source: doc/theses/andrew_beach_MMath/features.tex @ aa173d8

enumforall-pointer-decayjacob/cs343-translationnew-ast-unique-exprpthread-emulationqualifiedEnum
Last change on this file since aa173d8 was aa173d8, checked in by Peter A. Buhr <pabuhr@…>, 18 months ago

proofread features chapter of Andrew's thesis

  • Property mode set to 100644
File size: 37.9 KB
Line 
1\chapter{Exception Features}
2\label{c:features}
3
4This chapter covers the design and user interface of the \CFA EHM
5and begins with a general overview of EHMs. It is not a strict
6definition of all EHMs nor an exhaustive list of all possible features.
7However it does cover the most common structure and features found in them.
8
9\section{Overview of EHMs}
10% We should cover what is an exception handling mechanism and what is an
11% exception before this. Probably in the introduction. Some of this could
12% move there.
13\subsection{Raise / Handle}
14An exception operation has two main parts: raise and handle.
15These terms are sometimes known as throw and catch but this work uses
16throw/catch as a particular kind of raise/handle.
17These are the two parts that the user writes and may
18be the only two pieces of the EHM that have any syntax in a language.
19
20\paragraph{Raise}
21The raise is the starting point for exception handling
22by raising an exception, which passes it to
23the EHM.
24
25Some well known examples include the @throw@ statements of \Cpp and Java and
26the \code{Python}{raise} statement of Python. In real systems, a raise may
27perform some other work (such as memory management) but for the
28purposes of this overview that can be ignored.
29
30\paragraph{Handle}
31The primary purpose of an EHM is to run some user code to handle a raised
32exception. This code is given, with some other information, in a handler.
33
34A handler has three common features: the previously mentioned user code, a
35region of code it guards, and an exception label/condition that matches
36the raised exception.
37Only raises inside the guarded region and raising exceptions that match the
38label can be handled by a given handler.
39If multiple handlers could can handle an exception,
40EHMs define a rule to pick one, such as ``best match" or ``first found".
41
42The @try@ statements of \Cpp, Java and Python are common examples. All three
43show the common features of guarded region, raise, matching and handler.
44\begin{cfa}
45try {                           // guarded region
46        ...     
47        throw exception;        // raise
48        ...     
49} catch( exception ) {  // matching condition, with exception label
50        ...                             // handler code
51}
52\end{cfa}
53
54\subsection{Propagation}
55After an exception is raised comes what is usually the biggest step for the
56EHM: finding and setting up the handler for execution. The propagation from raise to
57handler can be broken up into three different tasks: searching for a handler,
58matching against the handler and installing the handler.
59
60\paragraph{Searching}
61The EHM begins by searching for handlers that might be used to handle
62the exception. The search is restricted to
63handlers that have the raise site in their guarded
64region.
65The search includes handlers in the current function, as well as any in
66callers on the stack that have the function call in their guarded region.
67
68\paragraph{Matching}
69Each handler found is matched with the raised exception. The exception
70label defines a condition that is used with the exception and decides if
71there is a match or not.
72In languages where the first match is used, this step is intertwined with
73searching; a match check is performed immediately after the search finds
74a handler.
75
76\paragraph{Installing}
77After a handler is chosen, it must be made ready to run.
78The implementation can vary widely to fit with the rest of the
79design of the EHM. The installation step might be trivial or it could be
80the most expensive step in handling an exception. The latter tends to be the
81case when stack unwinding is involved.
82
83If a matching handler is not guaranteed to be found, the EHM needs a
84different course of action for this case.
85This situation only occurs with unchecked exceptions as checked exceptions
86(such as in Java) are guaranteed to find a matching handler.
87The unhandled action is usually very general, such as aborting the program.
88
89\paragraph{Hierarchy}
90A common way to organize exceptions is in a hierarchical structure.
91This pattern comes from object-orientated languages where the
92exception hierarchy is a natural extension of the object hierarchy.
93
94Consider the following exception hierarchy:
95\begin{center}
96\input{exception-hierarchy}
97\end{center}
98A handler labeled with any given exception can handle exceptions of that
99type or any child type of that exception. The root of the exception hierarchy
100(here \code{C}{exception}) acts as a catch-all, leaf types catch single types,
101and the exceptions in the middle can be used to catch different groups of
102related exceptions.
103
104This system has some notable advantages, such as multiple levels of grouping,
105the ability for libraries to add new exception types, and the isolation
106between different sub-hierarchies.
