1. Extending Type Systems in a Library Yuriy Solodkyy Jaakko Järvi Esam Mlaih

2. 22 October 2006 Texas A&M University 2 Motivation l Type systems are good for you! –make sure certain bugs never appear –better optimizations l Type systems of a general purpose programming language are typically not extensible –a fixed part of a compiler l There are many domain specific type systems

3. 22 October 2006 Texas A&M University 3 Use cases l Physical quantities l Types to track some semantic properties: –nullability, sign, oddity of a number –security vulnerability to format strings –usage of user pointers in kernel space –deadlocks and data races l Regular Expression Types

4. 22 October 2006 Texas A&M University 4 Goal l Explore how far a pure library solution suffices to extending a type system

5. 22 October 2006 Texas A&M University 5 Contributions l We report on implementing simple type qualifiers as a C++ library l We implement regular expression types (in a limited form) to check XML data l We provide a framework to help others in extending the C++ type system for their abstractions

6. 22 October 2006 Texas A&M University 6 Example // a is a positive value double a = current_height(); // b is a positive value double b = max_allowed_height(); // b-a may be negative though! Result is always positive double c = std::sqrt(b-a); // b+a is assumed to be positive. Unless there is bug! double d = std::sqrt(b+a); returns only positive numbers upper bound for values from previous call difference is positive, but not for type system argument and result are always positive

7. 22 October 2006 Texas A&M University 7 What do we need? l Typing rules l Evaluation rules l Subtyping rules

8. 22 October 2006 Texas A&M University 8 How do we achieve that in C++? l Typing rules –Type construction via class templates l Evaluation rules –Function templates and overloading l Subtyping rules –A dedicated meta-function

9. 22 October 2006 Texas A&M University 9 Useful building blocks l Typing rules –tuple, variant, optional l Evaluation rules –enable_if l Subtyping rules –MPL l Interoperability of the above libraries!

10. 22 October 2006 Texas A&M University 10 Type qualifiers l Allow tracking of semantic properties like: –immutability of a certain value (const) –sign of a number (pos, neg) –assumptions about pointers (optional, nonnull) –trustworthiness of a certain value (tainted, untainted) –oddity of a number (odd, even) –origin of a pointer (user, kernel)

11. 22 October 2006 Texas A&M University 11 Example: Qualifiers’ Hello World #include DECLARE_NEGATIVE_QUALIFIER(pos); DECLARE_POSITIVE_QUALIFIER(tainted); //... Other qualifiers... namespace xtl { template <> struct minus { typedef qual type; }; template <> struct mul { typedef qual type; }; template <> struct div { typedef qual type;}; } // of namespace xtl int main() { untainted > > a(-42); pos > > b(7); neg > c = a * b; // OK: drop negative qualifier untainted //nonnull > d = b - a; // Error: nonnull isn’t carried by - pos > e = b + a*c; // OK to add positive qualifier //pos f = e; // Error:... but not OK to drop it! } Declare few qualifiers: Q is positive if T <: Q T Q is negative if Q T <: T Define how different operations transfer properties Declare your variables with appropriate properties Multiplication carries nonnull & negativeness on pos & neg arguments Subtraction does not carry nonnull Positive qualifiers can be added to result type...... but not dropped once they are there!

12. 22 October 2006 Texas A&M University 12 Example // Example definition that accepts only positive doubles template typename enable_if< typename is_subtype >::type, void >::type descend(const U& altitude) { pos a = subtype_cast >(altitude); //... }; // Data coming from measurements is marked untainted extern pos > get_corridor_height(); untainted > a = get_corridor_height(); descend(a); // no negative altitudes here! function descend accepts only positive numbers we achieve this by restricting its argument type to be a subtype of pos we convert value of a subtype into a value of a supertype returns a value that is both: positive and untainted a can hold positive, untainted values. order of qualifiers is not important! no negative altitudes can appear here!

13. 22 October 2006 Texas A&M University 13 Qualifiers summary l Easy to define and use l Cannot handle flow-sensitive qualifiers l Cannot handle arbitrary reference qualifiers (e.g. aliasing related)

14. 22 October 2006 Texas A&M University 14 Type system for XML l Types can describe XML elements with certain structure l Subtyping describes structurally more powerful types l Compile-time assurance that only valid XML documents are produced l Value-preserving type conversions

15. 22 October 2006 Texas A&M University 15 typedef element XMLname; typedef element XMLemail; typedef element XMLicq; typedef element<contact, boost::variant< XMLemail, XMLicq > > XMLcontact; typedef element<person, fusion::tuple< XMLname, XMLcontact > > XMLperson; XML Schema’s choice is mapped to Boost variant back references are mapped to previous typedefs we map XML data types into C++ types for each tag we create a dedicated tag-type Example XML SchemaC++ for each tag we create a dedicated tag-type we map XML data types into C++ types back references are mapped to previous typedefs XML Schema’s sequence is mapped to Fusion’s tuple XML Schema’s choice is mapped to Boost variant we use a dedicated type element to represent XML elements

16. 22 October 2006 Texas A&M University 16 Example //... typedef variant AnyContact; typedef element > Person; typedef element > PersonEx; int main() { Person p(make_tuple(Name("Yuriy"), Tel("555-4321"), ICQ(1234))); PersonEx x = p; // OK: Subtyping conversion // p = x; // ERROR: Not in subtyping relation ifstream xml("old-person.xml"); xml >> x; // read data from XML file. assumes file exist cout << x << endl; // show XML source on the screen } Tel <: AnyContactICQ <: AnyContact Name, Tel, ICQ <: Name, AnyContact, AnyContact Person <: PersonEx Instantiate an XML snippet that corresponds to Person type Person <: PersonEx Assignment involves subtype conversion PersonEx is not a subtype of Person Parses only XML files that correspond to PersonEx schema Produces XML source on the screen

17. 22 October 2006 Texas A&M University 17 XDuce l Type –set of sequences over a certain domain l Regular Expression Types –concatenation : A,B –alternation : A|B –repetition : A* –optional : A? –type construction : l[A] –recursion : X = A,X | ø l Subtyping –inclusion between the sets defined by types

18. 22 October 2006 Texas A&M University 18 C++ l Type –set of sequences over a certain domain l Regular Expression Types –concatenation : A,B tuple –alternation : A|B variant –repetition : A* vector –optional : A? optional –type construction : l[A] element –recursion : X = A,X | ø – l Subtyping –is_subtype and subtype_cast

19. 22 October 2006 Texas A&M University 19 XTL – eXtensible Typing Library l Provides a common interface for defining custom subtyping relation l Provides a common interface for defining conversion from a subtype to a supertype l Provides some ready definitions that can be used in defining other type systems: –subtyping of array types –subtyping of function types –subtyping of sequences and union types –subtyping of qualified types

20. 22 October 2006 Texas A&M University 20 Limitations l Reflexivity of subtyping relation has to be stated manually for each new type. l No implicit transitivity of subtyping relation. Meta-function join may return an arbitrary upper bound.

21. 22 October 2006 Texas A&M University 21 Future work l Look at applying our approach to ownership types l Look at alternative representations of type qualifiers l Extend subtyping of repetitions l Create a library of useful type qualifiers

22. 22 October 2006 Texas A&M University 22 Thank You! Questions?