www.digitalmars.com         C & C++   DMDScript  

digitalmars.D.learn - Pure Contract bug? (unnecessarily strict)

reply Era Scarecrow <rtcvb32 yahoo.com> writes:
 Maybe someone's brought this up, but i seem to have the compiler complaining
to me that my function isn't 'pure' by calling a non-pure function,
specifically to!string().

 However the unpure functions are only accessed in the contracts, and only if
it failed seriously. Is this already planned to be worked on? I thought i read
the contracts shouldn't be considered as part of it since they are totally
excluded during the release builds (and shouldn't have any side effects). 

Error: pure function 'offset' cannot call impure function 'to'


	 property const pure int offset(int field)
	in {
		assert(field < notes.length);
	}
	out (o) {
		assert(o >= 0, "Negative value! Check structure:" ~ name ~ "\nReq:" ~ requ ~
"\nsize:" ~ to!string(size) ~ "\n");
	}
	body { ... }
Jan 28 2012
next sibling parent "Daniel Murphy" <yebblies nospamgmail.com> writes:
The way to avoid purity checking is to put code in a debug {} statement. 
I'm not aware of any plans to disable purity checking for contracts.
Jan 28 2012
prev sibling next sibling parent reply "Jesse Phillips" <jessekphillips+D gmail.com> writes:
On Sunday, 29 January 2012 at 06:22:26 UTC, Era Scarecrow wrote:

 Maybe someone's brought this up, but i seem to have the 
 compiler complaining to me that my function isn't 'pure' by 
 calling a non-pure function, specifically to!string().


I don't see why this couldn't be done, not only does it get not 
exist in release, it shouldn't be changing variables in 
non-release. As mentioned there is a hole for debug code.

Report it:

http://d.puremagic.com/issues/

and we'll see what happens with that.
Jan 30 2012
parent "Era Scarecrow" <rtcvb32 yahoo.com> writes:
 I don't see why this couldn't be done, not only does it get not 
 exist in release, it shouldn't be changing variables in 
 non-release. As mentioned there is a hole for debug code.

 Report it:

 http://d.puremagic.com/issues/

 and we'll see what happens with that.


Reported; Minor priority (Won't break code)

http://d.puremagic.com/issues/show_bug.cgi?id=7401
Jan 30 2012
prev sibling parent reply "Era Scarecrow" <rtcvb32 yahoo.com> writes:
If I'm reading how pure works, my original example was likely 
broken as it was part of a struct that returned a state value 
(although the contract constraints meaning was still valid).

So is pure fully usable or is it not yet ready? Makes me think 
that pure should have further constraints/limits, if it's part of 
a class/struct it should either require or automatically be 
static (no state access) and if it accesses any global variables, 
they must be immutable.

int x;
immutable int y = 10;

pure int test(int z) {
	int t = z + x;		//should error
	t += y;			//fine, globally immutable.
	return t;
}

struct X {
	int s_x;
	static int s_st_x;
	immutable int s_y;
	static immutable int s_st_y = 100;

	pure int test(int z) {
		int t = x + z;	//should error
		t += s_x;	//error, mutable external state
		t += s_st_x;	//error, mutable external state (static)
		t += s_y;	//error, not statically immutable, mathematically 
impure.


		t += y;		//fine, global immutable
		t += s_st_y; 	//fine, statically immutable.
		return t;
	}
}

Errors I get currently are these:

test(int):
Error: pure function 'test' cannot access mutable static data 'x'

X.test(int):
Error: pure function 'test' cannot access mutable static data 'x'
Error: pure function 'test' cannot access mutable static data 
's_st_x'


If I understand pure correctly, I should get two more, for s_x 
and s_y.
Feb 04 2012
parent reply Timon Gehr <timon.gehr gmx.ch> writes:
On 02/04/2012 08:51 PM, Era Scarecrow wrote:

 If I'm reading how pure works, my original example was likely broken as
 it was part of a struct that returned a state value (although the
 contract constraints meaning was still valid).