107This design is used in \CFA even though it is not a object-orientated
108language; so different tools are used to create the hierarchy.
109
110% Could I cite the rational for the Python IO exception rework?
111
112\subsection{Completion}
113After the handler has finished, the entire exception operation has to complete
114and continue executing somewhere else. This step is usually simple,
115both logically and in its implementation, as the installation of the handler
116is usually set up to do most of the work.
117
118The EHM can return control to many different places, where
119the most common are after the handler definition (termination)
120and after the raise (resumption).
121
122\subsection{Communication}
123For effective exception handling, additional information is often passed
124from the raise to the handler and back again.
125So far, only communication of the exception's identity is covered.
126A common communication method for passing more information is putting fields into the exception instance
127and giving the handler access to them.
128Using reference fields pointing to data at the raise location allows data to be
129passed in both directions.
130
131\section{Virtuals}
132Virtual types and casts are not part of \CFA's EHM nor are they required for
133an EHM.
134However, one of the best ways to support an exception hierarchy
135is via a virtual hierarchy and dispatch system.
136
137Ideally, the virtual system should have been part of \CFA before the work
138on exception handling began, but unfortunately it was not.
139Hence, only the features and framework needed for the EHM were
140designed and implemented for this thesis. Other features were considered to ensure that
141the structure could accommodate other desirable features in the future
142but are not implemented.
143The rest of this section only discusses the implemented subset of the
144virtual-system design.
145
146The virtual system supports multiple ``trees" of types. Each tree is
147a simple hierarchy with a single root type. Each type in a tree has exactly
148one parent -- except for the root type which has zero parents -- and any
149number of children.
150Any type that belongs to any of these trees is called a virtual type.
151
152% A type's ancestors are its parent and its parent's ancestors.
153% The root type has no ancestors.
154% A type's descendants are its children and its children's descendants.
155
156Every virtual type also has a list of virtual members. Children inherit
157their parent's list of virtual members but may add new members to it.
158It is important to note that these are virtual members, not virtual methods
159of object-orientated programming, and can be of any type.
160
161\PAB{Need to look at these when done.
162
163\CFA still supports virtual methods as a special case of virtual members.
164Function pointers that take a pointer to the virtual type are modified
165with each level of inheritance so that refers to the new type.
166This means an object can always be passed to a function in its virtual table
167as if it were a method.
168\todo{Clarify (with an example) virtual methods.}
169
170Each virtual type has a unique id.
171This id and all the virtual members are combined
172into a virtual table type. Each virtual type has a pointer to a virtual table
173as a hidden field.
174\todo{Might need a diagram for virtual structure.}
175}%
176
177Up until this point the virtual system is similar to ones found in
178object-orientated languages but this is where \CFA diverges. Objects encapsulate a
179single set of methods in each type, universally across the entire program,
180and indeed all programs that use that type definition. Even if a type inherits and adds methods, it still encapsulate a
181single set of methods. In this sense,
182object-oriented types are ``closed" and cannot be altered.
183
184In \CFA, types do not encapsulate any code. Traits are local for each function and
185types can satisfy a local trait, stop satisfying it or, satisfy the same
186trait in a different way at any lexical location in the program where a function is call.
187In this sense, the set of functions/variables that satisfy a trait for a type is ``open" as the set can change at every call site.
188This capability means it is impossible to pick a single set of functions
189that represent a type's implementation across a program.
190
191\CFA side-steps this issue by not having a single virtual table for each
192type. A user can define virtual tables that are filled in at their
193declaration and given a name. Anywhere that name is visible, even if it is
194defined locally inside a function \PAB{What does this mean? (although that means it does not have a
195static lifetime)}, it can be used.
196Specifically, a virtual type is ``bound" to a virtual table that
197sets the virtual members for that object. The virtual members can be accessed
198through the object.
199
200While much of the virtual infrastructure is created, it is currently only used
201internally for exception handling. The only user-level feature is the virtual
202cast, which is the same as the \Cpp \code{C++}{dynamic_cast}.
203\label{p:VirtualCast}
204\begin{cfa}
205(virtual TYPE)EXPRESSION
206\end{cfa}
207Note, the syntax and semantics matches a C-cast, rather than the function-like
208\Cpp syntax for special casts. Both the type of @EXPRESSION@ and @TYPE@ must be
209a pointer to a virtual type.
210The cast dynamically checks if the @EXPRESSION@ type is the same or a sub-type
211of @TYPE@, and if true, returns a pointer to the
212@EXPRESSION@ object, otherwise it returns @0p@ (null pointer).
