Fix and improve contract generation optimization for static types

[yannham]

Fixes #2014.

Motivation

This PR fixes a number of issues with the optimization of contract generation from a static type annotation. This optimization has been introduced to take advantage of the guarantees of static typing to simplify the generated contract and elide a number of useless checks at run-time.

However, the original optimization is too agressive: it turns any non-function type in a positive position to Dyn.

Contracts in negative position must be kept around, because they check what's come from the (potentially untyped) external world inside the function: the fact that a function is statically typed doesn't ensure it'll be called with the
right arguments. Basic contracts in positive position can be elided though: if a function has been statically checked to be of type Number -> Number, we know that it'll always return a Number at runtime, and we can simplify the contract to Number -> Dyn (which is further specialized to an implementation that doesn't check anything on the codomain). Alas, this isn't true for more complex types in positive positions.

Unsoundness

The first issue is that a type constructor in positive position can hide negative contracts inside. Typically, take let functions: Array (Number -> Number) in (std.array.at 0 functions) "a". The application is untyped, and wrongly passes a string to a function of the array. However, the current optimization will turn this contract to just Dyn at runtime and get rid of entirely, because there's an Array _ in positive position, and won't blame at runtime (might get a primop dynamic type error, or nothing, depending what exactly does the function). The elision is only valid if _ doesn't contain any arrow type, which it does, in this example.

Another issue stems from the sealing/unsealing symmetry of polymorphic row contracts. Take let id : forall r. {foo : Number; r} -> {foo : Number; r} = fun x => x in id {foo = 1, bar = 2}. The current version would return {foo = 1}, with the bar field missing. The issue is that the second {foo : Number; r} is a record type in positive position, which currently gets entirely elided, giving forall r. {foo : Number; r} -> Dyn as an optimized contract. The argument contract seals anything else than foo in the record's tail, but there's no dual contract to unseal it anymore, such that bar stays sealed in the tail forever and thus invisible.

This commit implements a more complicated strategy, but which is hopefully correct. Instead of getting rid of type constructor in positive positions, we try to simplify their content as well, and only if the content is simplified down to Dyn (or {; Dyn} for record rows, etc.), we get rid of the entire constructor. Otherwise, we try to pay only for the necessary checks. For example, {foo : Number, bar : Number -> Number} now gets simplified to {bar : Number -> Dyn; Dyn} instead of just Dyn before (which was incorrect).

The full simplification rules around polymorphic row contracts are a bit intricate and are detailed in the documentation of the corresponding methods.

[github-actions]

Bencher

Report	Tue, September 10, 2024 at 09:02:44 UTC
Project	nickel
Branch	2017/merge
Testbed	ubuntu-latest

⚠️ WARNING: The following Measure does not have a Threshold. Without a Threshold, no Alerts will ever be generated!

• Latency (latency)

Click here to create a new Threshold
For more information, see the Threshold documentation.
To only post results if a Threshold exists, set the --ci-only-thresholds CLI flag.

Click to view all benchmark results

Benchmark	Latency	Latency Results nanoseconds (ns)
fibonacci 10	➖ (view plot)	486,120.00
pidigits 100	➖ (view plot)	3,129,800.00
product 30	➖ (view plot)	794,220.00
scalar 10	➖ (view plot)	1,472,500.00
sum 30	➖ (view plot)	786,110.00

Bencher - Continuous Benchmarking
View Public Perf Page
Docs | Repo | Chat | Help

[yannham]

@jneem if you have a chance to take a look - I'd like to include this in the 1.8 release (given the severity of the bug that is fixed)