.Net Foundation Design Reviews, 26 Feb 2016

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: .NET Core Design Reviews: BufferPool in CoreFX and Exceptions

Description

In this review, we’ll take a look at two issues:

- Safety concerns with buffer pooling in CoreFX
- This thread https://github.com/dotnet/corefx/pull/6389

To address #3423: A replacement API for DataReader.GetSchemaTable().

A

Getting live and are we are live alright, guys so think. Probably the first thing we should do is I talked about the buffer part, because the thing that puppy is faster, I guess than the other one. What.

B

Is the other one the.

A

Other one is the discussion we had on github regarding the DPR that Steven top submitted, with all the exception changes I want you to be on what we want to write down, because I think our guidance right now is is almost hundred percent, the opposite, um alright. So the the buffers thing there was a bunch of concerns about how we deal with management right.

A

So we have this thing called system the buffers which I think lifting core FX left for a while I didn't you moved it over like what three months ago, two months ago, something like this look like it and then now we started using this across square FX and yeah. You had some concerns about what that would mean for safety. Can you summarize what the concerns were so.

C

Busy, the problem is that if you have class a fasting right, that's using buffer internally, then if the people who have who are using the fast team- and if you use the buffers in the fast, if you busy just a place, the array of the bhakti internal buffer allocation inside Farsi bit cause to buffer a lock and thing. The spokesman thought you just said turn into the buffer pool I. That was great.

C

But if people who are using the fast team as a back in there called a like threading back in echo, that you know they are calling methods on multiple sets in parallel. But what, if might happen, is that you know to dispose method. Sounds it's a big call. This post marathon man said, but other set, is still eating from the buffer or force frightening to add buffer.

C

And what can happen then, is that the buffer gets checked out by somebody else, and now you have data corruption that it's like impossible to try to chase down right. So.

A

The problem is not so much to be a park in Oracle. The problem says the consumer setback endure, can use libraries and, in turn, causes the Ripley your whether we.

B

We can actually have hugs in our code yeah. We can that's true. Why not hugs I would say like it's a it's unclear whether some of these conditions are even balance, because today you can use filestream in a way it works, and there are actually no problems with suddenly when we switch to a buffer. You cannot think oh and you are probably are using it slightly incorrectly, like you're, not using it at how we prescribed, but it does work today and then in the future. It would break so that you.

C

Know the key value we had internet since the day one you know originally, it was driven by the fact that we that time to target you know departure tough environments and such it kind of force it. But the key value is that is it's not possible?

C

Assuming you are using the safe code, it's not possible to cause global data corruption. So if you have back in your code, let's say you know for 13 bucks. If you are using dictionary in not yet Saturday, you can get the dictionary into messed up state, and you know you can get exception coming out of dictionary. Let's say you know like just like messed up but threading, but you cannot introduce like corruption in like some little assists in completely and then think by using dictionary.

A

Incorrectly I to me, they're, giving if we a box in our code that stuff doesn't work and maybe even if it's been packed full. That's that's bad I. Think to me. The problem is, though, if its box and consumer cause or the magnitude worse, but.

B

I also, I think there are actually three levels and I kind of had an email exchange and I kind of I said I'm in the middle one level. Is we basically can guarantee that you never have problems super literally? Never you cannot. You cannot screw up and I think the bar is too hard hi. It would mean even literally like we cannot use bathroom. Then there is a you know, I would say low bar, which is if you follow.

B

If your code is correct- and I will call this and you follow all the rules that you gonna be fine, otherwise you may you're not into a problem and then I think there is like one in the middle, which is where I think we should be. If you don't use buffer for yourself, I think there should be no change for you. From my perspective, how that worked in the past? There's no global data corruption because you're not you're not using a buffer pool, correct you're, just using file streams, and maybe we use it internally.

B

But we ensure that no matter how you use by five, you may not using their prescribed guidance. So how did the.

D

Difficulty sorry that the difficulty with that middle one is pretty much every useful usage of buffer pool we could have in core FX would violate that middle one because, for example, even probably the most trivial one which is copied to a sink. You know we get a buffer, we call read, write, read, write, read right, we release the buffer, but we're handing that buffer out to some arbitrary stream underneath us which could hold on to that buffer and do something with it long term.

D

So, even in that case, we can't guarantee that the buffer isn't being used same with deflate stream, wrapping other stream pretty much every case. It falls into that category. I'm.

B

Not sure if I understand why ending to buffer to another same.

E

B

E

Can hold on to it so.

C

Like if you have a PF Mellish upstream I, then if you have malicious team, that you know that the hot Sun dude buffer, our it doesn't 93 malicious, it may be just bitin buggy right, I, KFS team. It has bug implementation of a saying that kind of letter Evans, but it still keeps writing to the buffer. No.

B

No, but that's fine, that's so I didn't even finish what my middle ground is.

C

B

I mean it's like as I started, to say: I'm, just using a components implemented by the dotnet team, I assume we can assume that they don't have bugs and I'm using some other components that don't have plans. I should be completely safe because I'm, a user who's not even aware that Africans exist. No, you, you have a. Let me finish. Let me finish the power and we can Scott the moment. You use the Brotherhood directly like you in your crowd, started to now using buffer pool. Are you pulling a component that has bugs on?

B

We have bugs in the.net framework I? Think then? Well, it's fine. You know like at that point. It's not ideal, but I think that's a reasonable bar to her. No.

E

Hang on, yes, the bug would be in a component that may never have heard of buffer pool, but just used about an array that was possible but incorrectly and I. Think the main thing here is that you know this is a fundamental I think this is the thing about to think about is fundamentally different. Behavior for the platform where a bug I mean it's a it's a key value proposition of the platform.