213
214\section{Exception}
215% Leaving until later, hopefully it can talk about actual syntax instead
216% of my many strange macros. Syntax aside I will also have to talk about the
217% features all exceptions support.
218
219Exceptions are defined by the trait system; there are a series of traits, and
220if a type satisfies them, then it can be used as an exception. The following
221is the base trait all exceptions need to match.
222\begin{cfa}
223trait is_exception(exceptT &, virtualT &) {
224        // Numerous imaginary assertions.
225};
226\end{cfa}
227The trait is defined over two types, the exception type and the virtual table
228type. Each exception type should have a single virtual table type.
229There are no actual assertions in this trait because the trait system
230cannot express them yet (adding such assertions would be part of
231completing the virtual system). The imaginary assertions would probably come
232from a trait defined by the virtual system, and state that the exception type
233is a virtual type, is a descendant of @exception_t@ (the base exception type),
234and note its virtual table type.
235
236% I did have a note about how it is the programmer's responsibility to make
237% sure the function is implemented correctly. But this is true of every
238% similar system I know of (except Agda's I guess) so I took it out.
239
240There are two more traits for exceptions defined as follows:
241\begin{cfa}
242trait is_termination_exception(
243                exceptT &, virtualT & | is_exception(exceptT, virtualT)) {
244        void defaultTerminationHandler(exceptT &);
245};
246
247trait is_resumption_exception(
248                exceptT &, virtualT & | is_exception(exceptT, virtualT)) {
249        void defaultResumptionHandler(exceptT &);
250};
251\end{cfa}
252Both traits ensure a pair of types are an exception type, its virtual table
253type,
254and defines one of the two default handlers. The default handlers are used
255as fallbacks and are discussed in detail in \vref{s:ExceptionHandling}.
256
257However, all three of these traits can be tricky to use directly.
258While there is a bit of repetition required,
259the largest issue is that the virtual table type is mangled and not in a user
260facing way. So these three macros are provided to wrap these traits to
261simplify referring to the names:
262@IS_EXCEPTION@, @IS_TERMINATION_EXCEPTION@, and @IS_RESUMPTION_EXCEPTION@.
263
264All three take one or two arguments. The first argument is the name of the
265exception type. The macro passes its unmangled and mangled form to the trait.
266The second (optional) argument is a parenthesized list of polymorphic
267arguments. This argument is only used with polymorphic exceptions and the
268list is be passed to both types.
269In the current set-up, the two types always have the same polymorphic
270arguments so these macros can be used without losing flexibility.
271
272For example consider a function that is polymorphic over types that have a
273defined arithmetic exception:
274\begin{cfa}
275forall(Num | IS_EXCEPTION(Arithmetic, (Num)))
276void some_math_function(Num & left, Num & right);
277\end{cfa}
278
279\section{Exception Handling}
280\label{s:ExceptionHandling}
281As stated,
282\CFA provides two kinds of exception handling: termination and resumption.
283These twin operations are the core of \CFA's exception handling mechanism.
284This section covers the general patterns shared by the two operations and
285then goes on to cover the details of each individual operation.
286
287Both operations follow the same set of steps.
288First, a user raises an exception.
289Second, the exception propagates up the stack.
290Third, if a handler is found, the exception is caught and the handler is run.
291After that control continues at a raise-dependent location.
292Fourth, if a handler is not found, a default handler is run and, if it returns, then control
293continues after the raise.
294
295%This general description covers what the two kinds have in common.
296The differences in the two operations include how propagation is performed, where execution continues
297after an exception is caught and handled, and which default handler is run.
298
299\subsection{Termination}
300\label{s:Termination}
301Termination handling is the familiar EHM and used in most programming
302languages with exception handling.
303It is a dynamic, non-local goto. If the raised exception is matched and
304handled, the stack is unwound and control (usually) continues in the function
305on the call stack that defined the handler.
306Termination is commonly used when an error has occurred and recovery is
307impossible locally.
308
309% (usually) Control can continue in the current function but then a different
310% control flow construct should be used.
311
312A termination raise is started with the @throw@ statement:
313\begin{cfa}
314throw EXPRESSION;
315\end{cfa}
316The expression must return a reference to a termination exception, where the
317termination exception is any type that satisfies the trait
318@is_termination_exception@ at the call site.
319Through \CFA's trait system, the trait functions are implicitly passed into the
320throw code for use by the EHM.
