last day (15 days later) » 

10:16 PM
-1
A: Class using virtual inheritance seems to allow a base class constructor to overwrite another base class' members

curiousguy I am not familiar enough with the memory layout of objects that contain virtual bases Virtual bases (and base class subobjects that have virtual bases) are not in general constructed nor represented like complete objects of the same types, as opposed to any other subobject which has the sam...

 
I know it’s wrong. I also know that memset in a constructor technically works for classes that contain only POD types. Constructors are normally able to assume they can initialize the full size of the class. Where I’m fuzzy is why the memory layout of class C changes when it uses virtual inheritance (vs non-virtual); it looks like it packs the members differently which makes the size assumption invalid. You touched on this in your answer and that was the part I was most interested in. If you expand on why it’s dangerous in the context of virtual inheritance, I’ll accept your answer.
Also, the very last part of my question asks why the compilers don’t at least warn if this situation is detected. gcc has -Wclass-memaccess which seems like the perfect diagnostic to trip here, but it doesn’t.
 
"I know it’s wrong" You suppose and believe so. Can you please provide any link to any source, authoritative or not, that backs up your comments?
"Warn when the destination of a call to a raw memory function such as memset or memcpy is an object of class type, and when writing into such an object might bypass the class non-trivial or deleted constructor or copy assignment" Not sure whether that was meant to apply to code inside a ctor. "violate const-correctness" no const here "or encapsulation" no encapsulation inside a member function "or corrupt virtual table pointers" not a polymorphic class, so no vptr
"gcc has -Wclass-memaccess which seems like the perfect diagnostic to trip here, but it doesn’t." And why would it? How is memset(this, 0, sizeof(A)); incorrect? Is memset on a non polymorphic class inherently invalid? The class has no base class, no virtual function...
 
""gcc has -Wclass-memaccess which seems like the perfect diagnostic to trip here, but it doesn’t." And why would it? How is memset(this, 0, sizeof(A)); incorrect? Is memset on a non polymorphic class inherently invalid?" I believe you are the one who told me in no uncertain terms how wrong and invalid it is in your answer. I quote: "It isn't frivolous, it's plainly wrong. ... The code uses an unsupported operation (overwriting the memory of the c2 object during construction)" If it's so plainly wrong and is "unsupported", why doesn't the compiler warn?
 
Did I say or imply that memset or other byte-level access functions can't ever be used on a class?
 
You've more than implied that its usage is incorrect in a constructor, and never made a distinction between that and any other form of its usage. When your answer clearly says "you're doing it wrong", followed by a comment that says, "what's wrong with it?" is exceedingly misleading.
It doesn't matter that you were referring to memset in the general sense, it came across very contradictory.
 
10:25 PM
I'm puzzled that you understood that. I never said that it's incorrect in a ctor.
 
Your answer was also very antagonistic. I wasn't looking for people telling me how wrong the example is. Of course I know not to use memset in a constructor. I was trying to find out why there aren't more protections around this when the compilers should be able to detect what's going on. And I was confused as to why the virtual inheritance is what caused it to break, when non-virtual inheritance seemed to do what I expected
 
It's obviously incorrect in some ctors and memset(this, 0, sizeof(A)); obviously is incorrect in a polymorphic class as it overwrites the vptr.
 
I understand that
 
"_Of course I know not to use memset in a constructor_"
You can use it to initialize a member of class of trivial type.
 
You are saying that memset(this, 0, sizeof(A)) is correct in A. Great. I agree, but your answer says that it isn't.
 
10:27 PM
My answer says no such thing.
Your program is buggy.
Using memset(this, 0, sizeof(A)) isn't inherently wrong.
 
My contrived example might be buggy, but that was basically the point of my question. Why, specifically, is it actually buggy?
memset() is perfectly valid in A's constructor
and deriving from it is also valid
 
I don't know what's a non-antagonistic answer but the first issue I see is that you want to assume that all instance of a class have the same representation, whether it's a complete object or a subobject, even when virtual bases are involved.
 
