g++ and aliasing bools

[Joe Buck]

David E. writes:

> 	You originally contributed c_get_alias_set().  Would you please
> provide us with a reference to the proof showing that it is safe for C?

Dan sabotaged his own cause by bringing up a lot of extraneous arguments
that just sidetracked people, I think.

Let's proceed in another way.  I think that, for the purpose of Dan's
proof, he should be allowed to accept as a postulate that c_get_alias_set
is correct when applied to C.  If this postulate is not acceptable,
then it seems that if someone owes us a proof, it is Mark, not Daniel.
However, c_get_alias_set has been there long enough that we have
reasonable confidence in it.

I think it's also fair to assume as a postulate that the current
conservative cxx_get_alias_set is safe.  Again, long experience.

Given that, let's look at Dan's proposal: currently we assume that all
aggregates alias with each other in C++, but for C, we compute aliasing
specifically based on structs and their members.  The way we do this is
by putting all aggregates in alias set 0 in C++.

Dan's proposed modification, in pseudocode, is

cxx_get_alias_set ()
{
	if (AGGREGATE_TYPE && HAS_BASECLASSES && HAS_VIRTUALS)
		return 0;
	return c_get_alias_set();
}

Let's assume that, while c_get_alias_set is correct, Dan is wrong, for
purposes of the proof, and that his change introduces an error that was
not there before.  Then there must be an aggregate and another object,
neither of which has baseclasses or virtual functions, and neither of
which would alias in C, but that alias in C++.  Let's assume that this is
so.  This means that I can construct a legal C++ program that creates
the extra aliasing; this program cannot be a legal C program as well.

There is only one extra C++ operation that will allow "type punning" that
doesn't exist in C: casting between base classes and derived classes.  But
any derived class pointer or reference, once constructed, will go into
alias set 0.  Even if the derived class pointer is created later, from
the base pointer, the compiler will not assume that it can use its
knowledge of the base object to learn anything about the extra members.

While this is not a formal proof, it's enough to convince me that Daniel's
change is safe.