c - 指针减法给出奇怪的结果

Question

我得到了结构:

typedef struct
{
    int a;
    int b;
    int c;
}Z;

代码:

int main()
{
    Z *a = (Z*)malloc(sizeof(Z)*8);
    Z *b = (Z*)malloc(sizeof(Z)*8);
    printf("%lu\n", sizeof(Z));
    printf("%p %p\n", b, a);
    printf("%lu\n", b - a);
}

输出:

12
0x89a080 0x89a010
12297829382473034420

为什么最后一行的值这么大？实际地址差异是 0x70(16 个字节的堆分配 header 加上 12*8 个字节的数组 a 元素)，因此根据指针的算术，我期望值 0x70/12=9.(3) 或 9 转换为整数。我知道减去的指针不指向相同的数组，但我希望得到更合理的结果，这会让我知道内存映射的样子。它是在 64b Ubuntu 和 gcc 4.8.2 上编译的。

组装:

    .file   "aa.c"
    .section    .rodata
.LC0:
    .string "%lu\n"
.LC1:
    .string "%p %p\n"
    .text
    .globl  main
    .type   main, @function
main:
.LFB2:
    .cfi_startproc
    pushq   %rbp
    .cfi_def_cfa_offset 16
    .cfi_offset 6, -16
    movq    %rsp, %rbp
    .cfi_def_cfa_register 6
    subq    $16, %rsp
    movl    $96, %edi
    call    malloc
    movq    %rax, -16(%rbp)
    movl    $96, %edi
    call    malloc
    movq    %rax, -8(%rbp)
    movl    $12, %esi
    movl    $.LC0, %edi
    movl    $0, %eax
    call    printf
    movq    -16(%rbp), %rdx
    movq    -8(%rbp), %rax
    movq    %rax, %rsi
    movl    $.LC1, %edi
    movl    $0, %eax
    call    printf
    movq    -8(%rbp), %rdx
    movq    -16(%rbp), %rax
    subq    %rax, %rdx
    movq    %rdx, %rax
    sarq    $2, %rax
    movq    %rax, %rdx
    movabsq $-6148914691236517205, %rax
    imulq   %rdx, %rax
    movq    %rax, %rsi
    movl    $.LC0, %edi
    movl    $0, %eax
    call    printf
    leave
    .cfi_def_cfa 7, 8
    ret
    .cfi_endproc
.LFE2:
    .size   main, .-main
    .ident  "GCC: (Ubuntu 4.8.2-19ubuntu1) 4.8.2"
    .section    .note.GNU-stack,"",@progbits

Answer 1

从1570草案来看，这是

§6.5.6 Additive operators

9. When two pointers are subtracted, both shall point to elements of the same array object, or one past the last element of the array object; the result is the difference of the subscripts of the two array elements. The size of the result is implementation-defined, and its type (a signed integer type) is ptrdiff_t defined in the <stddef.h> header. If the result is not representable in an object of that type, the behavior is undefined. In other words, if the expressions P and Q point to, espectively, the i-th and j-th elements of an array object, the expression (P)-(Q) has the value i−j provided the value fits in an object of type ptrdiff_t. Moreover, if the expression P points either to an element of an array object or one past the last element of an array object, and the expression Q points to the last element of the same array object, the expression ((Q)+1)-(P) has the same value as ((Q)-(P))+1 and as -((P)-((Q)+1)), and has the value zero if the expression P points one past the last element of the array object, even though the expression (Q)+1 does not point to an element of the array object.

您不能假设指针是连续的，但如果它们是连续的，那么实际问题是对指针执行算术的方式，因为指针的类型为 Z , 和 (void *)b - (void *a) != b - a .

所以检查这个例子来说明我的意思

Z *a;
Z *b;

Z *a = malloc(sizeof(Z) * 16);
if (a == NULL)
    return -1;
b = a + 8;

printf("%lu\n", sizeof(Z));
printf("%p, %p\n", b, a);

printf("%lu\n", (ptrdiff_t)(b - a)); /* this will give wrong result */
printf("%lu\n", (ptrdiff_t)((void *)b - (void *)a));

记得包括stddef.h对于 ptrdiff_t类型。