I never said I want to assume that. My question actually asks what the memory layout of the resulting class looks like because I wasn't sure!
 
It seemed to me that all problems derive from that assumption.
What makes you believe that deriving from a class is OK?
I don't even understand where you stand anymore. Under which condition is memset OK according to you?
 
I never understood where you stand. You seem to be all over the place.
 
10:33 PM
"Where I’m fuzzy is why the memory layout of class C changes when it uses virtual inheritance (vs non-virtual);"
The layout is extremely compiler dependent; why would you ever want to depend on it?
 
Where I stand is clear.
1) The layout of an object of some type is the same for a complete object, an array element, and a data member.
2) For a class involving virtual bases, the layout is typically different between a complete object and a base subobject.
Do you agree at least with that?
 
@JohnDrouhard "I never said I want to assume that"
Here you did:
"I also know that memset in a constructor technically works for classes that contain only POD types. Constructors are normally able to assume they can initialize the full size of the class"
memset in a constructor assumes that the representation of the class owns exclusively the same number of bytes as a complete object (sizeof (C))
"memset in a constructor technically works for classes that contain only POD types" -> 3 comments
1) in modern C++, there are no POD types but trivial types
2) the memset doesn't just assume that all members are trivial types, but that the class itself is standard layout (I think) so no virtual functions
 
Ok, slow down there.

My assumption was about memset, not about object layout. And therein is the source of my confusion. I figured, or hoped, that a compiler would know that memset() usage in these cases would stomp over things it shouldn't.
Yes, I was using POD as shorthand for trivial type. A is a trivial type.
 
10:40 PM
3) the assumption that there are sizeof (C) bytes exclusively associated with the object does not hold for a base class subobject in general
I don't think A is trivial:
struct A {
    A() { memset(this, 0, sizeof(A)); }
 
Yes, sorry. A is not trivial.
 
A user defined constructor isn't trivial
 
but it contains only trivial members and has standard layout.
 
yes (I think) so memset is potentially usable here
 
Using memset() to clear a type that is trivially copyable/destructible and has all trivial members is still valid for a complete type, like you said. But if the type is used as a base class for another class, then it could potentially become wrong, if the layout changes.
If I understand what you're saying.
 
10:44 PM
Almost!
There are two very closely related issues:
- the layout of a class: location of its data members and base classes
- the reserved size of a class
By definition virtual bases are unique so their relative locations change depending on which subobject base we consider.
struct VB { int i; };
struct D1 : virtual VB {};
struct D2_1 : D1 {};
struct D2_2 : D1 {};
struct D3 : D2_1, D2_2 {};
There is only one object VB in D3 so obviously the relative location of VB from D2_1 is different from the relative location from D2_2.
Note that D1 is only derived non virtually so there are as many D1 subobjects as D1 is mentioned in the inheritance: one D1 in D2_1 and another D1 in D2_2
 
Right
Here's another way to look at my question given all this
 
So there is a fixed layout for a complete D2_1 object and the layout of D3::D2_1 may or may not match it.
But we know that we cannot have at the same time:
 
Since using memset() in a constructor is sometimes safe, why can't the compilers detect an overwriting problem at compile time (since they are the ones doing the layout, and know the size being passed to memset())?
 
- complete D2_1 object layout matches D3::D2_1
- complete D2_2 object layout matches D3::D2_2
 
Yep, that totally makes sense. Introducing virtual inheritance will absolutely change the memory layout of base classes within the derived class
 
10:56 PM
A compiler is already an extremely complex piece of code. Compiling code efficiently is difficult but producing useful warnings may be even more difficult, almost an art.
Generating warnings depends on knowledge of some context for precision; more context may provide more precision but carrying too much information too far may cause other issues, like being very mysterious as to when warnings come and go.
 
True, and I don't want to downplay the expertise and skill required to make effective warnings. I just thought -Wclass-memaccess is almost there
 
Warnings that are sometimes provided and sometimes not can make the user experience very confusing.
 