E

Historically, that bugs you know like a like, like this, don't just manifest themselves in some very arbitrary way later on, like the fact where the bug is on our side on their side, whether they use bottle or not, I think it is extremely interesting to think about the fact that this bug could exist in some derive stream class in and then with no knowledge of what a buffer pool is, and the manifestation of that bug could be really really really really really hard to do to actually track down right.

C

That's kind of if you talk to people like you know, Mike routine, ohi, microcenter wages say you know like I say that exactly but be like. His point is like hey, you know when people are acting as your web services like I, don't know how they can write them in C++ right did. He is saying, like the only way to write a web service for azure thats. Actually, barks doesn't have like you know later. Corruption and stuff right is to you see char pics of that because of these guarantees right well, so my insane.

B

That but my position is that over time we should get our components be hardened and treat you know and return prefer pools correctly there for some of the issues that maybe we have today that Stephen was Stephen talking about, like you know today, when they send a sync operation in the flag. The problem is like they are calling.

C

Back into code that we don't know.

B

Well, let it so that one is yet another. One I think that today we don't have facilities to give people access to the buffer pool it like. If it's all internal I think we can harden the moment. There are AP I swear, you give a you know, pools to third-party code and we don't have a way to prevent. Today, from you know, from people doing the wrong thing: I think longer term we should hand buffer to third-party code only when they are up tin spans.

B

If we can get spans to be stuck on Lee yeah, and then you basically they can just you know, use the buffer. They cannot do say anything because even return it to the pool and I think you may end up in this situation, I think it's reasonable bar. Basically, we would work overtime to get those bugs out of our code up our component harden them and the buffers to third-party code only through spans and I understand that it's not as.

B

Resilience to problem says without using a buffer pool, but I think it's a reason move out and just like you know, I was trying to explain where my body. So what are.

D

You, if that's the bar we adopt, which might be a fine thing there. I just want to point out that we face it. We won't be using buffer pool anywhere in court effects, because there's basically there's like one or two minor bike feels this way. I.

C

Think you can like still say, you know, I think the interesting case is a like.

E

C

Filestream right, whether it's Rubio vortac to use it for the intern buffer out the file stream and pay the cost of checking it in and out for every operation. Yeah.

B

So I yeah I'm, not sure. If I use Steve you keep saying that you know we wouldn't use it almost anywhere. I think we wouldn't use it for the copy operation that you described, but the five shoot shun stream usage. I. Think now.

D

We we can't use them to fight stream either because we hand the other it's another stream.

D

Filestream doesn't prefer another stunning.

B

D

Stream, sorry, he sells.

B

D

B

In turn, up on the theme and we and we use the bathroom and we pass the buffer to the other stream right.

D

Because you compress data into the buffer and you give that buffer to write to another stream, so.

B

One thing we could discuss is you know, maybe we can expand it. We say user that doesn't implement. You know, framework abstractions, just uses uses components that are available in for FX and should be safe. The moment they use the custom implementation of a stream that is buggy, then maybe we, okay with it I, don't know. That's worth that. Could we want to discuss our AC didn't crack.

A

Head of, like you, just said that if it would move to span of T, that would help a bit because it's tech only that part I, don't question. Why would.

B

That help you, you cannot return, it's basically getting span of lights. Well, you cannot return it to the buffer pool. You cannot halt in the back hold it for cystic. The stake. Local nature doesn't know me to stash it away up, I see so inside code. We we still have to have to solve the problem of. You must be able to stash. You know spans from the hip, but then we said in the past that we would just wait in an unsafe context. I see so. Okay make sense. So then.

A

So to understand you are like you like, for example, if you have static aprs, like you know, file read all texts or whatever like like those internally could could use before pulling because there's no way you could use a cooking interfere with that's right. It.

B

Looked like very high level to summarize my Paris I'm, a user I'm using components that don't have bugs I, don't use buffer pool I should be fine. The moment I need an implementing, you know, custom components, dreams or whatnot or I, kept bugs in my code or I'm using components that have bugs well. You can pass like I.

E

Right, I just think that the main question is like like well, you have bugs is one thing, but I think the diagnosis ability of bugs like it's not so much the guarantee.

E

That of what happens as like as a sort of like a security thing or anything, but as much as just the debugging of of a situation like this is going to be extremely painful like if, when it happened so and that's something that I think that probably you know, and it can be no sort of you mix and match you know nuget packages across the ecosystem and one one thing or something strange, and then it's really hard to like know. What that witch thing did this and how this happened and I could.

B

The thing is that like people can imprint, v8 and do create- and there are reusable battery poops out there anyway, so well.

A

Right, what on the on the on the higher layer I'd selected, make the lower you get the more interactions you have but like if it's really literally in string- and you have a bug there like that easily goes everywhere. I do.

B

That, but also is a different force, which is the lower it is, and if it's in our code, we we should be able to get rid of the Boxcar I know.

A

Like a maniac but a bit like technican yawns example right like if it's a if it's let's say stream right, which is pretty low like the problem, is you implement your own time? So you are you're like you would take the user code or the third party code interferes with that lower layer right so that, even if we get a dry it like, if you get it wrong by it by a divider driving from that testing is still goes potentially everywhere, depending on what would work right.

B

But I would say you know how many people implement streams and if it's something that customers use very often over time, it sugar, you know, yeah. It's.

C

Kind of you know about county gonna tie today, then there is like junior developer of writing as your web service. If he's using, you know safe code, he cannot screw up the rest of the system right, it's like. If it will fail, it will feel like his stuff on the second you're out the back to him, and we have done right. Oh and now we are saying okay did. We need to also watch for, like those general folks and I dont 16.

