#9122: Make Lint check for bad uses of `unsafeCoerce` -------------------------------------+------------------------------------ Reporter: simonpj | Owner: Type: bug | Status: new Priority: normal | Milestone: Component: Compiler | Version: 7.8.2 Resolution: | Keywords: Operating System: Unknown/Multiple | Architecture: Unknown/Multiple Type of failure: None/Unknown | Difficulty: Unknown Test Case: | Blocked By: Blocking: | Related Tickets: -------------------------------------+------------------------------------ Comment (by goldfire): What are "the rules"? Where are they written? And, what if someone ''wants'' to do one of the things mentioned? I can imagine wanting to coerce between lifted and unboxed types or between ints and floats. (Unboxed types of different sizes, I tend to agree, wouldn't want to get coerced.) -- Ticket URL: http://ghc.haskell.org/trac/ghc/ticket/9122#comment:1 GHC http://www.haskell.org/ghc/ The Glasgow Haskell Compiler

#9122: Make Lint check for bad uses of `unsafeCoerce` -------------------------------------+------------------------------------ Reporter: simonpj | Owner: Type: bug | Status: new Priority: normal | Milestone: Component: Compiler | Version: 7.8.2 Resolution: | Keywords: Operating System: Unknown/Multiple | Architecture: Unknown/Multiple Type of failure: None/Unknown | Difficulty: Unknown Test Case: | Blocked By: Blocking: | Related Tickets: -------------------------------------+------------------------------------ Comment (by goldfire): I was thinking of someone who wanted the raw pointer associated with a value of a lifted type. Coercing `Int` to `Int#` would seemingly get that pointer value. It's conceivable to me to imagine scenarios where this behavior is desired, such as debugging against some sort of memory dump. Going the other way might also be desirable, if Haskell code has to operate against some pre-loaded memory image. Maybe these sorts of things never happen in Haskell, but I've done them (when debugging kernels / device drivers) in other languages. Or, is the idea that all such shenanigans are subsumed by `Foreign.Ptr` and friends? -- Ticket URL: http://ghc.haskell.org/trac/ghc/ticket/9122#comment:3 GHC http://www.haskell.org/ghc/ The Glasgow Haskell Compiler

#9122: Make Lint check for bad uses of `unsafeCoerce` -------------------------------------+------------------------------------ Reporter: simonpj | Owner: Type: bug | Status: new Priority: normal | Milestone: Component: Compiler | Version: 7.8.2 Resolution: | Keywords: Operating System: Unknown/Multiple | Architecture: Unknown/Multiple Type of failure: None/Unknown | Difficulty: Unknown Test Case: | Blocked By: Blocking: | Related Tickets: -------------------------------------+------------------------------------ Comment (by goldfire): Fair enough -- such users can always simply avoid `-dcore-lint` anyway. -- Ticket URL: http://ghc.haskell.org/trac/ghc/ticket/9122#comment:5 GHC http://www.haskell.org/ghc/ The Glasgow Haskell Compiler

#9122: Make Lint check for bad uses of `unsafeCoerce` -------------------------------------+------------------------------------- Reporter: simonpj | Owner: qnikst Type: bug | Status: new Priority: normal | Milestone: Component: Compiler | Version: 7.8.2 Resolution: | Keywords: newcomer Operating System: Unknown/Multiple | Architecture: Type of failure: None/Unknown | Unknown/Multiple Blocked By: | Test Case: Related Tickets: | Blocking: | Differential Revisions: -------------------------------------+------------------------------------- Changes (by qnikst): * owner: => qnikst -- Ticket URL: http://ghc.haskell.org/trac/ghc/ticket/9122#comment:7 GHC http://www.haskell.org/ghc/ The Glasgow Haskell Compiler

#9122: Make Lint check for bad uses of `unsafeCoerce` -------------------------------------+------------------------------------- Reporter: simonpj | Owner: qnikst Type: bug | Status: new Priority: normal | Milestone: Component: Compiler | Version: 7.8.2 Resolution: | Keywords: newcomer Operating System: Unknown/Multiple | Architecture: Type of failure: None/Unknown | Unknown/Multiple Blocked By: | Test Case: Related Tickets: | Blocking: | Differential Revisions: -------------------------------------+------------------------------------- Comment (by simonpj): I don't know how to reason about what might be "an error at some particular stage of the pipeline". ANY use of `unsafeCoerce` might make a program seg-fault. So at best these checks are going to smoke out uses that are more than usually likely to cause this behaviour. It's all very squishy. Ask a more specific question and I'll try to help. S -- Ticket URL: http://ghc.haskell.org/trac/ghc/ticket/9122#comment:9 GHC http://www.haskell.org/ghc/ The Glasgow Haskell Compiler

I don't know how to reason about what might be "an error at some

#9122: Make Lint check for bad uses of `unsafeCoerce` -------------------------------------+------------------------------------- Reporter: simonpj | Owner: qnikst Type: bug | Status: new Priority: normal | Milestone: Component: Compiler | Version: 7.8.2 Resolution: | Keywords: newcomer Operating System: Unknown/Multiple | Architecture: Type of failure: None/Unknown | Unknown/Multiple Blocked By: | Test Case: Related Tickets: | Blocking: | Differential Revisions: Phab:637 -------------------------------------+------------------------------------- Comment (by qnikst): Replying to [comment:9 simonpj]: particular stage of the pipeline".

