Explain MemorySegment and Arena, and how an Arena gives off-heap memory a safe, deterministic lifetime.

## Starting from zero: what is off-heap memory? Normally Java objects live on the **heap**, and the **garbage collector (GC)** decides when to free them. **Off-heap memory** is memory the JVM gets from the operating system directly, *outside* the heap, that the GC does not own. You want it for big buffers, memory-mapped files, or data shared with native code. The challenge: if you free it too early you get a **use-after-free** crash; if you never free it you get a **memory leak**. The FFM API solves this with two cooperating types. ## MemorySegment — a *bounded* region A **`MemorySegment`** represents a contiguous block of memory. The crucial word is **bounded**: the segment carries its own **size** (and a base address). Every read/write is **bounds-checked** — if you try to read at an offset past the end, you get an `IndexOutOfBoundsException` rather than silently reading whatever bytes happen to be there. A segment can wrap on-heap memory (e.g. a Java array) or, more commonly here, off-heap memory. You read/write a segment with *layouts* (typed accessors), e.g.: ```java segment.set(ValueLayout.JAVA_INT, 0, 42); // write int 42 at byte offset 0 int x = segment.get(ValueLayout.JAVA_INT, 0); // read it back ``` `ValueLayout.JAVA_INT` says "interpret these bytes as a 4-byte int". ## Arena — who controls the *lifetime* A **`MemorySegment` does not free itself.** Its **lifetime** — the moment it becomes valid and the moment it becomes invalid — is owned by an **`Arena`**. You allocate from an arena: ```java try (Arena arena = Arena.ofConfined()) { MemorySegment seg = arena.allocate(100); // 100 bytes off-heap seg.set(ValueLayout.JAVA_INT, 0, 7); // ... use seg ... } // <-- arena.close() runs here: ALL segments from this arena are freed NOW ``` Because `Arena` is `AutoCloseable`, the **try-with-resources** block calls `close()` automatically at the end. Closing the arena **deterministically** frees every segment allocated from it — at a precise point in your code, not "sometime later when the GC feels like it." ## The safety guarantee: temporal + spatial - **Spatial safety** (don't read outside the region) comes from the segment's bounds checking. - **Temporal safety** (don't read after it's freed) comes from the arena. After `close()`, the segments are invalidated; touching them throws `IllegalStateException` ("already closed"). So a **use-after-free** becomes a clean Java exception, never a JVM crash. This is the headline difference from `sun.misc.Unsafe`, which had *neither* guarantee — a wrong offset or a freed pointer would corrupt memory or crash the process. ## Arena flavors (the lifetime/access trade-offs) - **Confined** (`Arena.ofConfined()`): only the **thread that created it** may access its segments, and you must **explicitly close** it. Fastest, no synchronization. The common choice. - **Shared** (`Arena.ofShared()`): segments are accessible from **any thread**; close is coordinated so it's safe under concurrency (slightly more costly). Use when multiple threads touch the memory. - **Automatic** (`Arena.ofAuto()`): you don't close it; the segments are freed **by the GC** when no longer referenced. Convenient but gives up deterministic timing. - **Global** (`Arena.global()`): never closed, memory lives for the whole JVM — for truly permanent allocations. ## Confinement, briefly "Confined" means **thread-confined**: a confined arena's segments are bound to one thread. If another thread tries to access them, you get a `WrongThreadException`. This lets the JVM skip locking and guarantees no data races on close. ## Putting it together The pattern is always: pick an arena whose lifetime/access model fits your need → allocate segments from it → use them → let the arena close (try-with-resources for confined/shared, GC for automatic). Bounds checking (segment) + lifetime control + confinement (arena) = memory-safe off-heap programming.