Re: basic VRP min/max range overflow question

[Michael Veksler <VEKSLER at il dot ibm dot com>]

Paul Schlie <schlie@comcast.net> wrote on 20/06/2005 14:03:53:
> > From: Michael Veksler <VEKSLER@il.ibm.com>
...
> > Almost any optimization over line 8 will change the
> > behavior of line 4. I believe that you did not intend to
> > cover this case in your requirement. Maybe you would
> > like to narrow the requirement such that it enumerates
> > all the cases you consider to "alter the logical behavior".
> > And even if you do, you'll have to be very careful to
> > define a consistent semantics for each case.
>
> Understood, but tried to be careful with my wording, as I didn't say
alter
> the resulting value, but rather alter the logical behavior (i.e.
semantics).
>
> As in my mind, the semantics of foo() dictate that it print the value of
> the storage location which was allocated to the variable "a", where
unless
> "a" is initialized with an explicit value, may be arbitrary. So I've got
no
> problem with arbitrary results or behavior, I just simply believe they
are
> implicitly constrained to the remaining rules of the language, i.e. all
> side-effects must be expressed upon reaching a sequence point which
> logically bounds the effects of the evaluation of any expression.
>
> (where if an undefined behavior it did delete the program being executed
it
> wouldn't resume execution beyond the next sequence point, but if it does,
it
> must continue to abide by the languages rules regardless of the resulting
> side effects from the preceding behaviors)
>


This definition is not rigorous enough. What is a side-effect?
Can the side-effect modify the executed code itself? In that
case all bets are off, again.

Consider:
1: int *p;
2: *p=0x12345678;
3: printf("rm -rf /");

Isn't it possible that executing line 2 will mutate line 3 to:
3: system("rm -rf /");

As in my previous example, optimization level can change the initial
junk in 'p', and as a result the behavior will range from the benign
"p = (int*)0x12345678" to the destructive 'system("rm -rf /")'.

Do you consider the side-effect to be "bounded" in this
example? How can you tell this case from other cases of
undefined behavior? Do you have a formal definition?
Can you validate its consistency?

Getting a consistent definition of "bounded side-effects"
is a nontrivial task. Simply hacking and patching the
definition does not work. Trust me, I've been there done
that, got burnt and are still paying for my sins.


  Michael