When is a pointer expression "based on" another pointer?

Question

In Section 6.7.3.1 of the C language standard regarding restrict, it says:

1. Let D be a declaration of an ordinary identifier that provides a means of designating an object P as a restrict-qualified pointer to type T.

2. ...

3. In what follows, a pointer expression E is said to be based on object P if (at some sequence point in the execution of B prior to the evaluation of E) modifying P to point to a copy of the array object into which it formerly pointed would change the value of E.

I don't understand what this says - literally:

• Who said P was pointing to a "copy of an array object"?
• Why did P "formerly" point to anything? That is, who says we've changed its value?
• Let's suppose E is a pointer of local scope. Why would modifying any pointer expression other than the E pointer itself "change the value of E"? It could change the value pointed to by E maybe. Right?

Can someone help me interpret that piece of text so as to make more sense?

_{(Inspired by this answer)}

Answer 1

Who said P was pointing to a "copy of an array object"?

Pointer arithmetic is defined (in C 2018 6.5.6 8 and 9) in terms of pointers to array elements. For this purpose, a single object is treated as an array of one element. So, whenever we have any non-null object pointer, it is, in this model, pointing into an array.

Why did P "formerly" point to anything? That is, who says we've changed its value?

The text you quoted is saying “To figure out if E is based on P, let’s hypothetically make a copy of the array that P is pointing into and then assign to P a pointer into the corresponding place in the copy.” So the text you quoted is saying we are changing the value of P, and then we are comparing the value of E with this change and without it.

Let's suppose E is a pointer of local scope. Why would modifying any pointer expression other than the E pointer itself "change the value of E"? It could change the value pointed to by E maybe. Right?

Objects and values do not have scope. Identifiers have scope. But let’s consider an identifier with block scope:

// P is a pointer into A.
// S is the size of A.
// A is the start of an array not contained in any other array.
void foo(char *P, size_t S, char *A)
{
    void *E = P+2;
}

For illustration, assume P has value 0x1004 and A is 0x1000. Is E based on P? Well, given the above, E is 0x1006. Suppose we consider this code before the definition of E:

    char *N = malloc(S);
    memcpy(N, A, S);
    P = P - A + N;

Suppose malloc returns 0x2000. What will the value of E be? It will be 0x2006. That is different from 0x1006. Therefore E is based on P.

On the other hand, consider this:

void foo(char **P, size_t S, char **A)
{
    #if OnOrOff
        char *N = malloc(S);
        memcpy(N, A, S);
        P = P - A + N;
    #endif
    char **E = P[3];
}

Now, will the value of E change depending on whether OnOrOff is true or false? No, in either case it will receive the value that is the referenced element of A, either directly or from the copy. The fact that P might point into A or N does not affect the value of E. So this E is not based on P.

Answer 2

The definition of "based on" is intended to define a transitive relation among pointers, but its actual wording would yield an unworkable definition which so far as I can tell doesn't match any actual compiler behavior.

It would be simpler to transitively apply the following rule (and this is what compilers seem to do): If *p is a pointer of type T*, the following pointers are "based on" p:

• p+(intExpr) or p-(intExpr)
• (otherType*)p
• &*p
• &p->structMemberofNonArrayType or &p->unionMemberofNonArrayType
• p->structMemberofArrayType or p->unionMemberofArrayType
• &p[intExpr]
• Any pointer based on any of the above

I don't think the Standard is really clear about (someType*)someIntegerFunction((uintptr_t)p) and I don't think compiler writers are clear either.

Note that any q derived from p via any of the above expressions except the one involving casts through uintptr_t, the difference between (char*)p and (char*)q will be independent of the address held by p.

Incidentally, here's an example of a problematic corner case:

int test1(int * restrict p1, int * restrict p2, int n)
{
    int *restrict p3 = p1+n;
    // How would p4 and p5 be affected if p3 were replaced
    // with a pointer to a copy here?
    int *p4 = p3;
    if (p3 != p1) p4=p1;
    int *p5 = p2 + (p3 == p1);
    *p3 = 1;
    *p5 = 2;
    return *p4;
}

Using the transitive ways of forming a pointer based on another, if n is zero, p4 would clearly be based upon p3. Pointer p5 would not derive from p3, however, since there is no sequence of "based upon" steps by which its value could be derived.

Trying to apply the rules given in the Standard to the n==0 case by replacing p3 with a pointer to a copy of the array would not affect the value of p4, but would affect the value of p5. That would imply that p4 is not based upon p3, but p5 is, somehow.

I would regard such a result as nonsensical, and I think the authors of the Standard would too, but it follows from the rules given in the Standard, as worded.

Answer 3

After reading several comments, as well as @EricPostpischil's answer, I've tried to synthesize what I believe to be clearer, though a bit longer, wording to clarify things and answer the questions posed.

Original text:

In what follows, a pointer expression E is said to be based on object P if (at some sequence point in the execution of B prior to the evaluation of E) modifying P to point to a copy of the array object into which it formerly pointed would change the value of E.

Clarified text:

In what follows, a pointer expression E is said to be based on object P if changing P (with certain restrictions) before E is evaluated would cause E to evaluate to a different value. The restrictions are:

• Trivial sanity restriction: The modification of P must occur at a sequence point.
• P can only be modified to point to an identical copy of what it was pointing to originally.
  (And since in general, we can think of pointers always pointing to an array object - P can only be set to point at a copy of that array object).

Answer 4

Point 3 could be expressed in code as (roughly):

#define E(P)  ( (P) + 1 )   // put the expression you want to test here

extern T obj;    // T is some type
T copy = obj;

if ( E(&obj) != E(&copy) )
    printf("the expression in the macro is based on P")

The formal language definition used in the standard allows for E to be non-deterministic and other pathological cases (e.g. (P) + rand() % 5), whereas my example doesn't.

The standard version is that we compare what the result would be of E(&obj) with what the result would be of E(&copy) in the same context.