<!DOCTYPE html><html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<div class="markdown-here-wrapper" data-md-url="" style="">
<p style="margin: 0px 0px 1.2em !important;">On 19/09/2024 11:45,
Jonathan Rosenne wrote:</p>
<p style="margin: 0px 0px 1.2em !important;"></p>
<div class="markdown-here-exclude">
<p></p>
<blockquote type="cite" cite="mid:DB3PR10MB678628DB28C9FB8D326FFF3084632@DB3PR10MB6786.EURPRD10.PROD.OUTLOOK.COM">
<pre>One cannot rely on the C code being proper or safe. The C code may
define an array of a single int but actually use it for a much larger
array, or even use the variable for a completely different purpose. This
is a "feature" of C, after all. So the default of jextract should not
be changed. However, if the user of jextract is certain that it is safe,
then it is conceivable to provide such an option, whether global or
specific to a specific pointer.
</pre>
</blockquote>
<p></p>
</div>
<p style="margin: 0px 0px 1.2em !important;"></p>
<p style="margin: 0px 0px 1.2em !important;">I suppose what I’m
asking is a bit different - e.g. not saying we should trust all
C pointers. More the opposite.</p>
<p style="margin: 0px 0px 1.2em !important;">Say we have a C
function like this:</p>
<pre style="font-size: 0.85em; font-family: Consolas, Inconsolata, Courier, monospace;font-size: 1em; line-height: 1.2em;margin: 1.2em 0px;"><code class="hljs language-c" style="font-size: 0.85em; font-family: Consolas, Inconsolata, Courier, monospace;margin: 0px 0.15em; padding: 0px 0.3em; white-space: pre-wrap; border: 1px solid rgb(234, 234, 234); background-color: rgb(248, 248, 248); border-radius: 3px; display: inline;white-space: pre; overflow: auto; border-radius: 3px; border: 1px solid rgb(204, 204, 204); padding: 0.5em 0.7em; display: block !important;display: block; overflow-x: auto; padding: 0.5em; color: rgb(51, 51, 51); background: rgb(248, 248, 248); -moz-text-size-adjust: none;"><span class="hljs-keyword" style="color: rgb(51, 51, 51); font-weight: bold;">char</span>* API_VERSION(<span class="hljs-keyword" style="color: rgb(51, 51, 51); font-weight: bold;">void</span>);
</code></pre>
<p style="margin: 0px 0px 1.2em !important;">Then jextract will
generate a binding for it, like so:</p>
<pre style="font-size: 0.85em; font-family: Consolas, Inconsolata, Courier, monospace;font-size: 1em; line-height: 1.2em;margin: 1.2em 0px;"><code class="hljs language-java" style="font-size: 0.85em; font-family: Consolas, Inconsolata, Courier, monospace;margin: 0px 0.15em; padding: 0px 0.3em; white-space: pre-wrap; border: 1px solid rgb(234, 234, 234); background-color: rgb(248, 248, 248); border-radius: 3px; display: inline;white-space: pre; overflow: auto; border-radius: 3px; border: 1px solid rgb(204, 204, 204); padding: 0.5em 0.7em; display: block !important;display: block; overflow-x: auto; padding: 0.5em; color: rgb(51, 51, 51); background: rgb(248, 248, 248); -moz-text-size-adjust: none;"><span class="hljs-function">MemorySegment <span class="hljs-title" style="color: rgb(153, 0, 0); font-weight: bold;">API_VERSION</span><span class="hljs-params">()</span></span>;
</code></pre>
<p style="margin: 0px 0px 1.2em !important;">The question is: how
do you interact with this binding? In the current “unsafe” world
you can do this:</p>
<pre style="font-size: 0.85em; font-family: Consolas, Inconsolata, Courier, monospace;font-size: 1em; line-height: 1.2em;margin: 1.2em 0px;"><code class="hljs language-java" style="font-size: 0.85em; font-family: Consolas, Inconsolata, Courier, monospace;margin: 0px 0.15em; padding: 0px 0.3em; white-space: pre-wrap; border: 1px solid rgb(234, 234, 234); background-color: rgb(248, 248, 248); border-radius: 3px; display: inline;white-space: pre; overflow: auto; border-radius: 3px; border: 1px solid rgb(204, 204, 204); padding: 0.5em 0.7em; display: block !important;display: block; overflow-x: auto; padding: 0.5em; color: rgb(51, 51, 51); background: rgb(248, 248, 248); -moz-text-size-adjust: none;">String apiVersion = API_VERSION.getString(<span class="hljs-number" style="color: rgb(0, 128, 128);">0</span>);
</code></pre>
<p style="margin: 0px 0px 1.2em !important;">Note that, for this
to work, you need an unsafe derefrence of the pointer returned
by the C function. This is why jextract code needs
“—enable-native-access”.</p>
<p style="margin: 0px 0px 1.2em !important;">An alternative would
be to just leave C pointers as zero-length memory segments [1].
