jon: looking at disassembly (on my machine(TM)) from GCC, it uses movzbl to read a bool, which copies 8 bits. It doesn't need to actually test against true because true == is redundant and optimized away even with no optimization compiler options. So 0xff is passed. false == becomes an xor with 1, so 0xfe is passed. I don't know what the stream does with the value when the boolalpha manipulator is in effect, but given the results I would guess something equivalent to: if bit pattern is all-zeros print "false" else print "true". Dec 23, 2010 at 14:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.