  The OCaml language comes with a facility for interfacing with C code -- the
Foreign Function Interface or FFI. The primitives for working with the OCaml
runtime -- and, in particular, with the garbage collector (GC) -- strive for a
minimal overhead: they avoid unnecessary work and allow for calls to C code to
be very cheap. But they are also hard to use properly. Satisfying the GC
invariants leads to counter-intuitive C code and there are hardly any safety
checks to warn the developer. In this work, we explore two complementary
approaches to mitigate these issues. First, simply adding an indirection to the
API manipulating OCaml values let us write safer code amenable to optional
runtime tests that assert proper use of the API. Second, a notion of region for
tracking lifetimes of OCaml values on C side let us trade some performance for
simpler code.
