From: Tom Lane <tgl@sss.pgh.pa.us>
To: Mark Dilger <hornschnorter@gmail.com>
cc: Andres Freund <andres@anarazel.de>,
        Pg Hackers <pgsql-hackers@postgresql.org>
Subject: Re: [HACKERS] Constifying numeric.c's local vars
In-reply-to: <A4C2D702-C291-4556-B14C-9D9068C6AE5B@gmail.com>
References: <20170910232154.asgml44ji2b7lv3d@alap3.anarazel.de>
 <11630.1505131814@sss.pgh.pa.us>
 <267E42E4-2C53-4791-AEDA-9FB959DB6C4D@gmail.com>
 <A4C2D702-C291-4556-B14C-9D9068C6AE5B@gmail.com>
Comments: In-reply-to Mark Dilger <hornschnorter@gmail.com>
	message dated "Wed, 21 Feb 2018 09:12:51 -0800"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <21220.1519274722.1@sss.pgh.pa.us>
Date: Wed, 21 Feb 2018 23:45:22 -0500
Message-ID: <21221.1519274722@sss.pgh.pa.us>
Precedence: bulk

Mark Dilger <hornschnorter@gmail.com> writes:
>> This means that the const variable 'const_zero' contains a pointer that is
>> non-const, pointing at something that is static const, stored in read only
>> memory.  Yikes.

> I still believe this is unsafe.

I'm with Andres: I don't see the problem.  It's true that we've casted
away a chance for the compiler to notice a problem, but that's not the
only defense against problems.  If we did try to modify const_zero,
what should happen now is that we get a SIGSEGV from trying to scribble
on read-only memory.  But that's actually a step forward from before.
Before, we'd have successfully modified the value of const_zero and
thereby silently bollixed subsequent computations using it.  Since,
in fact, the code should never try to modify const_zero, the SIGSEGV
should never happen.  So effectively we have a hardware-enforced Assert
that we don't modify it, and that seems good.

As far as compiler-detectable mistakes go, Andres' changes to declare
various function inputs as const seem like a pretty considerable
improvement too, even if they aren't offering 100% coverage.

			regards, tom lane