C++: References as return values

Question

I noticed I don't get any compiler errors when I accidentally forget to return from a function that is supposed to return a reference. I wrote some small tests to see what actually happens and I got more confused than anything.

struct Foo
{
    int x;

    Foo() {
        x = 3;
    }
};

Foo* foo = new Foo;

Foo& test(bool flag) {
    if (flag)
        return *foo;
}

If test() doesn't (explicitly) return a value, I will still get something returned. However the Foo object that is returned is not initialized using the default constructor — that's because x is different from 3 in the non-explicitly returned value.

What is actually happening when you don't return a reference? If this is a feature, is it safe to use it as a means to return dummy objects in case errors occur, as opposed to returning a null pointer. (See example below.)

class FooFactory
{
    // Return reference...

    Foo& createFooRef() {
        Foo* foo = new Foo;
        bool success = foo->load();

        if (success)
            return *foo;
        // Implicit (and safe?) return value on failure?
    }

    // ... as opposed to returning a pointer.

    Foo* createFooPtr() {
         Foo* foo = new foo;
         bool success = foo->load();

         if (success)
             return foo;
         else
             return 0;
    }

    // Yes, I am aware of the memory leaks,
    // but that's not the point of the example.

Answer 1

Most compilers will give you a warning about this, but you may have to crank up the warning level of the compiler to see it.

No, this is not safe. It is bad. It may lead to stack corruption by just returning whatever happens to be on the stack at the time. As you've already seen, it does not use a constructor for you. If you want a default constructed object, you have to do that yourself (but be careful about returning a reference to a temporary object. That's also bad).

Answer 2

The usual way to lower references in compilers is to pointers. For a reference-returning function, it will mean you get an arbitrary address represented, whatever was in the register or stack slot used for the return value.

Formally in the language, the effects are undefined.