[racket-dev] Should `register-finalizer` unwrap impersonators?

That would be really nice for data structures defined in TR and used in 
untyped Racket, for which the contract boundary imposes O(n) overhead 
for everything. Also, it sounds dangerous. :D

It wouldn't solve the problem entirely, though. Here's an untyped 
program that has it:

#lang racket

(module resource racket
   (require (only-in ffi/unsafe register-finalizer))

   (provide
    (contract-out
     [connect-os-resource  (-> (struct/c os-resource-wrapper real?)
                               void?)])
    get-os-resource
    (struct-out os-resource-wrapper))

   (struct os-resource-wrapper (x) #:mutable)

   (define os-resource 0)
   (define (get-os-resource) os-resource)

   (define (connect-os-resource w)
     (set! os-resource (add1 os-resource))
     (printf "impersonator? ~v  chaperone? ~v~n"
             (impersonator? w)
             (chaperone? w))
     (register-finalizer
      w (λ (w) (set! os-resource (sub1 os-resource))))))

(require (submod "." resource))

(define w (os-resource-wrapper 1))
(connect-os-resource w)

(printf "os-resource = ~v~n" (get-os-resource))
(collect-garbage)
(sleep 1)  ; give finalizers a chance to run
(printf "os-resource = ~v~n" (get-os-resource))


This was actually hard to come up with. We usually use flat contracts 
like `os-resource-wrapper?`, and count on struct contracts at the 
boundary to ensure that `os-resource-wrapper?` implies (struct/c 
os-resource-wrapper real?) for any value coming in. When I did that, 
there was no way to provoke the error: `connect-os-resource` registered 
a finalizer on an unwrapped value, or on a wrapped value *for which the 
external module didn't have access to the original*.

The above program still exhibits the wrong-value-finalizer problem if 
the struct is provided with a contract. It probably gets wrapped twice 
in that case: once when created in the external module, and once on the 
way into `connect-os-resource`.

So I think our contracting habits make the problem rare, but it's still 
possible with just the contract system. I'm going to submit a bug report.

Neil ⊥

On 08/17/2014 05:19 PM, Matthias Felleisen wrote:
>
> I imagine a type-definition construct that allows programmers to specify how the type is translated into a contract. Think (define-trusted-type Finalizer C) and then the C specifies how little and how much of the type you wish to check.
>
> And yes, this is potentially a soundness hole but I am thinking that the primary uses could be connected to things in the core or the FFI. And programmers who wish to reduce the soundness of TR could use it to speed up boundary crossings at the cost of getting things wrong. In a sense, it's an FFI for types.
>
> -- Matthias
>
>
>
>
>
>
>
> On Aug 17, 2014, at 3:47 PM, Sam Tobin-Hochstadt wrote:
>
>> Can you say more about what the API for what you're imagining is?
>>
>> Sam
>>
>> On Sun, Aug 17, 2014 at 3:41 PM, Matthias Felleisen
>> <matthias at ccs.neu.edu> wrote:
>>>
>>> I am imagining that the type compilation of type Finalizer and such things would be parameterized over programmer code which would yield a 'trusted' 'thing' in this case except that this would open the door for other such things.
>>>
>>>
>>>
>>>
>>> On Aug 17, 2014, at 3:39 PM, Sam Tobin-Hochstadt wrote:
>>>
>>>> How would that change things here? The issue is about
>>>> finalizer-for-what, and that chaperones/impersonators affect object
>>>> identity.
>>>>
>>>> Sam
>>>>
>>>> On Sun, Aug 17, 2014 at 3:37 PM, Matthias Felleisen
>>>> <matthias at ccs.neu.edu> wrote:
>>>>>
>>>>> Could we benefit from an abstract/opaque Finalizer type here? I know we don't have those yet but it may address the general problem. -- Matthias
>>>>>
>>>>>
>>>>>
>>>>>
>>>>> On Aug 16, 2014, at 8:55 AM, Neil Toronto wrote:
>>>>>
>>>>>> Short version: the contract system doesn't allow `register-finalizer` to be used in Typed Racket.
>>>>>>
>>>>>> Long version: consider the following Typed Racket program, in which instances of `os-resource-wrapper` represent an operating system resource `os-resource`, which itself is just a counter. It attempts to register a finalizer for allocated wrappers, which decrements the counter.
>>>>>>
>>>>>>
>>>>>> #lang typed/racket
>>>>>>
>>>>>> (require/typed
>>>>>> ffi/unsafe
>>>>>> [register-finalizer  (All (A) (-> A (-> A Any) Void))])
>>>>>>
>>>>>> (: os-resource Integer)
>>>>>> (define os-resource 0)
>>>>>>
>>>>>> (struct os-resource-wrapper ())
>>>>>>
>>>>>> (: alloc-os-resource (-> os-resource-wrapper))
>>>>>> (define (alloc-os-resource)
>>>>>> (set! os-resource (add1 os-resource))
>>>>>> (define w (os-resource-wrapper))
>>>>>> (register-finalizer w (λ (w) (set! os-resource (sub1 os-resource))))
>>>>>> w)
>>>>>>
>>>>>> (define w (alloc-os-resource))
>>>>>> (printf "os-resource = ~v~n" os-resource)
>>>>>> (collect-garbage)
>>>>>> (sleep 1)  ; give finalizers a chance to run
>>>>>> (printf "os-resource = ~v~n" os-resource)
>>>>>>
>>>>>>
>>>>>> I get this output:
>>>>>>
>>>>>> os-resource = 1
>>>>>> os-resource = 0
>>>>>>
>>>>>> The finalizer is being run while the program still has a pointer to the wrapper object. I think it's because the wrapper object is being impersonated when it's sent across the contract barrier, and the *impersonator* is getting the finalizer. (Or it's a chaperone, or an impostor, or a charlatan, or whatever. Let's go with impersonator.)
>>>>>>
>>>>>> In my specific case, the OS resources are OpenGL objects; e.g. vertex object arrays. The call to `register-finalizer` *must* be in Typed Racket code because the wrapper contains an (Instance GL-Context<%>), which can't have a contract put on it, so it can't pass from untyped to typed code.
>>>>>>
>>>>>> Is there any reason for `register-finalizer` to behave this way? Does it ever make sense to register a finalizer on an impersonator?
>>>>>>
>>>>>> Neil ⊥
>>>>>> _________________________
>>>>>> Racket Developers list:
>>>>>> http://lists.racket-lang.org/dev
>>>>>
>>>>>
>>>>> _________________________
>>>>> Racket Developers list:
>>>>> http://lists.racket-lang.org/dev
>>>
>
>
> _________________________
>    Racket Developers list:
>    http://lists.racket-lang.org/dev
>