When is an identifier not an identifier? (Attack of the Mongolian Vowel Separator)

Here's a few things you may not be aware of:

• C# identifiers can include Unicode escape sequences (\u1234 etc)
• C# identifiers can include Unicode characters in the category "Other, formatting" (Cf) but these are ignored when comparing identifiers for equality
• The Mongolian Vowel Separator (U+180E) has oscillated between the Cf and Zs categories a couple of times
• .NET has its own copy of Unicode categories, separate from whatever Win32 might provide
• Roslyn (built in .NET) uses the Unicode categories, whereas csc.exe (the "old" native C# compiler) uses either the Win32 categories or a built-in copy
• Neither the .NET table nor the Win32 table necessarily reflects exactly what any one version of the Unicode standard says
• Compilers can have bugs in

Put them together, and chaos ensues!

How this all started - blame Vladimir

I started looking at this based on a discussion in our ECMA technical group meeting last week, when we were considering the normative references - and in particular, which version of Unicode we were going to target. Currently the ECMA 4th edition spec targets Unicode 4.0 and the Microsoft C# 5 specification targets Unicode 3.0. It's not clear to me whether any compilers actually take note of this, and moving forward we'd like both the ECMA and Microsoft standards to not specify a particular version of Unicode, effectively encouraging compiler authors to use the most recent one available to them. Despite the wrinkles listed below, I think that makes the most sense for real world uses - it's crazy to require compilers to ship with their own private copies of Unicode, effectively.

When discussing this, Vladimir Reshetnikov mentioned the Mongolian Vowel Separator (U+180E) which has had an interesting life. It was introduced in Unicode 3.0.0, when it was in the Cf category ("other, formatting"). Then in Unicode 4.0.0 it was moved into the Zs (separator, space) category. In Unicode 6.3.0 it was then moved back to the Cf category.

Of course, my natural inclination was to try to abuse this. My initial aim was to come up with code which behaved differently depending on which version of Unicode the compiler was using. It turned out to be a little more complicated than that, but we'll assume a hypothetical compiler first, with no bugs, but which obeys whichever version of the Unicode standard we want it to. (Arguably that's already a bug given the requirements of the current C# specs, but we'll set that aside.)

Hypothetical example 1: valid or invalid

For simplicity, let's start with some source code which is all in ASCII:

class MvsTest{ static void Main() { string stringx = "a"; string\u180ex = "b"; Console.WriteLine(stringx); }}

If the compiler is using Unicode 6.3 or higher (or a version earlier than 4.0) then U+180E is deemed to be in the Cf category, and is therefore valid within an identifier. In that case, it's fine for it to be escaped as per the code above. At that point, the identifier in the second line of the method is deemed to be "the same as" stringx, so the output is b.

What about a compiler using a version of Unicode between 4.0 and 6.2 (inclusive) though? At that point, U+180E is deemed to be in the Zs category, which makes it a whitespace character. Zs characters are allowed as whitespace within C# programs - but not within identifiers. Once it's not a valid identifier - and because this isn't within a character/string literal - it's invalid to use the Unicode escape sequence, so the code doesn't compile.

Hypothetical example 2: valid two different ways

We can write the same code without using an escape sequence, however. If you create a regular ASCII file like this:

class MvsTest{ static void Main() { string stringx = "a"; stringAAAx = "b"; Console.WriteLine(stringx); }}

then open it up in a hex editor and replace the AAA with bytes E1 A0 8E, then you've got a file containing the UTF-8 representation of U+180E at the same location as we had the Unicode escape sequence in the first version.

So, a compiler which compiled the first version would still compile this version (assuming you could tell it that the source code was UTF-8), and the results would be the same - it would print b as the second statement of the method would be a simple assignment to the existing variable.

However, a compiler which treats U+180E as whitespace and would therefore treat the first program as an error would accept this program - and treat that second statement as a declaration of a second local variable (x) and assign it an initial value. You might get a warning about the variable being unused, but it's valid C# and the output is a.

Reality: the Microsoft compilers

Whenever we talk about the Microsoft C# compiler these days, we need to distinguish between the "native" compiler (csc) and Roslyn (rcsc, although typically I just call it Roslyn).

As it's written in native code, csc uses whatever Windows supplies for its Unicode character tables - or it embeds it directly in the executable, potentially. (I've been scouring MSDN to find a Win32 native function to tell me the Unicode category of a specific code point, and failed so far. It would have been useful")

Compare that with Roslyn, which is written in C# and (as far as I'm aware) uses char.GetUnicodeCategory - which in turn uses the Unicode tables built into mscorlib.

My experiments suggest that whatever the native compiler uses to get the Unicode category has treated U+180E as a formatting character forever. At least, I've tried to find old machines (including VM images) which haven't had Windows update applied since September 2013 (which is when Unicode 6.3 was published) and they all compile the first program listed above. I'm beginning to suspect that csc might actually have a copy of Unicode 3.0 built into it; it certainly treats U+180E as a formatting character, but doesn't like either U+0600 or U+00AD within identifiers. (U+0600 wasn't introduced until Unicode 4.0, but has always been a formatting character; U+00AD was a "dash punctuation" character in Unicode 3.0, and became a formatting character in 4.0.)

