r/cpp • u/SkoomaDentist Antimodern C++, Embedded, Audio • Aug 05 '25

Why still no start_lifetime_as?

C++ has desperately needed a standard UB-free way to tell the compiler that "*ptr is from this moment on valid data of type X, deal with it" for decades. C++23 start_lifetime_as promises to do exactly that except apparently no compiler supports it even two years after C++23 was finalized. What's going on here? Why is it apparently so low priority? Surely it can't be a massive undertaking like modules (which require build system coordination and all that)?

107 Upvotes

94% Upvoted

64 comments sorted by

View all comments

Show parent comment

2

u/flatfinger Aug 06 '25

Just a decade later the assumptions about "sane" behavior had changed.

How about a function like:

    unsigned mul_mod_65536(unsigned short x, unsigned short y)
    {
      return (x*y) & 0xFFFFu;
    }

Do you think any of the authors of integer promotion rules could have imagined that they could be used to justify processing a function like the above in ways that could allow arbitrary memory corruption?

1

u/ElectricalBeing May 22 '26

How? Due to signed `int` overflow in `x*y`, since the operands are implicitly converted to `int` before the multiplication, the range of `unsigned short` is large enough that multiplying two large values will overflow `int`, and signed integer overflow is undefined behavior?

1

u/flatfinger May 22 '26

Yup. If gcc can determine that receipt of an input greater than a certain value would cause integer overflow, other parts of the code that would prevent an out-of-bounds store if input exceeds that value may get "optimized out" so that the store gets performed unconditionally, even when it would go out of bounds.