<div dir="ltr"><div dir="ltr">On Wed, 24 Feb 2021 at 04:30, Michael Laß via cfe-dev <<a href="mailto:cfe-dev@lists.llvm.org">cfe-dev@lists.llvm.org</a>> wrote:<br></div><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">OK, I think I can answer my own question. Here is the current code of the undefined-reinterpret-cast check:<br>
<br>
<a href="https://github.com/llvm/llvm-project/blob/b94c215592bdba915455895b2041398dfb2ac44a/clang/lib/Sema/SemaCast.cpp#L1874" rel="noreferrer" target="_blank">https://github.com/llvm/llvm-project/blob/b94c215592bdba915455895b2041398dfb2ac44a/clang/lib/Sema/SemaCast.cpp#L1874</a><br>
<br>
In the comment it states:<br>
<br>
// The cases that is checked for is:<br>
// *reinterpret_cast<T*>(&a)<br>
// reinterpret_cast<T&>(a)<br>
// where accessing 'a' as type 'T' will result in undefined behavior.<br>
<br>
So casting a pointer and dereferencing it at some later point in time is not covered by the check.</blockquote><div><br></div><div>Yes; unfortunately, Clang warnings tend to only perform a very local analysis, so they don't tend to catch this kind of issue when it's split across multiple expressions. (The static analyzer should be able to spot this kind of problem, but I don't know if it has a checker corresponding to this warning.)</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">It can also miss cases like the following:<br>
<br>
int matrix[2 * 2] = {0, 1, 2, 3};<br>
<br>
// missed because matrix is not referenced:<br>
int(&m1)[2][2] = *reinterpret_cast<int(*)[2][2]>(matrix);<br>
<br>
// missed because casted pointer is dereferenced via indexing operator:<br>
int(&m2)[2][2] = reinterpret_cast<int(*)[2][2]>(&matrix)[0];<br>
<br>
On the question whether these casts (and dereferencing the resulting pointers) actually cause undefined behavior, I noticed a comment by Davis Herring on <a href="https://stackoverflow.com/a/15284276" rel="noreferrer" target="_blank">https://stackoverflow.com/a/15284276</a>. I read it as: This is undefined behavior because the array referenced by the casted pointer does not actually exist and therefore the argument about array-to-pointer conversion made by the author of that post does not hold.<br></blockquote><div><br></div><div>Yes, Davis's comment matches my understanding.</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
Cheers,<br>
Michael<br>
<br>
> Am 22.02.2021 um 21:01 schrieb Michael Laß via cfe-dev <<a href="mailto:cfe-dev@lists.llvm.org" target="_blank">cfe-dev@lists.llvm.org</a>>:<br>
> <br>
> Hi all!<br>
> <br>
> I stumbled across some C++ code today that uses reinterpret_cast to reshape a 1D array into a 2D array. I wondered if this is actually legal or if it would cause undefined behavior. There is an elaborate post on Stack Overflow [1] that argues in favor of this method, quoting sections of the C++ standard but other people disagree [2].<br>
> <br>
> So I went ahead and tested different variants of such conversions with Clang’s -Wundefined-reinterpret-cast flag:<br>
> <br>
> <a href="https://godbolt.org/z/aE4fEM" rel="noreferrer" target="_blank">https://godbolt.org/z/aE4fEM</a><br>
> <br>
> The results can be summarized as:<br>
> 1. Casting from int[4] to int(&)[2][2] or int(&)[][2] causes a warning<br>
> 2. Casting from int(*)[4] to int(*)[2][2] or int(*)[][2] and _immediately_ dereferencing causes a warning<br>
> 3. Casting from int(*)[4] to int(*)[2][2] or int(*)[][2] without immediate dereferencing seems fine<br>
> 4. Casting from int[4] to int(*)[2] seems fine<br>
> 5. Dereferencing those pointers from 3. and 4. afterwards also seems fine<br>
> <br>
> This seems to be a bit inconsistent. From the results I assume that the cast itself is fine but dereferencing the casted pointer is undefined behavior. However, if those operations are split across multiple source code lines, there is no warning. Is this a bug or a natural limitation of the error checking within Clang?<br>
> <br>
> Cheers,<br>
> Michael<br>
> <br>
> <br>
> [1] <a href="https://stackoverflow.com/a/15284276" rel="noreferrer" target="_blank">https://stackoverflow.com/a/15284276</a><br>
> [2] <a href="https://stackoverflow.com/q/44398700" rel="noreferrer" target="_blank">https://stackoverflow.com/q/44398700</a><br>
> _______________________________________________<br>
> cfe-dev mailing list<br>
> <a href="mailto:cfe-dev@lists.llvm.org" target="_blank">cfe-dev@lists.llvm.org</a><br>
> <a href="https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-dev" rel="noreferrer" target="_blank">https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-dev</a><br>
<br>
_______________________________________________<br>
cfe-dev mailing list<br>
<a href="mailto:cfe-dev@lists.llvm.org" target="_blank">cfe-dev@lists.llvm.org</a><br>
<a href="https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-dev" rel="noreferrer" target="_blank">https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-dev</a><br>
</blockquote></div></div>