[Bug c++/18635] New: use of uninitialised reference accepted in C++ front end

[Bug c++/18635] New: use of uninitialised reference accepted in C++ front end

[ajo at acm dot org]

The following (presumably invalid) code is compiled successfully:

  int main(void) 
  {
      int &a = a;
  
      printf("a = %d\n", a);
      return 0;
  }

albeit with the following warning (if given -Wall -W):

  foo.cc: In function `int main()':
  foo.cc:5: warning: 'a' might be used uninitialized in this function

The generated assembly is as follows:

main()
        1070c:  9d e3 bf 90        save         %sp, -0x70, %sp
        10710:  11 00 00 41        sethi        %hi(0x10400), %o0
        10714:  90 12 23 c0        or           %o0, 0x3c0, %o0 ! 0x107c0
        10718:  40 00 40 54        call         printf
        1071c:  d2 02 40 00        ld           [%o1], %o1
        10720:  81 c7 e0 08        ret          
        10724:  91 e8 20 00        restore      %g0, 0x0, %o0

Given that the reference above is never bound to any valid object, should this
instead error?

Tested on 3.4.0 and 3.4.3 (both behave identically).

-- 
           Summary: use of uninitialised reference accepted in C++ front end
           Product: gcc
           Version: 3.4.3
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: c++
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: ajo at acm dot org
                CC: gcc-bugs at gcc dot gnu dot org
 GCC build triplet: sparc-sun-solaris2.9
  GCC host triplet: sparc-sun-solaris2.9
GCC target triplet: sparc-sun-solaris2.9


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=18635

[Bug c++/18635] use of uninitialised reference accepted in C++ front end

[pinskia at gcc dot gnu dot org]

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |diagnostic


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=18635

[Bug c++/18635] use of uninitialised reference accepted in C++ front end

[llib at computer dot org]

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |llib at computer dot org


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=18635

[Bug c++/18635] use of uninitialised reference accepted in C++ front end

[pinskia at gcc dot gnu dot org]

------- Additional Comments From pinskia at gcc dot gnu dot org  2004-11-24 19:07 -------
No this is valid code (but undefined):
int &a = a;
a is injected before the equals so the code is about the same as:
int *a = &*a;

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|                            |INVALID


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=18635

[Bug c++/18635] use of uninitialised reference accepted in C++ front end

[llib at computer dot org]

------- Additional Comments From llib at computer dot org  2004-11-26 02:56 -------
int &a = a;
i don't believe this is valid code.  i believe g++ should reject the code.
various comp.std.c++ people agree with me.

8.3.2/4 states "[...] A reference shall be initialized to refer to a valid
object or function."

surely a (the right-hand-side) is not a valid object or function since it has
not been initialised, so the code is ill-formed.

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=18635

[Bug c++/18635] use of uninitialised reference accepted in C++ front end

[giovannibajo at libero dot it]

------- Additional Comments From giovannibajo at libero dot it  2004-11-26 10:16 -------
Do you have a comp.std.c++ link?

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=18635

[Bug c++/18635] use of uninitialised reference accepted in C++ front end

[llib at computer dot org]

------- Additional Comments From llib at computer dot org  2004-11-29 00:54 -------
google groups link to discussion:
<http://groups.google.com/groups?hl=en&lr=&th=6d093e6073eaac16&seekm=fcaee77e.0411251120.6a6ad93b%40posting.google.com&frame=off>


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=18635

[Bug c++/18635] use of uninitialised reference accepted in C++ front end

[giovannibajo at libero dot it]

------- Additional Comments From giovannibajo at libero dot it  2004-11-29 11:26 -------
OK, reponening after the thread on comp.std.c++

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |UNCONFIRMED
         Resolution|INVALID                     |


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=18635

[Bug c++/18635] use of uninitialised reference accepted in C++ front end

[giovannibajo at libero dot it]

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
     Ever Confirmed|                            |1
      Known to fail|                            |2.95 3.0.4 3.2.2 4.0.0
   Last reconfirmed|0000-00-00 00:00:00         |2004-11-29 11:41:17
               date|                            |


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=18635

[Bug c++/18635] use of uninitialised reference accepted in C++ front end

[redi at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=18635

--- Comment #15 from Jonathan Wakely <redi at gcc dot gnu.org> 2011-05-22 18:40:26 UTC ---
(In reply to comment #14)
> If we cannot decide, we should at least give a verbose warning, included into
> -Wall.

