How does placement new work?

Question

I wrote the following thinking that it should segfault at runtime. However it does not, it runs fine, and I don't understand why.

#include <cstdlib>
#include <cstdio>
#include <new>

struct MyStruct
{
    double *a;

    MyStruct()
        : a(NULL) 
        { printf("Default constructor\n"); }
    MyStruct( double *b )
        : a(b) 
        {}
    MyStruct( const MyStruct& other )
    {
        printf("Copy-constructor\n");
        if ( a != NULL && *a != 3.14 )
            a = other.a;
    }
};

int main()
{
    double num = 3.14;
    MyStruct obj( &num );

    void *ptr = ::operator new( sizeof(MyStruct) );
    new (ptr) MyStruct(obj);

    delete (MyStruct*) ptr; // Calls ~MyStruct
}

The output is:

Copy-constructor

When I write void *ptr = ::operator new( sizeof(MyStruct) ); I know this only allocates memory, and should not call the default constructor. And it doesn't seem to: fine.

When I write new (ptr) MyStruct(obj);, I would expect it to segfault, if it worked like I thought. I think this is equivalent to ( (MyStruct*) ptr )->MyStruct(obj). If so, the line if ( a != NULL && *a != 3.14 ) should reach *a != 3.14 and segfault, because a has not been initialized.

My problem is that a doesn't seem to have been initialized (because there was no output "Default constructor"), but the previous still doesn't segfault. What am I missing?

---

Here is the assembly code generated (I don't know how to read it):

    .file   "placement_new.cpp"
    .section    .rodata.cst8,"aM",@progbits,8
    .align  8
.LCPI0_0:
    .quad   4614253070214989087     # double 3.1400000000000001
    .text
    .globl  main
    .align  16, 0x90
    .type   main,@function
main:                                   # @main
    .cfi_startproc
# BB#0:
    push    rbp
.Ltmp2:
    .cfi_def_cfa_offset 16
.Ltmp3:
    .cfi_offset rbp, -16
    mov rbp, rsp
.Ltmp4:
    .cfi_def_cfa_register rbp
    sub rsp, 48
    lea rdi, qword ptr [rbp - 24]
    lea rsi, qword ptr [rbp - 16]
    movsd   xmm0, qword ptr [.LCPI0_0]
    mov dword ptr [rbp - 4], 0
    movsd   qword ptr [rbp - 16], xmm0
    call    _ZN8MyStructC2EPd
    movabs  rdi, 8
    call    _Znwm
    mov qword ptr [rbp - 32], rax
    mov rax, qword ptr [rbp - 32]
    cmp rax, 0
    mov qword ptr [rbp - 40], rax # 8-byte Spill
    je  .LBB0_2
# BB#1:
    lea rsi, qword ptr [rbp - 24]
    mov rax, qword ptr [rbp - 40] # 8-byte Reload
    mov rdi, rax
    call    _ZN8MyStructC2ERKS_
.LBB0_2:
    mov rax, qword ptr [rbp - 32]
    cmp rax, 0
    mov qword ptr [rbp - 48], rax # 8-byte Spill
    je  .LBB0_4
# BB#3:
    mov rax, qword ptr [rbp - 48] # 8-byte Reload
    mov rdi, rax
    call    _ZdlPv
.LBB0_4:
    mov eax, dword ptr [rbp - 4]
    add rsp, 48
    pop rbp
    ret
.Ltmp5:
    .size   main, .Ltmp5-main
    .cfi_endproc

    .section    .text._ZN8MyStructC2EPd,"axG",@progbits,_ZN8MyStructC2EPd,comdat
    .weak   _ZN8MyStructC2EPd
    .align  16, 0x90
    .type   _ZN8MyStructC2EPd,@function
_ZN8MyStructC2EPd:                      # @_ZN8MyStructC2EPd
    .cfi_startproc
# BB#0:
    push    rbp
.Ltmp8:
    .cfi_def_cfa_offset 16
.Ltmp9:
    .cfi_offset rbp, -16
    mov rbp, rsp
.Ltmp10:
    .cfi_def_cfa_register rbp
    mov qword ptr [rbp - 8], rdi
    mov qword ptr [rbp - 16], rsi
    mov rsi, qword ptr [rbp - 8]
    mov rdi, qword ptr [rbp - 16]
    mov qword ptr [rsi], rdi
    pop rbp
    ret
.Ltmp11:
    .size   _ZN8MyStructC2EPd, .Ltmp11-_ZN8MyStructC2EPd
    .cfi_endproc

    .section    .rodata.cst8,"aM",@progbits,8
    .align  8
.LCPI2_0:
    .quad   4614253070214989087     # double 3.1400000000000001
    .section    .text._ZN8MyStructC2ERKS_,"axG",@progbits,_ZN8MyStructC2ERKS_,comdat
    .weak   _ZN8MyStructC2ERKS_
    .align  16, 0x90
    .type   _ZN8MyStructC2ERKS_,@function
_ZN8MyStructC2ERKS_:                    # @_ZN8MyStructC2ERKS_
    .cfi_startproc
# BB#0:
    push    rbp
.Ltmp14:
    .cfi_def_cfa_offset 16
.Ltmp15:
    .cfi_offset rbp, -16
    mov rbp, rsp
.Ltmp16:
    .cfi_def_cfa_register rbp
    sub rsp, 32
    lea rax, qword ptr [.L.str]
    mov qword ptr [rbp - 8], rdi
    mov qword ptr [rbp - 16], rsi
    mov rsi, qword ptr [rbp - 8]
    mov rdi, rax
    mov al, 0
    mov qword ptr [rbp - 24], rsi # 8-byte Spill
    call    printf
    mov rsi, qword ptr [rbp - 24] # 8-byte Reload
    cmp qword ptr [rsi], 0
    mov dword ptr [rbp - 28], eax # 4-byte Spill
    je  .LBB2_3
# BB#1:
    movsd   xmm0, qword ptr [.LCPI2_0]
    mov rax, qword ptr [rbp - 24] # 8-byte Reload
    mov rcx, qword ptr [rax]
    movsd   xmm1, qword ptr [rcx]
    ucomisd xmm1, xmm0
    jne .LBB2_2
    jp  .LBB2_2
    jmp .LBB2_3
.LBB2_2:
    mov rax, qword ptr [rbp - 16]
    mov rax, qword ptr [rax]
    mov rcx, qword ptr [rbp - 24] # 8-byte Reload
    mov qword ptr [rcx], rax
.LBB2_3:
    add rsp, 32
    pop rbp
    ret
.Ltmp17:
    .size   _ZN8MyStructC2ERKS_, .Ltmp17-_ZN8MyStructC2ERKS_
    .cfi_endproc

    .type   .L.str,@object          # @.str
    .section    .rodata.str1.1,"aMS",@progbits,1
.L.str:
    .asciz  "Copy-constructor\n"
    .size   .L.str, 18


    .ident  "Ubuntu clang version 3.4-1ubuntu3 (tags/RELEASE_34/final) (based on LLVM 3.4)"
    .section    ".note.GNU-stack","",@progbits

Answer 1

Reading a variable which has not been initialized is undefined behavior. It is not unreasonable then that your compiler sets the pointer's value to NULL before assignment, which would cause a short-circuit on the if statement in your copy constructor and thus *a would never be executed.