B

Yeah I don't agree so they can implement their own pool. They can do exactly what we are doing and then they yet, but it will be still in their code light of day. If the guy decides. Okay, you know I'm smart is.

C

B

It on the code, if they pass the buffer, pulls two custom streams like we are just talking about. It will not be in just in their code. It will be in anybody's code that uses those dreams. Now I, don't list an echo or what.

A

Depends on why we do it by the way. Take it. Let's say: I write a buffer pool, my stream abstraction is using it and then there's. Another system goes on top of me. That basically uses my streams.

A

Well then, the code that actually may have the bug is actually in the higher level component right and then, and if that blows up, then the guy who wrote the buffer pool that wrote the underlying extreme may not be on the SEC at that point right so, but I agree with you like in principle: I like the idea of localized arrows, which is a Houston, but like I mean in the past, we have done something very similar above multithreading and UI controls, but at some point we said well, you know you shouldn't use this for multiple threads other people.

A

Do it all the time and sadly it works in enough cases that people don't find it actually and then we started to throw exceptions when it when they do this kind of thing when they run with the psycho they do. You know the MDA is being enabled or whatever right I. Could we do something similar here or do we think that in practice you will never be able to find those? So one.

B

Thing we could do, but it just complicates the teacher we had this idea of. Instead of giving people arise, we give them a small struck that is called butter and then in distract we can attract more. Like you know, positioning of you don't worry so.

F

Then we can give.

B

You better Diagnostics like we could. We could play with it a bit, but it's like it doesn't complete and introduces some other complexity. In a case now we have to hang like sockets that thinks this not a raper takes this buffer thingie. We are back to the legs. You know span like problems.

C

So I don't know I think like the Diagnostics, for this is it would have to be going in the same direction as for Diagnostics looks for Maalik free today. Right, which means is a composite out. Most of the time.

A

Because they're not running under the debugger you're, not running with these things, any other.

G

Sectors, so they contract for the deferred for use after it. So because we're talking about really the flushing it like, for instance, a flush after displays, call right so, which is how you cause o'clock the globalized. What's our what's our contract today for four years after disposed? Is that undefined behavior, like what's our definition for using an object after disposal site called the object.

B

Is supposed to throw in cases it's really well, it even work something.

C

Else object disposed exception. Yeah then.

B

We will issue a 25, others.

C

In technical in 25 minute, but it's like undefined, we do best effort right right. So, if you, if you use kind of if you are calling creep on it on a steam, unwanted and disposed on out of that, it will work almost over the time. Sometimes you can so we have to get an exception right.

G

So right now they saw the same problem. Where sometimes are working. Sometimes it wont which right now it seems so.

C

It doesn't necessarily like if you, if you are kind of feel like for the case of steamed bun, one thing calling each other thing calling close right it. If you I guarantee that the closest called after you kind of start, the read then until dip, I.

B

Think the difference is that today, let's say you did something like what you described with a with a stream like using some basic operation in disposing on the different that tray, your stream, the operations that your string is doing. I gotta be screwed up attention with the buffer pool room. If you do something wrong with a sink and dispose some other stream in a completely different parts of the system, it is right. That is the new thing and the worst case it doesn't.

A

Go to an exception, it just reads: cross the data like I mean like a nice diamond like VF races to transpose. Usually you get usually pretty simple error messages like if I disposed to sleep, your connection, while I'm reading somewhere else. Well, suddenly the connections terminated right. The problem with buffers is: when you have races when the petroleum wheat, you get arbitrary results in many cases, may not even throw an exception. You just you just the tribals.

G

Because, during at least in all the use cases are seeking I've done when you implement the stream, you actually set the your attorney said. No, so the read or write would not actually happen. Cuz, you have annul objects, there's nothing you can do to cross the state. You've returned it back to the stream. You have no yeah.

C

But there might be operation in progress while you are setting it now. It's currently you.

B

Setting your your variable to know: well, some other variable already points to this buffer because it's doing a sink and it stashed it there. Okay.

G

What presidents do we have today for like twenty new district shubham selves in the fluid, in terms of like doing blatantly incorrect usage, such as unlocked operations on? But you.

E

Have we have to be very blunt? We have one very, very effective way of preventing all these classes of errors is called garbage collection and so basically replacing replayed anywhere, introducing my lock free, I, pi/4 buff for buying arrays and now we're discussing all the things that can go wrong uh when you, when you allocate this way, Allen it manually um and so there's a whole class of things that are, you know, I mean I, think it should be pretty.

E

Like I mean we can sort of like I go through sort of like exactly what can go wrong, but I mean at the end of the day. That seems to me that that's fundamentally, what were what we're up against here is like it's, like the exact reason why you know these things couldn't happen is because of you know the you know we were allocating these buffers.

E

You know from the garbage collector, which is has exactly the right knowledge to know when it's a you know to actually to actually you know free and now we say no, we have this API, which is exactly my lock in, like you know, and then free just you know and like we're gonna sort of invariably like bump up against all sorts of things. That could not happen. If we didn't use this, if we did I still I'm.

B

Gonna reiterate: I right, like I, still believe that people can do their own pools and whether it's used whether such pool is used in our code on or in their custom, like streams that they get from look at and what not I don't see a fundamental difference. If you saying that they might say that our streams is much more frequently and you know so, it will be more Revelin. Then I would kind of agree accept this.

B

As the second force, which is in our streams, we can get rid of bugs on all probability and random packages on look at so I. It may be that.

C

There's a same thing like the the phone number of us he's like people can use unsafe felt right, but they can like screw themselves number of ways, but if they use safe code and fold to follow the rules they kind of can still have bugs, but they kind of give them guarantees that you know things don't go for. It is.