There's already a warning for the original testcase, the one in comment 8 is
covered by PR 18016 and I have a patch for that

[Bug c++/18635] use of uninitialised reference accepted in C++ front end

[adam.rak at streamnovation dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=18635

--- Comment #14 from Ádám Rák <adam.rak at streamnovation dot com> 2010-11-27 13:45:03 UTC ---
(In reply to comment #13)
> There are lots of ways to put your program into an invalid state.
> 
> Of course there's "no point" to doing it, and noone's asking for the code to
> *work*
> 
> The question is whether the compiler is expected to diagnose the code and
> reject it.

If we cannot decide, we should at least give a verbose warning, included into
-Wall.

[Bug c++/18635] use of uninitialised reference accepted in C++ front end

[redi at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=18635

--- Comment #13 from Jonathan Wakely <redi at gcc dot gnu.org> 2010-11-26 17:37:33 UTC ---
There are lots of ways to put your program into an invalid state.

Of course there's "no point" to doing it, and noone's asking for the code to
*work*

The question is whether the compiler is expected to diagnose the code and
reject it.

[Bug c++/18635] use of uninitialised reference accepted in C++ front end

[pentek.imre at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=18635

--- Comment #12 from Imre Pentek <pentek.imre at gmail dot com> 2010-11-26 17:18:26 UTC ---
(In reply to comment #11)
> (In reply to comment #10)
> > (In reply to comment #9)
> > > (In reply to comment #2)
> > > > int &a = a;
> > > > i don't believe this is valid code.  i believe g++ should reject the code.
> > > 
> > > I'm not convinced the compiler must reject it. EDG accepts it too.
> > 
> > Without warning? What about clang 2.8?
> 
> Yes, without warning (G++ at least warns)
> I don't know about clang

This code is as valid as unset references are valid. The standards doesn't
allow 'unset' or 'extremal' references. In this way there's no point to query
the reference from a yet-unset reference, as there's no such a state as unset
reference. If you somehow manage to query the reference from an unset reference
you actually navigated your compiler to a state which doesn't even exist. It's
like division by zero to be accepted without any (runtime/compiletime) error
messages/crashes. Briefly, I consider this code as invalid, as it generates a
state which is invalid, and has no semantic meaning, and doesn't really exist.

[Bug c++/18635] use of uninitialised reference accepted in C++ front end

[redi at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=18635

--- Comment #11 from Jonathan Wakely <redi at gcc dot gnu.org> 2010-11-26 11:25:30 UTC ---
(In reply to comment #10)
> (In reply to comment #9)
> > (In reply to comment #2)
> > > int &a = a;
> > > i don't believe this is valid code.  i believe g++ should reject the code.
> > 
> > I'm not convinced the compiler must reject it. EDG accepts it too.
> 
> Without warning? What about clang 2.8?

Yes, without warning (G++ at least warns)
I don't know about clang

[Bug c++/18635] use of uninitialised reference accepted in C++ front end

[manu at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=18635

Manuel López-Ibáñez <manu at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |manu at gcc dot gnu.org

--- Comment #10 from Manuel López-Ibáñez <manu at gcc dot gnu.org> 2010-11-26 11:11:29 UTC ---
(In reply to comment #9)
> (In reply to comment #2)
> > int &a = a;
> > i don't believe this is valid code.  i believe g++ should reject the code.
> 
> I'm not convinced the compiler must reject it. EDG accepts it too.

