Thread

C++26: Trivial infinite loops are no longer undefined behaviour

173 points · 290 comments · ibobev

wahern · 1789747013 · focus · HN ↗
> When both conditions are met, the loop body is replaced with a call to std::this_thread::yield(). This gives execution of the loop the forward-progress semantics it previously lacked.
That's the epitome of the hidden code downside that Linus and many others dislike about C++. For constructors and destructors it's somewhat unavoidable and not so random, though Rust does better at limiting the blast radius of non-local code, at least in the drop case.
If they didn't want to adopt the C11 rule, the C++ committee should've explored a rule that required the compiler to emit a diagnostic or error for trivial loops (whether as defined by C11 or otherwise), requiring the programmer to explicitly insert ::yield or similar. No hidden code, and less opportunity for the compiler to do surprising things.
The C committee has been rigorously enumerating UB cases in the standard and addressing each case in turn, often by requiring a diagnostic, error, or by turning it into implemention defined behavior. But inserting code like that would be unthinkable.
1. IsTom · 1789747710 · focus · HN ↗
  > should've explored a rule that required the compiler to emit a diagnostic or error for trivial loops (whether as defined by C11 or otherwise), requiring the programmer to explicitly insert ::yield or similar
  It wouldn't work when this kind of loop is generated by macros/templates in some unreachable case left after const folding.
  1. rcxdude · 1789748275 · focus · HN ↗
    If it's truly unreachable then it's not likely to be a problem. If it is reachable and it's emerging from some macros and templates then I would be more inclined want a warning for it.
    IsTom · 1789748683 · focus · HN ↗
    Yeah, but then you need compiler to somehow know if it's truly unreachable to know when to emit the warning and when to not do that.
    krupan · 1789751797 · focus · HN ↗
    If it's a warning and not an error then emit it whether it's unreachable or not
2. rfgplk · 1789750722 · focus · HN ↗
  It's catastrophic actually. Like disastrously catastrophic. It started with C++20 mostly, and has only kept getting worse from then. See zero initializing variables by default (WHY?) compare/meta including half the STL and HARDCODING those symbols, std::initializer_list being in the std namespace (if you don't include <initializer_list> you literally can't use it, and there is no such thing as a __initializer_list or some internal symbol), the entire coroutine library where you MUST provide coroutine_handle, noop_coroutine, suspends et al (coroutines aren't that bad because they're not necessarily spaghetti).
  <meta> is the single WORST OFFENDER, where they hardcode std::vector (literally std::vector in the std namespace) std::ranges std::allocator.
  1. aw1621107 · 1789757157 · focus · HN ↗
    > See zero initializing variables by default
    Strictly speaking the standard only requires some pattern that is not tied to program state. Zero works for that, but so do other static patterns like 0xABAB... or the like.
    > (WHY?)
    The motivation section of the corresponding paper [0] might be interesting. tl;dr: it lets wrong code be wrong without suffering from (all) the consequences of full-blown UB.
    [0]: <a href="https://www.open-std.org/jtc1/sc22/wg21/docs/papers/2024/p2795r5.html#motivation" rel="nofollow">https://www.open-std.org/jtc1/sc22/wg21/docs/papers/2024/p27...
    fc417fc802 · 1789767692 · focus · HN ↗
    In other words, it's a sane default that you can opt out of on a case by case basis which is the way it should have been all along.
    WalterBright · 1789769436 · focus · HN ↗
    D initializes floating point variables to NaN by default. And chars to 0xFF. Yes it's controversial!
    dahart · 1789779641 · focus · HN ↗
    I’d guess the concern is performance, not what initializer value is used. And performance is a valid concern that is discussed in the proposal, and a reason there’s an escape hatch. Still, it might cause some confusion.
    TuxSH · 1789824043 · focus · HN ↗
    AFAIK zero-init is unfortunately the default compiler use (but you can change that)
  2. mitxela · 1789777701 · focus · HN ↗
    I can't find anything saying variables are zero initialized by default in C++20. But the reason to do so is obvious: many bugs are caused by the lack of this, and as long as you can opt out with "= void" or something, it's not violating C++ core principles.
    dahart · 1789779523 · focus · HN ↗
    They were saying the problematic philosophy started in C++ 20, not the variable initialization rule.
    Yes the reason is obvious, but it’s neither simple nor black and white. One huge problem is that this can cause serious performance regressions, and you have to change your code to opt out, e.g. add “[[indeterminate]]”. There are many, many cases in high performance computing where the intended & desired behavior is don’t touch my variables until I fill them.