B

The same with um so I grabbed a component from the gate which it yeah, but it's safe code Craig. Now I'm using safe.

C

Code but the component crisp and yeah by it's like it's like air problem that, like you kind of if you grab component from together as like two stars and then you know, okay yeah on your own right. So.

B

I agree so it's the same with I grab a you know: custom implementations such some stream that does wrong things with apples. You know like well I grab the component that is buggy which again I go back to to meet the main bar that we cannot give up literally, is I use components that don't have bugs and stuff net framework. I don't use buffer pool I'm like that, you know more to user of I should not have problems period. Ok, the moment like you, use buffer pool or use components that are buggy with you know.

B

Buffer pools, I understand that it's getting your head rather then, but but I think they did.

A

The earlier distinction was a bit more helpful because they get it's even pointed out right as I'm, inheriting from stream, and this overriding we didn't ride, I'm, not aware that as any buffer pumas is when using bottle for right. But if I have to sell the bucket young pointed out, I will corrupt the system badly.

A

I would say that if we, I would say that if I use the aesthetic functionality, but I'm not extending the fam work, so I would say if you derive from stream you're more or less from the purbas, you become part of the framework, inheritance hierarchy, so you're participating in the same level, and I think that I would treat those people differently from somebody who calls follow the results. Oh yeah, that's what? If we I think if we, if there's a meaningful tinction we can make, we should pursue that, but I would be concerned.

A

If we go too far, then we end up in the world that Steven outline where we have like two three cases in Quebec's that we can use this for, like the savings, are not that hard I, don't know.

B

You know like if it turns out that we can only use it in three places, but it's safe, I think I'm, fine with it I would rather not use it in you know like hundred places and then run into is we have to use but solved all the time that.

D

Is figure I wasn't arguing that we should use it in more places, just because I was saying like if that's our bar that's? This is the consequence, which might be like well.

A

No I would go a step further and say like if we, you know if it's only three places like like it's the cost worth it to have that component in core of X directly being used at all. If you just be a component on the side, but in some places we.

B

Can use it literally hundred percent safe, so I there are some some of those we.

F

Should do we know how to find, doesn't actually do it? The right thing and I think you know Angus whether we don't have to find it.

C

F

C

Think we can safely use it well, it's like we can simply use late, but most of I think, but you will find that most of the cases are titles right. So, for example, vice theme you can safely use it in filestream, but you pay like internal operations on each operation right and I think in fast team. It would be like good trade-off. You know, like some methods on a fast team, that shouldn't even be there likely bite food regress, but you know like I would argue that you know get bite on fast.

C

You miss cow, but if you.

A

Replace you today, p I to starve.

C

It you know uh yeah.

A

But I mean like I, think I mean it's a very high level. It's simple, I doesn't expose the race by, like it didn't really say fright like thats. That's an easy one. As soon as your.

B

A

B

It is no no it's not just that it. It kind, of course it cannot hand their right to user code. Unless it's like to user code that we said it's like, we consider it's unsafe, like you doing an extension to the framework right, but the second thing what it cannot do. It has to be very careful with thread like you may you know like in filestream.

B

We need to make sure that we higher, then the dispose method with all the async operations. It's all internal, but if we.

C

In dispose, the return, it's like you busy like me to treat the buffer pool the same way. Su teep anyone makes research site, presumably just to save, handle.

E

C

You know like probably save handle is not necessary, the perfect fit for it, but have like say hello, echo and for buffer pools, but for buffers from buffer pool this.

A

May be naive question, but is there any way we could basic treat these buffers as weak references and if they basically nobody reference and then they go back to the pool automatically? Is that tunda me just can't do well? That's basically, what GC does today funny.

E

C

Can sort of my dad is that you can kind of safe on the zero filling if you do magic in the GC, but I believe these are zero filling the buffers anyway right so I mean the only.

A

Difference would be the buffer is basically dodge enough to be on the loh I. Then you would benefit a bit because you don't have the you know, fragmentation that happens there. It it wouldn't have to compact it. He wouldn't have to do anything of it because it would reuse these buffers. Oh.

C

Potentially right but yeah I don't know.

B

Another thing you know like with all good wishes. Another thing, I kind of experimented with is.

B

Having a native memory span, I mean native memory buffer and then just using it withstands like. Basically that was that I had a native buffer pool implementation. It just allocates very large native memory chunks it into whatever chunks it needs hands on these pants. Nothing else, I.

C

Think you know, the fundamental thing is that you've got spawn site like a VF spends with like the kind buffer pool like it will be much better right, not very rich, whether you kind of get actual memory that recycled from cheesy or not it's just like minor.

B

Polish, you know, and so that leads to what I wanted to say it so I was kind of you know at for some time. Thinking about all these issues and I was thinking. Maybe we should start really really conservative with usage, as I said, if we can convince ourselves that we are completely safe, we are using it and it's more like a feature that anybody could implement it's a buffer pool. That could be a look at developer if I a third party and then once spans that we have negative memory.

B

Maybe then we can use it more places. It.

D

Sounds like that's we're landing, we're basically saying from a design perspective. Technically, we will only use it in core FX. If we can, a hundred percent prove there's no chance of incorrect usage, there's no chance of a problem whatsoever, we're not handing it out to any other code. It's you know, just on the stack, etc.

D

Then, on top of that, there's the question of art. Well, in the cases where we can actually meet that bar, is it actually useful to do? Are the trade-offs from a performance perspective there? That's an engineering question that whoever is doing this work would figure that out with perfect testing and alike. Let.

B

Me, let me ask you a question in you: describe the bar: are you still, including the caveat if somebody else in the system uses the pool and base throughout the pool like they return the buffer, then we grab and I will call this hundred percent safe, but we grab a buffer that they still hold to learn it. If.