The table built into mscorlib has definitely changed over time, however. If you run a simple program such as this:

using System;class Test{ static void Main() { Console.WriteLine(Environment.Version); Console.WriteLine(char.GetUnicodeCategory('\u180e')); }}

then running under CLRv2, the result is "SpaceSeparator" whereas running on CLRv4 (at least on a recently-updated system), the result is "Format".

Of course, Roslyn won't run under old CLRs, but we have hope by way of csharppad.com - which runs Roslyn in an environment (of uncertain origin - Mono? I'm unsure) which prints "SpaceSeparator" for the above. Sure enough the first program fails to compile - but it's harder to check the second program, as csharppad.com doesn't allow you to upload source code, and copy/paste produces some odd results.

Reality: mcs (Mono C# compiler)

Mono's compiler uses the BCL GetUnicodeCategory code too, which should make it significantly simpler to experiment - but unfortunately, the Mono parser has (at least) two bugs in it:

• It will allow any Unicode escape sequence in an identifier, whether it's an escape sequence for a valid identifier part or not. For example, string\u0020x = "" is valid under the Mono compiler. Filed as bug 24968. Source.
• It doesn't allow formatting characters within identifiers - it includes characters in classes Mn, Mc, Nd and Pc, but not Cf. Filed as bug 24969. Source.

For this reason, the first program always compiles and prints "b" whereas the second program always fails to compile, regardless of whether U+180E is treated as being in Zs or Cf.

What version is this, anyway?

Next, let's think about the Unicode data itself. It's not at all clear which version any particular BCL implementation is actually using. Consider this little program:

using System;class Test{ static void Main() { Console.WriteLine(char.GetUnicodeCategory('\u00ad')); Console.WriteLine(char.GetUnicodeCategory('\u0600')); Console.WriteLine(char.GetUnicodeCategory('\u180e')); }}

On my computer, under CLR v4 this prints "DashPunctuation, Format, Format", and under both Mono (3.3.0) and CLR v2 it prints "DashPunctuation, Format, SpaceSeparator".

That's very odd. It doesn't correspond with any version of the Unicode standard, as far as I can tell:

• U+00AD was a Po (other, punctuation) character in Unicode 1.x, then Pd (dash, punctuation) in 2.x and 3.x, and from 4.0 onwards has been Cf.
• U+0600 was only introduced in Unicode 4.0, and has always been Cf
• U+180E introduced as Cf in 3.0, then changed to Zs in 4.0, then back to Cf in 6.3.

So there is no version where the first line agrees with either the second line or the third line. I'm basically a bit baffled by this.

What about nameof and CallerMemberName?

The names of identifiers aren't only used for comparisons - they're available as strings without any reflection being involved at all. From C# 5, we've had CallerMemberName attribute, allowing things like:

public static void X\u0600y(){ ShowCaller();}public static void ShowCaller([CallerMemberName] string caller = null){ Console.WriteLine("Called by {0}", caller);}

And in C# 6, we can write:

string x\u0600y = "";Console.WriteLine("nameof = {0}", nameof(x\u0600y));

What should those print? They do just print "Xy" and "xy" as the names (respectively), as if the compiler has simply thrown away the formatting character entirely. But what should they print? Bear in mind that in the second case, we could easily have used nameof(xy) and that would still have compared equal to the declared identifier.

We can't even say "What's the name of the member being declared?" because you can overload with "different but equal" identifiers:

public static void Xy() {}public static void X\u0600y() {}public static void X\u070fy() {}...Console.WriteLine(nameof(X\u200by));

What should that print out? I'm sure you'll be relieved to hear that the C# team has a plan in place - but fundamentally this is one of these "no obvious right answer" scenarios. It gets even weirder when you bring the CLI specification into the mix. Section I.8.5.1 of ECMA-335 6th edition has:

Assemblies shall follow Annex 7 of Technical Report 15 of the Unicode Standard
3.0 governing the set of characters permitted to start and be included in identifiers, available online
at http://www.unicode.org/unicode/reports/tr15/tr15-18.html. Identifiers shall be in the
canonical format defined by Unicode Normalization Form C. For CLS purposes, two identifiers
are the same if their lowercase mappings (as specified by the Unicode locale-insensitive, one-to-one
lowercase mappings) are the same. That is, for two identifiers to be considered different
under the CLS they shall differ in more than simply their case. However, in order to override an
inherited definition the CLI requires the precise encoding of the original declaration be used.

I would love to explore the impact of this by adding a Cf character into IL, but unfortunately I haven't worked out a way of affecting the encoding of ilasm, in order to persuade it that my hacked up IL is what I want it to be.

Conclusion

As noted before, text is hard.

It turns out that even when restricting oneself to identifiers, text is hard. Who would've thought?