Pointer._offset is private, but Array.cpointer takes an offset argument.

[jemc]

This is a contradiction in safety boundaries I noticed while working on a fix for how File handles writev calls that don't complete.

Pointer._offset, which allows you to get a relative pointer based on the current one, is private - it cannot be used outside of the builtin library.

In contrast, Array.cpointer accepts an offset argument that allows you to do the same thing, without any bounds checking, provided that your original pointer is coming from an Array.

If one is safe to expose, then the other should be as well. And vice versa.

[jemc]

I think this is a principle of least surprise bug.

I propose we make Pointer._offset public. The Array.cpointer with offset call is already used for writev processing in both TCPConnection and File, so we can't easily remove it. And for whatever it's worth, having a public method for Pointer._offset would also be helpful in my current work around fixing error handling for File's writev invocation.

I think you're not really breaking memory safety as long as you can't actually access the memory without FFI.

[sylvanc]

Pointer._offset returns this->Pointer[A]:

  fun _offset(n: USize): this->Pointer[A] =>
    """
    Return a pointer to the n-th element.
    """
    compile_intrinsic

That's significantly more permissive than Array.cpointer, which returns Pointer[A] tag.

Having a Pointer[A] ref could allow the use of Array.from_pointer, etc. I think that's problematic?

[jemc]

Correct, yeah. I noticed that while working on this locally, but forgot to update the ticket with the new information.

In my local branch that "fixes" this ticket, it keeps the current private _offset function, but adds a new public offset function that returns a Pointer[A] tag.

How does that sound to you?

[jemc]

The issue ticket has the "needs discussion during sync" label because it's pending further discussion with @sylvanc.

[jemc]

Discussed this on today's sync call - @sylvanc is fine with this as long as we keep the private _offset: Pointer ref and add the public offset: Pointer tag.