On Tue, Aug 23, 2022 at 11:18 PM Tom Honermann <tom@honermann.net> wrote:

Thanks again for the paper, Corentin.

The following comments are based on the P2626R0 paper revision submitted for the August mailing. I'm sorry for the delay in responding.I have a number of reservations about the paper as currently proposed though I am strongly in favor of what it is trying to accomplish.


Thanks for the feedback.
I certainly won't have time to address everything by tomorrow but I'll try

I think I failed to convey what this proposal is.
If you have seen one of Titus's talks with the video of the giant chainsaw dangling from a helicopter, this is what this is.
Maybe for good measure the chainsaw is on fire.
It's better than the existing alternatives presented in the paper (which I got wrong btw, another one of them is also UB, surprise surprise), but it is still dangerous and should be used with caution.

Rust can get away with a less dangerous interface because the source pointer is borrowed,
so there is only one thing looking at the memory at a given time, as far as I understand.

In C++ we have this memory region, pointed to by an arbitrary number of pointers and we are changing its type, with compilers which assume that can't happen.
The interface is reflective of what i understand the constraints of the abstract machine to be, and what we can actually specify and implement (and I am not confident about understanding any of it)

My primary concern is whether these interfaces suffice to solve the issues as experienced in real world code. The before/after presentation in the Tony table section does a nice job of illustrating why the existing cast operations do not suffice, but does not illustrate the inherent danger in using the proposed interfaces. Consider the following (some suspension of disbelief is required here since std::print won't accept char8_t-based text, but ignore that for now; as the paper says, "charN_t types are poorly supported in the standard library. We should notably support them in format").

void rename(const char *from, const char *to);
const char8_t from[] = ...;
const char8_t to[] = ...;
rename(cast_utf_to<char>(from, sizeof(from)), cast_utf_to<char>(to, sizeof(to)));
std::print("Renamed {} to {}\n", from, to); // UB; the lifetime of the char8_t objects from and to held were ended.

To fix this, it is necessary to rebuild the prior objects (it is not valid to reference an object of type char via an lvalue of type char8_t; that is the aliasing problem). But attempts to do so run into the problem that from and to are not actually associated with the replacement objects other than through a common region of storage; references to the replaced objects are needed to re-bless the storage as holding objects of the previous type. However, even in that case, I'm not sure that the association between the variables and the objects can really be reestablished; I think problems similar to those for which std::launder was introduced are present here. Access to the new objects must go through a pointer/reference provided by the operation that created the replacement objects.

You have redeclarations here so not sure which is which.
Either way, you are only doing things to the memory, not the pointers themselves.

You change the type of the objects, which can then be used through pointers of the new type, change back and the old pointers can be used again.
(Although it is not clear how that plays with papers like P2414, the original pointers would need to be unzaped when the lifetime is restored).

In any case, you need to recast in the other direction, if that's not clear enough in the paper, I'll try to clarify.
 

I think what is most needed, at least for the example above, is an operation that temporarily (e.g., via RAII and an object with full expression lifetime) mutates the type of an object temporarily and then restores it.

I did think about it.
Trying to hide the dangers behind a safe looking interface may do more harm than good.

A simple approach with an raii object and an accessor for example could very easily lead to a situation where the lifetime of that raii object, and therefore the restoration, occurs before the new pointer is used.
We could also have a function that takes a callable, do the cast, make the call with the casted pointer, and restore it before returning, but
  • That doesn't work if you are getting a pointer from somewhere - for example main
  • It still hides a bunch of dragons like concurrent accesses. 
  • The callee could store the new pointer and in that case you don't want to restore the old one or ever touch it again either.    
There is a transfer of ownership that happens, and it can be permanent or temporary depending on the scenario.

The paper lists the ICU character casts as an inspiration for the paper. However, the proposed interfaces don't match the semantics of the ICU casts. The ICU casts don't invalidate the source objects; they coerce the compiler into forgetting what it knows about the contents of memory. As such, I'm skeptical that the proposed interfaces could be used to replace the ICU casts. If they can be, a diff of the changes that ICU would require to adopt the new interfaces would be very helpful. 

