[API Proposal]: Interlocked.CompareExchange overload that can work with pointers

[rolfbjarne]

Background and motivation

I would like to do something like this:

struct MyStruct {
    public int Value;
}
unsafe class MyClass {
    MyStruct* _myStruct;

    MyStruct* CreateOnce ()
    {
        var ptr = (MyStruct *) NativeMemory.AllocZeroed ((nuint) sizeof (MyStruct));
        var oldPtr = Interlocked.CompareExchange (ref _myStruct, ptr, null);
        if (oldPtr is not null {
            NativeMemory.Free (ptr);
            return oldPtr;
        }
        return ptr;
    }
}

but it doesn't compile:

The type 'MyStruct*' may not be used as a type argument

I wrote this helper method, which works:

internal unsafe static T* InterlockedCompareExchange<T> (ref T* location1, T* value, T* comparand) where T: unmanaged
{
    fixed (T** ptr = &location1) {
        return (T *) Interlocked.CompareExchange (ref Unsafe.AsRef<IntPtr> (ptr), (IntPtr) value, (IntPtr) comparand);
    }
}

but ugh... and I don't really know if it's safe or not either.

API Proposal

namespace System.Collections.Generic;

public class Interlocked
{
    public unsafe static T* CompareExchange<T> (ref T* location1, T* value, T* comparand) where T: unmanaged;
}

API Usage

struct MyStruct {
    public int Value;
}
unsafe class MyClass {
    MyStruct* _myStruct;

    MyStruct* CreateOnce ()
    {
        var ptr = (MyStruct *) NativeMemory.AllocZeroed ((nuint) sizeof (MyStruct));
        var oldPtr = Interlocked.CompareExchange<MyStruct> (ref _myStruct, ptr, null);
        if (oldPtr is not null {
            NativeMemory.Free (ptr);
            return oldPtr;
        }
        return ptr;
    }
}

Alternative Designs

Keep using either my scary-looking InterlockedCompareExchange solution, or use IntPtr (which is somewhat error prone too):

struct MyStruct {
    public int Value;
}
unsafe class MyClass {
    IntPtr _myStruct;

    MyStruct* CreateOnce ()
    {
        var ptr = (IntPtr) NativeMemory.AllocZeroed ((nuint) sizeof (MyStruct));
        var oldPtr = Interlocked.CompareExchange (ref _myStruct, ptr, IntPtr.Zero);
        if (oldPtr is not null {
            NativeMemory.Free (ptr);
            return (MyStruct *) oldPtr;
        }
        return (MyStruct *) ptr;
    }
}

Risks

Not sure if the proposed overload might conflict with the existing generic overload.

There might be other Interlocked APIs that this would apply to as well, I haven't looked.

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @VSadov
See info in area-owners.md if you want to be subscribed.

[tannergooding]

CC. @jkotas, this keeps coming up.

Last time it got kicked back as "maybe we'll add support for pointer generics", but that's likely a couple years out still, if at all.

This is a relatively trivial add where the alternative is very error prone or makes the code more dangerous as it loses type info. It doesn't handle multiple pointers, but I expect that's more niche.

The alternative might be some API on Unsafe which allows ref T* to ref void* and then we just expose Interlocked.Exchange(ref void*, void*, void*)

[jkotas]

I have seen many variants of this issue - Unsafe.*, Interlocked.*, Volatile.*, Span<T*>, List<T*>, ... .

There are community packages like https://github.com/rickbrew/PointerToolkit that provide the variety of convenience helpers for writing unsafe code. I am not sure we want to be pulling these convenience helpers into the BCL. There is a quite a bit of them. Where would be the stopping point?

use IntPtr (which is somewhat error prone too):

It is what I would use. Unsafe code is very error prone in general. I do not think a few convenience helpers are going to fix that.

[tannergooding]

Where would be the stopping point?

We would, as usual, weigh them on a per scenario basis. Interlocked is one in particular that has repeatedly come up for ourselves, other first party teams, and the community.

I think this is particularly relevant to the unsafe-evolution changes where pointers existing are becoming safe and where we are explicitly trying to encourage users to move away from IntPtr where a strongly typed pointer can be used instead (or to safer code in general).

Ideally we would just allow M<T*> and have it just work, but we've been saying this for years now and having to push users to less safe solutions. I think we have more than enough signal that this is something users, including ourselves, semi-regularly hit.

The simplest general purpose thing would be the below, which would solve the issue for any out/ref/in API where the user has a pointer with a single indirection (where 2+ indirections are increasingly uncommon):

static partial class Unsafe // or BitOperations, since pointers are going to be safe
{
    public static ref void* AsRef<T>(in T* value);
    public static void SkipInit<T>(out T* value);
}

[jkotas]

What would the Interlocked.CompareExchange example above look like with these APIs?

since pointers are going to be safe

The first API strips readonly, the second API suppress definitive assignment checks. Neither of these two APIs look v2 safe to me.

[tannergooding]

What would the Interlocked.CompareExchange example above look like with these APIs?

Given the above APIs, we'd also need to expose Interlocked.CompareExchange(ref void* location, void* value, void* comparand), a user can then (T*)Interlocked.CompareExchange(ref AsRef(ref _field), value, comparand) for any T*

If you had public static ref IntPtr AsRef<T>(in T* value) instead then you could do (T*)Interlocked.CompareExchange(ref AsRef(ref _field), (nint)value, (nint)comparand)

Neither are quite as "clean" as just having Interlocked.CompareExchange<T>(ref T* location, T* value, T* comparand), but the first avoids generic explosion in more places and the latter avoids needing to expose additional overloads taking pointers at all, at least allowing the loss of type info to be relegated to a single line.

The first API strips readonly, the second API suppress definitive assignment checks. Neither of these two APIs look v2 safe to me.

Yes, this was just representative of the "bare minimum". If you want to include safe usage then you'd need ref void* As<T>(ref T* value) and ref T* As<T>(ref void* value) -- likely with some slight name change to avoid ambiguities; could be AsPointerRef as an example.

---

So these if we wanted to expose overloads taking ref void* in a few places, without generic variants everywhere:

static ref void* AsPointerRef<T>(ref T* value);  // Safe
static ref T* AsPointerRef<T>(ref void* value);  // Safe

static ref T* AsRef<T>(in T* value);             // Unsafe
static void SkipInit<T>(out T* value);           // Unsafe

and these if you want to expose nothing anywhere else, giving users freedom to go from ref T* to ref U (such as Unsafe.As<nint, long>(ref AsPointerRef(ref _field))):

static ref nint AsPointerRef<T>(ref T* value); // Safe
static ref T* AsPointerRef<T>(ref nint value); // Safe

static ref T* AsRef<T>(in T* value);           // Unsafe
static void SkipInit<T>(out T* value);         // Unsafe

The AsRef and SkipInit just completing the circle for the same scenarios other types have unlocked.