ANY use of `unsafeCoerce` might make a program seg-fault. So at best

these checks are going to smoke out uses that are more than usually likely to cause this behaviour. It's all very squishy. Ask a more specific question and I'll try to help.

S

I think that Richard means that this check may be useful also in a typechecker, as lint will help from problems introduced by ghc, but doesn't prevent from incorrect programs to be written and accepted by typechecker. So idea was also perform this check in typechecker. -- Ticket URL: http://ghc.haskell.org/trac/ghc/ticket/9122#comment:11 GHC http://www.haskell.org/ghc/ The Glasgow Haskell Compiler

#9122: Make Lint check for bad uses of `unsafeCoerce` -------------------------------------+------------------------------------- Reporter: simonpj | Owner: qnikst Type: bug | Status: new Priority: normal | Milestone: Component: Compiler | Version: 7.8.2 Resolution: | Keywords: newcomer Operating System: Unknown/Multiple | Architecture: Type of failure: None/Unknown | Unknown/Multiple Blocked By: | Test Case: Related Tickets: | Blocking: | Differential Revisions: Phab:D637 -------------------------------------+------------------------------------- Comment (by goldfire): Should the type-checker reject `unsafeCoerce# (3 :: Int) :: Int#`? If not, the proposed change would mean that `-dcore-lint` would show an error even when GHC is not at fault. Or, another (opposite) way to ask the question: Should a program containing that chunk, but compiled ''without'' `-dcore- lint`, be accepted? -- Ticket URL: http://ghc.haskell.org/trac/ghc/ticket/9122#comment:13 GHC http://www.haskell.org/ghc/ The Glasgow Haskell Compiler

#9122: Make Lint check for bad uses of `unsafeCoerce` -------------------------------------+------------------------------------- Reporter: simonpj | Owner: qnikst Type: bug | Status: new Priority: normal | Milestone: Component: Compiler | Version: 7.8.2 Resolution: | Keywords: newcomer Operating System: Unknown/Multiple | Architecture: Type of failure: None/Unknown | Unknown/Multiple Blocked By: | Test Case: Related Tickets: | Blocking: | Differential Revisions: Phab:D637 -------------------------------------+------------------------------------- Description changed by simonpj: Old description:

I think it would be a great idea for Core Lint to check for uses of `unsafeCoerce` that don't obey the rules. It won't catch all cases, of course, but it would have caught #9035. Specficially, look for: * Coercions between lifted and unboxed types * Coercion between unboxed types of different sizes * Coercion between unboxed ints and floats.

Would anyone like to make a patch for this? Anything that can be checked by Core Lint, should be checked!

I'm afraid I don't know where to look for the reason for the int/float difficulty. I'd write a tiny function that exhibits the unsafe conversion and look the code it generates.

Simon

New description: I think it would be a great idea for Core Lint to check for uses of `unsafeCoerce` that don't obey the rules. It won't catch all cases, of course, but it would have caught #9035. Specficially, look for: * Coercions between lifted and unboxed types * Coercion between unboxed types of different sizes * Coercion between unboxed ints and floats. Would anyone like to make a patch for this? Anything that can be checked by Core Lint, should be checked! I'm afraid I don't know where to look for the reason for the int/float difficulty. I'd write a tiny function that exhibits the unsafe conversion and look the code it generates. Wiki design page [wiki:BadUnsafeCoercions] -- -- Ticket URL: http://ghc.haskell.org/trac/ghc/ticket/9122#comment:15 GHC http://www.haskell.org/ghc/ The Glasgow Haskell Compiler

#9122: Make Lint check for bad uses of `unsafeCoerce` -------------------------------------+------------------------------------- Reporter: simonpj | Owner: qnikst Type: bug | Status: closed Priority: normal | Milestone: 7.12.1 Component: Compiler | Version: 7.8.2 Resolution: fixed | Keywords: newcomer Operating System: Unknown/Multiple | Architecture: Type of failure: None/Unknown | Unknown/Multiple Blocked By: | Test Case: Related Tickets: | Blocking: | Differential Revisions: Phab:D637 -------------------------------------+------------------------------------- Changes (by thoughtpolice): * status: new => closed * resolution: => fixed * milestone: => 7.12.1 Comment: Merged, thanks Alexander! -- Ticket URL: http://ghc.haskell.org/trac/ghc/ticket/9122#comment:17 GHC http://www.haskell.org/ghc/ The Glasgow Haskell Compiler