Re: Systemless use of 'Address.

[kst@alsys.com (Keith Thompson)]

In <3ae5s0$o1p@gnat.cs.nyu.edu> dewar@cs.nyu.edu (Robert Dewar) writes:
> Why on earth should unchecked_access require system? it has nothing to do
> with entities declared in system, and its semantics is not system
> dependent.

Several other "unsafe" Ada constructs require an explicit "with".  Address
clauses require a "with" of System, instantiations of Unchecked_Conversion
and Unchecked_Deallocation require a "with" of the respective generic
subprogram, machine code insertions require a "with" of Machine_Code.
(Note, however, that calls to instances of Unchecked_Conversion and
Unchecked_Deallocation don't require a direct "with".)

The purpose is to flag a compilation unit that uses these unsafe
constructs in a highly visible way.

It would be consistent with this policy to require an explicit "with"
before using 'Unchecked_Access, but there's no clean way to add such
a requirement, since the 'Unchecked_Access attribute doesn't depend on
anything declared in any particular predefined unit.

I suppose the language could have defined something like this:

   generic
      type Object is limited private;
      type Name   is access all Object;
   function Unchecked_Access(X: Object) return Name;

(I *think* that's right.)

The drawbacks of this would be that it's less convenient (which I might
argue is a good thing), and that it draws attention to instantiations
and not to calls.

Of course, you can always scan the source file for the identifier
Unchecked_Access, so marking the context clause probably isn't such a
big deal anyway.

> Sure it can be used to construct erroneous programs whose behavior is
> implementation dependent, but hey, you can do that with uninitialized
> variables, and you don't have to with system to create those!

There's a difference between code that's unintentionally erroneous (i.e.,
buggy) and code that's deliberately "unsafe".  It's reasonable to make
the user work harder to write unsafe code.  It would be nice to make
it difficult or impossible to write buggy code, but that's beyond the
current state of the art.

In any case, I'm sure it's far to late in the Ada 9X process to
contemplate this kind of change.

-- 
Keith Thompson (The_Other_Keith)  kst@alsys.com
TeleSoft^H^H^H^H^H^H^H^H Alsys, Inc.
10251 Vista Sorrento Parkway, Suite 300, San Diego, CA, USA, 92121-2718
/user/kst/.signature: I/O error (core dumped)