Crash in C++ code due to undefined behaviour or compiler bug?

Question

I am experiencing strange crashes. And I wonder whether it is a bug in my code, or the compiler. When I compile the following C++ code with Microsoft Visual Studio 2010 as an optimized release build, it crashes in the marked line: ``` struct tup { int x; int y; }; class C { public: struct tup* p; struct tup* operator--() { return --p; } struct tup* operator++(int) { return p++; } virtual void Reset() { p = 0;} }; int main () { C c; volatile int x = 0; struct tup v1; struct tup v2 = {0, x}; c.p = &v1; (*(c++)) = v2; struct tup i = (*(--c)); // crash! (dereferencing a NULL-pointer) return i.x; } ``` Looking into the disassembly, it's obvious that it must crash: ``` int _tmain(int argc, _TCHAR* argv[]) { 00CE1000 push ebp 00CE1001 mov ebp,esp 00CE1003 sub esp,0Ch C c; volatile int x = 0; 00CE1006 xor eax,eax 00CE1008 mov dword ptr [x],eax struct tup v1; struct tup v2 = {0, x}; 00CE100B mov ecx,dword ptr [x] c.p = &v1; (*(c++)) = v2; 00CE100E mov dword ptr [ebp-8],ecx struct tup i = (*(--…

Accepted Answer

The code is fine. It's a compiler bug.

The code `*(c++) = v2` will post-increment `c.p` yielding the original value. That value was assigned in the previous line and is `&v1`. So, in effect, it does `v1 = v2;`, which is perfectly fine.

`c.p` now behaves as a one-past-the-end of a one element array that holds only `v1`, per §5.7p4 of the standard:

For the purposes of these operators [`+` and `-`], a pointer to a nonarray object behaves the same as a pointer to the first element of an array of length one with the type of the object as its element type.

Then `*(--c)` moves that pointer back to `&v1` and dereferences it, which is also fine.

Crash in C++ code due to undefined behaviour or compiler bug?

Solution

Problem