source: doc/theses/andrew_beach_MMath/features.tex @ 6a99803

ADTarm-ehast-experimentalenumforall-pointer-decayjacob/cs343-translationnew-ast-unique-exprpthread-emulationqualifiedEnum
Last change on this file since 6a99803 was 1c1c180, checked in by Andrew Beach <ajbeach@…>, 4 years ago

Fixed line length and trailing whitespace on modified tex files.

  • Property mode set to 100644
File size: 19.7 KB
Line 
1\chapter{Exception Features}
2
3This chapter covers the design and user interface of the \CFA
4exception-handling mechanism.
5
6\section{Virtuals}
7Virtual types and casts are not required for a basic exception-system but are
8useful for advanced exception features. However, \CFA is not object-oriented so
9there is no obvious concept of virtuals. Hence, to create advanced exception
10features for this work, I needed to designed and implemented a virtual-like
11system for \CFA.
12
13Object-oriented languages often organized exceptions into a simple hierarchy,
14\eg Java.
15\begin{center}
16\setlength{\unitlength}{4000sp}%
17\begin{picture}(1605,612)(2011,-1951)
18\put(2100,-1411){\vector(1, 0){225}}
19\put(3450,-1411){\vector(1, 0){225}}
20\put(3550,-1411){\line(0,-1){225}}
21\put(3550,-1636){\vector(1, 0){150}}
22\put(3550,-1636){\line(0,-1){225}}
23\put(3550,-1861){\vector(1, 0){150}}
24\put(2025,-1490){\makebox(0,0)[rb]{\LstBasicStyle{exception}}}
25\put(2400,-1460){\makebox(0,0)[lb]{\LstBasicStyle{arithmetic}}}
26\put(3750,-1460){\makebox(0,0)[lb]{\LstBasicStyle{underflow}}}
27\put(3750,-1690){\makebox(0,0)[lb]{\LstBasicStyle{overflow}}}
28\put(3750,-1920){\makebox(0,0)[lb]{\LstBasicStyle{zerodivide}}}
29\end{picture}%
30\end{center}
31The hierarchy provides the ability to handle an exception at different degrees
32of specificity (left to right). Hence, it is possible to catch a more general
33exception-type in higher-level code where the implementation details are
34unknown, which reduces tight coupling to the lower-level implementation.
35Otherwise, low-level code changes require higher-level code changes, \eg,
36changing from raising @underflow@ to @overflow@ at the low level means changing
37the matching catch at the high level versus catching the general @arithmetic@
38exception. In detail, each virtual type may have a parent and can have any
39number of children. A type's descendants are its children and its children's
40descendants. A type may not be its own descendant.
41
42The exception hierarchy allows a handler (@catch@ clause) to match multiple
43exceptions, \eg a base-type handler catches both base and derived
44exception-types.
45\begin{cfa}
46try {
47        ...
48} catch(arithmetic &) {
49        ... // handle arithmetic, underflow, overflow, zerodivide
50}
51\end{cfa}
52Most exception mechanisms perform a linear search of the handlers and select
53the first matching handler, so the order of handers is now important because
54matching is many to one.
55
56Each virtual type needs an associated virtual table. A virtual table is a
57structure with fields for all the virtual members of a type. A virtual type has
58all the virtual members of its parent and can add more. It may also update the
59values of the virtual members and often does.
60
61While much of the virtual infrastructure is created, it is currently only used
62internally for exception handling. The only user-level feature is the virtual
63cast, which is the same as the \CC \lstinline[language=C++]|dynamic_cast|.
64\label{p:VirtualCast}
65\begin{cfa}
66(virtual TYPE)EXPRESSION
67\end{cfa}
68Note, the syntax and semantics matches a C-cast, rather than the unusual \CC
69syntax for special casts. Both the type of @EXPRESSION@ and @TYPE@ must be a
70pointer to a virtual type. The cast dynamically checks if the @EXPRESSION@ type
71is the same or a subtype of @TYPE@, and if true, returns a pointer to the
72@EXPRESSION@ object, otherwise it returns @0p@ (null pointer).
