The code fails to set the type when a number value is assigned to a (formerly) string value. As a result, later access to the value or destruction of the object cause undefined behaviour (access to arbitrary memory address and/or heap corruption). The string field of the union is accessed, but its the number what is there…
It's also wrong in the book!
The fact that this bug has survived so long pretty much proves the point that code with unions is hard to get right ;-)
Oh, by the way, in order to test this, I had to add a constructor. Though, I'm not including it in the change. I suppose this just stuff we take for granted in the "// …" comment.
* Standardize example headings
Some example headings used "Example, [good,bad]" and others used
"Example; [good,bad]" (note the comma verses semicolon). The vast
majority of the headings used the comma version, so this commit
normalizes all example headings to use a comma instead of a semicolon.
* Standardize note heading level
Two of the "Note" headings were set to level four, but the rest are at
level 5. Fix the level fours to make them level fives.
The value -2 is signed, so the word "unsigned" is clearly wrong. The
text notes that negative subscripts are a source of surprises and
bugs, so the correction to "negative" seems to reflect Bjarne's
original intent.
Amir Livneh
Sergey Zubkov
hsutter
Martín Knoblauch Revuelta
Matthew Dews
Franz Hollerer
mpherg
Dave Smith
beinhaerter
Mark Abraham