Previously, typestate was initializing the init constraint for
a declared-but-not-initialized variable (like x in "let x;") to False,
but other constraints to Don't-know. This led to over-lenient results
when a variable was used before declaration (see the included test
case). Now, everything gets initialized to False in the prestate/poststate-
finding phase, and Don't-know should only be used in pre/postconditions.
This aspect of the algorithm really needs formalization (just on paper),
but for now, this closes#700
The logic for how the "returns" constraint was handled was always
dodgy, for reasons explained in the comments I added to
auxiliary::fn_info in this commit. Fixed it by adding distinct
"returns" and "diverges" constraints for each function, which
are both handled positively (that is: for a ! function, the
"diverges" constraint must be true on every exit path; for
any other function, the "returns" constraint must be true
on every exit path).
Closes#779
You can now say
let {bcx, val} = some_result_returner();
Similar for loop variables. Assigning to such variables is not safe
yet. Function arguments also remain a TODO.
To handle multiple-LHS declarations with initializers properly,
I changed seq_states to take a list of expressions paired with optional
names, not just a list of expressions. Then, the same logic that handles
ordered lists of subexpressions everywhere else can handle multi-
declarations.
There are still things not handled properly: relying on other preconditions
of upvars is likely to cause bad things to happen. We probably want to
disallow it.
This adds parser support and most of the machinery for
auto x = 10, y = 20;
However, the above still goes wrong somewhere in typestate, causing
the state checker to believe only the last variable in the list is
initialized after the statement.
Tim, if you have a moment, could you go over the changes to the tstate
code in this patch and see where I'm going wrong?
Multi-var-decls without the typestate extension
Add a loop
Programs with constrained types now parse and typecheck, but
typestate doesn't check them specially, so the one relevant test
case so far is XFAILed.
Also rewrote all of the constraint-related data structures in the
process (again), for some reason. I got rid of a superfluous
data structure in the context that was mapping front-end constraints
to resolved constraints, instead handling constraints in the same
way in which everything else gets resolved.
Assignments and moves with a simple local variable reference on the
RHS now propagate any typestate constraints the RHS was involved
in to the LHS. Swaps where both sides are local variables
exchange the constraints.
This was a pain in the butt and I'm still not proud of the resulting
code. Needs refactoring like whoa.
src/comp/syntax is currently just a sub-module of rustc, but it will,
in the near future, be its own crate. This includes:
- The AST data structure
- The parser
- The pretty-printer
- Visit, walk, and fold
- The syntax extension system
- Some utility stuff that should be in the stdlib*
*) Stdlib extensions currently require a snapshot before they can be
used, and the win build is very broken right now. This is temporary
and will be cleaned up when one of those problems goes away.
A lot of code was moved by this patch, mostly towards a more organized
layout. Some package paths did get longer, and I guess the new layout
will take some getting used to. Sorry about that!
Please try not to re-introduce any dependencies in syntax/ on any of
the other src/comp/ subdirs.
Modify typestate to check for unused variables and emit warnings
where relevant. This exposed a (previously harmless) bug in
collect_locals where outer functions had bit-vector entries
for init constraints for variables declared in their inner
nested functions. Fixing that required changing collect_locals to
use visit instead of walk -- probably a good thing anyway.
Implement "claim" (issue #14), which is a version of "check" that
doesn't really do the check at runtime. It's an unsafe feature.
The new flag --check-claims turns claims into checks automatically --
but it's off by default, so by default, the assertion in a claim
doesn't execute at runtime.
Wrote some small test cases that use while loops and moves, to
make sure the poststate for the loop body gets propagated into the
new prestate and deinitialization gets reflected.
Along with that, rewrite the code for intersecting states. I still
find it dodgy, but I guess I'll continue trying to add more tests.
Also, I'll probably feel better about it once I start formalizing
the algorithm.
This will probably need more work, as moving doesn't appear to do
quite the right thing yet in general, and we should also check
somewhere that we're not, for example, moving out the content out of
an immutable field (probably moving out of fields is not okay in
general).
Non-copyability is not enforced yet, and something is still flaky with
dropping of the internal value, so don't actually use them yet. I'm
merging this in so that I don't have to keep merging against new
patches.
Modified typestate to throw away any constraints mentioning a
variable on the LHS of an assignment, recv, assign_op, or on
either side of a swap.
Some code cleanup as well.
typestate now drops constraints correctly in the post-state of
a move expression or a declaration whose op is a move. It doesn't
yet drop constraints mentioning variables that get updated.