73
74\section{Exception}
75% Leaving until later, hopefully it can talk about actual syntax instead
76% of my many strange macros. Syntax aside I will also have to talk about the
77% features all exceptions support.
78
79Exceptions are defined by the trait system; there are a series of traits, and
80if a type satisfies them, then it can be used as an exception. The following
81is the base trait all exceptions need to match.
82\begin{cfa}
83trait is_exception(exceptT &, virtualT &) {
84        virtualT const & @get_exception_vtable@(exceptT *);
85};
86\end{cfa}
87The function takes any pointer, including the null pointer, and returns a
88reference to the virtual-table object. Defining this function also establishes
89the virtual type and a virtual-table pair to the \CFA type-resolver and
90promises @exceptT@ is a virtual type and a child of the base exception-type.
91
92\PAB{I do not understand this paragraph.}
93One odd thing about @get_exception_vtable@ is that it should always be a
94constant function, returning the same value regardless of its argument. A
95pointer or reference to the virtual table instance could be used instead,
96however using a function has some ease of implementation advantages and allows
97for easier disambiguation because the virtual type name (or the address of an
98instance that is in scope) can be used instead of the mangled virtual table
99name. Also note the use of the word ``promise'' in the trait
100description. Currently, \CFA cannot check to see if either @exceptT@ or
101@virtualT@ match the layout requirements. This is considered part of
102@get_exception_vtable@'s correct implementation.
103
104\section{Raise}
105\CFA provides two kinds of exception raise: termination
106\see{\VRef{s:Termination}} and resumption \see{\VRef{s:Resumption}}, which are
107specified with the following traits.
108\begin{cfa}
109trait is_termination_exception(
110                exceptT &, virtualT & | is_exception(exceptT, virtualT)) {
111        void @defaultTerminationHandler@(exceptT &);
112};
113\end{cfa}
114The function is required to allow a termination raise, but is only called if a
115termination raise does not find an appropriate handler.
116
117Allowing a resumption raise is similar.
118\begin{cfa}
119trait is_resumption_exception(
120                exceptT &, virtualT & | is_exception(exceptT, virtualT)) {
121        void @defaultResumptionHandler@(exceptT &);
122};
123\end{cfa}
124The function is required to allow a resumption raise, but is only called if a
125resumption raise does not find an appropriate handler.
126
127Finally there are three convenience macros for referring to the these traits:
128@IS_EXCEPTION@, @IS_TERMINATION_EXCEPTION@ and @IS_RESUMPTION_EXCEPTION@. Each
129takes the virtual type's name, and for polymorphic types only, the
130parenthesized list of polymorphic arguments. These macros do the name mangling
131to get the virtual-table name and provide the arguments to both sides
132\PAB{What's a ``side''?}
133
134\subsection{Termination}
135\label{s:Termination}
136
137Termination raise, called ``throw'', is familiar and used in most programming
138languages with exception handling. The semantics of termination is: search the
139stack for a matching handler, unwind the stack frames to the matching handler,
140execute the handler, and continue execution after the handler. Termination is
141used when execution \emph{cannot} return to the throw. To continue execution,
142the program must \emph{recover} in the handler from the failed (unwound)
143execution at the raise to safely proceed after the handler.
144
145A termination raise is started with the @throw@ statement:
146\begin{cfa}
147throw EXPRESSION;
148\end{cfa}
149The expression must return a termination-exception reference, where the
150termination exception has a type with a @void defaultTerminationHandler(T &)@
151(default handler) defined. The handler is found at the call site using \CFA's
152trait system and passed into the exception system along with the exception
153itself.
