double pointer output explanation - c

Question

Could you explain how the output is -4? I think ++pp; is UB but not sure. Your explanation will really help in the way of understanding. Could be there any difference of outputs in big-endian or little-endian machine?
#include <stdio.h>
int a[] = { -1, -2, -3, -4 };
int b[] = { 0, 1, 2, 3 };
int main(void)
{
int *p[] = { a, b };
int **pp = p;
printf("a=%p, b=%p, p=%p, pp=%p\n", (void*)a, (void*)b, (void*)p, (void*)pp);
++pp;
printf("p=%p, pp=%p *pp=%p\n", (void*)p, (void*)pp, (void*)*pp);
++*pp;
printf("p=%p, pp=%p *pp=%p\n", (void*)p, (void*)pp, (void*)*pp);
++**pp;
printf("%d\n", (++**pp)[a]);
}
My output:
a=0x107121040, b=0x107121050, p=0x7ffee8adfad0, pp=0x7ffee8adfad0
p=0x7ffee8adfad0, pp=0x7ffee8adfad8 *pp=0x107121050
p=0x7ffee8adfad0, pp=0x7ffee8adfad8 *pp=0x107121054
-4
Ideone output

Answer 1

When you use the name of an array (in most contexts), it decays to a pointer to its first element. That means that int* p = a; and int* p = &a[0]; are exactly the same.
So to understand what happens in this case, just walk through step by step. At the point of your first printf call, things look like this:
pp p a
+-------+ +------+ +----+----+----+----+
| +---------> +--------> -1 | -2 | -3 | -4 |
+-------+ | | +----+----+----+----+
| |
+------+ b
| | +----+----+----+----+
| +---------> 0 | 1 | 2 | 3 |
| | +----+----+----+----+
+------+
pp points to the first element of p, which is a pointer to the first element of a.
Now, when you increment pp, it changes to point to the second element of p, which is a pointer to the first element of b:
pp p a
+-------+ +------+ +----+----+----+----+
| + | | +--------> -1 | -2 | -3 | -4 |
+---|---+ | | +----+----+----+----+
| | |
| +------+ b
| | | +----+----+----+----+
+---------> +---------> 0 | 1 | 2 | 3 |
| | +----+----+----+----+
+------+
You then increment *pp. Since *pp is a pointer to the first element of b, that pointer is incremented to point to the second element of b:
pp p a
+-------+ +------+ +----+----+----+----+
| + | | +--------> -1 | -2 | -3 | -4 |
+---|---+ | | +----+----+----+----+
| | |
| +------+ b
| | | +----+----+----+----+
+---------> | | 0 | 1 | 2 | 3 |
| + | +----+-^--+----+----+
+---|--+ |
+---------------+
Then you increment **pp. At this point pp is a pointer to the second element of p, so *pp is a pointer to the second element of b. That means **pp names the second element of b. You increment that from 1 to 2:
pp p a
+-------+ +------+ +----+----+----+----+
| + | | +--------> -1 | -2 | -3 | -4 |
+---|---+ | | +----+----+----+----+
| | |
| +------+ b
| | | +----+----+----+----+
+---------> | | 0 | 2 | 2 | 3 |
| + | +----+-^--+----+----+
+---|--+ |
+---------------+
Now, lets dissect (++**pp)[a]. ++**pp is the same as before, so the second element of b gets incremented to 3.
Now, for any pointer ptr and integer n, ptr[n] is the same as *(ptr + n). Since addition is commutative, ptr + n is the same as n + ptr. That means ptr[n] is the same as n[ptr].
Putting these together, that means that (++**pp)[a] is the same as 3[a], which is the same as a[3]. a[3] is -4, hence your result.

Answer 2

Remember the definition of the subscription operator [], e.g. as defined in this online C standard draft:
6.5.2.1 Array subscripting
2) ... The definition of the subscript operator [] is that E1[E2] is
identical to (*((E1)+(E2))). ...
It says that E1[E2] is identical to (*((E1)+(E2)).Then it becomes clear that (++**pp)[a] is the same as *((++**pp)+(a)), which again is the same as *((a)+(++**pp)), which consequently reads as a[(++**pp)]. The value of ++**pp is 3 then, and a[3] is -4.

Answer 3

It's easiest to understand this if you express all the array names in expressions as their decayed values. arrayName as a pointer becomes &arrayName[0]. So after all the initializations, you have:
a[0] = -1, a[1] = -2, a[2] = -3, a[3] = -4
b[0] = 0, b[1] = 1, b[2] = 2, b[3] = 3
p[0] = &a[0], p[1] = &b[0]
pp = &p[0]
Incrementing a pointer makes it point to the next array element, so after ++pp we now have
pp = &p[1]
++*pp dereferences pp, so it's equivalent to ++p[1], so now we have
p[1] = &b[1]
++**pp dereferences this twice, so it's equivalent to ++b[1], so now we have
b[1] = 2
Finally, we have the really confusing expression (++**pp)[a]. ++**pp again increments b[1], so its value is now 3, and that value replaces that expression, so it's equivalent to 3[a]. This might look like nonsense (3 isn't an array, how can you index it?), but it turns out that in C, x[y] == y[x] because of the way indexing is defined in terms of pointer arithmetic. So 3[a] is the same as a[3], and the last line prints -4.