So that this code:</p>
<pre style="font-size: 0.85em; font-family: Consolas, Inconsolata, Courier, monospace;font-size: 1em; line-height: 1.2em;margin: 1.2em 0px;"><code class="hljs language-java" style="font-size: 0.85em; font-family: Consolas, Inconsolata, Courier, monospace;margin: 0px 0.15em; padding: 0px 0.3em; white-space: pre-wrap; border: 1px solid rgb(234, 234, 234); background-color: rgb(248, 248, 248); border-radius: 3px; display: inline;white-space: pre; overflow: auto; border-radius: 3px; border: 1px solid rgb(204, 204, 204); padding: 0.5em 0.7em; display: block !important;display: block; overflow-x: auto; padding: 0.5em; color: rgb(51, 51, 51); background: rgb(248, 248, 248); -moz-text-size-adjust: none;"> String apiVersion = API_VERSION.getString(<span class="hljs-number" style="color: rgb(0, 128, 128);">0</span>) <span class="hljs-comment" style="color: rgb(153, 153, 136); font-style: italic;">// throws IndexOutOfBounds</span>
</code></pre>
<p style="margin: 0px 0px 1.2em !important;">Will fail - as we’re
attempting to read from a segment whose size is zero. Instead,
this would be required:</p>
<pre style="font-size: 0.85em; font-family: Consolas, Inconsolata, Courier, monospace;font-size: 1em; line-height: 1.2em;margin: 1.2em 0px;"><code class="hljs language-java" style="font-size: 0.85em; font-family: Consolas, Inconsolata, Courier, monospace;margin: 0px 0.15em; padding: 0px 0.3em; white-space: pre-wrap; border: 1px solid rgb(234, 234, 234); background-color: rgb(248, 248, 248); border-radius: 3px; display: inline;white-space: pre; overflow: auto; border-radius: 3px; border: 1px solid rgb(204, 204, 204); padding: 0.5em 0.7em; display: block !important;display: block; overflow-x: auto; padding: 0.5em; color: rgb(51, 51, 51); background: rgb(248, 248, 248); -moz-text-size-adjust: none;"> String apiVersion = API_VERSION.reinterpret(someLength).getString(<span class="hljs-number" style="color: rgb(0, 128, 128);">0</span>) <span class="hljs-comment" style="color: rgb(153, 153, 136); font-style: italic;">// ok</span>
</code></pre>