    This is changing C++ core principles, there’s a new designation for the state of a variable: erroneous. It’s also subtle and weird, because you can still have well-defined behavior even with erroneous state. It does seem like this might be an experiment though, I don’t think this is the end of the story. (It seems they’re already talking some redesign of this idea.)
    ack_complete · 1789780786 · focus · HN ↗
    What I'm most annoyed at with the variable initialization change is that:
    - It's potentially a performance change in every single function, especially ones that have sizable fixed-size buffers - If you have regressions you have to spray [[indeterminate]] everywhere, because there is no coarser way of suppressing it. - While the language says unrecognized attributes are ignored, compilers frequently warn on unrecognized attributes. Clang, for instance, currently warns on [[indeterminate]]. - There is no defined macro name for backwards compatibility.
    Which means that libraries are going have to all declare their own macros for [[indeterminate]] and pepper their code with it.
    mitxela · 1789785386 · focus · HN ↗
    Uninitialized variables were already UB to read, because some architectures have trap representations, even for integers. Every register on Itanium has one.
    cryptonector · 1789793319 · focus · HN ↗
    That's not reason enough to have the compiler initialize.
    zrm · 1789796870 · focus · HN ↗
    That's assuming you were reading it without writing to it. There are three common cases when that isn't true.
    The first is that you have a fixed buffer large enough for the maximum message size even though the typical ones aren't that big. You most often write 1% of the buffer and read it back, the other 99% is never accessed.
    The second is that you always write the entire contents before reading it but the compiler may not be able to see that.
    And the third is that you have a code path where that variable is simply not used.
    You would then have the compiler emitting instructions to write zeros that are either overwritten before being read or are never read at all.
    Moreover, zero initializing the data doesn't actually remove the bugs when that isn't the case. Consider the first case when you mess up. You have a fixed buffer used to store variable length messages. For the first message the buffer is now zeros instead of uninitialized, but for every subsequent message the remainder of the buffer still contains the remainder of the previous message and subjects you to information disclosure or data modification if you're reading back a different amount than was written in the associated call.
    Now consider the second or third case. You unintentionally read from a variable before assigning to it. You get zeros instead of uninitialized memory, but if you weren't expecting zeros, well, the UID field is now 0.
    mitxela · 1789822839 · focus · HN ↗
    If you are writing to it before reading from it then it's not uninitialised, and in 99% of cases the compiler can see that and will not set it to 0 at its declaration because that's a dead store.
    zrm · 1789871243 · focus · HN ↗
    Consider this (quite common) code:
    char buffer[LARGE_SIZE]; if(maybe_fill_buffer(buffer, sizeof(buffer))) { use_result(buffer); }
    The function maybe_fill_buffer() is an external library function that either fills the buffer and returns true or doesn't access it and returns false. Or maybe it unconditionally fills it, or unconditionally returns false without reading from it. The compiler can't see any of that though because it's in an external library. For all it knows that function is going to read from it instead of writing to it.
    Notice that if it could actually figure it out 99% of the time then it could also emit a warning the 1% of the time that it can't and encourage you to make an explicit choice, which would have been a better option if that was actually the rate.
    nullc · 1789798187 · focus · HN ↗
    Zero initializing also hides bugs.
    Say you have some code that should not be reading the initial state and is buggy if it does. Without zero-init, valgrind and msan will give you an immediate and false positive message that your code is wrong-- or forget dynamic analysis: the compiler can often statically tell you that the code will use an uninitialized variable. Zero initialize it and you lose that signal.
    paulf38 · 1790087132 · focus · HN ↗
    "valgrind and msan will give you an immediate and false positive message"
    Why a false positive? Are you one of those people that 'knows' that their code is correct and always blames the tool? What you describe sounds like a real error. Sort of. The error is not triggered by reading the value, it gets triggered when it is used in some conditional context and the undefinedness has an observable impact on the execution of the program.
    This is a change from undefined/erroneous behaviour to something else - defined but maybe not what you wanted.
    I agree that this can make error analysis more difficult.
3. pbalau · 1789755100 · focus · HN ↗
  Is it hidden if it's explained in the standard?
  I think Linus's complain was before there was a c++ standard. An updated version of the complaint would be "this shit is doing too much".
  1. andrepd · 1789755469 · focus · HN ↗
    An empty loop, under some non-obvious conditions, on some compiler flags but not others, silently transforms into a system call. In a systems programming language.
    WalterBright · 1789769608 · focus · HN ↗
    I try to minimize use of destructors for the same reason.
    andrepd · 1789772401 · focus · HN ↗
    Destructors run predictably at list, and are pervasive everywhere. You know that when you exit a scope, be that a function or whatever it may, the destructors of variables in that scope are called. That is clear and consistent. The transformation mentioned above is not.