Without warning? What about clang 2.8?

[Bug c++/18635] use of uninitialised reference accepted in C++ front end

[redi at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=18635

Jonathan Wakely <redi at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to fail|                            |

--- Comment #9 from Jonathan Wakely <redi at gcc dot gnu.org> 2010-11-26 10:59:24 UTC ---
(In reply to comment #2)
> int &a = a;
> i don't believe this is valid code.  i believe g++ should reject the code.

I'm not convinced the compiler must reject it. EDG accepts it too.

> various comp.std.c++ people agree with me.

Working link to the thread:
http://groups.google.com/group/comp.std.c++/browse_thread/thread/fb732bbcd0fecec5/4e04facc65ebf2f5

> 8.3.2/4 states "[...] A reference shall be initialized to refer to a valid
> object or function."
>
> surely a (the right-hand-side) is not a valid object or function since it has
> not been initialised, so the code is ill-formed.

Right, but consider:

inline int& f(int& i) { return i; }

int& i = f(i);

And then consider if f(int&) is not inline and is defined in another
translation unit.  The compiler can warn that f(i) uses an uninitialized
variable but can't know that the initializer for i is invalid, because maybe
f() does return a reference to a valid object.

(In reply to comment #8)
> in g++-4.6 (and maybe all before) this bug can be even more troublesome:
> struct AA
> {
>  int &a;
>  AA() : a(a)
>  {
>  }
> };
> 
> int main()
> {
>         AA aa;
>         cout << &aa.a << endl;
>         return 0;
> }
> 
> compiled without a warning even with

That's simply because we don't do uninitialized warnings for data members,
that's a separate bug.

[Bug c++/18635] use of uninitialised reference accepted in C++ front end

[adam.rak at streamnovation dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=18635

Ádám Rák <adam.rak at streamnovation dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |adam.rak at streamnovation
                   |                            |dot com

--- Comment #8 from Ádám Rák <adam.rak at streamnovation dot com> 2010-11-26 00:30:17 UTC ---
in g++-4.6 (and maybe all before) this bug can be even more troublesome:
struct AA
{
 int &a;
 AA() : a(a)
 {
 }
};

int main()
{
        AA aa;
        cout << &aa.a << endl;
        return 0;
}

compiled without a warning even with
g++ main.cpp -O3 -Wall -pedantic -Wextra -Winit-self -Wuninitialized

And in -O0 it prints some address, probably the address of the reference as
suggested before. But in -O1..3 it prints a 0, which means we made an
nullreference. 

The practical problem is that because of this, the code can be easily messed up
like this:

class AA
{
...int &aaa;

   AA(int& aaaa) : aaa(aaa) {...

A single typo and the compiled does really strange things, the segfault is best
case, sometimes the reference points a valid address. It is very hard to debug
too. And when the programmer checks the code he/she can naively think that the
compiler should check it, so "why bother checking whether they are spelled
exactly the same?"

The old testcase was a bit harder to do accidentally, this one can happen more
easily. A self-init warning might enough to clue the programmer if this
happens. An error would be better if we are sure this is invalid.

[Bug c++/18635] use of uninitialised reference accepted in C++ front end

[pinskia at gcc dot gnu dot org]

------- Comment #7 from pinskia at gcc dot gnu dot org  2009-05-29 14:35 -------
*** Bug 40293 has been marked as a duplicate of this bug. ***


-- 

pinskia at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |pentek dot imre at gmail dot
                   |                            |com


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=18635

[Bug c++/18635] use of uninitialised reference accepted in C++ front end

[gdr at gcc dot gnu dot org]

------- Comment #6 from gdr at gcc dot gnu dot org  2005-11-27 21:18 -------
this is accept-invalid, no diagnostic


-- 

gdr at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|diagnostic                  |accepts-invalid


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=18635