[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <E0B617D3-437D-419C-A920-3CFCE1E332AC@trust-in-soft.com>
Date: Fri, 17 Jul 2015 19:55:59 +0000
From: Pascal Cuoq <cuoq@...st-in-soft.com>
To: "musl@...ts.openwall.com" <musl@...ts.openwall.com>
Subject: Re: Left-shift of negative number
Jens Gustedt wrote:
> Am Freitag, den 17.07.2015, 18:28 +0000 schrieb Loïc Runarvot:
> > According to the C11 standard, doing a left-shift on a negative
> > integer is considered as an undefined behavior (6.5.7:4).
>
> There is no such thing as "considered undefined behavior",
You are right, the word “considered” is unnecessary.
A left shift on a negative integer is undefined behavior, period.
> this is a
> terminology that makes not much sense. Unfortunately the term
> "undefined behavior" is often used as a synonym for "errorneous code"
> which it just isn't.
But in this case, it is used as a synonym for “being undefined behavior”,
which it is. Or are we reading the phrase “otherwise, the behavior is undefined”
in the relevant clause of the standard differently?
I know that this is not well-known, so perhaps I should explain: ever since
the late 1990s, C compilers have been taking advantage of undefined behavior
in the C standard to introduce new optimizations. So if you rely on undefined
behavior in your C programs, they may not work today, and they may break
tomorrow. For instance, a claim very similar to yours:
> Whereas we can
> reasonably assume that a shift of a negative value in two's complement
> is the same as an unsigned shift,
may be used to justify that INT_MAX + 1 results in INT_MIN on two's
complement platforms. This line of reasoning does not work too well nowadays,
as anyone who has ever read the assembly generated by a modern optimizing
compiler for the function int f(int x) { return x + 1 > x; } has verified for
themselves.
So what about shifts of negative values then? Should we worry that they
will be broken in 2017? No, there is no need to wait.
According to this post, ICC takes full advantage today of the fact
that they are undefined behavior:
http://stackoverflow.com/questions/22883790/left-shift-of-negative-values
And according to one slide in this deck, MSVC does too(*):
http://fsl.cs.illinois.edu/images/2/27/2011-09-30-CK-MVD.pdf
> But this doesn't mean
> that a particular implementation of a C compiler or the C library
> (here musl) can't define a behavior for that.
I sincerely do not think that it's not musl's place to define the behavior
of -1 << 1, until it comes bundled with a C compiler, because until
then, the behavior of that expression is entirely without its control
and entirely within the control of unsympathetic C compilers that have
the C standard on their side. Also the phrase
“strives to be correct in the sense of standards-conformance…”
would need to be amended to something like “works with at least
two GCC-like C compilers”.
Pascal
(*) by the way, do not remember anything that these slides say about
Frama-C. The authors of the slides, when talking about it, have no idea
what the f-word they are talking about, and they have a research the usefulness
of which they conveniently want to impress you with.
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