 So is pure fully usable or is it not yet ready? Makes me think that pure
 should have further constraints/limits, if it's part of a class/struct
 it should either require or automatically be static (no state access)
 and if it accesses any global variables, they must be immutable.

 int x;
 immutable int y = 10;

 pure int test(int z) {
 int t = z + x; //should error
 t += y; //fine, globally immutable.
 return t;
 }

 struct X {
 int s_x;
 static int s_st_x;
 immutable int s_y;
 static immutable int s_st_y = 100;

 pure int test(int z) {
 int t = x + z; //should error
 t += s_x; //error, mutable external state
 t += s_st_x; //error, mutable external state (static)
 t += s_y; //error, not statically immutable, mathematically impure.


 t += y; //fine, global immutable
 t += s_st_y; //fine, statically immutable.
 return t;
 }
 }

 Errors I get currently are these:

 test(int):
 Error: pure function 'test' cannot access mutable static data 'x'

 X.test(int):
 Error: pure function 'test' cannot access mutable static data 'x'
 Error: pure function 'test' cannot access mutable static data 's_st_x'


 If I understand pure correctly, I should get two more, for s_x and s_y.


Pure does not imply const in D. If you want stronger guarantees, just 
turn 'test' into a const (or immutable) member function. In D, a 
function can change anything that is mutable and reachable through its 
parameters, this includes the implicit 'this' pointer. The reason for 
this design is simple: There is no need to be overly restrictive, 
because the additional restrictions are already trivially expressed in 
the type system. Furthermore, any mutation of a parameter can be turned 
into a less efficient protocol that only requires a const pure function, 
so there would be no gain if pure implied const, it would only make pure 
less useful.

void foo(int* x)pure{*x+=2;}
int bar(const(int)*x)pure{return *x+2;}

void main() pure{
     int x, y;
     foo(&x);     // those two lines have
     y = bar(&y); // equivalent functionality!
}
Feb 04 2012
next sibling parent reply "Era Scarecrow" <rtcvb32 yahoo.com> writes:
 Pure does not imply const in D. If you want stronger 
 guarantees, just turn 'test' into a const (or immutable) member 
 function. In D, a function can change anything that is mutable 
 and reachable through its parameters, this includes the 
 implicit 'this' pointer. The reason for this design is simple: 
 There is no need to be overly restrictive, because the 
 additional restrictions are already trivially expressed in the 
 type system. Furthermore, any mutation of a parameter can be 
 turned into a less efficient protocol that only requires a 
 const pure function, so there would be no gain if pure implied 
 const, it would only make pure less useful.

 void foo(int* x)pure{*x+=2;}
 int bar(const(int)*x)pure{return *x+2;}

 void main() pure{
 int x, y;
 foo(&x);     // those two lines have
 y = bar(&y); // equivalent functionality!
 }


Only external data I was implying, that was not based off the 
input arguments. Examples in the book refer that calculating Pi, 
or the square root of 2 is a constant and will always result in 
the same output, regardless the situation.

Quote TDPL pg 165:
"In D, a function is considered pure if returning a result is 
it's only  effect and the result depends only on the function's 
arguments.

Also, pure functions can run literally in parallel because they 
don't interact with the rest of the program except through their 
result."

So... If we take a struct.

struct X {
    int i;
    pure int squaredPlus(int x) {
        return x*x + i
    }
    alias squaredPlus sqp;
}

    X st(15);

    writeln(st.sqp(0));  //15
    int i1 = st.sqp(10); st.i++;
    int i2 = st.sqp(10); st.i++;
    int i3 = st.sqp(10); st.i++;
    int i4 = st.sqp(10); st.i++;

    assert(i1 == 100); //pass/fail?
    assert(i2 == 101); //pass/fail?
    assert(i3 == 102); //pass/fail?
    assert(i4 == 103); //pass/fail?
    assert(s1.i == 104); //probably pass.

