κDOT: scaling DOT with mutation and constructors

Self Cite

The Dependent Object Types (DOT) calculus aims to formalize the Scala programming language with a focus on path-dependent types -types such as x .a 1 . . . a n .T that depend on the runtime value of a path x .a 1 . . . a n to an object. Unfortunately, existing formulations of DOT can model only types of the form x .A which depend on variables rather than general paths. This restriction makes it impossible to model nested module dependencies. Nesting small components inside larger ones is a necessary ingredient of a modular, scalable language. DOT's variable restriction thus undermines its ability to fully formalize a variety of programming-language features including Scala's module system, family polymorphism, and covariant specialization.This paper presents the pDOT calculus, which generalizes DOT to support types that depend on paths of arbitrary length, as well as singleton types to track path equality. We show that naive approaches to add paths to DOT make it inherently unsound, and present necessary conditions for such a calculus to be sound. We discuss the key changes necessary to adapt the techniques of the DOT soundness proofs so that they can be applied to pDOT. Our paper comes with a Coq-mechanized type-safety proof of pDOT. With support for paths of arbitrary length, pDOT can realize DOT's full potential for formalizing Scala-like calculi.

Section: Recursion Eliminationmentioning

confidence: 99%

Section: Recursion Eliminationmentioning

confidence: 99%

A path to DOT: formalizing fully path-dependent types

Rapoport

Lhoták

2019

Self Cite

“…To address these issues more rigorously, the compiler of the new Scala 3 language (called Dotty) has been designed hand in hand with a new foundational type system Ð the Dependent Object Types (DOT) calculus. This development led to a number of increasingly expressive versions of DOT and type soundness proofs thereof Kabir and Lhoták 2018;Rapoport et al 2017;Rapoport and Lhoták 2016;, culminating in the pDOT calculus [Rapoport and Lhoták 2019], and has helped to fix various soundness bugs in Scala 3 .…”

Section: Introductionmentioning

confidence: 99%

Scala step-by-step: soundness for DOT with step-indexed logical relations in Iris

Giarrusso

Stefanesco

Timany

et al. 2020

The metatheory of Scala's core type system Ð the Dependent Object Types (DOT) calculus Ð is hard to extend, like the metatheory of other type systems combining subtyping and dependent types. Soundness of important Scala features therefore remains an open problem in theory and in practice. To address some of these problems, we use a semantics-first approach to develop a logical relations model for a new version of DOT, called guarded DOT (gDOT). Our logical relations model makes use of an abstract form of step-indexing, as supported by the Iris framework, to model various forms of recursion in gDOT. To demonstrate the expressiveness of gDOT, we show that it handles Scala examples that could not be handled by previous versions of DOT, and prove using our logical relations model that gDOT provides the desired data abstraction. The gDOT type system, its semantic model, its soundness proofs, and all examples in the paper have been mechanized in Coq.

ιDOT: a DOT calculus with object initialization

Kabir

Lhoták

2020

The Dependent Object Types (DOT) calculus serves as a foundation of the Scala programming language, with a machine-verified soundness proof. However, Scala's type system has been shown to be unsound due to null references, which are used as default values of fields of objects before they have been initialized. This paper proposes ιDOT, an extension of DOT for ensuring safe initialization of objects. DOT was previously extended to κDOT with the addition of mutable fields and constructors. To κDOT, ιDOT adds an initialization effect system that statically prevents the possibility of reading a null reference from an uninitialized object. To design ιDOT, we have reformulated the Freedom Before Commitment object initialization scheme in terms of disjoint subheaps to make it easier to formalize in an effect system and prove sound. Soundness of ιDOT depends on the interplay of three systems of rules: a type system close to that of DOT, an effect system to ensure definite assignment of fields in each constructor, and an initialization system that tracks the initialization status of objects in a stack of subheaps. We have proven the overall system sound and verified the soundness proof using the Coq proof assistant.