Which of these will create a null pointer?

Question

The standard says that dereferencing the null pointer leads to undefined behaviour. But what is "the null pointer"? In the following code, what we call "the null pointer":

struct X
{
  static X* get() { return reinterpret_cast<X*>(1); }
  void f() { }
};

int main()
{
  X* x = 0;
  (*x).f(); // the null pointer?  (1)

  x = X::get();
  (*x).f(); // the null pointer?  (2)

  x = reinterpret_cast<X*>( X::get() - X::get() );
  (*x).f(); // the null pointer?  (3)

  (*(X*)0).f(); // I think that this the only null pointer here (4)
}

My thought is that dereferencing of the null pointer takes place only in the last case. Am I right? Is there difference between compile time null pointers and runtime according to C++ Standard?

Answer 1

A null pointer is any pointer that has a value of 0. Things like casts and method calls are only compiler constructs, and do not affect whether or not something is a null pointer.

Answer 2

Only the first and the last are null pointers. The others are results of reinterpret_cast and thus operate on implementation defined pointer values. Whether the behavior is undefined for them depends on whether there is an object at the address you casted to.

Answer 3

An integer constant expression that evaluates to 0 is valid as a null pointer, so the first case is also dereferencing a null pointer.

A pointer which is set to 0 via some arithmetic calculation is not necessarily a null pointer. In most implementations it will behave in the same way as a null pointer, but this is not guaranteed by the standard.

Answer 4

X* x = 0;
(*x).f(); // the null pointer?  (1)

I think this qualifies as dereference, even though f() never actually uses the this pointer, and there are no virtual methods in X. My reflex was to say that this is a crash, but now that I think of it, I'm not so sure.

x = X::get();
(*x).f(); // the null pointer?  (2)

Probably an invalid pointer. not sure whether it will crash (see above for reasoning).

x = reinterpret_cast<X*>( X::get() - X::get() );
(*x).f(); // the null pointer?  (3)

Does the expression X::get() - X::get() compile? I didn't think it was legal to subtract a pointer from another pointer like that.

EDIT: D'oh! Of course it's legal. What was I thinking? Clearly, I am a maroon.

Answer 5

C++ Standard (2003) 4.10

4.10 Pointer conversions

1 A null pointer constant is an integral constant expression (5.19) rvalue of integer type that evaluates to zero. A null pointer constant can be converted to a pointer type; the result is the null pointer value of that type and is distinguishable from every other value of pointer to object or pointer to function type. Two null pointer values of the same type shall compare equal. The conversion of a null pointer constant to a pointer to cv-qualified type is a single conversion, and not the sequence of a pointer conversion followed by a qualification conversion (4.4).

5.2.10 Reinterpret cast

Note 64) Converting an integral constant expression (5.19) with value zero always yields a null pointer (4.10), but converting other expressions that happen to have value zero need not yield a null pointer.

1) X* x = 0; (*x).f(); Yes. 0 is integral constant expression and is converted to the null pointer constant. Then null pointer constant can be converted to the null pointer value.

2) x = X::get(); no, see note 64 in 5.2.10

3) x = reinterpret_cast<X*>( X::get() - X::get() ); no, see note 64 in 5.2.10

4) ((X)0).f(); Yes. 0 (integral constant expression) --> the null pointer constant --> the null pointer value.