Undefined behaviour and how to recognise it

Understanding Undefined behaviour and how to recognise it

The standard describes what a program does only for operations whose preconditions hold: a + b on ints requires the true result to fit in an int, v[i] requires i < v.size(), *p requires p to point at a live object of that type. Violate one and you do not get a wrong value for that one operation, you get an execution with no described behaviour at all, including the parts that already ran. That asymmetry is why undefined behaviour is so hard to recognise from symptoms: the crash, the garbled string, or the missing output can sit arbitrarily far from the line that broke the rule.

The compiler is not being spiteful when UB turns into strange results; it is using the one thing the standard hands it, permission to assume every operation is valid. That assumption is what lets it keep a 32-bit loop counter in a 64-bit register, hoist a load out of a loop, or delete a branch reachable only after signed overflow. So the practical effect of UB is not a diagnostic but a program that means one thing at -O0 and another at -O2, and a check written after the fact, such as if (a + b < a), can be removed precisely because it tests for something the compiler already assumed cannot occur.

Recognising UB is a reading habit built on a short list rather than a wait for a warning. Signed overflow, shifting by a count outside [0, width), division or remainder by zero and INT_MIN / -1, indexing past the end, indirection through a null or dangling pointer, reading an uninitialised scalar, accessing an object through an incompatible type, unsynchronised access from two threads, and falling off the end of a value-returning function cover nearly everything you will meet in ordinary code. Keep that distinct from unspecified behaviour, where the implementation picks one of several valid options such as the order in which the operands of + are evaluated, and from implementation-defined behaviour, which is a documented choice such as sizeof(int) or whether char is signed: those two hand you a value you may not have predicted, while UB leaves you nothing to reason from.

#include <climits>
#include <iostream>
#include <stdexcept>
#include <vector>

// Every operation below has a precondition. Each check is written so that it
// never performs the operation it is guarding.
bool safe_to_add(int a, int b) {
    if (b > 0) return a <= INT_MAX - b;   // INT_MAX - b cannot overflow
    if (b < 0) return a >= INT_MIN - b;   // INT_MIN - b cannot overflow
    return true;
}

bool safe_to_shift(int value_bits, int amount) {
    return amount >= 0 && amount < value_bits;
}

int main() {
    const int int_bits = static_cast<int>(sizeof(int) * CHAR_BIT);
    const std::vector<int> v{10, 20, 30};

    std::cout << std::boolalpha;
    std::cout << "2000000000 + 2000000000 defined? " << safe_to_add(2000000000, 2000000000) << '\n';
    std::cout << "2000000000 + -2000000000 defined? " << safe_to_add(2000000000, -2000000000) << '\n';
    std::cout << "1 << 32 defined? " << safe_to_shift(int_bits, 32) << '\n';
    std::cout << "v[3] with size 3 defined? " << (3u < v.size()) << '\n';

    try {
        std::cout << v.at(3) << '\n';
    } catch (const std::out_of_range&) {
        std::cout << "at(3) reported the violation; v[3] would not have\n";
    }
}

Worked examples

#include <cstdint>
#include <iostream>
#include <vector>

int main() {
    std::vector<int> v{1, 2, 3};

    // Freeze the address as an integer while the buffer is still alive: once the
    // old buffer is freed, even inspecting the stale pointer value is not
    // well defined, but an integer copied out of it stays inspectable.
    const std::uintptr_t old_buffer = reinterpret_cast<std::uintptr_t>(v.data());
    const std::size_t old_capacity = v.capacity();

    while (v.capacity() == old_capacity) {
        v.push_back(0);   // reallocates once size would exceed capacity
    }

    std::cout << std::boolalpha;
    std::cout << "buffer moved: "
              << (reinterpret_cast<std::uintptr_t>(v.data()) != old_buffer) << '\n';
    std::cout << "capacity grew: " << (v.capacity() > old_capacity) << '\n';
    std::cout << "values preserved: " << (v[0] == 1 && v[1] == 2 && v[2] == 3) << '\n';
}

#include <cstdint>
#include <cstring>
#include <iostream>

static_assert(sizeof(float) == sizeof(std::uint32_t), "needs a 32-bit float");

int main() {
    const float f = 1.5f;

    std::uint32_t bits = 0;
    std::memcpy(&bits, &f, sizeof bits);    // defined: copies the object representation
    std::cout << std::hex << std::showbase << bits << '\n';

    float back = 0.0f;
    std::memcpy(&back, &bits, sizeof back);
    std::cout << std::dec << back << '\n';

    // std::uint32_t bad = *reinterpret_cast<const std::uint32_t*>(&f);
    // Undefined: that reads a float object through a uint32_t lvalue. It
    // compiles, it usually prints the same number, and the optimiser is still
    // free to move the read across unrelated float stores.
}

Important notes

Common mistakes

Try it yourself