How about some sort of Foreign Object, which contains (among other instance
variables) a block of unorganized storage of a size fixed at creation time.
Create it with links back to the main system dictionary so it can only be
deleted "manually", not by the GC.  Then foreign functions can do whatever they
want as long as it's done inside the raw memory contained in the object.  The
only corruption of object memory will occur if you run out of it - not by
objects disappearing and the foreign function writing all over a new object at
the same address.  You'll still need some sort of cooperation with the external
accessor, but not quite as much.

"Raab, Andreas" wrote:

> > Gruess Gott!  This sounds very cool.  I had a thought though.
> > Why don't we split the job between 2 VMs, with some shared
> > memory, and let theother VM be the one that crashes.
> > Be able to detect and log it, and restart another VM.
> > Flag that call as disabled and keep going?
>
> Interesting idea. There are a couple of problems with it though. The biggest
> problem is that Squeaks object memory can be corrupted by calls to external
> functions. There is no way to check this and the effect is not immediate
> (e.g., usually the system will crash at the next garbage collection and this
> may be *way* after you've actually done the bad stuff). Thus, you would
> basically need to clone the entire image for each call (ouch) until you know
> it's in a stable state again. And not only the image - it can be similarily
> bad if you corrupt any VM state so you'd basically have to clone the entire
> process (e.g., VM+image). A little too much work just for calling some
> function ;-)
>
>   Andreas