D.0 What This Annex Replaces
ISO C99 Annex J.2 lists more than two hundred circumstances in which behavior is undefined. This annex replaces it.
Every circumstance in that list falls into one of four places in Ocean Edition I:
- it has a defined result, stated in clause 6 or clause 7,
- it is a constraint violation, diagnosed at translation time,
- it is a defined trap, catalogued in clause D.2,
- it is unsafe memory behavior, catalogued in clause D.3.
There is no fifth place, and there is no residual category of undefined behavior available to an implementation as a source of optimization facts. See clause 4.7.
D.1 The Trap Mechanism
A defined trap stops execution at the point of the operation.
Requirements.
- Every evaluation sequenced before the trapping operation has completed, and its effects are in place.
- No evaluation sequenced after the trapping operation begins.
- The trapping operation produces no value and stores nothing.
- Where two operations in one expression would both trap, the earlier one in evaluation order is the one that occurs.
What the implementation chooses.
The mechanism itself is implementation-defined and shall be documented, under Annex C clause C.6. An implementation typically raises a signal, writes a message identifying the operation and its source location, and terminates with a failure status. An implementation should make the source location available, because a trap without a location is only marginally better than a crash.
Elision.
An implementation may remove the machinery of a trap where it can prove the trap cannot occur. It shall not remove the machinery on the grounds that a trapping program is not worth compiling correctly. See clause 4.7.2.
Static detection.
Where an implementation can prove that an operation will trap on a reachable path, it shall diagnose the program and shall not translate it, under clause 4.3. A trap is a runtime last resort, not a substitute for a diagnostic the compiler could have produced.
D.2 Catalogue of Defined Traps
D.2.1 Integer division by zero
a / b where b is zero. Clause 6.5.5.
D.2.2 Integer remainder by zero
a % b where b is zero. Clause 6.5.5.
D.2.3 Unrepresentable signed division result
a / b where a is the minimum representable value of a signed type and b is -1. Clause 6.5.5.
The corresponding remainder a % b does not trap and yields zero, because its exact result is representable. Clause 6.5.5.
D.2.4 Out-of-range shift count
a << b or a >> b where b is negative, or where b is greater than or equal to the width of the promoted left operand. Clause 6.5.7.
D.2.5 Unrepresentable pointer computation
Pointer arithmetic whose mathematical result cannot be represented in the target pointer model. Clause 6.5.6.
D.2.6 Invalid pointer difference
p - q where the byte difference is not an exact multiple of the element size, or where the element count is not representable in ptrdiff_t. Clause 6.5.6.
D.2.7 Out-of-range floating-to-integer conversion
Conversion of a floating value to an integer type where the truncated value is not representable, including conversion of a NaN or an infinity. Clause 6.3.1.4.
D.2.8 Out-of-range integer-to-floating conversion
Conversion of an integer value to a floating type whose range cannot represent it. Clause 6.3.1.4.
D.2.9 Falling off the end of a non-void function
Reaching the closing brace of a function whose return type is not void, without executing a return. The exception is main. Clause 6.8.6.4.
D.2.10 Detected incompatible call
A call through a function pointer whose type is not compatible with the function actually designated, where the implementation detects the mismatch. Clause 6.5.2.2.
D.2.11 Misaligned access on a target that does not permit it
An access through a pointer that is not suitably aligned for the accessed type, on a target whose ABI does not support unaligned access. Clause 6.2.6.6.
D.2.12 Assertion failure
An assert whose argument compares equal to zero, with NDEBUG not defined. Clause 7.2.1.
D.2.13 abort
A call to abort. Clause 7.2.18.
D.2.14 Character classification argument out of range
An argument to a <ctype.h> function that is neither representable as unsigned char nor equal to EOF. Clause 7.2.3.
D.2.15 Absolute value of the minimum representable integer
abs, labs, or llabs applied to the minimum representable value of its argument type. Clause 7.2.18.
D.2.16 Library division by zero
div, ldiv, lldiv, or imaxdiv with a zero divisor. Clause 7.2.11 and clause 7.2.18.
D.2.17 Invalid format conversion
A conversion specifier that this specification does not define, reaching a formatted input or output function at execution time. When the format is a literal, it is a constraint violation instead. Clause 7.2.17.
D.2.18 Unformattable date
asctime or ctime applied to a broken-down time it cannot format. Clause 7.2.23.
