Add withForeignPtrST, touchForeignPtrST

[raehik]

withForeignPtr :: ForeignPtr a -> (Ptr a -> IO b) -> IO b is a key utility for consuming ForeignPtrs safely. It is expectably common when consuming ByteStrings.
It and its related utilities use the primops

keepAlive# :: a -> State# s -> (State# s -> b) -> b
touch# :: a -> State# s -> State# s

But withForeignPtr is stuck in IO, preventing its use in ST contexts.
(This is probably due to the relevant primops being stuck in the RealWorld until #152 , implemented in GHC 9.8.)

I propose the following new functions:

withForeignPtrST :: ForeignPtr a -> (Ptr a -> ST s b) -> ST s b
touchForeignPtrST :: ForeignPtr a -> ST s ()

These would be defined in ghc-internal at GHC.Internal.ForeignPtr, together with their IO versions.

My draft implementation below is boring, copied from the existing IO versions with ST swapped in.

withForeignPtrST :: ForeignPtr a -> (Ptr a -> ST s b) -> ST s b
withForeignPtrST fo@(ForeignPtr _ r) f = ST $ \s ->
  case f (unsafeForeignPtrToPtr fo) of
    ST action# -> keepAlive# r s action#

touchForeignPtrST :: ForeignPtr a -> ST s ()
touchForeignPtrST (ForeignPtr _ r) = touchST r

-- not exported
touchST :: ForeignPtrContents -> ST s ()
touchST r = ST $ \s -> case touch# r s of s' -> (# s', () #)

No breaking changes.

[raehik]

I originally had to write these myself in order to consume ByteStrings inside a text-builder-linear primitive, which requests ST. @bgamari was kind enough to provide a cursory check of withForeignPtrST. See Bodigrim/linear-builder#23 (comment) .

[Bodigrim]

To save a click, Ben says that

@raehik, your implementation looks good to me. In general keepAlive# is sound (that is, keeps its first argument alive until the end of the continuation given as its last argument). It is the older touch# primop that was one needs to be extremely careful with; I would avoid the latter unless absolutely necessary.

I like the proposal, although I'm not proficient in the area.

[phadej]

withForeignPtrST :: ForeignPtr a -> (Ptr a -> ST s b) -> ST s b

is doubtful interface, as there isn't really anything you can do with Ptr safely in ST.

EDIT: you can build a morally pure (ST) interface managing resources of (morally pure) C library (e.g. BLAS), but you'd need STPtr s a like abstraction etc. IMHO, that is worth exploring; but better done first somewhere else than in base. You may also run into limitations, like https://gitlab.haskell.org/ghc/ghc/-/issues/24534

[raehik]

withForeignPtrST [...] is doubtful interface, as there isn't really anything you can do with Ptr safely in ST

Thanks. This surprises me, purely based off primop type signatures: I can writeByteArray# (from primitive) to an Addr# from a Ptr. In my head, I should be able to allocate memory for a bytestring in IO, then fill it in ST. This is effectively what I'm using these functions for. Does that seem safe? Perhaps my understanding of ST and RealWorld is incorrect.