https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95663
--- Comment #5 from rguenther at suse dot de <rguenther at suse dot de> --- On Mon, 15 Jun 2020, redi at gcc dot gnu.org wrote: > https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95663 > > --- Comment #3 from Jonathan Wakely <redi at gcc dot gnu.org> --- > Or to be more clear: > > struct Large { > char pad[1024*1024]; > int x; > }; > > Large* p = 0; > int i = p->x; Sure, but this isn't the same if C++ mandates the static_cast of a null evaluates to null and not the offset of the base class. So what clang does is not unsafe but wrong since the offset is missing and it returns Base1::x instead of Base2::y? Note for getter and clang I see _Z6getterP5Base2: # @_Z6getterP5Base2 .cfi_startproc # %bb.0: leaq -4(%rdi), %rax testq %rdi, %rdi cmoveq %rdi, %rax movl 4(%rax), %eax retq So either static_cast<Derived*>(base) should evaluate to zero or not. If it does then clang dereferences the wrong address in the null case (but only in 'field'). So, what does C++ say here?