D

That's a criteria. We can't use the buffer pier, we can't you see it. Okay,.

C

So I think that's fine like busy, but the buffer, but the buffer pool allocator. It's like you know. It's like we used to call these things like different names like it's busy security, critical code, it's like if you use it incorrectly like it, can cause bad things to happen night. There was like another proposal I saw like um I think it was in Rosellini reported. You know. Maybe there should be like unsafe.

C

Cal code has to be unsafe attribute, but you mark things that hey, you know like it's like. It has all good say types and signature bites like fundamentally unsafe API to.

A

Another by the way, but I mean, like I, mean like yeah I would be like if the bar is to protect the buffer pool. Then, like the game is over all right, I mean there's no way to expose that, but I would treat buffer probably the same way. I would treat Marshall like if uses incorrectly. You will hang yourself very badly and another.

B

Thing we could consider there was a option that we had on the email thread, which is: should we create our own buffer pool first, isolate ourselves from musical and that one has the disadvantage that I would you know, then we would like baffin police already large, correct, like if it's not used frequently, it may actually be negative net benefit. So we want to minimize the number of other pools there for today. I. Don't.

C

Think that reach anywhere I, it's like on in windows in this plan, long time for a vile where they say okay, you know, like each component ate its own mark so lets you know when once one components comes a bit more, the other guy can still on finite, and it just didn't work I like today. This, like one global mark, free and lets it dry, I.

A

Mean to be fair, my biggest concern is also they about the maintainability on our side, because if we would have an internal static thing somewhere, well suddenly have to deal with either like internal contracts or some other way to inject this thing, and then, like god forbid, we want to actually Persian these things independently again and then you know we break the api's and happens and I think that yeah, if we don't believe it has any video I, wouldn't go on a complexity. I just called it off, because I mean that what.

C

Would you know like one thing about the diagnosis but I think it would be super available surface which in the buffer that busy terms of the caching, so it would hello what what it to do? If you know somebody is like complex system, they bet on the buffer pool. Like four other reason, and now they are seen beard gracious, hey, how do they say?

C

Okay, see the buffer pool, or is it like one of those out of 10 things right so nice having guests page that says you know, I know buffer pool crestor that you know I think it's a very good program. We should do it. Do we have that I yesterday? It needs to be kind of you know. Configurable from dogs, I have something yeah. It's.

B

Basically turned off african change it to be like GC.

C

Left there we go the first step to come under up to half making marked out I, know the bell. Then we.

B

Could even make it on the kind of like a rental basis? No, no. You turn.

H

B

Off no brands disappeared, you're.

D

Just talking about making return a no-op right.

B

Yeah, you know the device disappear. Now you like, okay, which component is screwing up to you, hey exactly.

C

That's kind of the next step, but then filling the gaps multicare.

E

So it's like you have the hypothesis that may be the buffer pool is the cause of the weirdness. You turn it off and the weirdness goes away, and now you know to look for my bad, but not.

C

They present a a Gandhi that you know if you turned off and the garage goes have a buffer pool. But it's like strong indication that blue right right and that.

D

Point maybe you'd enter on the ECW events that we have and you correlate them with your other operations and owe.

A

You a happy event by the way for the buffers or.

B

Is it something.

G

Some canoodling you remind us what what are the events Africa? We have the rentals returns. If you have some twenty one of those exhaust and give allocate, we.

B

Have the tool that could analyze the traces and discover when this return after rent food certainly is a pattern where we basically rent.

D

B

D

Certainly update like add to perf you to do that and you can. You can see the events today and / few, but there's no analysis, I think.

G

There's a correlation I need the tune, rights and returns, so you can correlate a rental ID with return ID absolute.

B

You know what I meant is like. Basically, when you, when you have the threading issue, I, think, potentially we would return twice or we would nah I'm, not sure how we would all you can see if.

G

You can do.

B

Post-Processing manually, because with.

G

The HW events inside code using a trace listener because we give a unique ID, /, / actual buffer instance. So you can actually track you to buffer instance and see if it was returned twice arrested, twice: yeah.

D

Right or see if it was rented while like before it was returned or whatever yeah.

B

Well, that one is but I think I was hoping that we can discover day saying the async case is making a use-after-free exact.

C

So to do diagnostics you can do for dead. One is to fill the thing with unique pattern on return and the new house want to check it out. You verify that is that, but instead to let impact right, that's kind of you know the classic Malik free kind of you know. Private guide.

B

Yeah I wonder whether we should invest in thinking in doing more of something like this diagnostics is just it lads. You know it adds cost it.

C

You know it needs to be kind of optionally, the same way as smartly diagnostic is optional, but there is to be a way we can train on, ideally to config files, so that you can just like oh right.

D

Or you expose an API like set diagnostic mode which allows it to be. You know, drop on return, fill with garbage on return whatever, and then someone can easily hook it up to whatever they want in their own code. To say like if I set, this environment variable call this method, yeah.

B

There's no way we can protect the memory to it. This would be a nice feature. Man.

C

B

Was like why I'm making.

C

With GC and it's light, it's kind of like steam, kind of guy sides, I think if you have to go there like PF a bigger provide. No, it's just. You know the fee that they kind of what it means that you know the kind of the complexity we have to invest input to deal with the solution. It's like Bay by more than like the kind of the problem benefit we are getting out of to solving a problem. Oh yeah, well,.

B

Since I don't know, I understand that it's way more costly than just implementing, you know an API on top of array, but I don't know maybe at some point we should think that kidding.

A

Me something like this, but everything I like team is anything more. You want to get out of that. Otherwise, you should quickly talk about the exception thing. I think.