If the compiler can reorder or run these in parallel (for 
optimization) or caches the result the first time (since it's 
suppose to always return the same value), what's correct in this 
case? This afterall isn't synchronized, even if it was, what's 
correct behavior? Am I wrong in understanding this?
Feb 04 2012
next sibling parent reply Timon Gehr <timon.gehr gmx.ch> writes:
On 02/04/2012 11:04 PM, Era Scarecrow wrote:

 Pure does not imply const in D. If you want stronger guarantees, just
 turn 'test' into a const (or immutable) member function. In D, a
 function can change anything that is mutable and reachable through its
 parameters, this includes the implicit 'this' pointer. The reason for
 this design is simple: There is no need to be overly restrictive,
 because the additional restrictions are already trivially expressed in
 the type system. Furthermore, any mutation of a parameter can be
 turned into a less efficient protocol that only requires a const pure
 function, so there would be no gain if pure implied const, it would
 only make pure less useful.

 void foo(int* x)pure{*x+=2;}
 int bar(const(int)*x)pure{return *x+2;}

 void main() pure{
 int x, y;
 foo(&x); // those two lines have
 y = bar(&y); // equivalent functionality!
 }


 Only external data I was implying, that was not based off the input
 arguments. Examples in the book refer that calculating Pi, or the square
 root of 2 is a constant and will always result in the same output,
 regardless the situation.

 Quote TDPL pg 165:
 "In D, a function is considered pure if returning a result is it's only
 effect and the result depends only on the function's arguments.

 Also, pure functions can run literally in parallel because they don't
 interact with the rest of the program except through their result."


Probably the restriction was lifted after TDPL was out.

 So... If we take a struct.

 struct X {
 int i;
 pure int squaredPlus(int x) {
 return x*x + i
 }
 alias squaredPlus sqp;
 }

 X st(15);

 writeln(st.sqp(0)); //15
 int i1 = st.sqp(10); st.i++;
 int i2 = st.sqp(10); st.i++;
 int i3 = st.sqp(10); st.i++;
 int i4 = st.sqp(10); st.i++;

 assert(i1 == 100); //pass/fail?
 assert(i2 == 101); //pass/fail?
 assert(i3 == 102); //pass/fail?
 assert(i4 == 103); //pass/fail?
 assert(s1.i == 104); //probably pass.

 If the compiler can reorder or run these in parallel (for optimization)
 or caches the result the first time (since it's suppose to always return
 the same value), what's correct in this case? This afterall isn't
 synchronized, even if it was, what's correct behavior? Am I wrong in
 understanding this?


Yes. The compiler will only reorder/run in parallel/optimize if it is 
safe (not changing execution semantics). Pure can be used to prove that 
certain optimizations are safe. If a pure function only takes const or 
immutable arguments, the compiler has more guarantees and can do more 
things. If a pure function takes mutable arguments, it can be used as a 
component of other pure functions (important!), but the kind of 
optimizations that can be performed directly on them are a lot more limited.

'Pure' means that the behavior of the function does not change between 
invocations with the same/equivalent arguments. This can include 
mutating actions on the arguments, if those are typed mutable.
Feb 04 2012
parent reply "Era Scarecrow" <rtcvb32 yahoo.com> writes:
 Probably the restriction was lifted after TDPL was out.




 Yes. The compiler will only reorder/run in parallel/optimize if 
 it is safe (not changing execution semantics). Pure can be used 
 to prove that certain optimizations are safe. If a pure 
 function only takes const or immutable arguments, the compiler 
 has more guarantees and can do more things. If a pure function 
 takes mutable arguments, it can be used as a component of other 
 pure functions (important!), but the kind of optimizations that 
 can be performed directly on them are a lot more limited.

 'Pure' means that the behavior of the function does not change 
 between invocations with the same/equivalent arguments. This 
 can include mutating actions on the arguments, if those are 
 typed mutable.



Even if you changed the signature of the pure function to 'pure 
int squaredPlus(immutable int);' you'd have the same problem; 
Because the int argument it receives is a copy so it won't matter 
if it was mutable or not. (If it were an object, then it would be 
more enforced).

I'll refer to the language specs to see if I can find an answer 
on this, but it feels wrong allowing access to 'this' on mutable 
data; I thought it could only mutate it's own data in regards to 
local variables and arguments it owned.
Feb 04 2012
parent reply Timon Gehr <timon.gehr gmx.ch> writes:
On 02/05/2012 12:15 AM, Era Scarecrow wrote:

 Probably the restriction was lifted after TDPL was out.




 Yes. The compiler will only reorder/run in parallel/optimize if it is
 safe (not changing execution semantics). Pure can be used to prove
 that certain optimizations are safe. If a pure function only takes
 const or immutable arguments, the compiler has more guarantees and can
 do more things. If a pure function takes mutable arguments, it can be
 used as a component of other pure functions (important!), but the kind
 of optimizations that can be performed directly on them are a lot more
 limited.

