55

In this blog post, Eric Niebler states that:

What is wrong with std::begin and std::end? Surprise! they are not memory safe. Consider what this code does:

extern std::vector<int> get_data();
auto it = std::begin(get_data());
int i = *it; // BOOM

std::begin has two overloads for const and non-const lvalues. Trouble is, rvalues bind to const lvalue references, leading to the dangling iterator it above.

I'm having trouble understanding his point and why it is a dangling reference. Could someone explain?

Improve this question
6
  • 19
    How is the above code any different from auto it = get_data().begin();. That code has the same problem I think, so what point is the author is making? Commented Feb 11, 2019 at 7:56
  • 11
    @john Eric is saying that ranges::begin is better than std::begin, he isn't claiming anything about .begin. Commented Feb 11, 2019 at 8:58
  • 3
    @MarcGlisse OK, I was misled by the title of this post, and I couldn't easily find the original quote. Commented Feb 11, 2019 at 9:00
  • Related question: stackoverflow.com/questions/48976859/… Commented Feb 11, 2019 at 12:26
  • 2
    Personally, I would say that's more a combination of "not Machiavelli-safe" or "not derp-safe" and a quirk of rvalue references than "not memory-safe", since it demonstrates that std::begin() is exactly as memory-safe as the parameter you pass to it, and not inherently unsafe solely in and of itself. That's just me, though. Commented Feb 12, 2019 at 7:40

6 Answers 6

Reset to default
60

The get_data function returns an object. When used the way shown, that object will be a temporary object, which will be destructed once the full expression ends. The iterator now references a vector object which no longer exists, and can't be dereferenced or used in any useful way.

Improve this answer
Sign up to request clarification or add additional context in comments.

2 Comments

Though this is definitely correct, isn't john's comment to the original post also appropriate? How does the given example show a problem of std::begin and std::end?
Because std::begin lets you make that mistake, but std::ranges::begin will not.
53

I think Eric's point about std::begin is that it silently accepts an rvalue container as an argument to begin with. On the face of it, the problem with the code is also exemplified in

auto it = get_data().begin();

But std::begin is a free function template, it can be made to reject rvalues without needing to add the proper reference qualifiers to each container's begin members. By "just" forwarding it misses an opportunity to add a layer of memory safety to code.

Ideally, the overload set could have benefited from the addition of

template< class C > 
void begin( C&& ) = delete;

That one would have caused the code in the blog post to be flat out rejected on the spot.

Improve this answer

8 Comments

Is it possible for us to make a warning of deprecation or usage for that particular template instantiation instead of outright deleting it? Compiler specific extensions allowed.
@PaulStelian - Here's how btw, pure C++14. coliru.stacked-crooked.com/a/7c99059b5b1a8dca
@PaulStelian - No, we can't. I intentionally provided an example in another namespace. To add this overload, we'd need to write a proposal, then get it voted int o the standard.
The thing is, as Alexandrescu points it out with humour in its 2018 cppcon talk, the C++ committee likes to be consistent in its past errors. One might think the reason why std::begin accepts r-values is to let begin(c) and c.begin() be perfectly equivalent. (but yes obviously this overload set would be ideal)
@YSC .begin() could also be made to reject rvalues, couldn't it? iterator begin() && = delete;
|
14

The temporary vector returned by get_data goes out of scope after std::begin is done. It is not kept alive, so it is an iterator into a destroyed object.

Improve this answer

Comments

4

Is it fair to say this is a memory safety failing of std::begin? There is no 'safe' way of creating an iterator such that it will be valid to follow the pointer after the container is deleted.

It lacks a check that another method has, but it's not like there is no way to make a ranges derived iterator go pop. You just have to try a bit harder...

Improve this answer

Comments

1

Because it allows initialisation from an rvalue, which is bad.

Improve this answer

Comments

0

In fact, the complicated function can be simplified to two short functions, such as:

int& foo(int x){
   return x;
}
int generate_a_int(){
   return 42;
}

and then invoke it foo(generate_a_int()), a temporary value is generated, once out of the function body, the temporary value generated by generate_a_int() is destroyed, and then a dangle reference hass happened.

Do you understand now?

Improve this answer

Comments

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.