D

We have our answer. Alright,.

A

So students admitted APR that fixed argument exception instances by using name of which was I think nobody Republic with that part, but he also changed some exceptions to throw derived exceptions instead, and there was a discussion of the prr 638 nine that when the teacher like whether we think that's compatible, that's incompatible, it's worth doing all of that. It was like a huge range of opinions, pretty much both extremes in the sexual, I would say from. We should never do this 20, it seems like say, but we shouldn't do it and 20.

A

I think we should just do it to just echo the concerns. I think one of the concerns was well. We had lived invaded by changing the exception types we throw out. We had a little value by changing the types to derive once people do before bed over us catch exceptions and that obviously change the behavior throw a different exception type. Let me clarify: I use their.

B

Own word: I said whether it's a compact problem I, it may be compatible. Em I, don't care about in this case. What I'm after is portability? Yes, so.

A

So basically, the idea is that when we talk about compatibility, that's the difference between a compiled against I yeah compiled against an older version of something or run against later version of that says. If you want to be to issue portability deals with two unrelated stacks, where you want to make assumptions that hold true on both sides right.

A

So if one sec drove the derived target, once you throw the base type and if you catch the drive type or you wanna catch it on the other side right, which is harder to reason about I would generally say for free, sorry, but.

C

That you can like once you know that I, let me can go fix it. I guess yes, so.

A

My I would say.

F

To me, in this case, you could because there there's a hierarchy going on some cases. It might not be true if you're completely different exception,.

B

F

You can go better.

B

You again kazar.

A

F

Like fuzzy put well.

A

I would generally say, that's also an incompatible changes because NS, if you want to be to issue to like I, think but I mean, if you throw it arrived bondage only consider compatible, but it has to go to teach you right now. So I think we should generally optimized for making a damn easy people to just write code in a way, and it happens to be portable so like they shouldn't have to figure this out in the perfect world.

A

But I also think for things that argument exceptions if you write catch entrance for that I would also say well. This is not something we should be the business optimizing for, because I'm really doing the wrong thing like you shouldn't catch any of those. If you really go down that path, yeah then I would say then you'll probably also have tried to write to catch exception. Right I mean that's.

B

Really a document that we don't want, you catching art, okay, so actually you know what, if, if we? Basically, if we want it to have the following stance, if it's one of those exceptions that you shouldn't be catch it like for you, sir charles yeah, my position is that it almost like the exception type, doesn't matter. The most important thing is that you have diagnostic information. You have you no good error message and so on and so on.

B

At that point, I'm, like I, don't care what exception typed me throw I will still want the guidance that I pushed before in this PR for the runtime errors like if there's an exception that we actually say yeah yet, like you know, file not found you.

C

B

Be catching I would not want to do what the pier are on. It originally was doing, which is throwing a exception. That is more derived than it some other platform, and you know we because that net core well doesn't we don't have lots of cases where that's already not the case, because we have different exception type between the petrol between dotnet framework and that, of course, and I d on it it.

B

So what I wanted to say is in the direction of that net court throws the more bass, let's derive deception, I think that's fine and the reason for it is that I think and that may be arbitrary, that that call should the gold standard like if I want to write portable cold. I think people should write to that net core and they would be like you know they will write code and they will get some exception. Exception is thrown and it's you know final, not found exception. They will be okay.

B

Let me let me catch the file not found, and this coach were conducted framework. um Nothing. Let's.

D

Not apply that every bug we fix and core absolutely must be fixed in da net framework yeah.

B

I mean you know, like I, don't know if I don't know whether I I would say as black and white I just say. You know like this there's a steady state line. We should kind of keep trying to get the code base to the steady state line like there's a gold standard, definite car I write code to it. Yes, of course, some things will not work on that that framework, but we shouldn't make it to be. We shouldn't make it worse unless we have a very strong I.

E

Feel like this isn't even close to like the worst thing that you'd have to deal with like in terms of like things that are not that are not guaranteed by compilation like so we've always kind of taken. This, like wishy-washy stance really with portability like exceptions, are interesting because they're like they could be in the signature but they're not but generally speaking, like you know all of this or rules that we have all the infrastructure.

E

The way that reference to some buddies are defying the entire framework for doing portability is based on, like mostly if you compile it works, but then you still gotta, run and test your code like Red, Bull and and we no guarantee and we can't we don't- have the means to statically guarantee.

E

You know that, because you could you could you have the potential to run their won't Whoopi bugs and we do fix just blame fixed bugs, sometimes and say: well, yeah I know, and you know, but if you go and run this ode against on a framework that doesn't have the bug fix well, you know you're still going to hit the bug, um and so you know, there's a spectrum here like I I feel like that that basically, this applies basically to all the non breaking changes in that document.

E

We're like one of the first ones is like throwing a derived. Exception is okay, so I've historically taken the the model in my head is we can make behavioral non breaking changes as we've always sort of semi could make from one version to another, a platform we can make them in.net core and not necessarily fix them. We don't even have with the different cadent release. Cadence. We can't fix all the bugs altogether. Nor can we make any guarantees about that because not everyone will have deployed all the debug fixes. So I see this as like.

E

If it's a not behavioral change that moves in the direction of fixing a bug, that's a deemed a non-breaking change. Yes, there can be sort of edge case portability issues, but I, don't think that we should further restrict that set, which already is a small set of things. We're allowed to do ah based on this sort of well, there might be observable differences for a portable library, I think we should accept that.

E

That's the case and the way that you deal with those is you test your code at where you want to run, and sometimes there are core cases but I feel like they should be quarter cases if we did a good enough job describing what are the sort.