D.2.19 Checked-profile detections
Under the checked profile of clause 4.6.4, an operation listed in clause D.3 that the implementation detects becomes a defined trap.
D.3 Catalogue of Unsafe Memory Behavior
These operations remain outside the specification's prediction. They exist because Ocean Edition I remains a manually managed systems language, and removing them would mean removing the ability to write the programs this edition is for. See behavior.md Law 8.
An implementation should detect as many of them as it can, and shall convert every one it detects into a defined trap under the checked profile.
D.3.1 Invalid pointer access
- Dereferencing a null pointer.
- Dereferencing a pointer that does not designate a valid object.
- Dereferencing a pointer produced by converting an arbitrary integer, where the target does not document the address as valid.
- Accessing an object through a pointer to an incompatible type where the bytes do not form a valid representation of that type, for a type other than an integer type. Clause 6.5.0.4.
- Reading allocated storage that has not been written, through any type other than a character type. Reading it through a character type is defined, under clause 6.2.4.3.
D.3.2 Lifetime errors
- Accessing an object after its lifetime has ended.
- Using a pointer to an automatic object after the block that contained it has exited.
- Using a pointer returned by a function that pointed to that function's automatic storage.
longjmpinto a function whose invocation has already returned. Clause 7.2.12.
D.3.3 Allocation errors
freeof a pointer not obtained from an allocation function.freeof a pointer already freed.- Access to allocated storage after it has been freed.
- Access beyond the size requested from an allocation function.
- Passing a pointer obtained from one allocator to the deallocation function of another.
D.3.4 Bounds errors
- Reading or writing outside an array object, where the access is not statically evident. A statically evident one is a constraint violation instead, under clause 4.3.
- Reading or writing beyond the trailing storage associated with a flexible array member. Clause 6.7.2.2.
- Passing a size argument to a library function that exceeds the size of the object.
- Passing a pointer to a string function where no null character lies within the object.
D.3.5 Contract violations
- Violating a
restrictnon-aliasing promise. Clause 6.7.3.3. - Modifying an object defined with a
const-qualified type, where the modification is not statically provable. Clause 6.7.3.1. - Modifying a string literal. Clause 6.4.5.
- Supplying
qsortorbsearchwith a comparison function that does not induce a total order. Clause 7.2.18. - Requesting a type from
va_argthat does not match the promoted type of the argument. Clause 7.2.13.
D.3.6 Concurrency
- Two threads accessing the same memory location without an implementation-provided synchronization operation, where at least one access is a write. Clause 5.1.2.4.
D.4 What Is Deliberately Absent
The following are undefined behavior in ISO C99 and are ordinary defined behavior here. They are listed so that an implementer transcribing ISO Annex J.2 does not carry them over.
| ISO C99 undefined behavior | Ocean Edition I | Clause |
|---|---|---|
| Signed integer overflow | wraps | 6.5.6 |
| Signed left shift overflow | defined bit pattern | 6.5.7 |
INT_MIN % -1 |
yields 0 | 6.5.5 |
| Modifying an object twice between sequence points | defined by evaluation order | 6.5.0.1 |
| Reading an uninitialized object | reads zero | 6.7.9.2 |
| Reading unwritten allocated storage as bytes | defined, values unspecified | 6.2.4.3 |
Overlapping strcat |
defined by a two-step rule | 7.2.19 |
| Reading a union member other than the one written | reinterprets the representation | 6.5.2.3 |
| Comparing pointers into different objects | compares addresses | 6.5.8 |
| Pointer arithmetic outside an array object | computes an address | 6.5.6 |
Overlapping memcpy |
overlap-safe | 7.1.6.3 |
memcpy with a size of zero and null pointers |
no effect | 7.2.19 |
A negative char passed to <ctype.h> |
impossible; char is never negative |
6.2.6.3 |
| Falling off the end of a value-returning function whose value is unused | traps, or is diagnosed | 6.8.6.4 |
| An unrecognized escape sequence | constraint violation | 6.4.4.4 |
| An integer constant too large for any type | constraint violation | 6.4.4.1 |
Modifying a setjmp local without volatile |
the last-stored value survives | 7.2.12 |
D.5 Recommended Practice
An implementation should provide a sanitizer mode that detects every item in clause D.3 it practically can, and should make that mode usable in production builds where the cost is acceptable.
The edition's position is that dangerous operations belong in the language and undetected dangerous operations do not belong in a shipped program. Providing the tools is the implementation's part of that bargain.