Question

The question says it all. More specifically, I am writing bindings to a C library, and I’m wondering what c functions I can use unsafePerformIO with. I assume using unsafePerformIO with anything involving pointers is a big no-no.

It would be great to see other cases where it is acceptable to use unsafePerformIO too.

Answer 1

In the specific case of the FFI, unsafePerformIO is meant to be used for calling things that are mathematical functions, i.e. the output depends solely on the input parameters, and every time the function is called with the same inputs, it will return the same output. Also, the function shouldn’t have side effects, such as modifying data on disk, or mutating memory.

Most functions from <math.h> could be called with unsafePerformIO, for example.

You’re correct that unsafePerformIO and pointers don’t usually mix. For example, suppose you have

p_sin(double *p) { return sin(*p); }

Even though you’re just reading a value from a pointer, it’s not safe to use unsafePerformIO. If you wrap p_sin, multiple calls can use the pointer argument, but get different results. It’s necessary to keep the function in IO to ensure that it’s sequenced properly in relation to pointer updates.

This example should make clear one reason why this is unsafe:

# file export.c

#include <math.h>
double p_sin(double *p) { return sin(*p); }

# file main.hs
{-# LANGUAGE ForeignFunctionInterface #-}

import Foreign.Ptr
import Foreign.Marshal.Alloc
import Foreign.Storable

foreign import ccall "p_sin"
  p_sin :: Ptr Double -> Double

foreign import ccall "p_sin"
  safeSin :: Ptr Double -> IO Double

main :: IO ()
main = do
  p <- malloc
  let sin1  = p_sin p
      sin2  = safeSin p
  poke p 0
  putStrLn $ "unsafe: " ++ show sin1
  sin2 >>= \x -> putStrLn $ "safe: " ++ show x

  poke p 1
  putStrLn $ "unsafe: " ++ show sin1
  sin2 >>= \x -> putStrLn $ "safe: " ++ show x

When compiled, this program outputs

$ ./main 
unsafe: 0.0
safe: 0.0
unsafe: 0.0
safe: 0.8414709848078965

Even though the value referenced by the pointer has changed between the two references to “sin1”, the expression isn’t re-evaluated, leading to stale data being used. Since safeSin (and hence sin2) is in IO, the program is forced to re-evaluate the expression, so the updated pointer data is used instead.