B

Of behavioral changes you're allowed to make, but it makes I would agree with you. You mentioned by fixing bugs I agree with you for fixing bugs I really do right, like we think we should be fixing bugs and if it results in portability, issues that can be mitigated me, like you know, yeah by default, if I wrote some code, it's not portable, but then I can change to something, and now it's possible or I'm all for it. That he's an IE reacted to this PR.

B

A bit is just it's also a combination that I didn't see a lot of fun. I like throwing a you know, argument a conception, not argumentnullexception I, don't consider it that back I mean, like you know, it's a it's. A nice aesthetic see shows that.

D

Wasn't the bus? The bug was that it's, the the parameters were completely wrong. Yeah.

B

Yeah, no! No! No, that one day in that one I did when I thought. You checked incorrect because I could.

D

Have all the ones that change to derive types? We did so because the wrong arguments were being passed to fix it. We would have had to add resources, so we could provide a message there. We could just throw the derive type, which already has a built-in message.

B

Okay, are you saying, because of now the cost of not doing this? You you didn't fix yet. But let me like okay here, we basically saying because of the cost. Now you didn't do the the.

D

I'm saying I, wasn't we weren't and to be clear, like I was resubmitting somebody else's fixed I'm, not taking credit for the facts, but we were. We were doing this to fix a bug.

E

Yeah, it's the right fix right. Okay, if we didn't have like in there was a bug- and this is the best fix like I- think that's that's. The best fix like you can argue like it's, it's it's limiting value, but if the code had been written correctly, it would the very fact that it just wants to pass a parameter name is indicative of the intent that I don't have me. It's not.

B

Like whatever so let let's discuss a bit of you know like guidance and theoretical issue, not the specific one. What I wanted to say is, let's say the bug was somebody or the bag or the issue. Somebody file was oh, it's throwing argument exception and it should be throwing argumentnullexception. There are no issues with messages or anything. It's just you know. Taste, we can type I mean a exception type. I would say.

B

The value of this change is so small that the negative impact on portability I feel like it's more important, for the exceptions that you know, sifu should be catching further out in front of your such exceptions. As I said: I kind of don't care. It's you know exception message is the most important thing over there to be clear. This TR there are no exceptions, change there were no I yeah I I. That therefore I know that we just you know now that somebody pointed it out.

B

I'm yeah, I, agree I, so you, finally adding the original bug, fixes yeah I'm fine with this one and in general, I'm. Fine with the guidance justice says that, basically, if it's a usage error and it's in a in a you, know, compatible change, we don't care about portability of the solution in catching goodness great. They, though,.

A

It's like compatibility. The one stands we've also taken in the past, which was less of a yeah less of an argument from construction wall of an argument from reality is that we said like. We cannot make everything portable considering the world we live in, that you have to sometimes evolve an API that by contracts that this API will always work and relax the rules to say this API may work. So we basically said well, if you have these cases, let me give you new API.

A

Is that will indicate you whether the operation is supporting you're expected to call this?

A

So essentially, we are weakening our guarantees in order to optimize for each, and so we said well from our point of view, there's no, that we cannot build a system where you can write code that will be portable by construction in all cases and all the cases that you will after the fact, if to go back to your component and be aware of the fact that you may run in the context that doesn't support X or Y and we set our bar, is you want to design api's and evolve for existing ap is to make it so that you can write for the book code?

A

And sometimes that means you have to change your code and you know take into consideration that things that used to always work in all may fail in various ways. It would see changing the exception. Types are more or less in the same spirit, because sometimes you may be may add new exception type, so that that you also have to handle. Sometimes we may not and I, think I get you a point of like we shouldn't arbitrarily make changes for cosmetics which I bye, but I.

A

Think we should also be very careful that we don't claim that we, you know, try to get something. That is completely unrealistic.

B

Ii know I already said that, like important bility, you know I right go to the gold standard. I I should test it on all platforms, yes I, but there should be the least number of land mines that we put. Okay, yes in the system. Therefore, if it's an exception, that is something that people should be catching I think the default should be I would prefer that God's standard to throw the exception. That is that you know the common denominator. The denominator exceptional bring the partial from this role.

B

In some cases I, you know like I, think it's also fine, it's just as a rule of thumb, I think it's a good rule. So we hurry we're going to put back the fixes all right because they are because they are you suggesting I would say the main reason is they are you such exceptions? Okay? Well, they should be, nobody should be able to handle them. Therefore, the issue of you know portability for exception. Handler is none issue. Okay,.

E

And now another case where this has come up in the past deserve been some bad api's implementations that through either argument exception, but you have to catch it or through exception, and you have to catch it or application, something so generic, and yet you had to catch it and in the past, between da net framework versions, we have actually fixed those, as as in order to allow the competence or mindful developer, to catch something more reasonable than the would we consider those changes in tonic or considering that we've even made them between da net framework versions.

E

I would want to say yes like I think we shouldn't just change exception types cuz we can, but I think the closet says that we can is useful in some specific scenarios. One of them is we screwed up, and through this exception, it's like you're not supposed to catch. That like, like you know it's so generic that, like it's useless, we should at least throw something meaningful. um We've I think we should still be allowed to do.

B

That also, but I think, is the example brigade- is there a difference between frameworks in what exceptions they throw versions? Yes, we have done that in the past and.

A

The nut versions.

B

Between, let's call them murray disks or platforms, my.

E

Yes, that almost certainly there are, but I don't know I don't- have the data. I had the link that I point to actually gave an example where we made it drive like culture not found, instead of just saying arguing exception, because you can't know if the culture is going to be found. So you shouldn't catch argument exception, which is what you have to do and got it three or so five or something, and then in 40 we fixed it but they're even worse. Examples are places in the bloody framework to throw exception. The base class.