To do this, I had to change typestate to use trit-vectors instead
of bit-vectors, because for every constraint, there are three
possible values: known-to-be-false (e.g. after x <- y, init(y) is
known-to-be-false), known-to-be-true, and unknown. Before, we
conflated known-to-be-false with unknown. But move requires them
to be treated differently. Consider:
(program a)
(a1) x = 1;
(a2) y <- x;
(a3) log x;
(program b)
(b1) x = 1;
(b2) y <- z;
(b3) log x;
With only two values, the postcondition of statement a2 for
constraint init(x) is the same as that of b2: 0. But in (a2)'s
postcondition, init(x) *must* be false, but in (b2)'s condition,
it's just whatever it was in the postcondition of the preceding statement.
This involved, in part, changing the ast::def type so that a def_fn
has a "purity" field. This lets the typechecker determine whether
functions defined in other crates are pure.
It also required updating some error messages in tests. As a test
for cross-crate constrained functions, I added a safe_slice function
to std::str (slice(), with one of the asserts replaced with a
function precondition) and some test cases (various versions of
fn-constraint.rs) that call it. Also, I changed "fn" to "pred" for
some of the boolean functions in std::uint.
This reduces some redundancy in the AST data structures and cruft in
the code that works with them. To get a def_id from a node_id, apply
ast::local_def, which adds the local crate_num to the given node_id.
Most code only deals with crate-local node_ids, and won't have to
create def_ids at all.
Revert "rustc: Export only what's needed from middle::ty"
This reverts commit 4255d58aa5.
Revert "rustc: Make name resolution errors less fatal"
This reverts commit b8ab9ea89c.
Revert "rustc: Make import resolution errors less fatal"
This reverts commit 92a8ae94b9.
Revert "rustc: Export only what's used from middle::resolve"
This reverts commit 4539a2cf7a.
Revert "rustc: Re-introduce session.span_err, session.err"
This reverts commit 7fe9a88e31.
Revert "rustc: Rename session.span_err -> span_fatal, err -> fatal"
This reverts commit c394a7f49a.
With the changing of receive semantics the parser has been putting the rhs
expression in the first argument of expr_recv and the lhs in the second, and
all subsequent passes have been referring to them backwords (but still doing
the right thing because they were assuming that lhs was the port and rhs was
the receiver).
This makes all code agree on what lhs and rhs mean for receive expressions.
I noticed that typestate was being lazier than it should be,
because it was only checking typestate for statements and
top-level expression (that is, the expression in a stmt_expr, but
not any subexpressions). So I rewrote the checks in tstate/ck.rs
to use walk, which exposed a few bugs in typestate that I fixed.
Also added some more test cases for if-check.
Most of the fields in an AST item were present in all variants. Things
could be simplified considerably by putting them in the rec rather
than in the variant tags.
I added a "resolved" version of the ast::constr type -- ty::constr_def
-- that has a def_id field instead of an ann_field. This is more
consistent with other types and eliminates some checking.
Incidentally, I removed the def_map argument to the top-level function
in middle::alias, since the ty::ctxt already has a def_map field.
Since the decl in a for or for-each loop must always be a local
decl, I changed the AST to express this. Fewer potential match
failures and "the impossible happened" error messages = yay!
Generate appropriate constraints for calls to functions with
preconditions, and reject calls where those constraints don't
hold true in the prestate.
...by which I mean that it works for one test case :-)
Changed function types to include a list of constraints. Added
code for parsing and pretty-printing constraints. This necessitated
splitting pprust into two files (pprust and ppaux) to break a
circulate dependency, as ty_to_str now needs to print out constraints,
which may include literals, but pprust depended on ty.
A non-returning call should have a postcondition in which all predicates
are true -- not just a poststate. Otherwise, alt expressions where
one or more branches terminate in a non-returning call and others
initialize a variable get rejected.
Includes a test case.
* Non-returning calls should set all predicates to be true, not
just the "this function returns" predicate
* Fixed a bug in the expr_alt case in tstate.states that wasn't updating
the changed flag properly, then fixed *another* bug that was updating
it too enthusiastically, but was masked by the first bug.
Change ty_fn to have a controlflow field. A 'controlflow' is
essentially a bit of data that says whether or not this function
never returns to the caller (if it never returns, that means it calls
"fail" or another "never-returns" function on every control path).
Also add syntax for annotating functions that never return:
fn foo() -> ! {
fail;
}
for example. Functions marked with ! implicitly have a result type of
ty_bot, which is a new type that this commit also adds.