154
155At runtime, a representation of the exception type and an instance of the
156exception type is copied into managed memory (heap) to ensure it remains in
157scope during unwinding. It is the user's responsibility to ensure the original
158exception object at the throw is freed when it goes out of scope. Being
159allocated on the stack is sufficient for this.
160
161Then the exception system searches the stack starting from the throw and
162proceeding towards the base of the stack, from callee to caller. At each stack
163frame, a check is made for termination handlers defined by the @catch@ clauses
164of a @try@ statement.
165\begin{cfa}
166try {
167        GUARDED_BLOCK
168} @catch (EXCEPTION_TYPE$\(_1\)$ * NAME)@ { // termination handler 1
169        HANDLER_BLOCK$\(_1\)$
170} @catch (EXCEPTION_TYPE$\(_2\)$ * NAME)@ { // termination handler 2
171        HANDLER_BLOCK$\(_2\)$
172}
173\end{cfa}
174The statements in the @GUARDED_BLOCK@ are executed. If those statements, or any
175functions invoked from those statements, throws an exception, and the exception
176is not handled by a try statement further up the stack, the termination
177handlers are searched for a matching exception type from top to bottom.
178
179Exception matching checks the representation of the thrown exception-type is
180the same or a descendant type of the exception types in the handler clauses. If
181there is a match, a pointer to the exception object created at the throw is
182bound to @NAME@ and the statements in the associated @HANDLER_BLOCK@ are
183executed. If control reaches the end of the handler, the exception is freed,
184and control continues after the try statement.
185
186The default handler visible at the throw statement is used if no matching
187termination handler is found after the entire stack is searched. At that point,
188the default handler is called with a reference to the exception object
189generated at the throw. If the default handler returns, the system default
190action is executed, which often terminates the program. This feature allows
191each exception type to define its own action, such as printing an informative
192error message, when an exception is not handled in the program.
193
194\subsection{Resumption}
195\label{s:Resumption}
196
197Resumption raise, called ``resume'', is as old as termination
198raise~\cite{Goodenough75} but is less popular. In many ways, resumption is
199simpler and easier to understand, as it is simply a dynamic call (as in
200Lisp). The semantics of resumption is: search the stack for a matching handler,
201execute the handler, and continue execution after the resume. Notice, the stack
202cannot be unwound because execution returns to the raise point. Resumption is
203used used when execution \emph{can} return to the resume. To continue
204execution, the program must \emph{correct} in the handler for the failed
205execution at the raise so execution can safely continue after the resume.
206
207A resumption raise is started with the @throwResume@ statement:
208\begin{cfa}
209throwResume EXPRESSION;
210\end{cfa}
211The semantics of the @throwResume@ statement are like the @throw@, but the
212expression has a type with a @void defaultResumptionHandler(T &)@ (default
213handler) defined, where the handler is found at the call site by the type
214system. At runtime, a representation of the exception type and an instance of
215the exception type is \emph{not} copied because the stack is maintained during
216the handler search.
217
218Then the exception system searches the stack starting from the resume and
219proceeding towards the base of the stack, from callee to caller. At each stack
220frame, a check is made for resumption handlers defined by the @catchResume@
221clauses of a @try@ statement.
222\begin{cfa}
223try {
224        GUARDED_BLOCK
225} @catchResume (EXCEPTION_TYPE$\(_1\)$ * NAME)@ { // resumption handler 1
226        HANDLER_BLOCK$\(_1\)$
227} @catchResume (EXCEPTION_TYPE$\(_2\)$ * NAME)@ { // resumption handler 2
228        HANDLER_BLOCK$\(_2\)$
229}
230\end{cfa}
231The statements in the @GUARDED_BLOCK@ are executed. If those statements, or any
232functions invoked from those statements, resumes an exception, and the
233exception is not handled by a try statement further up the stack, the
234resumption handlers are searched for a matching exception type from top to
235bottom. (Note, termination and resumption handlers may be intermixed in a @try@
236statement but the kind of raise (throw/resume) only matches with the
237corresponding kind of handler clause.)