321A new @defaultTerminationHandler@ can be defined in any scope to
322change the throw's behaviour when a handler is not found (see below).
323
324The throw copies the provided exception into managed memory to ensure
325the exception is not destroyed if the stack is unwound.
326It is the user's responsibility to ensure the original exception is cleaned
327up whether the stack is unwound or not. Allocating it on the stack is
328usually sufficient.
329
330% How to say propagation starts, its first sub-step is the search.
331Then propagation starts with the search. \CFA uses a ``first match" rule so
332matching is performed with the copied exception as the search key.
333It starts from the raise in the throwing function and proceeds towards the base of the stack,
334from callee to caller.
335At each stack frame, a check is made for termination handlers defined by the
336@catch@ clauses of a @try@ statement.
337\begin{cfa}
338try {
339        GUARDED_BLOCK
340} catch (EXCEPTION_TYPE$\(_1\)$ * [NAME$\(_1\)$]) {
341        HANDLER_BLOCK$\(_1\)$
342} catch (EXCEPTION_TYPE$\(_2\)$ * [NAME$\(_2\)$]) {
343        HANDLER_BLOCK$\(_2\)$
344}
345\end{cfa}
346When viewed on its own, a try statement simply executes the statements
347in the \snake{GUARDED_BLOCK}, and when those are finished,
348the try statement finishes.
349
350However, while the guarded statements are being executed, including any
351invoked functions, all the handlers in these statements are included in the
352search path.
353Hence, if a termination exception is raised, these handlers may be matched
354against the exception and may handle it.
355
356Exception matching checks the handler in each catch clause in the order
357they appear, top to bottom. If the representation of the raised exception type
358is the same or a descendant of @EXCEPTION_TYPE@$_i$, then @NAME@$_i$
359(if provided) is
360bound to a pointer to the exception and the statements in @HANDLER_BLOCK@$_i$
361are executed. If control reaches the end of the handler, the exception is
362freed and control continues after the try statement.
363
364If no termination handler is found during the search, then the default handler
365(\defaultTerminationHandler) visible at the raise statement is called.
366Through \CFA's trait system the best match at the raise statement is used.
367This function is run and is passed the copied exception.
368If the default handler finishes, control continues after the raise statement.
369
370There is a global @defaultTerminationHandler@ that is polymorphic over all
371termination exception types.
372The global default termination handler performs a cancellation
373(see \vref{s:Cancellation} for the justification) on the current stack with the copied exception.
374Since it is so general, a more specific handler is usually
375defined, possibly with a detailed message, and used for specific exception type, effectively overriding the default handler.
376
377\subsection{Resumption}
378\label{s:Resumption}
379
380Resumption exception handling is the less familar EHM, but is
381just as old~\cite{Goodenough75} and is simpler in many ways.
382It is a dynamic, non-local function call. If the raised exception is
383matched, a closure is taken from up the stack and executed,
384after which the raising function continues executing.
385The common uses for resumption exceptions include
386potentially repairable errors, where execution can continue in the same
387function once the error is corrected, and
388ignorable events, such as logging where nothing needs to happen and control
389should always continue from the raise point.
390
391A resumption raise is started with the @throwResume@ statement:
392\begin{cfa}
393throwResume EXPRESSION;
394\end{cfa}
395\todo{Decide on a final set of keywords and use them everywhere.}
396It works much the same way as the termination throw.
397The expression must return a reference to a resumption exception,
398where the resumption exception is any type that satisfies the trait
399@is_resumption_exception@ at the call site.
400The assertions from this trait are available to
401the exception system while handling the exception.
402
403At run-time, no exception copy is made, since
404resumption does not unwind the stack nor otherwise remove values from the
405current scope, so there is no need to manage memory to keep the exception in scope.
406
407Then propagation starts with the search. It starts from the raise in the
408resuming function and proceeds towards the base of the stack,
409from callee to caller.
410At each stack frame, a check is made for resumption handlers defined by the
411@catchResume@ clauses of a @try@ statement.
412\begin{cfa}
413try {
414        GUARDED_BLOCK
415} catchResume (EXCEPTION_TYPE$\(_1\)$ * [NAME$\(_1\)$]) {
416        HANDLER_BLOCK$\(_1\)$
417} catchResume (EXCEPTION_TYPE$\(_2\)$ * [NAME$\(_2\)$]) {
418        HANDLER_BLOCK$\(_2\)$
419}
420\end{cfa}
421% PAB, you say this above.