<p style="margin: 0px 0px 1.2em !important;">What is <code style="font-size: 0.85em; font-family: Consolas, Inconsolata, Courier, monospace;margin: 0px 0.15em; padding: 0px 0.3em; white-space: pre-wrap; border: 1px solid rgb(234, 234, 234); background-color: rgb(248, 248, 248); border-radius: 3px; display: inline;">someLength</code>
? Maybe the client knows - however, in most cases, esp. for
strings, my feeling is that the client does not know (which is
why we opted for unsafely reinterpreting all C pointers to
Long.MAX_VALUE).</p>
<p style="margin: 0px 0px 1.2em !important;">And, note that we
have just moved where the unsafe operation occurs: instead of
having the unsafe resize happen inside jextract generated code,
the resize here would be explicit in the client code. So it’s
not like the resulting code would be any safer, just more
explicit (which, for some use cases, might be a good thing).</p>
<p style="margin: 0px 0px 1.2em !important;">Maurizio</p>
<div title="MDH:PHA+PGJyPjwvcD48ZGl2IGNsYXNzPSJtb3otY2l0ZS1wcmVmaXgiPk9uIDE5LzA5LzIwMjQgMTE6
NDUsIEpvbmF0aGFuIFJvc2VubmUgd3JvdGU6PGJyPjwvZGl2PjxibG9ja3F1b3RlIHR5cGU9ImNp
dGUiIGNpdGU9Im1pZDpEQjNQUjEwTUI2Nzg2MjhEQjI4QzlGQjhEMzI2RkZGMzA4NDYzMkBEQjNQ
UjEwTUI2Nzg2LkVVUlBSRDEwLlBST0QuT1VUTE9PSy5DT00iPjxwcmU+T25lIGNhbm5vdCByZWx5
IG9uIHRoZSBDIGNvZGUgYmVpbmcgcHJvcGVyIG9yIHNhZmUuIFRoZSBDIGNvZGUgbWF5IApkZWZp
bmUgYW4gYXJyYXkgb2YgYSBzaW5nbGUgaW50IGJ1dCBhY3R1YWxseSB1c2UgaXQgZm9yIGEgbXVj
aCBsYXJnZXIgCmFycmF5LCBvciBldmVuIHVzZSB0aGUgdmFyaWFibGUgZm9yIGEgY29tcGxldGVs
eSBkaWZmZXJlbnQgcHVycG9zZS4gVGhpcwogaXMgYSAiZmVhdHVyZSIgb2YgQywgYWZ0ZXIgYWxs
LiBTbyB0aGUgZGVmYXVsdCBvZiBqZXh0cmFjdCBzaG91bGQgbm90IApiZSBjaGFuZ2VkLiBIb3dl
dmVyLCBpZiB0aGUgdXNlciBvZiBqZXh0cmFjdCBpcyBjZXJ0YWluIHRoYXQgaXQgaXMgc2FmZSwK
IHRoZW4gaXQgaXMgY29uY2VpdmFibGUgdG8gcHJvdmlkZSBzdWNoIGFuIG9wdGlvbiwgd2hldGhl
ciBnbG9iYWwgb3IgCnNwZWNpZmljIHRvIGEgc3BlY2lmaWMgcG9pbnRlci4KPC9wcmU+PC9ibG9j
a3F1b3RlPjxwPkkgc3VwcG9zZSB3aGF0IEknbSBhc2tpbmcgaXMgYSBiaXQgZGlmZmVyZW50IC0g
ZS5nLiBub3Qgc2F5aW5nIHdlIHNob3VsZCB0cnVzdCBhbGwgQyBwb2ludGVycy4gTW9yZSB0aGUg
b3Bwb3NpdGUuPC9wPjxwPlNheSB3ZSBoYXZlIGEgQyBmdW5jdGlvbiBsaWtlIHRoaXM6PC9wPjxw
PmBgYGM8YnI+Y2hhciogQVBJX1ZFUlNJT04odm9pZCk7PGJyPmBgYDwvcD48cD5UaGVuIGpleHRy
