As far as I know, the function printf
has an exception here.
For an ordinary function foo
, the order of evaluation of foo(bar(x++), baz(++x))
is undefined. Correct! However printf
, being an ellipsis function has a somewhat more definite order of evaluation.
The printf
in the standard library, in fact, has no information about the number of arguments that has been sent to. It just tries to figure out the number of variables from the string placeholders; namely, from the number of percent operators (%
) in the string. The C compiler starts pushing arguments from the very right towards left; and the address of the string is passed as a last argument. Having no exact information about the number of arguments, printf
evaluates the last address (the string) and starts replacing the %
's (from left to right) with values of the corresponding addresses in the stack. That is, for a printf
like below;
{
int x = 0;
printf("%d %d %f\n", foo(x), bar(x++), baz(++x));
}
The order of evaluation is:
- x is incremented by 1,
- function baz is called with
x = 1
; return value is pushed to the stack,
- function bar is called with
x = 1
; return value is pushed to the stack,
- x is incremented by 1,
- function foo is called with
x = 2
; return value is pushed to the stack,
- the string address is pushed to the stack.
Now, printf
has no information about the number of arguments that has been sent to. Moreover, if -Wall
is not issued in compilation, the compiler will not even complain about the inconsistent number of arguments. That is; the string may contain 3 %
's but the number of arguments in the printf
line can be 1, 2, 3, 4, 5 or even can contain just the string itself without any arguments at all.
Say, the string has 3 placeholders and you've send 5 arguments (printf("%d %f %s\n", k1, k2, k3, k4, k5)
). If compilation warning is turned off, the compiler will not complain about excessive number of arguments (or insufficient number of placeholders). Knowing the stack address, printf
will;
- treat the first integer width in the stack and print it as an integer (without knowing whether it is an integer or not),
- treat the next double width in the stack and print it as a double (without knowing whether it is a double or not),
- treat the next pointer width in the stack as a string address and will try to print the string at that address, until it finds a string terminator (provided, the address pointed to belong to that process; otherwise raises segmentation error).
- and ignore the remaining arguments.