422% When a try statement is executed, it simply executes the statements in the
423% @GUARDED_BLOCK@ and then finishes.
424%
425% However, while the guarded statements are being executed, including any
426% invoked functions, all the handlers in these statements are included in the
427% search path.
428% Hence, if a resumption exception is raised, these handlers may be matched
429% against the exception and may handle it.
430%
431% Exception matching checks the handler in each catch clause in the order
432% they appear, top to bottom. If the representation of the raised exception type
433% is the same or a descendant of @EXCEPTION_TYPE@$_i$, then @NAME@$_i$
434% (if provided) is bound to a pointer to the exception and the statements in
435% @HANDLER_BLOCK@$_i$ are executed.
436% If control reaches the end of the handler, execution continues after the
437% the raise statement that raised the handled exception.
438%
439% Like termination, if no resumption handler is found during the search,
440% then the default handler (\defaultResumptionHandler) visible at the raise
441% statement is called. It will use the best match at the raise sight according
442% to \CFA's overloading rules. The default handler is
443% passed the exception given to the raise. When the default handler finishes
444% execution continues after the raise statement.
445%
446% There is a global @defaultResumptionHandler{} is polymorphic over all
447% resumption exceptions and performs a termination throw on the exception.
448% The \defaultTerminationHandler{} can be overridden by providing a new
449% function that is a better match.
450
451The @GUARDED_BLOCK@ and its associated nested guarded statements work the same
452for resumption as for termination, as does exception matching at each
453@catchResume@. Similarly, if no resumption handler is found during the search,
454then the currently visible default handler (\defaultResumptionHandler) is
455called and control continues after the raise statement if it returns. Finally,
456there is also a global @defaultResumptionHandler@, which can be overridden,
457that is polymorphic over all resumption exceptions but performs a termination
458throw on the exception rather than a cancellation.
459
460Throwing the exception in @defaultResumptionHandler@ has the positive effect of
461walking the stack a second time for a recovery handler. Hence, a programmer has
462two chances for help with a problem, fixup or recovery, should either kind of
463handler appear on the stack. However, this dual stack walk leads to following
464apparent anomaly:
465\begin{cfa}
466try {
467        throwResume E;
468} catch (E) {
469        // this handler runs
470}
471\end{cfa}
472because the @catch@ appears to handle a @throwResume@, but a @throwResume@ only
473matches with @catchResume@. The anomaly results because the unmatched
474@catchResuem@, calls @defaultResumptionHandler@, which in turn throws @E@.
475
476% I wonder if there would be some good central place for this.
477Note, termination and resumption handlers may be used together
478in a single try statement, intermixing @catch@ and @catchResume@ freely.
479Each type of handler only interacts with exceptions from the matching
480kind of raise.
481
482\subsubsection{Resumption Marking}
483\label{s:ResumptionMarking}
484A key difference between resumption and termination is that resumption does
485not unwind the stack. A side effect is that, when a handler is matched
486and run, its try block (the guarded statements) and every try statement
487searched before it are still on the stack. There presence can lead to
488the \emph{recursive resumption problem}.
489
490The recursive resumption problem is any situation where a resumption handler
491ends up being called while it is running.
492Consider a trivial case:
493\begin{cfa}
494try {
495        throwResume (E &){};
496} catchResume(E *) {
497        throwResume (E &){};
498}
499\end{cfa}
500When this code is executed, the guarded @throwResume@ starts a
501search and matches the handler in the @catchResume@ clause. This
502call is placed on the stack above the try-block. Now the second raise in the handler
503searches the same try block, matches, and puts another instance of the
504same handler on the stack leading to infinite recursion.
505
506While this situation is trivial and easy to avoid, much more complex cycles can
507form with multiple handlers and different exception types.  The key point is
508that the programmer's intuition expects every raise in a handler to start
509searching \emph{below} the @try@ statement, making it difficult to understand
510and fix the problem.
511
512To prevent all of these cases, each try statement is ``marked" from the
513time the exception search reaches it to either when a matching handler
514completes or when the search reaches the base
515of the stack.
516While a try statement is marked, its handlers are never matched, effectively
517skipping over it to the next try statement.
518
519\begin{center}
520\input{stack-marking}
521\end{center}
522
523There are other sets of marking rules that could be used,
524for instance, marking just the handlers that caught the exception,
525would also prevent recursive resumption.
526However, the rule selected mirrors what happens with termination,
527and hence, matches programmer intuition that a raise searches below a try.