238
239The exception search and matching for resumption is the same as for
240termination, including exception inheritance. The difference is when control
241reaches the end of the handler: the resumption handler returns after the resume
242rather than after the try statement. The resume point assumes the handler has
243corrected the problem so execution can safely continue.
244
245Like termination, if no resumption handler is found, the default handler
246visible at the resume statement is called, and the system default action is
247executed.
248
249For resumption, the exception system uses stack marking to partition the
250resumption search. If another resumption exception is raised in a resumption
251handler, the second exception search does not start at the point of the
252original raise. (Remember the stack is not unwound and the current handler is
253at the top of the stack.) The search for the second resumption starts at the
254current point on the stack because new try statements may have been pushed by
255the handler or functions called from the handler. If there is no match back to
256the point of the current handler, the search skips\label{p:searchskip} the stack frames already
257searched by the first resume and continues after the try statement. The default
258handler always continues from default handler associated with the point where
259the exception is created.
260
261% This might need a diagram. But it is an important part of the justification
262% of the design of the traversal order.
263\begin{verbatim}
264       throwResume2 ----------.
265            |                 |
266 generated from handler       |
267            |                 |
268         handler              |
269            |                 |
270        throwResume1 -----.   :
271            |             |   :
272           try            |   : search skip
273            |             |   :
274        catchResume  <----'   :
275            |                 |
276\end{verbatim}
277
278This resumption search-pattern reflect the one for termination, which matches
279with programmer expectations. However, it avoids the \emph{recursive
280resumption} problem. If parts of the stack are searched multiple times, loops
281can easily form resulting in infinite recursion.
282
283Consider the trivial case:
284\begin{cfa}
285try {
286        throwResume$\(_1\)$ (E &){};
287} catch( E * ) {
288        throwResume;
289}
290\end{cfa}
291Based on termination semantics, programmer expectation is for the re-resume to
292continue searching the stack frames after the try statement. However, the
293current try statement is still on the stack below the handler issuing the
294reresume \see{\VRef{s:Reraise}}. Hence, the try statement catches the re-raise
295again and does another re-raise \emph{ad infinitum}, which is confusing and
296difficult to debug. The \CFA resumption search-pattern skips the try statement
297so the reresume search continues after the try, mathcing programmer
298expectation.
299
300\section{Conditional Catch}
301Both termination and resumption handler-clauses may perform conditional matching:
302\begin{cfa}
303catch (EXCEPTION_TYPE * NAME ; @CONDITION@)
304\end{cfa}
305First, the same semantics is used to match the exception type. Second, if the
306exception matches, @CONDITION@ is executed. The condition expression may
307reference all names in scope at the beginning of the try block and @NAME@
308introduced in the handler clause. If the condition is true, then the handler
309matches. Otherwise, the exception search continues at the next appropriate kind
310of handler clause in the try block.
311\begin{cfa}
312try {
313        f1 = open( ... );
314        f2 = open( ... );
315        ...
316} catch( IOFailure * f ; fd( f ) == f1 ) {
317        // only handle IO failure for f1
318}
319\end{cfa}
320Note, catching @IOFailure@, checking for @f1@ in the handler, and reraising the
321exception if not @f1@ is different because the reraise does not examine any of
322remaining handlers in the current try statement.
323
324\section{Reraise}
325\label{s:Reraise}
326Within the handler block or functions called from the handler block, it is
327possible to reraise the most recently caught exception with @throw@ or
328@throwResume@, respective.
329\begin{cfa}
330catch( ... ) {
331        ... throw; // rethrow
332} catchResume( ... ) {
333        ... throwResume; // reresume
334}
335\end{cfa}
336The only difference between a raise and a reraise is that reraise does not
337create a new exception; instead it continues using the current exception, \ie
338no allocation and copy. However the default handler is still set to the one
339visible at the raise point, and hence, for termination could refer to data that
340is part of an unwound stack frame. To prevent this problem, a new default
341handler is generated that does a program-level abort.
