Signed Integers Considered Harmful
summary
Argues that counts and sizes should be unsigned by default, not signed, because unsigned avoids expensive checks and more predictable semantics for counts; shows a common infinite-loop bug when counting down a size_t that wraps, and fixes with a do/while or proper unsigned logic; runs SPEC-like tests (bzip) on GCC/Clang/ICC finding size_t fastest versus int32/uint32; demonstrates diagnostics with UBSan / -fsanitize=unsigned-integer-overflow and cites David LeBlanc’s safeint results.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 1:10Unsigned usage motivations
- 3:17Signed in loops
- 11:26Unsigned wraparound problems
- 22:07Why unsigned makes sense
- 31:47Critique of Google C++ style
- 41:14Signed overflow undefined
- 51:06Unsigned performance and correctness
- 56:01Choosing variable types
- 1:00:42Summary
related talks
01h 00mSigned integers are two's complement
29mintegral types
39mMitigating Integer Overflow in C
01h 30mDangerous Optimizations in C and C++ Programming Languages
01h 33mSafe and Sane C++ Types
06mLightning Talk: Safe Arithmetic Speed-Run: Experimental C++ Library
05mFighting Compiler warnings
01h 04mRemoving Needless Undefined Behavior for a Safer C++