 'Pure' means that the behavior of the function does not change between
 invocations with the same/equivalent arguments. This can include
 mutating actions on the arguments, if those are typed mutable.



 Even if you changed the signature of the pure function to 'pure int
 squaredPlus(immutable int);' you'd have the same problem; Because the
 int argument it receives is a copy so it won't matter if it was mutable
 or not. (If it were an object, then it would be more enforced).

 I'll refer to the language specs to see if I can find an answer on this,
 but it feels wrong allowing access to 'this' on mutable data; I thought
 it could only mutate it's own data in regards to local variables and
 arguments it owned.


the signature I meant looks like

pure int squaredPlus(int)immutable;
Feb 04 2012
parent reply "Era Scarecrow" <rtcvb32 yahoo.com> writes:
 the signature I meant looks like

 pure int squaredPlus(int)immutable;


Which then the only way you could call it, was if the object 
itself was immutable, which is definitely safe (I think). Hmmm...
Feb 04 2012
parent Timon Gehr <timon.gehr gmx.ch> writes:
On 02/05/2012 01:20 AM, Era Scarecrow wrote:

 the signature I meant looks like

 pure int squaredPlus(int)immutable;


 Which then the only way you could call it, was if the object itself was
 immutable, which is definitely safe (I think). Hmmm...


Alternatively you can use pure int squaredPlus(int)const;, of course.
Feb 04 2012
prev sibling parent David Held <dmd wyntrmute.com> writes:
On 2/4/2012 2:04 PM, Era Scarecrow wrote:

 [...]
 struct X {
     int i;
     pure int squaredPlus(int x) {
         return x*x + i
     }
     alias squaredPlus sqp;
 }

     X st(15);

     writeln(st.sqp(0));  //15
     int i1 = st.sqp(10); st.i++;
     int i2 = st.sqp(10); st.i++;
     int i3 = st.sqp(10); st.i++;
     int i4 = st.sqp(10); st.i++;


You can rewrite these like so:

int i1 = sqp(st, 10); st.i++;
int i2 = sqp(st, 10); st.i++;
int i3 = sqp(st, 10); st.i++;
int i4 = sqp(st, 10);

At this point it becomes a little more obvious that these cannot be 
reordered because their arguments have a shared dependency, just like 
the following cannot be reordered:

int i = 15;
int i1 = i * i; ++i;
int i2 = i * i; ++i;
int i3 = i * i; ++i;
int i4 = i * i;

I hope we all agree that opMult(int, int) is pure, and that is both safe 
to reorder its execution with non-dependent args, and unsafe to do so here.


     assert(i1 == 100); //pass/fail?
 [...]


Fail.  It should be i1 == 115. ;)

Dave
Jan 02 2014
prev sibling parent reply David Held <dmd wyntrmute.com> writes:
On 2/4/2012 12:45 PM, Timon Gehr wrote:

 [...]
 Pure does not imply const in D.
 [...]


I think this is a language defect:

struct Foo
{
     int computed() pure { return x * y; }
     int wrapper() const { return computed() + 5; }

     int x;
     int y;
}

void main()
{
}

src\Bug2.d(4): Error: mutable method Bug2.Foo.computed is not callable 
using a const object

Surprisingly, this is legal, and "fixes" the issue:

     int computed() const pure { return x * y; }

I say this is a bug because of what a "non-const pure" method would be: 
a method which could somehow modify 'this', or its members.  I hope we 
all agree that such a method is not, in fact, pure.  Let's try, just to 
make sure:

     int computed() pure { return ++x * y; }

Oh noes...this is allowed!!!  Surely this is wrong.  Suppose we rewrote 
the method like so:

     int computed(ref int x, int y) pure { return ++x * y; }

Would anyone say this is legit?

Dave
Jan 02 2014
parent "H. S. Teoh" <hsteoh quickfur.ath.cx> writes:
On Thu, Jan 02, 2014 at 04:31:24PM -0800, David Held wrote:
[...]