528
529In detail, the marked try statements are the ones that would be removed from
530the stack for a termination exception, \ie those on the stack
531between the handler and the raise statement.
532This symmetry applies to the default handler as well, as both kinds of
533default handlers are run at the raise statement, rather than (physically
534or logically) at the bottom of the stack.
535% In early development having the default handler happen after
536% unmarking was just more useful. We assume that will continue.
537
538\section{Conditional Catch}
539Both termination and resumption handler clauses can be given an additional
540condition to further control which exceptions they handle:
541\begin{cfa}
542catch (EXCEPTION_TYPE * [NAME] ; CONDITION)
543\end{cfa}
544First, the same semantics is used to match the exception type. Second, if the
545exception matches, @CONDITION@ is executed. The condition expression may
546reference all names in scope at the beginning of the try block and @NAME@
547introduced in the handler clause. If the condition is true, then the handler
548matches. Otherwise, the exception search continues as if the exception type
549did not match.
550
551The condition matching allows finer matching by checking
552more kinds of information than just the exception type.
553\begin{cfa}
554try {
555        handle1 = open( f1, ... );
556        handle2 = open( f2, ... );
557        handle3 = open( f3, ... );
558        ...
559} catch( IOFailure * f ; fd( f ) == f1 ) {
560        // Only handle IO failure for f1.
561} catch( IOFailure * f ; fd( f ) == f3 ) {
562        // Only handle IO failure for f3.
563}
564// Handle a failure relating to f2 further down the stack.
565\end{cfa}
566In this example the file that experienced the IO error is used to decide
567which handler should be run, if any at all.
568
569\begin{comment}
570% I know I actually haven't got rid of them yet, but I'm going to try
571% to write it as if I had and see if that makes sense:
572\section{Reraising}
573\label{s:Reraising}
574Within the handler block or functions called from the handler block, it is
575possible to reraise the most recently caught exception with @throw@ or
576@throwResume@, respectively.
577\begin{cfa}
578try {
579        ...
580} catch( ... ) {
581        ... throw;
582} catchResume( ... ) {
583        ... throwResume;
584}
585\end{cfa}
586The only difference between a raise and a reraise is that reraise does not
587create a new exception; instead it continues using the current exception, \ie
588no allocation and copy. However the default handler is still set to the one
589visible at the raise point, and hence, for termination could refer to data that
590is part of an unwound stack frame. To prevent this problem, a new default
591handler is generated that does a program-level abort.
592\end{comment}
593
594\subsection{Comparison with Reraising}
595Without conditional catch, the only approach to match in more detail is to reraise
596the exception after it has been caught, if it could not be handled.
597\begin{center}
598\begin{tabular}{l|l}
599\begin{cfa}
600try {
601        do_work_may_throw();
602} catch(excep_t * ex; can_handle(ex)) {
603
604        handle(ex);
605
606
607
608}
609\end{cfa}
610&
611\begin{cfa}
612try {
613        do_work_may_throw();
614} catch(excep_t * ex) {
615        if (can_handle(ex)) {
616                handle(ex);
617        } else {
618                throw;
619        }
620}
621\end{cfa}
622\end{tabular}
623\end{center}
624Notice catch-and-reraise increases complexity by adding additional data and
625code to the exception process. Nevertheless, catch-and-reraise can simulate
626conditional catch straightforwardly, when exceptions are disjoint, \ie no
627inheritance.
628
629However, catch-and-reraise simulation becomes unusable for exception inheritance.
630\begin{flushleft}
631\begin{cfa}[xleftmargin=6pt]
632exception E1;
633exception E2(E1); // inheritance
634\end{cfa}
635\begin{tabular}{l|l}
636\begin{cfa}
637try {
638        ... foo(); ... // raise E1/E2
639        ... bar(); ... // raise E1/E2
640} catch( E2 e; e.rtn == foo ) {
641        ...
642} catch( E1 e; e.rtn == foo ) {
643        ...
644} catch( E1 e; e.rtn == bar ) {
645        ...
646}
647
648\end{cfa}
649&
650\begin{cfa}
651try {
652        ... foo(); ...
653        ... bar(); ...
654} catch( E2 e ) {
655        if ( e.rtn == foo ) { ...
656        } else throw; // reraise
657} catch( E1 e ) {
658        if (e.rtn == foo) { ...
659        } else if (e.rtn == bar) { ...