YWN0IHdpbGwgZ2VuZXJhdGUgYSBiaW5kaW5nIGZvciBpdCwgbGlrZSBzbzo8L3A+PHA+YGBgamF2
YTxicj5NZW1vcnlTZWdtZW50IEFQSV9WRVJTSU9OKCk7PGJyPmBgYDwvcD48cD5UaGUgcXVlc3Rp
b24gaXM6IGhvdyBkbyB5b3UgaW50ZXJhY3Qgd2l0aCB0aGlzIGJpbmRpbmc/IEluIHRoZSBjdXJy
ZW50ICJ1bnNhZmUiIHdvcmxkIHlvdSBjYW4gZG8gdGhpczo8L3A+PHA+YGBgamF2YTxicj5TdHJp
bmcgYXBpVmVyc2lvbiA9IEFQSV9WRVJTSU9OLmdldFN0cmluZygwKTs8YnI+YGBgPC9wPjxwPk5v
dGUgdGhhdCwgZm9yIHRoaXMgdG8gd29yaywgeW91IG5lZWQgYW4gdW5zYWZlIGRlcmVmcmVuY2Ug
b2YgdGhlIHBvaW50ZXIgcmV0dXJuZWQgYnkgdGhlIEMgZnVuY3Rpb24uIFRoaXMgaXMgd2h5IGpl
eHRyYWN0IGNvZGUgbmVlZHMgIi0tZW5hYmxlLW5hdGl2ZS1hY2Nlc3MiLjwvcD48cD5BbiBhbHRl
cm5hdGl2ZSB3b3VsZCBiZSB0byBqdXN0IGxlYXZlIEMgcG9pbnRlcnMgYXMgemVyby1sZW5ndGgg
bWVtb3J5IHNlZ21lbnRzIFsxXS4gU28gdGhhdCB0aGlzIGNvZGU6PGJyPjwvcD48cD5gYGBqYXZh
PGJyPgpTdHJpbmcgYXBpVmVyc2lvbiA9IEFQSV9WRVJTSU9OLmdldFN0cmluZygwKSAvLyB0aHJv
d3MgSW5kZXhPdXRPZkJvdW5kczxicj4KYGBgPC9wPgo8cD5XaWxsIGZhaWwgLSBhcyB3ZSdyZSBh
dHRlbXB0aW5nIHRvIHJlYWQgZnJvbSBhIHNlZ21lbnQgd2hvc2Ugc2l6ZSBpcyB6ZXJvLiBJbnN0
ZWFkLCB0aGlzIHdvdWxkIGJlIHJlcXVpcmVkOjwvcD48cD5gYGBqYXZhPGJyPgpTdHJpbmcgYXBp
VmVyc2lvbiA9IEFQSV9WRVJTSU9OLnJlaW50ZXJwcmV0KHNvbWVMZW5ndGgpLmdldFN0cmluZygw
KSAvLyBvazxicj4KYGBgPC9wPjxwPldoYXQgaXMgYHNvbWVMZW5ndGhgID8gTWF5YmUgdGhlIGNs
aWVudCBrbm93cyAtIGhvd2V2ZXIsIGluIG1vc3QgY2FzZXMsIGVzcC4gZm9yIHN0cmluZ3MsIG15
IGZlZWxpbmcgaXMgdGhhdCB0aGUgY2xpZW50IGRvZXMgbm90IGtub3cgKHdoaWNoIGlzIHdoeSB3
ZSBvcHRlZCBmb3IgdW5zYWZlbHkgcmVpbnRlcnByZXRpbmcgYWxsIEMgcG9pbnRlcnMgdG8gTG9u
Zy5NQVhfVkFMVUUpLjwvcD48cD5BbmQsIG5vdGUgdGhhdCB3ZSBoYXZlIGp1c3QgbW92ZWQgd2hl
cmUgdGhlIHVuc2FmZSBvcGVyYXRpb24gb2NjdXJzOiBpbnN0ZWFkIG9mIGhhdmluZyB0aGUgdW5z
YWZlIHJlc2l6ZSBoYXBwZW4gaW5zaWRlIGpleHRyYWN0IGdlbmVyYXRlZCBjb2RlLCB0aGUgcmVz
aXplIGhlcmUgd291bGQgYmUgZXhwbGljaXQgaW4gdGhlIGNsaWVudCBjb2RlLiBTbyBpdCdzIG5v
dCBsaWtlIHRoZSByZXN1bHRpbmcgY29kZSB3b3VsZCBiZSBhbnkgc2FmZXIsIGp1c3QgbW9yZSBl
eHBsaWNpdCAod2hpY2gsIGZvciBzb21lIHVzZSBjYXNlcywgbWlnaHQgYmUgYSBnb29kIHRoaW5n
KS48L3A+PHA+TWF1cml6aW88YnI+PC9wPjxwPjxicj48L3A+PGJyPjxwPjxicj48L3A+PHA+PC9w
PjxwPjwvcD48cD48YnI+PC9wPjxwPjxicj48L3A+" style="height:0;width:0;max-height:0;max-width:0;overflow:hidden;font-size:0em;padding:0;margin:0;"></div>
</div>
</body>
</html>