 I think this is a language defect:
 
 struct Foo
 {
     int computed() pure { return x * y; }
     int wrapper() const { return computed() + 5; }
 
     int x;
     int y;
 }
 
 void main()
 {
 }
 
 src\Bug2.d(4): Error: mutable method Bug2.Foo.computed is not
 callable using a const object
 
 Surprisingly, this is legal, and "fixes" the issue:
 
     int computed() const pure { return x * y; }
 
 I say this is a bug because of what a "non-const pure" method would
 be: a method which could somehow modify 'this', or its members.  I
 hope we all agree that such a method is not, in fact, pure.  Let's
 try, just to make sure:
 
     int computed() pure { return ++x * y; }
 
 Oh noes...this is allowed!!!  Surely this is wrong.  Suppose we
 rewrote the method like so:
 
     int computed(ref int x, int y) pure { return ++x * y; }
 
 Would anyone say this is legit?


[...]

You're confused because D's purity system is not quite the same as the
purity in functional languages. In D, there's the notion of "strong
purity" vs. "weak purity":

- Strong purity is what most people would understand as "pure" in the
  functional language sense. In D, this is the purity you get when a
  function is (1) pure, and (2) its arguments have no mutable
  indirections.

- D, however, extends the notion of purity to what is called "weak
  purity", which permits mutation of external data, but with the
  restriction that this mutation can only take place through references
  passed in as arguments to the function.

This is why you need to write "const pure" when you want strong purity,
because under the definition of weak purity, the function is allowed to
modify data via 'this'.

What's the point of weak purity, you may ask? The basic idea is this:
since D is an imperative language, it is most natural to write
imperative style code containing mutation of local variables, etc., but
from a functional language's POV these are all impure operations and are
therefore not allowed in 'pure' code. So you'd have to write 'pure'
functions in a convoluted, unnatural style (i.e., in a functional style)
in order to conform to the definition of purity. However, this
restriction is actually superfluous if all of the side-effects caused by
the function is never visible to the outside world. Mutation of local
variables is allowed because nobody outside the function will see this
mutation. So, as far as the outside world is concerned, the function is
still pure, and the fact that it uses 'impure' constructs like mutation
of local variables is a mere implementation detail. So modification of
local state is permitted in pure functions.

So far so good. But what of weak purity? The motivation behind weak
purity comes from the observation that if some helper function, let's
call it helper(), can only mutate data via its arguments, then it is
legal to call it from a strongly-pure function, because since the
strongly-pure function has no outside-observable side-effects, any data
it is allowed to mutate can only be local state unobservable to the
outside world. This in turn means that it is impossible for the
strongly-pure function to pass a mutable reference to any global state
to helper(), and therefore, whatever helper() does can only affect state
local to the strongly-pure function. As a result, none of helper()'s
side-effects (when called from a strongly-pure function) will be visible
to the outside world either.

This expanded scope of allowable code in a strongly-pure function is
desirable, because it can simplify implementation in many cases.
Duplicated code can be avoided (no need to rewrite something just
because a pure function needs to call it but it just so happens to not
be strongly pure), and you can create class instances inside a
strongly-pure function and mutate it by calling its methods -- as long
as the methods are subject to the restriction that they only ever mutate
state reachable via their arguments, and nothing else. As long as the
class instance remains strictly local to the strongly-pure function, the
outside world wouldn't know any better (nor care) -- the function is
still strongly pure as far as it is concerned.  Thus, we can expand the
scope of what can be considered pure in D, while still enjoying the
benefits of purity (no (observable) side-effects, cacheability, etc.).

So in view of this, D's 'pure' keyword has come to mean 'weakly pure',
that is, modification of data is allowed via indirections passed in as
function arguments (the 'this' pointer is considered an argument), but
direct modification of global state is strictly prohibited. Finally, a
(weakly) pure function is strongly-pure when its arguments contain no
mutable indirections, because then, together with the weakly-pure
restriction, this implies that the function cannot modify any external
state at all, since the only permitted avenue of doing so -- via
function arguments -- contains no mutable indirections, so the function
is unable to reach any outside state.

This is the reason for Timon's response that you need to write 'const
pure' when you mean "strongly-pure"; "pure" by itself means
"weakly-pure" because the 'this' pointer is mutable by default.


T

-- 
Маленькие детки - маленькие бедки.
Jan 02 2014