hylo icon indicating copy to clipboard operation
hylo copied to clipboard

Soundness bug in inout accessor

Open seanbaxter opened this issue 1 year ago • 14 comments
trafficstars

public type Foo : Deinitializable {

  public memberwise init

  public subscript(_ arg: let Int): Int {
    inout {
      yield arg; // Why is this allowed?
    }
  }
}

public fun main() {
  var a = Foo()

  let i = 101;

  // Gain a mutable reference to i.
  inout d = &a[i]

  // Read through i:
  print(i)

  // Mutate through d:
  &d = 102;

  // Exclusivity violation:
  // we can name i while there's a live mutable reference (d) to it.
  print(i)
}

Is this an exclusivity violation? I can load from i while modifying it through an alias d. If I make the subscript parameter inout and call the subscript like &a[&i] the compiler gives the "illegal mutable access" error on the first print statement, as expected.

Can I ask what the lifetime semantics are on the reference returned through the subscript ramp function? What are the constraints on the caller and callee that trigger "illegal mutable access" and "illegal immutable access" errors? Since you're returning a reference from a function, I would think, as with Rust, it's putting constraints on the arguments of the function call. I'm guessing it's constraining the lifetime on the return reference to the same lifetime that constrains all the argument references.

seanbaxter avatar Oct 06 '24 00:10 seanbaxter