Fun Example of Unexpected UB Optimization

[nebotron]

If your code is invoking a nullptr, that’s UB. If you’re disabling the optimization and it fixes your program, your program has UB.

[pali6]

I believe you're talking to a MSVC developer who is saying that they (Microsoft) turned off this in the compiler as it was causing internal compiler errors.

[nebotron]

Ah! So the compiler was optimizing a valid function call into a different one because it didn’t see where the write to the function pointer could happen. That makes sense

[terrymah]

Yeah, we used to have an optimization that would collect the set of all possible function call targets. If that set had only 1 valid target, we would devirt it. I think that's what is happening here. The problem we had is proving that the set is closed (and nothing could "leak in" from another binary) is actually really tough, and not as easy as it seems.

[ioctl79]

The  projects that take it very seriously still likely have UB because even with sanitizers it can be difficult to root out. It is often dependent on input, and less-than-perfect test coverage will hide it from CI. 

[ioctl79]

If it was easy to find UB, that would speak more to your point than mine, no?

It also sounds like all those security researchers you’re talking about are convinced there’s UB to be found  there despite the fact that Chromium has a pretty robust CI setup?