You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Here is a graph showing the hierarchy of predefined capability traits. Classifier traits are underlined.
52
52
```
@@ -56,17 +56,18 @@ Here is a graph showing the hierarchy of predefined capability traits. Classifie
56
56
/ \
57
57
/ \
58
58
SharedCapability ExclusiveCapability
59
-
----------------
59
+
---------------- |
60
60
| |
61
61
| |
62
62
| |
63
63
| |
64
-
Control Read
65
-
------- ----
64
+
Control Unscoped
65
+
------- --------
66
66
```
67
67
At the top of the hierarchy, we distinguish between _shared_ and _exclusive_ capabilities in two traits `SharedCapability` and `ExclusiveCapability`. All capability classes we have seen so far are shared.
68
68
`ExclusiveCapability` is a base trait for capabilities that
69
-
are checked for anti-aliasing restrictions with the rules governed by [separation checking](separation-checking.md). Separation checking is currently an optional extension of capture checking, enabled by a different language import. Since `Capability` is a sealed trait, all capability classes are either shared or exclusive.
69
+
are checked for anti-aliasing restrictions with the rules governed by [separation checking](separation-checking.md). Separation checking is currently an optional extension of capture checking, enabled by a different language import. Since `Capability` is a sealed trait, all capability classes are either shared or exclusive. `SharedCapability` is a classifier, but `ExclusiveCapability` is not. Therefore,
70
+
exclusive capabilities can have shared capabilities in their capture set but not _vice versa_.
70
71
71
72
`Control` capabilities are shared. This means they cannot directly or indirectly capture exclusive capabilities such as capabilities that control access to mutable state. Typical `Control` capabilities are:
72
73
@@ -76,6 +77,28 @@ are checked for anti-aliasing restrictions with the rules governed by [separatio
76
77
77
78
These are all expressed by having their capability classes extend `Control`.
78
79
80
+
### The Unscoped Classifier
81
+
82
+
Capabilities classified as `Unscoped` can escape their environment. For instance, the following
83
+
is permitted:
84
+
```scala
85
+
classRef[T](init: T) extendsUnscoped
86
+
87
+
classFile:
88
+
defread():String= ...
89
+
90
+
defwithFile[T](op: (f: File^) =>T):T=
91
+
op(newFile)
92
+
93
+
withFile: f =>
94
+
valr:Ref^=Ref(f.read())
95
+
r
96
+
```
97
+
Here, `r` is a fresh reference that escapes the scope of `withFile`. That's OK only since
98
+
`Ref` is classified as `Unscoped`. Since `Unscoped` is a classifier it means that `Ref` cannot
99
+
possible capture `f`, which as a `File` is not classified as unscoped. So returning a `Ref`
100
+
from a `withFile` does not affect the lifetime of `f`.
101
+
79
102
### Classifier Restriction
80
103
81
104
Consider the following problem: The `Try.apply` method takes in its `body` parameter a computation, and runs it while catching any exceptions or `boundary.break` aborts. The exception or break will be re-issued when calling
0 commit comments