Re: ptrdiff_t misuse [was :Re: (empty)]

[Paul Eggert]

On 06/30/2012 07:07 AM, Stefan Monnier wrote:
> But "fixing" the code like you have will just make it run "correctly"
> and so super-extra slow that the user will just think it's frozen.

If Emacs simply cannot handle large hscroll values, how
about if we ceiling them out at some suitably-large value,
say 1000?  That would make this discussion moot and would
make Emacs more robust in practice, as it'd prevent some
freezes.  Emacs already limits tab width in this way, so
there's precedent.  I can work on writing up a patch along
these lines if you like.

If we can't impose an arbitrary limit, then here are some
more thoughts about the point at issue.

Although it's true that in some cases Emacs happened to run
incorrectly and quickly without the fix, in other cases
Emacs ran incorrectly and froze whereas it now runs
correctly and quickly (e.g., if the new hscroll is
sufficiently negative).  Since the patch fixes this bug
without introducing new bugs it seems like a win.

Besides, the previous paragraph assumes that signed integer
overflow silently wraps around.  This was formerly true of
Emacs porting targets but is no longer true: overflow has
undefined behavior, and can dump core or worse.  Maybe the
unfixed code happens to wrap around or dump core on all our
porting targets when overflow occurs (which appears to be
"acceptable" behavior here), but maybe it has even worse
behavior, and it's not feasible to test whether it does.
The fixed code doesn't have this problem.

I sense a larger worry here that if we methodically change
Emacs to prevent all cases of undefined behavior triggerable
by converting Emacs fixnums to C integer values, then we'll
have to add lots of checks that contort the C code so much
as to make Emacs unmaintainable.  If that's the worry, then
there should be no need for concern, as no rewrite should be
needed: the Emacs source code already has the desired
property, modulo whatever minor bugs in this area still need
fixing.