660        else throw; // reraise
661}
662\end{cfa}
663\end{tabular}
664\end{flushleft}
665The derived exception @E2@ must be ordered first in the catch list, otherwise
666the base exception @E1@ catches both exceptions. In the catch-and-reraise code
667(right), the @E2@ handler catches exceptions from both @foo@ and
668@bar@. However, the reraise misses the following catch clause. To fix this
669problem, an enclosing @try@ statement is need to catch @E2@ for @bar@ from the
670reraise, and its handler must duplicate the inner handler code for @bar@. To
671generalize, this fix for any amount of inheritance and complexity of try
672statement requires a technique called \emph{try-block
673splitting}~\cite{Krischer02}, which is not discussed in this thesis. It is
674sufficient to state that conditional catch is more expressive than
675catch-and-reraise in terms of complexity.
676
677\begin{comment}
678That is, they have the same behaviour in isolation.
679Two things can expose differences between these cases.
680
681One is the existence of multiple handlers on a single try statement.
682A reraise skips all later handlers for a try statement but a conditional
683catch does not.
684% Hence, if an earlier handler contains a reraise later handlers are
685% implicitly skipped, with a conditional catch they are not.
686Still, they are equivalently powerful,
687both can be used two mimic the behaviour of the other,
688as reraise can pack arbitrary code in the handler and conditional catches
689can put arbitrary code in the predicate.
690% I was struggling with a long explanation about some simple solutions,
691% like repeating a condition on later handlers, and the general solution of
692% merging everything together. I don't think it is useful though unless its
693% for a proof.
694% https://en.cppreference.com/w/cpp/language/throw
695
696The question then becomes ``Which is a better default?"
697We believe that not skipping possibly useful handlers is a better default.
698If a handler can handle an exception it should and if the handler can not
699handle the exception then it is probably safer to have that explicitly
700described in the handler itself instead of implicitly described by its
701ordering with other handlers.
702% Or you could just alter the semantics of the throw statement. The handler
703% index is in the exception so you could use it to know where to start
704% searching from in the current try statement.
705% No place for the `goto else;` metaphor.
706
707The other issue is all of the discussion above assumes that the only
708way to tell apart two raises is the exception being raised and the remaining
709search path.
710This is not true generally, the current state of the stack can matter in
711a number of cases, even only for a stack trace after an program abort.
712But \CFA has a much more significant need of the rest of the stack, the
713default handlers for both termination and resumption.
714
715% For resumption it turns out it is possible continue a raise after the
716% exception has been caught, as if it hadn't been caught in the first place.
717This becomes a problem combined with the stack unwinding used in termination
718exception handling.
719The stack is unwound before the handler is installed, and hence before any
720reraises can run. So if a reraise happens the previous stack is gone,
721the place on the stack where the default handler was supposed to run is gone,
722if the default handler was a local function it may have been unwound too.
723There is no reasonable way to restore that information, so the reraise has
724to be considered as a new raise.
725This is the strongest advantage conditional catches have over reraising,
726they happen before stack unwinding and avoid this problem.
727
728% The one possible disadvantage of conditional catch is that it runs user
729% code during the exception search. While this is a new place that user code
730% can be run destructors and finally clauses are already run during the stack
731% unwinding.
732%
733% https://www.cplusplus.com/reference/exception/current_exception/
734%   `exception_ptr current_exception() noexcept;`
735% https://www.python.org/dev/peps/pep-0343/
736\end{comment}
737
738\section{Finally Clauses}
739\label{s:FinallyClauses}
740Finally clauses are used to preform unconditional clean-up when leaving a
741scope and are placed at the end of a try statement after any handler clauses:
742\begin{cfa}
743try {
744        GUARDED_BLOCK
745} ... // any number or kind of handler clauses
746... finally {
747        FINALLY_BLOCK
748}
749\end{cfa}
750The @FINALLY_BLOCK@ is executed when the try statement is removed from the
751stack, including when the @GUARDED_BLOCK@ finishes, any termination handler
752finishes, or during an unwind.
753The only time the block is not executed is if the program is exited before
754the stack is unwound.
755
756Execution of the finally block should always finish, meaning control runs off
757the end of the block. This requirement ensures control always continues as if
758the finally clause is not present, \ie finally is for cleanup not changing
759control flow.
760Because of this requirement, local control flow out of the finally block
761is forbidden. The compiler precludes any @break@, @continue@, @fallthru@ or
762@return@ that causes control to leave the finally block. Other ways to leave
763the finally block, such as a long jump or termination are much harder to check,
764and at best requiring additional run-time overhead, and so are only
765discouraged.
