<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body>
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.gmail-m6204826104124305112gmail-m1450706126456948411gmail-
{mso-style-name:gmail-m_6204826104124305112gmail-m_1450706126456948411gmail-;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
<div class="WordSection1">
<p class="MsoNormal">For me, they look OK.</p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">VTK_SIZEHINT is not a beautiful syntax, but I understand why it is like this and don't have a better suggestion. How do you specify size hints for multiple arguments?</p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Andras</p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="mso-element:para-border-div;border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="border:none;padding:0in"><b>From: </b><a href="mailto:david.gobbi@gmail.com">David Gobbi</a><br>
<b>Sent: </b>Wednesday, August 9, 2017 16:53<br>
<b>To: </b><a href="mailto:lasso@queensu.ca">Andras Lasso</a>; <a href="mailto:berk.geveci@kitware.com">
Berk Geveci</a><br>
<b>Cc: </b><a href="mailto:vtk-developers@vtk.org">VTK Developers</a><br>
<b>Subject: </b>Re: [vtk-developers] Safer item access in Python wrapped VTK arrays</p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<div dir="ltr">
<div>Here's what I'm currently thinking about for wrapper hints, please let me know if the syntax is too obtrusive.</div>
<div><br>
</div>
<div>The basic precondition contract, similar to proposed C++ contracts:</div>
<div><br>
</div>
<div> float GetValue(vtkIdType i) VTK_EXPECTS(i >= 0 && i < GetNumberOfValues());</div>
<div> </div>
<div>And here's the format that I'm currently thinking about for wrapper size hints (to replace our "hints" file):</div>
<div><br>
</div>
<div> double *GetPoint(vtkIdType i) VTK_SIZEHINT(return[3]);<br>
</div>
<div><br>
</div>
<div>When used in combination things start to look ugly, but the method signature is still readable:</div>
<div><br>
</div>
void SetTuple(vtkIdType i, float *a)
<div> VTK_EXPECTS(i >= 0 && i < GetNumberOfTuples())</div>
<div> VTK_SIZEHINT(a[GetNumberOfComponents()]);<br>
<div class="gmail_extra"><br>
</div>
<div class="gmail_extra"> float *GetTuple(vtkIdType i)
<div> VTK_EXPECTS(i >= 0 && i < GetNumberOfTuples())</div>
<div> VTK_SIZEHINT(return[GetNumberOfComponents()]);</div>
<div><br>
</div>
<div>Any thoughts? I'd really like to express the size hint as some kind of contract, but C++ doesn't provide a way to check the number of values pointed to by a pointer.</div>
<div><br>
</div>
<div>As an aside: for vtkDataArray, I don't actually intend to add VTK_SIZEHINT as shown above. Currently the size hints for vtkDataArray are hard-coded into the wrappers, and I'll probably keep them that way in order to keep the C++ headers clean.</div>
<div><br>
</div>
<div> - David</div>
<div><br>
</div>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Mon, Aug 7, 2017 at 6:56 AM, David Gobbi <span dir="ltr">
<<a href="mailto:david.gobbi@gmail.com" target="_blank">david.gobbi@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div dir="ltr">Hi Andras,
<div><br>
</div>
<div>I agree that these contracts are a better choice than inventing something of our own, I'm going to play around with this to see how easy it would be to add them to the wrappers.</div>
<div><br>
</div>
<div>The macros can be made a little more compact:</div>
<div><span style="font-family:"Courier New"">T& operator[](size_t i) VTK_PRECONDITION(i >= 0 && i < size());</span><br>
</div>
<div><br>
</div>
<div>Or we could use <span style="font-family:"Courier New"">VTK_EXPECTS(i >= 0 && i < size());</span></div>
<div><br>
</div>
<div> - David<br>
</div>
<div>
<div class="gmail-m_6204826104124305112gmail-h5">
<div><br>
</div>
<div><br>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Fri, Aug 4, 2017 at 7:39 PM, Andras Lasso <span dir="ltr">
<<a href="mailto:lasso@queensu.ca" target="_blank">lasso@queensu.ca</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US">
<div class="gmail-m_6204826104124305112gmail-m_1450706126456948411gmail-m_8165851147542036691WordSection1">
<p class="MsoNormal">Eventually, C++17 standard contracts may be used to specify these bounds checks. For now, we may use the same format but add them as comments or protected by macros; and when we switch to C++17 then these can be converted to actual contracts.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Proposal for contracts: <a href="https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.open-std.org%2FJTC1%2FSC22%2FWG21%2Fdocs%2Fpapers%2F2015%2Fn4415.pdf&data=02%7C01%7Classo%40queensu.ca%7C81f26f06e88740ecf91808d4df68c0b1%7Cd61ecb3b38b142d582c4efb2838b925c%7C1%7C1%7C636379088380189665&sdata=9oNtyphRr76c6McZ6ML0IIMZbPYxbnUh1FzPFp3CgKA%3D&reserved=0" target="_blank">
http://www.open-std.org/JTC1/S<wbr>C22/WG21/docs/papers/2015/n441<wbr>5.pdf</a><u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Example contract:<u></u><u></u></p>
<p class="MsoNormal"><span style="font-family:"Courier New"">T& operator[](size_t i) [[expects: i >= 0 && i < size()]];<u></u><u></u></span></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">For now, we could do this in VTK:<u></u><u></u></p>
<p class="MsoNormal"><span style="font-family:"Courier New"">T& operator[](size_t i) VTK_CONTRACT([[expects: i >= 0 && i < size()]]);<u></u><u></u></span></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Andras<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><a name="m_6204826104124305112_m_1450706126456948411_m_8165851147542036691__MailEndCompose"><u></u> <u></u></a></p>
<span></span>
<p class="MsoNormal"><span class="gmail-m_6204826104124305112gmail-m_1450706126456948411gmail-"><b>From:</b> David Gobbi [mailto:<a href="mailto:david.gobbi@gmail.com" target="_blank">david.gobbi@gmail.com</a>]
<br>
</span><b>Sent:</b> Friday, August 4, 2017 4:05 PM<br>