342
343
344\section{Finally Clauses}
345A @finally@ clause may be placed at the end of a @try@ statement.
346\begin{cfa}
347try {
348        GUARDED_BLOCK
349} ...   // any number or kind of handler clauses
350} finally {
351        FINALLY_BLOCK
352}
353\end{cfa}
354The @FINALLY_BLOCK@ is executed when the try statement is unwound from the
355stack, \ie when the @GUARDED_BLOCK@ or any handler clause finishes. Hence, the
356finally block is always executed.
357
358Execution of the finally block should always finish, meaning control runs off
359the end of the block. This requirement ensures always continues as if the
360finally clause is not present, \ie finally is for cleanup not changing control
361flow. Because of this requirement, local control flow out of the finally block
362is forbidden. The compiler precludes any @break@, @continue@, @fallthru@ or
363@return@ that causes control to leave the finally block. Other ways to leave
364the finally block, such as a long jump or termination are much harder to check,
365and at best requiring additional run-time overhead, and so are discouraged.
366
367\section{Cancellation}
368Cancellation is a stack-level abort, which can be thought of as as an
369uncatchable termination. It unwinds the entirety of the current stack, and if
370possible forwards the cancellation exception to a different stack.
371
372There is no special statement for starting a cancellation; instead the standard
373library function @cancel_stack@ is called passing an exception. Unlike a
374raise, this exception is not used in matching only to pass information about
375the cause of the cancellation.
376
377Handling of a cancellation depends on which stack is being cancelled.
378\begin{description}
379\item[Main Stack:]
380The main stack is the one used by the program main at the start of execution,
381and is the only stack in a sequential program. Hence, when cancellation is
382forwarded to the main stack, there is no other forwarding stack, so after the
383stack is unwound, there is a program-level abort.
384
385\item[Thread Stack:]
386A thread stack is created for a @thread@ object or object that satisfies the
387@is_thread@ trait. A thread only has two points of communication that must
388happen: start and join. As the thread must be running to perform a
389cancellation, it must occur after start and before join, so join is a
390cancellation point. After the stack is unwound, the thread halts and waits for
391another thread to join with it. The joining thread, checks for a cancellation,
392and if present, resumes exception @ThreadCancelled@.
393
394There is a subtle difference between the explicit join (@join@ function) and
395implicit join (from a destructor call). The explicit join takes the default
396handler (@defaultResumptionHandler@) from its calling context, which is used if
397the exception is not caught. The implicit join does a program abort instead.
398
399This semantics is for safety. One difficult problem for any exception system is
400defining semantics when an exception is raised during an exception search:
401which exception has priority, the original or new exception? No matter which
402exception is selected, it is possible for the selected one to disrupt or
403destroy the context required for the other. \PAB{I do not understand the
404following sentences.} This loss of information can happen with join but as the
405thread destructor is always run when the stack is being unwound and one
406termination/cancellation is already active. Also since they are implicit they
407are easier to forget about.
408
409\item[Coroutine Stack:] A coroutine stack is created for a @coroutine@ object
410or object that satisfies the @is_coroutine@ trait. A coroutine only knows of
411two other coroutines, its starter and its last resumer. The last resumer has
412the tightest coupling to the coroutine it activated. Hence, cancellation of
413the active coroutine is forwarded to the last resumer after the stack is
414unwound, as the last resumer has the most precise knowledge about the current
415execution. When the resumer restarts, it resumes exception
416@CoroutineCancelled@, which is polymorphic over the coroutine type and has a
417pointer to the cancelled coroutine.
418
419The resume function also has an assertion that the @defaultResumptionHandler@
420for the exception. So it will use the default handler like a regular throw.
421\end{description}
Note: See TracBrowser for help on using the repository browser.