John Regehr

I'm not exactly a compiler engineer (I do program analysis research, frequently with LLVM as my base), but here are some things that come to mind: * The LLVM ecosystem is an absolute godsend for most instrumentation, analysis, and optimization tasks. The project provides an excellent tutorial on writing LLVM passes[1] that I refer to daily. * The compiler blogosphere is full of excellent resources, including Eli Bendersky[2], Trail of Bits[3] (fd: my employer), and John Regehr[4]. [1]: https://llvm.org/docs/WritingAnLLVMPass.html [2]: https://eli.thegreenplace.net/tag/llvm-clang [3]: https://blog.trailofbits.com/category/compilers/ [4]: https://blog.regehr.org/

I'd recommend "Embedded in Academia" - https://blog.regehr.org/

You could always write one. I recommend the work of John Regehr as a starting reference: http://blog.regehr.org/

And see John Regehr's ( http://blog.regehr.org/, of the headline article) other posts. He's written a great deal about undefined behaviour in C/C++ and how modern compilers handle it. Check the ‘Compilers’ and ‘Software Correctness’ categories.

https://blog.regehr.org for undefined behavior lovers.

You are asking a number of inter-related questions. I will try to scatter a few pointers (pun intended) for you to follow up on. As far as learning the essential syntax of the C language, K&R 2ed is excellent. It was rewritten to cover the ANSI spec variations. The first edition uses the "traditional" conventions and these are generally flagged with warnings by most C compilers. You mention performance. That claim is a red herring. In absolute terms, C allows you to write the fastest code if you know what you are doing. But it's like saying that a Ferrari is the better car to drive to the mall because it gets you there faster - no mention of speeding tickets, purchase cost, insurance, etc. Many other languages will let you write almost as performant code which takes less time to debug and is easier to maintain. C is used for many different application areas, you don't mention what area you are working in. For example, C programming for Linux kernel modules is very different to writing Arduino code or networking code, etc. Each of these areas have a large body of knowledge based upon experiences, etc. I find Google / StackOverflow excellent resources. If you really want to learn about the quirks of C language and C compilers, then I can recommend http://blog.regehr.org. Finally, I recommend using gcc or clang on Linux or Mac with a vanilla text editor and command line tools. Using IDEs, including VS, introduces too much magic which can be extremely difficult…

When I was writing the code generation part of a compiler in a previous lifetime, there were a number of conversations of the following sort early on in the production life of the compiler: Programmer: The compiler is producing the wrong code for this case. Compiler team: Ok, let's look at the code and step through it. Programmer: So it is putting this quantity in the register pair here Compiler team: Right. Programmer: and it is taking out the high byte and putting it there Compiler team: Right. Programmer: and then it is . . . Oh. Wow, that is a weird way to do this. Compiler team: Right. Saves two bytes of code. The programming team had previously used assembler and had developed conventions of code patterns. Our boss pointed out that "A compiler should produce assembly code that an assembly programmer would be fired for writing." Not that we didn't have bugs, but the previous conversation was more common than the code generation bugs we had. And if, Team Compiler, if you think that that compiler is always right, John Regehr http://blog.regehr.org/ has some news for you.

I was struggling to come up with "worth it" ASCII-art-in-code scenarios for my codebase and found a post[1] with examples (that turns out to have been posted here in HN a while back[2]). Pretty cool. [1] https://blog.regehr.org/archives/1653 [2] https://news.ycombinator.com/item?id=31891226

Beej's guides are great. As for C, you also need the mandatory companion guide: A Guide to Undefined Behavior in C and C++ (https://blog.regehr.org/archives/213).