    WalterBright · 1789775183 · focus · HN ↗
    Understanding the code requires understanding the destructors of the objects you're using. Since they are invisibly inserted, they are a source difficulty in entirely understanding the code.
    rcxdude · 1789776457 · focus · HN ↗
    I do wonder if any of the language servers that insert implied type annotations would ever also show things like destructor calls in a similar manner. It seems like it would be quite useful.
    otabdeveloper4 · 1789801065 · focus · HN ↗
    > Since they are invisibly inserted
    They're not, all destructors are explicit. Seems like a skill issue on your end.
    WalterBright · 1789802773 · focus · HN ↗
    Since AFAIK I'm still the only person to write a correct C++ (C++98) compiler from preprocessor to object file, I know all about destructors.
    Here's a fun one for your amusement:
    foo(a, b, c);
    The parameters are pass by value. a, b and c are objects that have destructors. Have a look at the code generated for that.
    It is nice that the compiler does the dirty work for you, but the various paths with exceptions and recovery with invisible code may not be well tested.
    degaart · 1789884324 · focus · HN ↗
    > Seems like a skill issue on your end.
    You're talking to walter bright, the guy who wrote the digital mars C++ compiler
    otabdeveloper4 · 1789963438 · focus · HN ↗
    > appeal to authority
    Okay.
  2. aw1621107 · 1789755801 · focus · HN ↗
    > Is it hidden if it's explained in the standard?
    In the context of that particular complaint, yes. From what I understand the gist of it is basically that you should be able to tell what is going on by looking at the code locally (i.e., the code is "explicit").
    > I think Linus's complain was before there was a c++ standard.
    These emails [0]? IIRC those are the most well-known ones and they are from the mid-2000s
    [0]: <a href="https://harmful.cat-v.org/software/c++/linus" rel="nofollow">https://harmful.cat-v.org/software/c++/linus
4. pwdisswordfishq · 1789759863 · focus · HN ↗
  GNU C does the same: memory copies can be optimized into memcpy, various operations can be realized as calls into libgcc, etc.
  1. slaymaker1907 · 1789776183 · focus · HN ↗
    And memcpy is kind of special to C/C++ compilers. Sure, it exists as a function, but it will often have special purpose code generated for that particular location.
    It’s obvious why you want to inline memcpy, but the specialization is more interesting. For example, I’ve seen the compiler optimize a memcpy with a static number of bytes and then use SIMD registers to do the copying with no loop at all. It can even be smart enough to take advantage of memory alignment for this.
  2. rcxdude · 1789776266 · focus · HN ↗
    Those do for the most part correspond to operations which make sense in an embedded context, though.
5. kevin_thibedeau · 1789769126 · focus · HN ↗
  The C++ committee has a habit of thumbing its nose at standard practice. They intentionally broke bitwise operators on volatiles because they wanted to be impose their atomic religion everywhere. Then they had to walk that back after they broke every embedded library directly manipulating hardware registers.
  Empty infinite loops are also commonplace in embedded C once main is done with init and within exception handlers. They don't care about anything beyond their narrow systems programming worldview.
  1. Sniffnoy · 1789786015 · focus · HN ↗
    > They intentionally broke bitwise operators on volatiles because they wanted to be impose their atomic religion everywhere.
    Could you elaborate on this?
    aw1621107 · 1789791121 · focus · HN ↗
    "broke" is arguably an overstatement. C++20 deprecated some (most?) operations on volatile variables [0] in part because they can misleadingly imply an atomic operation:
    > volatile external modifications are only truly meaningful for loads and stores. Other read-modify-write operations imply touching the volatile object more than once per byte because that’s fundamentally how hardware works. Even atomic instructions (remember: volatile isn’t atomic) need to read and write a memory location []. These RMW operations are therefore misleading and should be spelled out as separate read ; modify ; write, or use volatile atomic operations which we discuss below.
    This was not received particularly well in the embedded community (e.g., [1]) due to said deprecation affecting compound bitwise operations on volatile variables, which are extremely widely used to interact with hardware registers. This pushback eventually resulted in C++23 un-deprecating compound bitwise operators on volatile variables [2].
    [0]: <a href="https://www.open-std.org/jtc1/sc22/wg21/docs/papers/2018/p1152r0.html" rel="nofollow">https://www.open-std.org/jtc1/sc22/wg21/docs/papers/2018/p11...
    [1]: <a href="https://www.reddit.com/r/cpp/comments/jswz3z/compound_assignment_to_volatile_must_be/" rel="nofollow">https://www.reddit.com/r/cpp/comments/jswz3z/compound_assign...
