Safe Haskell and instance coherence

Hello, It's a relatively well-known fact that GHC allows for multiple type class instances for the same type to coexist in a single program. This can be used, for example, to construct values of the type Data.Set.Set that violate the data structure invariant. I was mildly surprised to find out that this works even when Safe Haskell is turned on: https://gist.github.com/3854294 Note that the warnings tell us that both instances are "[safe]" which gives a false sense of security. I couldn't find anything on the interplay between orphan instances and Safe Haskell both in the Haskell'12 paper and online. Is this something that the authors of Safe Haskell are aware of/are intending to fix? -- () ascii ribbon campaign - against html e-mail /\ www.asciiribbon.org - against proprietary attachments

On 08/10/2012 20:11, Mikhail Glushenkov wrote:
Hello,
It's a relatively well-known fact that GHC allows for multiple type class instances for the same type to coexist in a single program. This can be used, for example, to construct values of the type Data.Set.Set that violate the data structure invariant. I was mildly surprised to find out that this works even when Safe Haskell is turned on:
https://gist.github.com/3854294
Note that the warnings tell us that both instances are "[safe]" which gives a false sense of security.
I couldn't find anything on the interplay between orphan instances and Safe Haskell both in the Haskell'12 paper and online. Is this something that the authors of Safe Haskell are aware of/are intending to fix?
A fine point. Arguably this violates the module abstraction guarantee, because you are able to discover something about the implementation of Set by violating its assumption that the Ord instance for a given type is always the same. I don't know what we should do about this. Disallowing orphan instances seems a bit heavy-handed. David, Simon, any thoughts? (can someone forward this to David Mazieres? all the email addresses I have for him seem to have expired :-) Cheers, Simon

Hello Simon,
On Thu, Oct 11, 2012 at 11:24 AM, Simon Marlow
On 08/10/2012 20:11, Mikhail Glushenkov wrote:
I couldn't find anything on the interplay between orphan instances and Safe Haskell both in the Haskell'12 paper and online. Is this something that the authors of Safe Haskell are aware of/are intending to fix?
[...] I don't know what we should do about this. Disallowing orphan instances seems a bit heavy-handed. David, Simon, any thoughts?
What about detecting duplicate instances at link time? We could put information about all instances defined in a given module into the .comment section of the corresponding .o file and then have a pre-link step script extract this information from all .o files in the program and check that there are no duplicate or conflicting instances. -- () ascii ribbon campaign - against html e-mail /\ www.asciiribbon.org - against proprietary attachments

On Oct 11, 2012, at 5:30 PM, Mikhail Glushenkov
Hello Simon,
On Thu, Oct 11, 2012 at 11:24 AM, Simon Marlow
wrote: On 08/10/2012 20:11, Mikhail Glushenkov wrote:
I couldn't find anything on the interplay between orphan instances and Safe Haskell both in the Haskell'12 paper and online. Is this something that the authors of Safe Haskell are aware of/are intending to fix?
[...] I don't know what we should do about this. Disallowing orphan instances seems a bit heavy-handed. David, Simon, any thoughts?
What about detecting duplicate instances at link time? We could put information about all instances defined in a given module into the .comment section of the corresponding .o file and then have a pre-link step script extract this information from all .o files in the program and check that there are no duplicate or conflicting instances.
You have a bigger problem coming. Some extensions make multiple instances OK, even in Safe Haskell. For example: {-# LANGUAGE FlexibleInstances, IncoherentInstances, Safe #-} module Over where data Nil = Nil newtype Cons a = Cons a class Number n where value :: n -> Integer instance Number Nil where value Nil = 0 instance Number a => Number (Cons a) where value (Cons n) = value n + 1 instance Number (Cons (Cons Nil)) where value (Cons (Cons Nil)) = 2012 naturals = nats Nil where nats :: Number n => n -> [Integer] nats n = value n : nats (Cons n) Here we have two different instances Number (Con (Cons Nil)) at play, because it gives you: *Over> value (Cons (Cons Nil)) 2012 *Over> take 5 naturals [0,1,2,3,4]

Hello,
On Thu, Oct 11, 2012 at 3:54 PM, MigMit
You have a bigger problem coming. Some extensions make multiple instances OK, even in Safe Haskell. For example:
{-# LANGUAGE FlexibleInstances, IncoherentInstances, Safe #-} [...]
Safe Haskell already disallows OverlappingInstances. If we add a requirement that it must be unambiguous which instance declaration a given type class constraint resolves to (taking into account instances defined in all modules), I think it will be necessary to also disallow IncoherentInstances. -- () ascii ribbon campaign - against html e-mail /\ www.asciiribbon.org - against proprietary attachments

On Oct 11, 2012, at 6:23 PM, Mikhail Glushenkov
Hello,
On Thu, Oct 11, 2012 at 3:54 PM, MigMit
wrote: You have a bigger problem coming. Some extensions make multiple instances OK, even in Safe Haskell. For example:
{-# LANGUAGE FlexibleInstances, IncoherentInstances, Safe #-} [...]
Safe Haskell already disallows OverlappingInstances.
It doesn't. Overlapping instances are allowed in safe modules, provided that they won't be used in other modules.

Hello,
On Thu, Oct 11, 2012 at 4:33 PM, MigMit
On Oct 11, 2012, at 6:23 PM, Mikhail Glushenkov
wrote: On Thu, Oct 11, 2012 at 3:54 PM, MigMit
wrote: You have a bigger problem coming. Some extensions make multiple instances OK, even in Safe Haskell. For example:
{-# LANGUAGE FlexibleInstances, IncoherentInstances, Safe #-} [...]
Safe Haskell already disallows OverlappingInstances.
It doesn't. Overlapping instances are allowed in safe modules, provided that they won't be used in other modules.
I stand corrected. Still, I think that something will have to be done about IncoherentInstances if the aforementioned restriction will be added. -- () ascii ribbon campaign - against html e-mail /\ www.asciiribbon.org - against proprietary attachments

I hate to admit it, but it seems to me now that one would need dependent types to guarantee Set's good behavior (so that the dictionary for the Ord instance is contained within the Set type).
Отправлено с iPhone
Oct 11, 2012, в 18:42, Mikhail Glushenkov
Hello,
On Thu, Oct 11, 2012 at 4:33 PM, MigMit
wrote: On Oct 11, 2012, at 6:23 PM, Mikhail Glushenkov
wrote: On Thu, Oct 11, 2012 at 3:54 PM, MigMit
wrote: You have a bigger problem coming. Some extensions make multiple instances OK, even in Safe Haskell. For example:
{-# LANGUAGE FlexibleInstances, IncoherentInstances, Safe #-} [...]
Safe Haskell already disallows OverlappingInstances.
It doesn't. Overlapping instances are allowed in safe modules, provided that they won't be used in other modules.
I stand corrected. Still, I think that something will have to be done about IncoherentInstances if the aforementioned restriction will be added.
-- () ascii ribbon campaign - against html e-mail /\ www.asciiribbon.org - against proprietary attachments
participants (3)
-
MigMit
-
Mikhail Glushenkov
-
Simon Marlow