I do not believe the ICU implementation is aligned with what it is possible to specify, and it may possibly be defeated by a sufficiently clever compiler.
But yes, the new functions can be used by icu internally or by the user, either way a recast to the original type is necessary if any old pointers are to be reused.

> As specified, the operations do not end the lifetime of, nor change the type of, the array objects that hold the sequence of elements that are being converted. This creates the strange result that, for example, an array object of type char16_t could have elements of type wchar_t. I'm not sure if that is ok from a core language perspective or not, but it seems problematic to me.

This needs to be seen by core, sg1, etc.
I would be amazed if that wording was not terrible.

The proposed operations are not really casts; they behave more like a destructive in-place move. Describing them as casts is, I think, misleading.

I'm open to better (i.e. more scary sounding) names.
But I tried a lot of different names and these are the most descriptive things I could find given I want to keep the unicode semantic in the name too.

With a few exceptions, each of the existing cast operators supports symmetric conversion between types. If a cast operation supports converion from type A to type B, then it also (usually) supports conversion from type B to type A. I'm not aware of a precedent in the language for a cast in one direction to have a different name than for a cast in the other direction. And I don't think such a distinction is needed in this case. The fundamental operation that is needed is the ability to cast/convert/swap an object of one type to a type that is, or shares, an underlying type (same kind (integer, float, etc...), size, alignment). Once that operation is available, encoding aware interfaces that limit conversion direction can be built on top if desired.

I don't think we want to generalize that dangerous interface to even more types.
The paper explains why there is this choice of separate interfaces - both for the names and different preconditions.

The paper includes a link to godbolt.org containing the following example use. The call to in.size() is UB since it follows a call to std::move(in). I think this illustrates how difficult these interfaces may be to use correctly.

I don't believe it to be ub (move doesn't move and invalidating the data pointer doesn't do anything to the size... but also the string_view's invariants don't hold any more so, who knows) but it should read as_char.size() regardless.
 

std::string utf8_to_iso8859_7(std::u8string_view in) {
    iconv_t conv = iconv_open("ISO-8859-7", "UTF-8");
    auto as_char = cast_utf_to<char>(std::move(in));
    std::string out(10, 0);
    std::size_t out_size = out.size();
    std::size_t in_size  = in.size();
    char* inptr = const_cast<char*>(as_char.data()); // C interfaces are fantastic
    char* outptr = out.data();  
    int ret = iconv(conv, &inptr, &in_size, &outptr, &out_size);
    return out;
}

The basic_string_view and span overloads seem deeply problematic to me. Consider:

std::string s = ...;
auto u8sv = cast_as_utf_unchecked(s); // the implicitly constructed temporary string_view binds to the rvalue reference.
// The buffer managed by s is of type char, but now holds objects of type char8_t.
// Any use of s, including destruction (at least in constexpr context) is UB.

You get the same problem with 
auto u8sv = cast_as_utf_unchecked(s.data(), s.data()+s.size());

The wording for the basic_string_view and span overloads of cast_as_utf_unchecked references a From type that does not appear in the declaration.


I will look into that.


The TL;DR is I think SG16 should decide whether they like the general direction, and send me to SG1 so they can tell me whether this is implementable and whether
better is possible.

But either way, here be dragons. by design - or rather by virtue of the fact the abstract machine isn't to be toyed with. 
It's a higher level start_lifetime_as-like thing, but not that high level either.
It doesn't mean it's not necessary, for example it's an important piece of getting format(u8"{}", 42) to work.(fmt would call from chars and then cast the buffer - or have a u8 buffer, cast it to char and back, depending how format is implemented).

The only way to get a safe behavior is to make a copy by successive application of bit_cast which is prohibitive expensive in some cases
 

Tom.

On 7/30/22 2:16 PM, Corentin via SG16 wrote:
Early draft, feedback welcome.

Thanks, 
Corentin 

https://isocpp.org/files/papers/D2626R0.pdf