{"action":"created","issue":{"url":"https://api.github.com/repos/D-Programming-Language/phobos/issues/2966","labels_url":"https://api.github.com/repos/D-Programming-Language/phobos/issues/2966/labels{/name}","comments_url":"https://api.github.com/repos/D-Programming-Language/phobos/issues/2966/comments","events_url":"https://api.github.com/repos/D-Programming-Language/phobos/issues/2966/events","html_url":"https://github.com/D-Programming-Language/phobos/pull/2966","id":56908481,"number":2966,"title":"fix trusted issues in std.array","user":{"login":"WalterBright","id":568298,"avatar_url":"https://avatars.githubusercontent.com/u/568298?v=3","gravatar_id":"","url":"https://api.github.com/users/WalterBright","html_url":"https://github.com/WalterBright","followers_url":"https://api.github.com/users/WalterBright/followers","following_url":"https://api.github.com/users/WalterBright/following{/other_user}","gists_url":"https://api.github.com/users/WalterBright/gists{/gist_id}","starred_url":"https://api.github.com/users/WalterBright/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/WalterBright/subscriptions","organizations_url":"https://api.github.com/users/WalterBright/orgs","repos_url":"https://api.github.com/users/WalterBright/repos","events_url":"https://api.github.com/users/WalterBright/events{/privacy}","received_events_url":"https://api.github.com/users/WalterBright/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":8,"created_at":"2015-02-07T11:43:47Z","updated_at":"2015-02-07T18:31:07Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/D-Programming-Language/phobos/pulls/2966","html_url":"https://github.com/D-Programming-Language/phobos/pull/2966","diff_url":"https://github.com/D-Programming-Language/phobos/pull/2966.diff","patch_url":"https://github.com/D-Programming-Language/phobos/pull/2966.patch"},"body":"Sets `uninitializedArray()` to be @system when it is returning uninitialized pointers.\r\n\r\nRemoves code that uses @trusted to inject unsafe code into surrounding context.\r\n\r\nDiscovered that `insertInPlace()` does not work when faced with a postblit and CTFE. CTFE and blitting memory about with system code really doesn't work too well. This aspect still needs work, but at least it'll error out with the memcpy call now."},"comment":{"url":"https://api.github.com/repos/D-Programming-Language/phobos/issues/comments/73376440","html_url":"https://github.com/D-Programming-Language/phobos/pull/2966#issuecomment-73376440","issue_url":"https://api.github.com/repos/D-Programming-Language/phobos/issues/2966","id":73376440,"user":{"login":"quickfur","id":405446,"avatar_url":"https://avatars.githubusercontent.com/u/405446?v=3","gravatar_id":"","url":"https://api.github.com/users/quickfur","html_url":"https://github.com/quickfur","followers_url":"https://api.github.com/users/quickfur/followers","following_url":"https://api.github.com/users/quickfur/following{/other_user}","gists_url":"https://api.github.com/users/quickfur/gists{/gist_id}","starred_url":"https://api.github.com/users/quickfur/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/quickfur/subscriptions","organizations_url":"https://api.github.com/users/quickfur/orgs","repos_url":"https://api.github.com/users/quickfur/repos","events_url":"https://api.github.com/users/quickfur/events{/privacy}","received_events_url":"https://api.github.com/users/quickfur/received_events","type":"User","site_admin":false},"created_at":"2015-02-07T18:31:07Z","updated_at":"2015-02-07T18:31:07Z","body":"Yep, this is why marking an entire function body as `@trusted` is dangerous, especially in a template function. The type passed in the template argument can be any arbitrary type, so its range primitives may very well be `@system`. The template function therefore cannot correctly be attributed as `@trusted`, since it has no way of guaranteeing that the range primitives it invokes are safe in any way. What we *really* mean in this case is \"this template function is `@trusted` if all of the range primitives in the template argument are `@safe` or `@trusted`\". However, there is no way to express that in the current language.\r\n\r\nA similar issue of dependent attribution exists for the other attributes as well: over the course of the past year or so, we Phobos maintainers have concluded that template functions generally should not be marked with *any* attributes as far as possible. The reason is the same: if you mark a template function as `nothrow`, for example, then it will not compile if the template argument has a throwing range primitive. But *not* marking it as `nothrow` introduces another issue: if someone inadvertently changes a previously non-throwing template function so that it now throws, suddenly a whole bunch of user code breaks, because they depended on the fact that the compiler would infer the template as `nothrow`, but that is no longer true. The workaround we came up with was to use attributed unittests to prevent this kind of regressions: mark the unittest as `nothrow`, then instantiate the template function with a range that is known to have non-throwing primitives. That way, we ensure that any throwing behaviour that might result can only have come from the template argument, not from the function body itself. This solution is good enough, though in an ideal world, we would have way of expressing that a template function's attribute(s) depends upon certain attributes in the incoming template argument.\r\n\r\nIn the case of `@trusted`, however, no such workaround exists. Since `@trusted` by definition means the compiler can't prove its safety, there is no way of saying \"this function is `@trusted` if the template argument has `@trusted` or `@safe` range primitives\". You either mark the whole thing as `@trusted`, which is wrong because a range with `@system` methods will break the safety system, or you don't mark it and the compiler is forced to infer it as `@system`, making it unusable from `@safe` code, even though it is actually safe when the template argument also has `@safe` methods."}}