Why does this implementation of offsetof() work?

In ANSI C, offsetof is NOT defined like that. One of the reasons it's not defined like that is that some environments will indeed throw null pointer exceptions, or crash in other ways. Hence, ANSI C leaves the implementation of offsetof( ) open to compiler builders.

The code shown above is typical for compilers/environments that do not actively check for NULL pointers, but fail only when bytes are read from a NULL pointer.

Although that is a typical implementation of offsetof, it is not mandated by the standard, which just says:

The following types and macros are defined in the standard header <stddef.h> [...]

offsetof(type,member-designator)

which expands to an integer constant expression that has type size_t, the value of which is the offset in bytes, to the structure member (designated by member-designator), from the beginning of its structure (designated by type). The type and member designator shall be such that given

statictypet;

then the expression &(t.member-designator) evaluates to an address constant. (If the specified member is a bit-field, the behavior is undefined.)

Read P J Plauger's "The Standard C Library" for a discussion of it and the other items in <stddef.h> which are all border-line features that could (should?) be in the language proper, and which might require special compiler support.

It's of historic interest only, but I used an early ANSI C compiler on 386/IX (see, I told you of historic interest, circa 1990) that crashed on that version of offsetof but worked when I revised it to:

#define offsetof(st, m) ((size_t)((char *)&((st *)(1024))->m - (char *)1024))

That was a compiler bug of sorts, not least because the header was distributed with the compiler and didn't work.

To answer the last part of the question, the code is not portable.

The result of subtracting two pointers is defined and portable only if the two pointers point to objects in the same array or point to one past the last object of the array (7.6.2 Additive Operators, H&S Fifth Edition)

Listing 1: A representative set of offsetof() macro definitions

// Keil 8051 compiler
#define offsetof(s,m) (size_t)&(((s *)0)->m)

// Microsoft x86 compiler (version 7)
#define offsetof(s,m) (size_t)(unsigned long)&(((s *)0)->m)

// Diab Coldfire compiler
#define offsetof(s,memb) ((size_t)((char *)&((s *)0)->memb-(char *)0))

typedef struct 
{
    int     i;
    float   f;
    char    c;
} SFOO;

int main(void)
{
  printf("Offset of 'f' is %zu\n", offsetof(SFOO, f));
}

The various operators within the macro are evaluated in an order such that the following steps are performed:

1. ((s *)0) takes the integer zero and casts it as a pointer to s.
2. ((s *)0)->m dereferences that pointer to point to structure member m.
3. &(((s *)0)->m) computes the address of m.
4. (size_t)&(((s *)0)->m) casts the result to an appropriate data type.

By definition, the structure itself resides at address 0. It follows that the address of the field pointed to (Step 3 above) must be the offset, in bytes, from the start of the structure.

It doesn't segfault because you're not dereferencing it. The pointer address is being used as a number that's subtracted from another number, not used to address memory operations.

It calculates the offset of the member m relative to the start address of the representation of an object of type st.

((st *)(0)) refers to a NULL pointer of type st *. &((st *)(0))->m refers to the address of member m in this object. Since the start address of this object is 0 (NULL), the address of member m is exactly the offset.

char * conversion and the difference calculates the offset in bytes. According to pointer operations, when you make a difference between two pointers of type T *, the result is the number of objects of type T represented between the two addresses contained by the operands.

Quoting the C standard for the offsetof macro:

C standard, section 6.6, paragraph 9

An address constant is a null pointer, a pointer to an lvalue designating an object of static storage duration, or a pointer to a function designator; it shall be created explicitly using the unary & operator or an integer constant cast to pointer type, or implicitly by the use of an expression of array or function type. The array-subscript [] and member-access . and -> operators, the address & and indirection * unary operators, and pointer casts may be used in the creation of an address constant, but the value of an object shall not be accessed by use of these operators.

The macro is defined as

#define offsetof(type, member)  ((size_t)&((type *)0)->member)

and the expression comprises the creation of an address constant.

Although genuinely speaking, the result is not an address constant because it does not point to an object of static storage duration. But this is still agreed upon that the value of an object shall not be accessed, so the integer constant cast to pointer type will not be dereferenced.

Also, consider this quote from the C standard:

C standard, section 7.19, paragraph 3

The type and member designator shall be such that given

static type t;

then the expression &(t.member-designator) evaluates to an address constant. (If the specified member is a bit-field, the behavior is undefined.)

A struct in C is a composite data type (or record) declaration that defines a physically grouped list of variables under one name in a block of memory, allowing the different variables to be accessed via a single pointer or by the struct declared name which returns the same address.

From the compiler perspective, the struct declared name is an address and the member designator is an offset from that address.

It doesn't fully work.

The standard requires that offsetof should yield an integer constant expression.

Address-based calculations are never allowed to yield that although (intptr_t)&((T*)0)->T_member effectively is a compile-time known constant and if the compiler is squeamish about address 0, then at least (intptr_t)&((T*)CONSTANT)->T_member - (intptr_t)(T*)CONSTANT) should be (gcc and clang allow expressions like the previous ones in some integer-constant-expression requiring contexts, but technically, that's undefined behavior).

True integer constants can be detected, via magic such as:

#define CEXPR_EH(X) _Generic(1? (int*)0 : (void *)( 0ull*(X)), int*: 1, void*: 0)

and that macro says that the implementation™'s offsetof is better than yours:

#define CEXPR_EH(X) _Generic(1? (int*)0 : (void *)( 0ull*(X)), int*: 1, void*: 0)
#include <stddef.h>
struct a { int a, b; };
_Static_assert(CEXPR_EH(offsetof(struct a,b)),""); ✓
#define myoffsetof(T,M) ((long)&((T*)0)->M)
_Static_assert(CEXPR_EH(myoffsetof(struct a,b)),"Oops, I'm not special."); // ✗ fires

You may not like the standard-writers philosophy on this, but this is the way things are.

Clang and gcc implement offsetof via a special builtin:

#define offsetof(TYPE,MEMBER) __builtin_offsetof (TYPE, MEMBER)