Short Communication TYPE-SAFE CASTING

types cannot be cast, because their representations are unknown. We can cast an lvalue from a visible type T1 to another visible typeT2when all of the following conditions hold: Every bit pattern that represents a legal value in T1 represents a legal value in T2 . If the lvalue is writable, every bit pattern that represents a legal value in T2 must represent a legal value in T1 . The use of the lvalue must satisfy the constraints of the underlying architecture. For example, we disallow casts between floating point and integer lvalues. Such casts might not preserve sharing if the lvalues were assigned to registers because the integer and floating point register sets are disjoint. The use of the lvalue must satisfy the code generation constraints of the compiler and architecture. For example, the alignment of the lvalue may have to satisfy the alignment required for T2. Reasoning about the bit representation of types is straightforward (although compilerand languagedependent): For a base non-pointer type, the set of legal bit representations is defined by the language implementation. For a pointer type, the set of legal representations is distinct from all other types. For a record or array type, the set of legal representations is a combination of the bit representations of the types of the fields (which must include any padding). This definition assumes that the constituents of a record or array as well as any padding are laid out according to a well-known, deterministic algorithm (as defined by the language or compiler). Our casting operator is type-safe for two reasons. First, the conditions for legal casting guarantee that our cast does not create any illegal representations. Second, there is no harm in allowing application-provided code to “create” new instances of a visible type T via casting. Since T is a visible type, a client can allocate and modify its own instances the type anyway, so no protection is lost. For the sake of exposition, we have assumed that the lvalue has the same size as T2. Nevertheless, the lvalue can be larger thanT2 , in which case it is effectively truncated by the cast. (Our notion of representation equivalence can be easily modified to account for truncation.) This feature is useful for looking at network packets, where networking code needs to examine only the first few bytes of a packet. For a dynamically sized lvalue, such as an array, the size of the lvalue must be checked at runtime to guarantee that the lvalue is at least as large as T2 .