Re: Fwd: ScopeLayout hidden

On Sat, 2010-02-27 at 18:41 -0500, Kevin Reid wrote:
> Begin forwarded message:
> 
> > From: Mark Miller <[email protected]>
> > Date: February 27, 2010 18:06:46 EST
> > To: Kevin Reid <[email protected]>
> > Cc: Thomas Leonard <tal-v5nx5w6akNyLE8xUarVfuPLx9OUvmyODWmv/[email protected]>
> > Subject: ScopeLayout hidden
> >
> > Kevin, Besides the obvious change, this [patch] also does a bit of  
> > comment
> > reformatting. And it adds maximally restrictive safej files for
> > ScopeLayout and EvalContext, just in case they leak by other means.
> > See ENode#getScopeLayout() as such a leak that should probably be
> > plugged more directly than just making ScopeLayouts opaque.

> > Hi Thomas, I'm cc'ing you as our new committer. Welcome aboard! This
> > is in reaction to the bug you reported. The underlying problem is that
> > our taming system is too permissive. This doesn't fix this underlying
> > problem, but only a symptom: It restricts Scope to not expose
> > ScopeLayouts or EvalContexts, as these are really details of the
> > implementation that shouldn't be visible from E. The specific bug you
> > found came from exposing an internal optimization that relied to
> > delicate invariants to E code which could violate these invariants.

Hi Mark, thanks for fixing this!

But I find the solution quite surprising. I thought taming was only
needed for legacy code, not for clean ocaps code such as E itself.

Does the taming affect Joe-E code? If so, I guess this means that E's
implementation can't be Joe-E, since it wouldn't be able to do anything
useful with Scope. If not, it means that by default E code can't be
allowed to call Joe-E code (since it could pass safeScope to Java,
creating the usual confused deputy issues).

I was expecting that Scope would be split into two objects, with the
underlying one used by the EVM internally and a limited facet given to E
code as "safeScope". Then E code could freely created new scopes and
interact with the interpreter just as Java code can (using the
underlying Scope object), but without giving E code this access by
default through safeScope.

The current version breaks my software (which is OK), but it would be a
shame if the only fix was to rewrite bits of it in Java.

Thanks,


-- 
Dr Thomas Leonard
IT Innovation Centre
2 Venture Road
Southampton
Hampshire SO16 7NP

Tel: +44 0 23 8076 0834
Fax: +44 0 23 8076 0833
mailto:tal-v5nx5w6akNyLE8xUarVfuPLx9OUvmyODWmv/[email protected]
http://www.it-innovation.soton.ac.uk