A local ref's value stored in a tuple or passed to a local function changes when the ref is assigned later

Aberta
  • Algo errado?
#9,227 0 comentários 0 reações 0 responsáveis Ver no GitHub

Mantenedores costumam responder em até 1 dia

Ninguém assumiu esta issue ainda.

Avaliação

Dificuldade
4/5
Tempo estimado
3-5 dias
Facilidade para iniciantes
45/100
Tipo de issue
Bug
Clareza
Claramente especificada
Status de atividade
Ativa
Stack de tecnologia
javascript, ocaml
Domínio
compilers

Direção de pesquisa

Start by reading compiler/core/js_pass_flatten_and_mark_dead.ml around subst_map and mark_dead_code, then compare the local function path in compiler/core/js_pass_tailcall_inline.ml around subst and inline_call. Reproduce the tuple and local function examples in the issue and inspect the generated JavaScript. Done means values captured before a later assignment remain unchanged in both cases, with regression coverage for the reported cases.

Escrita pelo modelo de indexação a partir do texto da issue.

Descrição

When a local ref compiles to a JavaScript variable, a value read from it and stored in a tuple, record or variant, or passed to a local function that gets inlined, is later read from the variable itself. If the ref is assigned in between, the code gets the new value instead of the one that was stored or passed.

A tuple built from x.contents and taken apart after x := 2:

let f = () => {
  let x = ref(1)
  let t = (x.contents, "b")
  x := 2
  let (a, _) = t
  a
}
Console.log(f())

function f() {
  let x = 1;
  x = 2;
  return x;
}

This prints 2. a is the first element of t, which was built while x was 1, so it should print 1. The same happens with a record that has two or more fields and no mutable one, read as p.x, and with a constructor that has two or more payloads, taken apart with switch: {x: x.contents, label: "p"} and Pair(x.contents, "b") followed by x := 2 both give 2.

When the use is in a closure, the closure reads the variable's last value:

let snapshots = () => {
  let i = ref(0)
  let out = []
  while i.contents < 3 {
    let pair = (i.contents, "x")
    out->Array.push(() => {
      let (n, _) = pair
      n
    })
    i := i.contents + 1
  }
  out->Array.map(get => get())
}
Console.log(snapshots())

function snapshots() {
  let i = 0;
  let out = [];
  while (i < 3) {
    out.push(() => i);
    i = i + 1 | 0;
  };
  return out.map(get => get());
}

This prints [ 3, 3, 3 ] instead of [ 0, 1, 2 ].

A local function called in tail position with count.contents, whose body assigns the ref:

let run = () => {
  let count = ref(0)
  let bump = before => {
    count := count.contents + 1
    (before, count.contents)
  }
  bump(count.contents)
}
Console.log(run())

function run() {
  let count = 0;
  count = count + 1 | 0;
  return [
    count,
    count
  ];
}

This prints [ 1, 1 ] instead of [ 0, 1 ]: before should be the value of count at the call. 12.3.1 compiles run with let before = count.contents; before the assignment and prints [ 0, 1 ].

In the tuple, closure, record and variant cases, subst_map in compiler/core/js_pass_flatten_and_mark_dead.ml handles let t = <immutable block> with two or more elements. It keeps the elements that are variables or constants, binds the other elements to new variables (t_0, ...), and records the block. A later t[i] or t.field (Array_index or Static_index on t) is replaced by the recorded element when that element is a variable or a constant, and mark_dead_code then marks t as unused, so it is not printed. Nothing checks whether that variable is assigned between the definition of t and the read. Before this pass, f is still let t = [x, "b"]; x = 2; return t[0];, which returns 1.

In the local function case, Js_pass_tailcall_inline.subst (compiler/core/js_pass_tailcall_inline.ml) replaces return bump(count) with the body of bump, which is used once. inline_call maps a parameter whose argument is a variable to that variable (Var (Id id) -> Map_ident.add param id vars), and substitute_arguments renames the parameter's uses in the body. Number, boolean, undefined and null arguments are substituted too; only other arguments get a let binding. The Js_fun_env.no_tailcall mask keeps the binding for a parameter that a tail call reassigns, but nothing checks whether the argument variable is assigned in the body. The Lambda inliner binds such an argument: since #9177, Lam_beta_reduce.can_move puts a variable that is assigned somewhere (Lam_stats.assignable) in place of the parameter only when the body reads the parameter before anything with side effects.

Both substitutions are only correct for a variable that nothing assigns. For an assigned variable, the element or argument needs the binding that the passes already create for other expressions.

A local ref becomes a JavaScript variable when it does not escape. Up to 13.0.0-alpha.5 this excluded refs captured by a closure, so count in the local function case stayed {contents: 0}, the argument count.contents was not a variable, and it got let before = count.contents. #8617 (13.0.0-alpha.6) also turns captured refs into variables, which exposes that case.

The tuple, closure, record and variant cases reproduce with 11.1.4, 12.3.1, 13.0.0-alpha.5, 13.0.0-alpha.6 and master (fc7444266). The local function case reproduces with 13.0.0-alpha.6 and master (fc7444266), and compiles correctly with 12.3.1 and 13.0.0-alpha.5.

Related: #8617, #9159, #9177.

Linguagem predominante
OCaml
Estrelas
7.5k
Forks
485
Merge médio
17h 9min
PRs com merge (30d)
264

Preparar o ambiente

Abrir no Codespaces

Inicia o contêiner de desenvolvimento do projeto no navegador, com a sua própria conta do GitHub.

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de rescript-lang/rescript

Todas as issues de rescript-lang/rescript

Issues semelhantes

Mais issues de Compilers

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.