Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:83530
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain zend.com designates 209.85.223.180 as permitted sender)
References: <2e4694f9805ee81ea0b2c79eab06c2d6@mail.gmail.com>
	<CAAyV7nExeZ1xouJAsACm9AvAGuQw0e-0FgVdEOAyzsC5OEn5_Q@mail.gmail.com>
	<54EA5EDA.8010605@gmail.com>	<CAAyV7nFt3KL_uH4HuA5xQ7HY+3_3=fq=pg0_U1aMrdirETC6LQ@mail.gmail.com>
	<54EA6A99.5010609@gmail.com> <CAAyV7nE2Cfr0ohpPnXWnf5agmyGfeirNH-3UGyHEhsDaMvmsoQ@mail.gmail.com>
 <54EA7F15.9030606@gmail.com> <54EA891B.6030405@gmail.com>
In-Reply-To: <54EA891B.6030405@gmail.com>
MIME-Version: 1.0
Thread-Index: AQIDXD7ehmaYKzbAddTs7O1sB4MzmgIw+OLdAe4e2iYCibfnDQEmdWqtAiDZcfAB4cR2SQJXxpD6nCYS8QA=
Date: Mon, 23 Feb 2015 04:06:02 +0200
Message-ID: <09b9ee836c04b1750614a91bd39a5bed@mail.gmail.com>
To: Jefferson Gonzalez <jgmdev@gmail.com>
Cc: PHP internals <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: RE: [PHP-DEV] JIT (was RE: [PHP-DEV] Coercive Scalar Type Hints RFC)
From: zeev@zend.com (Zeev Suraski)

> -----Original Message-----
> From: Jefferson Gonzalez [mailto:jgmdev@gmail.com]
> Sent: Monday, February 23, 2015 3:58 AM
> To: Stanislav Malyshev; Anthony Ferrara
> Cc: Zeev Suraski; Jefferson Gonzalez; PHP internals
> Subject: Re: [PHP-DEV] JIT (was RE: [PHP-DEV] Coercive Scalar Type Hints
> RFC)
>
> How casting (int) could be such dangerous thing? Lets take for example
> this
> code:
>
> echo (int) "whats cooking!";
> echo intval("whats cooking");
>
> Both statements print 0, so how is casting unsafe???

One key premise behind both strict type hinting and coercive type hinting is
that conversions that lose data, or that 'invent' data, are typically
indicators of a bug in the code.

You're right that there's no risk of a segfault or buffer overflow from the
snippets you listed.  But there are fair chances that if you fed $x  into
round() and it contains "whats cooking" (string), your code contains a bug.

Coercive typing allows 'sensible' conversions to take place, so that if you
pass "35.7" (string) to round() it will be accepted without a problem.
Strict typing will disallow any input that is not of the exact type that the
function expects, so in strict mode, round() will reject it.  The point that
was raised by Stas and others is that this is likely to push the user to
explicitly cast the string to float;  Which from that point onwards, happily
accept "whats cooking", keeping the likely bug undetected.

Zeev