Well, low skill floor, sure, but there's a very high skill ceiling. John Regehr and his students have done impressively deep work in finding compiler bugs. • https://blog.regehr.org/archives/category/compilers • https://blog.regehr.org/ (some of his compiler-related posts aren't properly tagged) • [PDF] https://users.cs.utah.edu/~regehr/papers/pldi11-preprint.pdf Finding and Understanding Bugs in C Compilers (edit I see someone else already posted this paper) • A (very) little discussion: https://news.ycombinator.com/item?id=7728035

For someone who's been writing "C for 20+ years" according to your other post, you come across as extremely ignorant of how modern optimizing C compilers work. I suggest you thoroughly read and understand Russ Cox's simple expose [1] and the UB posts in John Regeh'r blog [2]. The C security issues that plague us today are partly fueled by the attitude of guesswork and ignorance demonstrated in your posts. [1] https://research.swtch.com/ub [2] https://blog.regehr.org/

musl is one of the better ones [0]. None other than John Regehr recommends studying it [1]. [0] https://en.wikipedia.org/wiki/Musl [1] https://blog.regehr.org/archives/1393

This article gives a "No True Scotsman" (https://en.wikipedia.org/wiki/No_true_Scotsman) arguement about C programming being safe in the hands of sufficiently skilled developers. Notwithstanding the best "ace / sniper" C developers and modern compilers, scanners, fuzzers, etc., C continues to be unsafe due to undefined behavior and how easy it is for anyone (including experts) to make mistakes: https://blog.regehr.org/archives/1520

Here's some more on gcc optimization from 2010, discusses how GCC optimization started eliminating null pointer checks in Linux kernel code necessiting compiling at a lower optimization level (towards the bottom). On the 'good' side, it also mentions tight loops can speed up 30-50% if the compiler can ignore signed integer overflow. Also has 'best practices' list: https://blog.regehr.org/archives/213

I heartily agree. The best take I have ever seen was due to John Regehr: https://blog.regehr.org/archives/1393

Since it hasn't been mentioned yet, I'll point out that the article is about how hardware processors react to assembly level shifts with greater than register size. Unless you are programming directly in assembly, the most important take-home from the article is probably the "Bonus chatter" at the end: shifts equal to or greater than register size are undefined in C and C++. How the CPU would handle the theoretical assembly instruction is usually of little importance when demons are flying out of your nose. Here's Regehr on some of the standard ways to protect yourself from a malicious or overzealous compiler when you need to have a function that does variable sized rotations: https://blog.regehr.org/archives/1063

This novel, and the prequel A Deepness in the Sky, depict a human interstellar civilization thousands of years in the future, in which superluminal travel is impossible (for the humans), so travelers use hibernation to pass the decades while their ships travel between systems. Merchants, including the ones the book portrays, often revisit systems after a century or two, so see great changes in each visit. <spoiler>The merchants repeatedly find that once smart dust (tiny swarms of nanomachines) are developed, governments inevitably use them for ubiquitous surveillance, which inevitably causes societal collapse.<https://blog.regehr.org/archives/255></spoiler> People always talk about the future Usenet and such, but this is the most important single insight of Vinge in the two books.

One of the key interest of C compared to more recent languages is that everything is explicit. With a finger you can follow the code as it runs and know exactly what is going on and when exactly. This has not been true in many years. C appears to be such a language, but optimizing compilers have learned how to find and optimize undefined behavior in code that most C programmers don't realize is unsafe. As a result there can be a considerable gap between the code as clearly intended, and the code that will be generated. See https://blog.regehr.org/archives/213 for more on this. Including real world examples of things like validation checks being elided by the compiler, leading to real-world vulnerabilities in programs which clearly have checks to avoid exactly those vulnerabilities.

My favorite take on the severity of the UB problem, https://blog.regehr.org/archives/1520 : > Tools like [Valgrind] are exceptionally useful and they have helped us progress from a world where almost every nontrivial C and C++ program executed a continuous stream of UB to a world where quite a few important programs seem to be largely UB-free in their most common configurations and use cases...Be knowledgeable about what’s actually in the C and C++ standards since these are what compiler writers are going by. Avoid repeating tired maxims like “C is a portable assembly language” and “trust the programmer.” Unfortunately, C and C++ are mostly taught the old way, as if programming in them isn’t like walking in a minefield.