    [2]: <a href="https://www.open-std.org/jtc1/sc22/wg21/docs/papers/2021/p2327r1.pdf" rel="nofollow">https://www.open-std.org/jtc1/sc22/wg21/docs/papers/2021/p23...
    tialaramex · 1789809225 · focus · HN ↗
    Basically on a rare occasion somebody (JF Bastien) was able to land a C++ proposal which warns you if you'd do something stupid, and inevitably C programmers cosplaying as C++ programmers insisted "it's not stupid it's advanced" and so now C++ must not even warn you this is a bad idea.
    It still is a bad idea, but being warned would make them feel bad.
  2. 112233 · 1789786139 · focus · HN ↗
    By narrow luck compiler writers so far have been the sane bunch, and have ignored C++ committee on many important points. Thus we still have explicitly non-conformant things like -fno-exceptions that lets one use C++ compiler on embedded.
    But I wonder how long that can last, with the way C++ is going.
    At one point, it will make practical sense to update codebase to some other language, rather than keep fighting this one
    pjmlp · 1789798036 · focus · HN ↗
    I have been saying that C++23, or maybe C++26 due to reflection, will eventually be the last standard that actually matters.
    For a large number of C++ users, it boils down to what it offers beyond C, but not to the extent WG21 is driving it since C++20.
    Also the major surviving three compilers have lost wind on their sails as the corporations sponsoring their development have switched focus to other compiled languages.
    Other than the whole security debate, there are no features that would make C++ significantly better for LLVM, GCC, CLR, V8, CUDA,.. improvements.
    In fact, some of those projects still require C++17.
    If this sounds strange, how many care nowadays about ISO Fortran 2023, or ISO COBOL 2023, despite the amount of software written in them powering many busisesses, or Python libraries even, e.g. SciPy.
    Or even with C, almost 20 years later many still reach out to C99, ignoring everything else.
    ilayn · 1789803300 · focus · HN ↗
    Not to take away from your points; SciPy is now Fortran-free completely[0] (we are also requiring C++17 at most). NumPy never had it. BLAS is all C/Assembly in all optimized vendors. For LAPACK we are working on it [1].
    Once there is enough pain, none of the talking points matter for any language. They don't and can't die but linger. I fear that time for C family might come in a decade which would be a shame given how magical Cpp compilers are, all that effort folks pouring in.
    [0]: <a href="https://github.com/scipy/scipy/issues/18566" rel="nofollow">https://github.com/scipy/scipy/issues/18566 [1]: <a href="https://github.com/ilayn/semicolon-lapack" rel="nofollow">https://github.com/ilayn/semicolon-lapack
    pjmlp · 1789804262 · focus · HN ↗
    Thanks for the update overview, and interestingly you also mention C++17, as the version you currently care about.
    MaxBarraclough · 1790365100 · focus · HN ↗
    Is there any significant performance difference?
    ilayn · 1790619131 · focus · HN ↗
    Not really, all competitive compilers saturated to the same performance. Often Fortran and "restrict" sprinkled C compile to the same command set.
6. gpderetta · 1789769288 · focus · HN ↗
  As the only observable behaviour of this_thread::yield is forward progress, because of the as-if rule, the compiler doesn't actually need to replace the loop, when running on a runtime that guarantees preemption. That's the case when std::threads are backed by kernel threads. On a M:N implementation, then yes, a yield would need to be added, but that would be desirable.
  Interestingly, posix realtime FIFO scheduling doesn't preempt even on kernel thread based implementations, so one reading of the standard would require yield on this case. But that can actually be potentially catastrophic as FIFO scheduling is expected to be deterministic. But realtime scheduling is already beyond the standard: I doubt gcc and clang will do the transformation by default.
  In practice the equivalence is necessary to make some obscure corner of the memory model work and prevent some undesirable optimizations; I expect that in practice the compilers, if they implement this at all, will provide an opt-in flag, but they will optimize as-if the call was there.
7. add2 · 1789779830 · focus · HN ↗
  > For constructors and destructors it's somewhat unavoidable and not so random, though Rust does better at limiting the blast radius of non-local code, at least in the drop case.
  Unlike C++, Rust does not manage exceptions at all; in C++, you must consider situations where exceptions arise.
  1. steveklabnik · 1789785259 · focus · HN ↗
    If panics are set to unwind, you do need to consider it, and the UnwindSafe auto trait is there to help with memory safety, but logical issues can still arise.
    It’s way way more rare in Rust though.
8. cryptonector · 1789793419 · focus · HN ↗
  There needs to be a way to stop this. A trivial infinite loop can be useful such as for getting you into a state where you can attach a debugger and examine state then have execution resume elsewhere.

Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.