Bitwise operations act outside of type width in C; Compiler Bug or Within Spec?

You've got multiple instances of undefined behavior here.

First, value points to an object of type uint32_t. You then point subset to it which has type int16_t and subsequently dereference that pointer. Doing so is a strict aliasing violation which causes undefined behavior.

But supposed you fixed that part and did this instead:

int16_t v2 = 0xbbbb;
int16_t *subset = &v2;

Then you still have a problem with this:

*subset << 16

Which is the same problem as your last question, namely the value in *subset is negative and subsequently left shifted, and left shifting a negative value triggers undefined behavior.

And again, changing subset to a pointer to uint16_t isn't enough either because the value is first converted to int before the shift, and a left shift of the signed value 0x0000bbbb shifts into the sign bit which again triggers undefined behavior.

As before an explicit cast is required to an unsigned 32 bit type for the program to have well defined behavior.

uint16_t v2 = 0xbbbb;
uint16_t *subset = &v2;
uint32_t test = 0x00000000;
test = ((uint32_t)*subset << 16) | *subset;

Taking a step back, if you were to add the explicit cast but not change the type of subset:

int16_t v2 = 0xbbbb;
int16_t *subset = &v2;
uint32_t test = 0x00000000;
test = ((uint32_t)*subset << 16) | *subset;

The behavior is well defined, but test ends up with the value 0xffffbbbb. This is because of the promotion of the negative int16_t value of 0xbbbb to the same value with type int, which is represented as 0xffffbbbb. This explains the output you were seeing, and explains why *subset & 0xffff fixed this issue.

*subset is expanded to an int when combined with integer constants like 16 and 0xFFFF. Since the leading bit is 1, it is expanded as a negative number (on a twos complement computer): 0xFFFFBBBB in your case. The results are within spec.

However, the result depends on the endianess of the computer - and while all commercial CPUs that I am aware of are 2s complement, there is a mix of Big Endian and Little Endian, and most load/store RISC cpus can load/store either way. So your results end in 0xbbbb on Little Endian (e.g. Intel) and 0xaaaa on Big Endian (e.g. PPC Big Endian mode).

Consider this code:

#include <inttypes.h>
#include <stdint.h>
#include <stdio.h>


int main(void)
{
    int16_t  a = 0xBBBB;
    uint32_t b = 0 | a; // Using trivial OR with zero to demonstrate promotion. (See below.)
    printf("b = 0x%" PRIx32 ".\n", b);
}

This outputs:

b = 0xffffbbbb.

That is because:

• In int16_t a = 0xBBBB;, BBBB₁₆ (48,059₁₀) is converted to int16_t. This conversion produces −17,477 (48,059 − 2¹⁶), which is represented in 16-bit two’s complement with the bits BBBB₁₆. These bits are stored in a. (The conversion is implementation-defined, but this is the most common behavior.)
• In uint32_t b = 0 | a;, a is automatically promoted to int. Promotion never changes a value; it remains −17,477. However, in a 32-bit two’s complement int, −17,477 is represented with the bits FFFFBBBB₁₆. Then, to initialize b, this value is converted to uint32_t. This produces the value 4,294,949,819 (−17,477 + 2³²), which is represented with the bits FFFFBBBB₁₆.

The printf shows that value of b.

This is what is happening in your code test2 = (*subset << 16) | *subset;. The value −17,477 in *subset is promoted, and the bits FFFFBBBB₁₆ are used in the | operation.

There is, as others have noted, undefined behavior in your code. But, as the defined code above shows, this behavior stems from the promotion to int.