Well, I think if the warning were diagnosed in this situation, it would always be diagnosed in this situation, but I agree that non-deterministic warnings are not good
 
Even if the content of an inline function is available for further analysis in the calling code, that doesn't mean that the compiler has inferred a set of pre/post conditions from the internals of the function.
Doing so would generate a lot of information such as "that function can't be called with a null pointer as third argument" or "if called with x>3, then the precondition is that y<7 (warn otherwise) and the return value cannot be null".
You see that these can be arbitrarily complex and obviously a bound must be set on the amount of information.
Doing a lot of static analysis has the annoying effect that a very tiny change in the source code can invalidate a lot of a analysis.
It means that the programmer never knows how precise his tools are.
 
Sure.
 
11:05 PM
(Note that the remark also applies to advanced optimization that may be stopped by any program change that the user doesn't know is likely to prevent optimizations.)
Emitting correct warning in your code doesn't sound like science fiction.
 
Knowing that this situation is possible is worrisome for me. There's no telling how library authors or other developers have written constructors, and if it's sometimes safe to use memset(), it seems dangerous to require knowledge of implementation before determining whether its safe to use as a base class
 
Some classes are not constructed to be useful as base classes (no virtual functions, not even a virtual dtor) but usually that doesn't mean they can't be used as base classes at all.
In modern C++ a class can insist on not being used as a base class by using final
(Few classes do that.)
A class that has a virtual base obviously is designed to be used as a base class.
Between those never meant to be base classes and those specially designed to base classes, there are many classes where it isn't documented to be used as a base and not documented to never be used as one.
This is a large gray area where people may still sometime want to derive from these classes to add some members while not having to forward all the existing member functions.
You are right about the fact that such classes could use idioms not safe when used as bases.
 
Right, and if they happen to use memset() in a constructor, then you have a potentially buggy program. I guess that's what worries me
 
And using byte oriented functions is just one way to break derived classes.
 
Through no real fault of either yours or theirs
 
11:11 PM
Another idiom that would break derived classes is the use of the destroy-construct sequence for assignment:
A &operator= (const A &rhs) {
  if (this==&rhs) return *this;
  this->~A();
  new (this) A(rhs);
  return *this;
}
 
Yeah, that looks broken to me
 
This is safe as long as
- there is no possible exception during reconstruction
- there are no const or reference members in the class (that includes in any subobject)
AND
- there is no further derivation
 
For the same reason clang doesn't elide the copy in delegating constructors for types that have non trivial copy constructors (gcc does, which I still believe to be a bug)
Ah yes, reference members. Yeah, that just seems too brittle to actually use
 
The destroy-reconstruct idiom is now actively discouraged ...
but it's technically valid and usable in a strictly limited set of cases
 
Falls into the same category as this memset() issue I suppose
"technically valid but is so prone to gotchas"
 
11:18 PM
For a class not meant to be derived you can use final, but it's still fragile
@JohnDrouhard I have never considered that issue
 
Yeah, if the delegating constructor elides the copy, it could potentially construct the object as it if was the most derived type, when it might not be
Richard Smith (clang maintainer) was the one who showed why this is dangerous and why clang fails to compile it
I didn't know either, until I sent a bug report to LLVM: bugs.llvm.org/show_bug.cgi?id=40245 and his response was actually what got me thinking and led to the stack overflow question that we are discussing now. The difference is the memset() call from inside the ctor vs a static factory function
factory function knows it's valid to memset the whole thing because it has a complete object already. Using this known good technique will still cause bugs if the copy is elided in a delegating constructor
@curiousguy appreciate you discussing this with me. If you want to edit your answer to include some of what we discussed here, I will accept your answer. Hopefully it's more clear where my confusion was
 
11:41 PM
I will update and clarify my answer (but not today)
 
Ok, thanks. Have a good one
 

last day (15 days later) »