Title
typeid null dereference check in subexpressions
Status
drwp
Section
7.6.1.8 [expr.typeid]
Submitter
David Majnemer

Created on 2014-06-23.00:00:00 last changed 3 months ago

Messages

Date: 2023-11-10.15:48:20

Proposed resolution (approved by CWG 2023-11-09):

Insert a new paragraph before 7.6.1.8 [expr.typeid] paragraph 3 and change the latter as follows:

If an expression operand of typeid is a possibly-parenthesized unary-expression whose unary-operator is * and whose operand evaluates to a null pointer value (6.8.4 [basic.compound]), the typeid expression throws an exception (14.2 [except.throw]) of a type that would match a handler of type std::bad_typeid (17.7.5 [bad.typeid]). [ Note: In other contexts, evaluating such a unary-expression results in undefined behavior (7.6.2.2 [expr.unary.op]) -- end note ]

When typeid is applied to a glvalue whose type is a polymorphic class type (11.7.3 [class.virtual]), the result refers to a std::type_info object representing the type of the most derived object (6.7.2 [intro.object]) (that is, the dynamic type) to which the glvalue refers. If the glvalue is obtained by applying the unary * operator to a pointer [ Footnote: ... ] and the pointer is a null pointer value (6.8.4 [basic.compound]), the typeid expression throws an exception (14.2 [except.throw]) of a type that would match a handler of type std::bad_typeid exception (17.7.5 [bad.typeid]).

Date: 2024-03-15.00:00:00

[Accepted as a DR at the March, 2024 meeting.]

According to 7.6.1.8 [expr.typeid] paragraph 2,

If the glvalue expression is obtained by applying the unary * operator to a pointer69 and the pointer is a null pointer value (7.3.12 [conv.ptr]), the typeid expression throws an exception (14.2 [except.throw]) of a type that would match a handler of type std::bad_typeid exception (17.7.5 [bad.typeid]).

The footnote makes clear that this requirement applies without regard to parentheses, but it is unspecified whether it applies when the dereference occurs in a subexpression of the operand (e.g., in the second operand of the comma operator or the second or third operand of a conditional operator). There is implementation divergence on this question.

History
Date User Action Args
2024-07-20 13:52:34adminsetstatus: dr -> drwp
2024-04-05 21:43:46adminsetstatus: ready -> dr
2024-03-20 14:10:31adminsetstatus: tentatively ready -> ready
2023-11-22 21:44:38adminsetstatus: review -> tentatively ready
2023-11-10 15:48:20adminsetmessages: + msg7512
2023-11-10 15:48:20adminsetstatus: open -> review
2014-06-23 00:00:00admincreate