{"action":"opened","issue":{"url":"https://api.github.com/repos/Microsoft/checkedc/issues/38","repository_url":"https://api.github.com/repos/Microsoft/checkedc","labels_url":"https://api.github.com/repos/Microsoft/checkedc/issues/38/labels{/name}","comments_url":"https://api.github.com/repos/Microsoft/checkedc/issues/38/comments","events_url":"https://api.github.com/repos/Microsoft/checkedc/issues/38/events","html_url":"https://github.com/Microsoft/checkedc/issues/38","id":168712547,"number":38,"title":"Describe bounds declarations on union members","user":{"login":"dtarditi","id":11841034,"avatar_url":"https://avatars.githubusercontent.com/u/11841034?v=3","gravatar_id":"","url":"https://api.github.com/users/dtarditi","html_url":"https://github.com/dtarditi","followers_url":"https://api.github.com/users/dtarditi/followers","following_url":"https://api.github.com/users/dtarditi/following{/other_user}","gists_url":"https://api.github.com/users/dtarditi/gists{/gist_id}","starred_url":"https://api.github.com/users/dtarditi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dtarditi/subscriptions","organizations_url":"https://api.github.com/users/dtarditi/orgs","repos_url":"https://api.github.com/users/dtarditi/repos","events_url":"https://api.github.com/users/dtarditi/events{/privacy}","received_events_url":"https://api.github.com/users/dtarditi/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-08-01T18:39:24Z","updated_at":"2016-08-01T18:39:24Z","closed_at":null,"body":"The specification is currently silent about bounds declarations on union members.   Union members are problematic because storing a value in one member and accessing it at a different member is implicitly a cast of a value from one type to another type.  Of course, this can easily accidentally bypass bounds checking.\r\n\r\nEven though union members are problematic, I believe that we should allow bounds declarations on union members.   First, we already allow explicit casts that could violate bounds safety, so we are not worse off safety-wise than before.   Of course, It is easier to misuse union member accesses because the casts happen implicitly, not explicitly in the code.  Second, we do plan to extend the specification to check pointer type casts that preserve bounds safety.  We will address the issue of union members acting as implicit casts as part of that work.  Many times unions are used in a type-safe way to save space.    There might a tag that controls  access to members or program invariants that values stored in a union member are only read using that the union member.  We still face the problem of unions being used to implement truly unsafe casts, but my guess is often we'll be able to show that unions are being used in ways that do preserve bounds safety.\r\n\r\nFrom a practical viewpoint, it will make it easier to add bounds declarations to existing code if we allow bounds declarations on union members.  Consider the alternative of banning bounds declarations on union members.   If a programmer wants to still have bounds declaration in code that uses the member, the programmer would have to place bounds casts at each use of a member.   This is error-prone and tedious, so many programmers won't do that.  A programmer might create wrapper functions and use them, but that can affect performance negatively and require more significant changes to code.  A likely outcome is that code that uses unions would just be left as unchecked code.   That seems worse than allowing bounds even though a programmer might compromise them through a type-safety violation."}}
{"actor":{"display_login":"dtarditi"}}