766
767Not all languages with unwinding have finally clauses. Notably \Cpp does
768without it as destructors, and the RAII design pattern, serve a similar role.
769Although destructors and finally clauses can be used for the same cases,
770they have their own strengths, similar to top-level function and lambda
771functions with closures.
772Destructors take more work for their creation, but if there is clean-up code
773that needs to be run every time a type is used, they are much easier
774to set-up.
775On the other hand finally clauses capture the local context, so is easy to
776use when the clean-up is not dependent on the type of a variable or requires
777information from multiple variables.
778
779\section{Cancellation}
780\label{s:Cancellation}
781Cancellation is a stack-level abort, which can be thought of as as an
782uncatchable termination. It unwinds the entire current stack, and if
783possible forwards the cancellation exception to a different stack.
784
785Cancellation is not an exception operation like termination or resumption.
786There is no special statement for starting a cancellation; instead the standard
787library function @cancel_stack@ is called passing an exception. Unlike a
788raise, this exception is not used in matching only to pass information about
789the cause of the cancellation.
790Finaly, since a cancellation only unwinds and forwards, there is no default handler.
791
792After @cancel_stack@ is called the exception is copied into the EHM's memory
793and the current stack is unwound.
794The behaviour after that depends on the kind of stack being cancelled.
795
796\paragraph{Main Stack}
797The main stack is the one used by the program main at the start of execution,
798and is the only stack in a sequential program.
799After the main stack is unwound there is a program-level abort.
800
801The reasons for this semantics in a sequential program is that there is no more code to execute.
802This semantics also applies to concurrent programs, too, even if threads are running.
803That is, if any threads starts a cancellation, it implies all threads terminate.
804Keeping the same behaviour in sequential and concurrent programs is simple.
805Also, even in concurrent programs there may not currently be any other stacks
806and even if other stacks do exist, main has no way to know where they are.
807
808\paragraph{Thread Stack}
809A thread stack is created for a \CFA @thread@ object or object that satisfies
810the @is_thread@ trait.
811After a thread stack is unwound, the exception is stored until another
812thread attempts to join with it. Then the exception @ThreadCancelled@,
813which stores a reference to the thread and to the exception passed to the
814cancellation, is reported from the join to the joining thread.
815There is one difference between an explicit join (with the @join@ function)
816and an implicit join (from a destructor call). The explicit join takes the
817default handler (@defaultResumptionHandler@) from its calling context while
818the implicit join provides its own; which does a program abort if the
819@ThreadCancelled@ exception cannot be handled.
820
821The communication and synchronization are done here because threads only have
822two structural points (not dependent on user-code) where
823communication/synchronization happens: start and join.
824Since a thread must be running to perform a cancellation (and cannot be
825cancelled from another stack), the cancellation must be after start and
826before the join, so join is used.
827
828% TODO: Find somewhere to discuss unwind collisions.
829The difference between the explicit and implicit join is for safety and
830debugging. It helps prevent unwinding collisions by avoiding throwing from
831a destructor and prevents cascading the error across multiple threads if
832the user is not equipped to deal with it.
833It is always possible to add an explicit join if that is the desired behaviour.
834
835With explicit join and a default handler that triggers a cancellation, it is
836possible to cascade an error across any number of threads, cleaning up each
837in turn, until the error is handled or the main thread is reached.
838
839\paragraph{Coroutine Stack}
840A coroutine stack is created for a @coroutine@ object or object that
841satisfies the @is_coroutine@ trait.
842After a coroutine stack is unwound, control returns to the @resume@ function
843that most recently resumed it. @resume@ reports a
844@CoroutineCancelled@ exception, which contains a references to the cancelled
845coroutine and the exception used to cancel it.
846The @resume@ function also takes the \defaultResumptionHandler{} from the
847caller's context and passes it to the internal report.
848
849A coroutine only knows of two other coroutines, its starter and its last resumer.
850The starter has a much more distant connection, while the last resumer just
851(in terms of coroutine state) called resume on this coroutine, so the message
852is passed to the latter.
853
854With a default handler that triggers a cancellation, it is possible to
855cascade an error across any number of coroutines, cleaning up each in turn,
856until the error is handled or a thread stack is reached.
857
858\PAB{Part of this I do not understand. A cancellation cannot be caught. But you
859talk about handling a cancellation in the last sentence. Which is correct?}
Note: See TracBrowser for help on using the repository browser.