No C pedantry thread would be complete without a link to one of the finest resources on the subject: https://blog.regehr.org/

> If you want to blame something, blame the C language. Compiler developers are just doing their jobs. Compiler developers are doing a fantastic job, and I absolutely do blame the C language and standard. For the cases referenced in the article, it seems to me that the preferred solutions would be making int 64-bits and leaning on the restrict keyword rather than the semi-disaster that is strict aliasing (https://blog.regehr.org/archives/1307).

Funny enough, pointers are a great example of an abstraction provided by C that people assume is isomorphic to hardware, when they don't: https://blog.regehr.org/archives/1621 That said, I 10000% agree that pointers are a thing that is great to learn. > You really should understand how things like .size or lengh() aren’t “free” and how they work. You're talking about strings here, right? This is not true in all languages, but certainly is true that these are not free in C :)

The standard massively conflicts with the practices used in existing C programs by existing C programmers. Yes, it's perfectly possible to write code that doesn't violate any of the (largely implicit, it's worth noting) strict-aliasing rules. But was it a good idea for the standard to allow optimizing compilers to silently break massive amounts of existing code that has worked for years? Even if that were acceptable, was it a good idea for the standard to disallow one of the more ergonomic and explicit ways (using a union) of reinterpreting an object as an object of a different type? Some good reads on this topic: https://blog.regehr.org/archives/1307 http://www.yodaiken.com/2018/05/20/depressing-and-faintly-terrifying-d… https://blog.regehr.org/archives/903 (See the end of Xavier Leroy's comment)

It's not about the compiler doing "extra checks" to deliberately do something different. The real issue is with aggressive optimizations. In order to get maximum performance, the compiler is allowed to assume that the programmer doesn't invoke undefined behavior. In other words, it can replace code with something that is equivalent in the presence of UB, but does something totally different in the absence of UB. See e.g. https://blog.regehr.org/archives/767 for some examples of how this can go wrong. (My favorite is the third one.)

recall this classic: https://blog.regehr.org/archives/140 C Compilers Disprove Fermat’s Last Theorem

> Unfortunately, I'm also sure that we don't have the time to do it. And that really is the crux of the issue. Despite the significant amount of discussion around the problems of C UB, there is precious little work being done to actually "solve" the problems. https://blog.regehr.org/archives/1287 > Since we published the Friendly C proposal, people have been asking me how it’s going. This post is a long-winded way of saying that I lost faith in my ability to push the work forward. However, I still think it’s a great idea and that there are people besides me who can make it happen.

by "safer C", i assume you're talking about the likes of rust et al. I'm actually thinking of variants of C that allow existing code to be used with no or minimal modifications. The "Friendly C" proposal that another commenter linked to is a good example: https://blog.regehr.org/archives/1180 It seems like Rust is getting some traction, and that's great, but it's certainly not a drop-in replacement for C.

>Here's something I'd love to know about undefined behavior in C: is this something specific to C, or is it something that any similar language would have to contend with? How similar is similar? Pascal? Ada? Spark Ada? Rust? Friendly C (https://blog.regehr.org/archives/1180)?

FSCQ is a really great example of a large system with proofs of correctness using extraction from Coq. Another well known project is CompCert the certified C compiler [1]. Which has seen a fair amount of external testing and use in verification of GCC and Clang as a reference for checking invalid compiled semantics [2] (to say nothing of compiling programs). 1 http://compcert.inria.fr 2 https://blog.regehr.org/archives/1052

I'm less of a PARC fan and more of a Lampson fan. In fact, I'm a huge Butler Lampson fan. I've read his PARC valedictory Hints on Computer System Design many times and he's updated it recently. He went from PARC to DEC SRC (maybe 5 miles). I saw him give a talk at SRC and for about 15 minutes afterwards, I understood. Hints is the favorite paper of a lot of my heroes like John Regehr. https://www.microsoft.com/en-us/research/wp-content/uploads/2016/02/ac… http://bwlampson.site/Slides/Hints%20and%20principles%20(HLF%202015).p… http://blog.regehr.org/archives/1143 From SRC, he went to Microsoft and he also taught at MIT. https://ocw.mit.edu/courses/electrical-engineering-and-computer-scienc…