How to prevent 'Unchecked_Access

How to prevent 'Unchecked_Access

[Geert Bosch]

OK, as long as there is no GC for GNAT I'd like to use the stack
whereever I can to prevent errors in memory management. Sadly
enough there are many times I need to pass access types to procedures
at library level, notably OS and GUI libraries. 

Although I understand the use of Ada-95 accessibility levels to
prevent dangling pointers (dangling access objects???), there are
many times Unchecked_Access is necessary to pass parameters to
a subprogram that is known not to secretly store it somewhere for
later reuse.

Isn't there a way to express this safe behavior at the subprogram, so
they can be used without using Unchecked_Access. A pragma specifying
that an access-type parameter is limited would seem logical.

For those who might think that this question falls into the
category "how do I turn this screw without using the screwdriver",
I'd like to point out that the situation I describe doesn't
have to be "Unchecked".

Subprograms that take these limited access types as parameters can be
checked at compile time so there is nothing Unchecked taking place.
Reserving a dangerous feature for places which *are* potentially
dangerous is better IMHO that using it all over the place.

Of course specifying the pragma for imported C functions is
potentially unsafe, but importing C functions was unsafe 
already.

I'm very interested in your opinions on this.
-- 
E-Mail: geert@sun3.iaf.nl    

Re: How to prevent 'Unchecked_Access

[Robert A Duff]

In article <54jarn$1rp@fozzie.sun3.iaf.nl>,
Geert Bosch <geert@fozzie.sun3.iaf.nl> wrote:
>Isn't there a way to express this safe behavior at the subprogram, so
>they can be used without using Unchecked_Access. A pragma specifying
>that an access-type parameter is limited would seem logical.

An earlier version of Ada 9X had limited access types.  The feature was
removed, primarily to simplify the language and keep the number of
changes smaller.  It wasn't anything against that feature in particular,
as far as I remember.

Well, there was something in particular against limited
access-to-subprogram types.  That's been discussed to death on this
newsgroup.

Access parameters can do more-or-less what you want, in many cases.  You
can take 'Access (instead of 'Unchecked_Access), and pass it to an
access parameter, and as long as the called subprogram doesn't do
anything evil (like assigning it into a global), all is well --
otherwise you get a run-time error.

- Bob