B

No, no, but incorrectly you're talking about just like it changes whether they're, compatible or not. I completely agree changing to ASAP tide is a compatible change. We should be doing those what I they think that previously will discuss the portability should to me. It's like the dotnet card should not be eating for rock type Drive.

F

Type and a well is as long as you can write poor bugger. I don't think it matters one side or the other side, but if you think you're doing the right thing, we should just do it. Yeah, and you know if there's a value.

B

Like you disk now, you're describing cases that, like the value, is so much higher because well you know we now throw very generic exception and there's no good way to handle it without some complicated filters and possibly is running code yeah. You know the value is high, should go here.

A

We did it by design is actually comment or or when a team from a particular.

A

So we said instead of slow and calm exception, we throw exception that sets the error code so that, if we give the new error code shows up, we can project it to basically a different exception at some point, which case the error message, if you get probably is pretty shitty I mean whatever, like Windows, provides given the error code, lookup mechanism, that it's the error, message that the exception will have, but you don't have to catch exception and ask for the error code.

A

The future version may be able to say catch in a file not found exception or whatever they close. It is to be ad and I. Think that's generally good. um I would also say, as Nick try to hinders that. Well, if you consider something compatible between framework versions, that should be good enough for portability too, because I mean like it is the most conservative compared bar that we have, and it is.

B

One of the biggest problems on had I agree I, look at that compatibility between the versions. If you want portability between versions, you probably want to write your code to the previous version and hope that it will run on the then you were not the other way when we lead in that net car with exceptions, more derived, reality a situation we telling people if you want to write, compare a particle called write it to the new we're kind of the newer version, and then you know sceles no.

E

There's no it's hard to say what's new and different when they have different cadences, but but I I think, like I, think here's the summary it's like all of those behavioral changes that we tolerate that can cause problems for import ability that we tolerate. They all. Have this one caveat which is like we don't do this just cuz right. So here we have a case like the message exception. Messages were wrong. So now one of the tools at our disposal is among these behavioral changes.

E

I think all these behavioral changes are, or should be, should be, should be like I, don't think we shop, it's not going to work to have a set of things you can do between versions, but you can't do them in.net course too hard like this. These are behavioral. Changes are like it's. Basically, you can't like.

E

This is a list of things that are that are yes, you can come up with ways that it doesn't work, but fundamentally they are maneuvers at your disposal, but they all come with the basic thing that says they all carry some risk of the these portability problems or like really bad code, taking a dependency on them, and so we don't just do them like for it. But when something comes up, there's a bug: there is an exception. That's really really too general. There's some some impetus to do it.

E

Then you know these are the maneuvers that you're allowed to do. I. Think that's easier to reason about then to sort of like you know. You know to say you know you, you know, make special rules about about usage exceptions or, like I don't know, I think it's like I.

B

Kind of I tend to agree with you. Basically, a.

B

We shouldn't a sacrifice: portability, there's not a lot of value for the further tight and when I saw the pr I didn't initially look I didn't take into consideration that the resources think that you guys mentioned I just saw a change from argument exception. Argumentnullexception me, the value of doing the the value of this is close to zero and I'm like for a value of close to zero. We are, you know, making portability a bit more complicated. That's why I!

B

But if you know I agree if there is a value, if you fixing a bag, if you're improving the way that you know now, we prepare a genetic exception and that you literally cannot handle in a reasonable way. If, if there is value, yes, you should be able to do those so.

A

Summary is we don't have to change your guidance? The guidance that we have right now, which is seven ma drive type, is compatible. Is fine the guidance because there's Nick point out everything we do is more or less case by case I mean we view every change and sometimes even compatible changes. We don't think are worth it right. I mean so that I think that that would, I would just leave it as their dad 00.

E

Make call those out like they're compatible because we redefine the most compatible but like someone else's definition of compatible could make them incompatible right. So that's why that's why we don't just do them right. It's.

B

Not like I want a denote that, because, basically, the guidance that we have today is all about compatibility. I would say some of these changes also have impact on portability and.

C

B

Value should be, you know, should be proportional to the cause. You.

E

Got every one of those horrible behavioral changes, acceptable. Behavioral changes have portability consequences because they're generally there to make things better in some way like to fix a problem that house in a previous version and to give you out to fix those problems and if you fix problems in one version, but you want to run on the version without the fix. You're gonna have exactly the you're. Gonna have exactly the portability problem. Yeah.

A

I mean like a very simple example right, adding an API. We consider compatible change. Well, does it have portability issues? Yes, because you could have ports of things it doesn't have. The age now is.

I

Modeled by the system, though, find that compilers and the reference.

E

Assemblies love. What.

A

To a degree right I mean but I mean, like the my point, is that I think there's a difference that it's just so different dimensions by there's portability and there is compatibility right and I mean for don't echo. We try to do both every to be with. We try to say this is the foundation, for you know future skews that are basically composed off. Of that echo we want to be.

A

You know compatible with you know within that ecosys was a foreigner ecosystem, but we also two came up portability and compatibility between Donna Cohen, full member right, and that is I think a dance that is case by case because they can just take the stand and say we will be compatible in all cases, because we just can't just based on timeline but also shouldn't make arbitrary changes, which is why I think I I, don't think there's much.

A

You can do put the guidance but I'm a few pieces of media PR and change diverting in the way you see fit, but I think the getaway the document is written right now is I. Think the headline is it just as acceptable? Behavior changes and I mean to me it is acceptable, but you know maybe worth what equality for that all.

B

E

So we revert the river right yep.

A

Revert the pervert great line. Alright, then thanks guys online and then see you later all right. Thank.

D