Living on a null object

Post by Nico Brailovsky @ 2011-08-16 | Permalink | Leave a comment

Check this out:

struct S {
   int f(){ return 42; }
};
int main() {
   S x = (S) NULL;
   return x->f();
}

What does this do? Does it compile? Does it crash? I'll give you a second.

Ready? It does compile, OK

But it doesn't crash.

Why, you may ask

Think about it, you must.

The compiler will mangle S::f and translate this into something like:

struct S {};
int mangled_S_f(struct S this){
   return 42;
}
int main() {
   S x = (S*) NULL;
   mangled_S_f(x);
}

Now, in this new "translated" code, what do you think? Will it crash? It won't, since no one is going to dereference "this". Crazy, huh? This crazy idiom also allows even crazier things, like C++ objects committing sepuku