Re: master d582356: * src/fns.c (Frandom): Handle bignum `limit`s

[Eli Zaretskii <eliz@gnu.org>]

> From: Pip Cet <pipcet@gmail.com>
> Date: Sat, 6 Mar 2021 13:22:10 +0000
> Cc: Stefan Monnier <monnier@iro.umontreal.ca>, emacs-devel@gnu.org
> 
> > > So I'm not sure whether code_conversion_save is allowed to call Lisp.
> 
> > I'd rather it didn't, for more than one reason.  But we can side-step
> > this by making Fgenerate_new_buffer_name use random-fixnum, which is
> > still a pure-C implementation.
> 
> Here's a patch which makes it use get_random() directly.

Thanks, maybe add a comment explaining the need for the do-while loop
in generate-new-buffer-name.

> Actually, I think it would be best to have these restrictions
> represented in the code. I see two ways of doing that:
> 
> 1. Have FUNCTION_MAY_GC etc. translate into a GCC attribute in debug
> builds so we can statically check that a function that says it never
> calls GC doesn't call a function that says it may call GC.
> 2. Have a statement at the beginning of non-GCing functions which sets
> a flag that is then checked by garbage-collecting functions, so that
> we may dynamically check this.
> 
> (1) seems easy to implement, but has a high rate of false negatives as
> many functions are safe to call from non-GCing functions as long as
> the arguments are correct.
> (2) is difficult to implement, and would only trigger at runtime.
> 
> So I say we should do (1) in preference to (2), but maybe we should do both.

I don't think I understand how will we know which function says it
never calls GC.  And the FUNCTION_MAY_GC attribute, even if applied to
the lowest-level functions that actually call maybe_gc, would be a
maintenance headache because we do change this from time to time.  So
we'd need something that checks the attribute's accuracy at compile
time, otherwise the attribute will bitrot.

For the same reasons, I don't see how (2) can be done in practice.