<b>To:</b> Berk Geveci <<a href="mailto:berk.geveci@kitware.com" target="_blank">berk.geveci@kitware.com</a>><br>
<b>Cc:</b> Andras Lasso <<a href="mailto:lasso@queensu.ca" target="_blank">lasso@queensu.ca</a>>; VTK Developers <<a href="mailto:vtk-developers@vtk.org" target="_blank">vtk-developers@vtk.org</a>><br>
<b>Subject:</b> Re: [vtk-developers] Safer item access in Python wrapped VTK arrays<u></u><u></u></p>
<div>
<div class="gmail-m_6204826104124305112gmail-m_1450706126456948411gmail-h5">
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">For a while, we kicked around the idea of having the hints in the comments. This would be less intrusive than adding C++11 attributes the declarations (i.e. what I've been doing so far).<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">The C++11 attributes are definitely the cleanest way for the wrappers to store the hints, since the hints become part of the parse tree, so I want to keep them as the primary hinting mechanism. Comment-based hints could be added as a secondary
mechanism, i.e. after a declaration has been parsed we can check the docstring for extra hints, and then add the hints to the parse tree before the wrapper code is generated.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">I'll have to search through the archives to remember what kind of syntax we were considering for comment-based hints.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"> - David<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">On Fri, Aug 4, 2017 at 1:30 PM, Berk Geveci <<a href="mailto:berk.geveci@kitware.com" target="_blank">berk.geveci@kitware.com</a>> wrote:<u></u><u></u></p>
<blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0cm 0cm 0cm 6pt;margin-left:4.8pt;margin-right:0cm">
<div>
<p class="MsoNormal">As much as I support the concept of range checking in the wrappers, this hint will make things look very ugly and non-standard at a time where we are trying to move towards more standard looking C++. Isn't there a way of doing this without
mangling the signatures?<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<div>
<p class="MsoNormal">On Fri, Aug 4, 2017 at 1:06 PM, David Gobbi <<a href="mailto:david.gobbi@gmail.com" target="_blank">david.gobbi@gmail.com</a>> wrote:<u></u><u></u></p>
</div>
</div>
<blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0cm 0cm 0cm 6pt;margin-left:4.8pt;margin-right:0cm">
<div>
<div>
<div>
<p class="MsoNormal">Hi Andras,<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Yes, this would be possible. It could be hard-coded into the wrappers, or even better, in the header file a generic hint could be added to the index parameter so that the index would be checked against the size of the array:<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"> float GetValue(vtkIdType idx VTK_RANGECHECK(0,GetNumberOfVa<wbr>lues()));<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">I have a list of wrapper hints at <a href="https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.vtk.org%2FWiki%2FVTK%2FWrapping_hints&data=02%7C01%7Classo%40queensu.ca%7C37f3749bcbbf4422f0ba08d4db741f07%7Cd61ecb3b38b142d582c4efb2838b925c%7C1%7C0%7C636374739163412038&sdata=FtQM8JHWrl8ReFwC3EFD4j0COBmWqm1r6k9b%2BF5tZzU%3D&reserved=0" target="_blank">http://www.vtk.org/Wiki/VTK<wbr>/Wrapping_hints</a>,
and I can add this "RANGECHECK" hint to the "Proposed hints" section.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">I'm hoping to find time to implement more of these wrapper hints over the next few weeks.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="color:rgb(136,136,136)"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:rgb(136,136,136)"> - David<u></u><u></u></span></p>
</div>
<div>
<div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">On Fri, Aug 4, 2017 at 9:53 AM, Andras Lasso <<a href="mailto:lasso@queensu.ca" target="_blank">lasso@queensu.ca</a>> wrote:<u></u><u></u></p>
<blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0cm 0cm 0cm 6pt;margin-left:4.8pt;margin-right:0cm">
<div>
<div>
<p class="MsoNormal"><span style="color:rgb(31,73,125)">Hi David,</span><u></u><u></u></p>
<p class="MsoNormal"><span style="color:rgb(31,73,125)"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="color:rgb(31,73,125)">Users who mostly use VTK via Python wrapping are sometimes surprised how easily they can crash the application by accessing out-of-bounds elements in arrays. For example, this crashes an application:</span><u></u><u></u></p>
<p class="MsoNormal"><span style="color:rgb(31,73,125)"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:Courier;color:black">>>>
</span><span style="font-size:8.5pt;font-family:Courier;color:rgb(0,0,150)">a=vtk.vtkStringArray()</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:Courier;color:black">>>>
</span><span style="font-size:8.5pt;font-family:Courier;color:rgb(0,0,150)">print(a.GetValue(0))</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:Courier;color:rgb(0,0,150)"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="color:rgb(31,73,125)">I first thought that it should be handled by documentation and training, but it would be nicer if the wrappers could handle this.</span><u></u><u></u></p>
<p class="MsoNormal"><span style="color:rgb(31,73,125)"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="color:rgb(31,73,125)">Would it be feasible to add bounds check to VTK array accessors in Python wrappers, so that in case of an out of bounds access, a Python exception would be raised instead of crashing the application?</span><u></u><u></u></p>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><span style="color:rgb(31,73,125)">Andras</span><span style="color:rgb(136,136,136)"><u></u><u></u></span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<br>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<br>
</div>
</div>
</div>
</div>
</body>
</html>