Agoric SES, 10 Apr 2023

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: SES Meeting: SuperFreeze

Description

Approaches for better support of object immutability: readonly ArrayBuffer and slices, superFreeze as the basis for transitive harden while working around the override mistake, and XS’s petrify.

A

Mathieu hofman: welcome to the assess meeting today on the agenda.. We will be talking about immutable objects, and in particular, array, buffer, and also plus, potentially after that,, a super freeze,, which is a trans.

A

Mathieu hofman: a non-transitive version of freeze., but that has.

A

Mathieu hofman: different freezing properties.

A

Mathieu hofman: so on the immutable oray buffer. This is something that came up recently on our side.

A

Mathieu hofman:, we have a need to be able to.

A

Mathieu hofman: share mathieu hofman: what we call copy bytes across the wire.

A

Mathieu hofman: however, all the representation of bytes. Currently in javascript. I mean the representation of byitarian array buffer,, which are all usable, and actually cannot be frozen.

A

Mathieu hofman:, so we need a way to have an object, whether it is array, buffer, related or not., that represents frozen immutable, bytes, and that can be the representation of of those.. So when you receive those copy bytes,, we can create that that object.

A

Mathieu hofman:, or we can also recognize those objects and know that if we pass it around,, it will not mutate under the the hood anymore.

A

Mathieu hofman: there is a proposal from a jack works. Unlimited array buffer,, which I believe is about being able.

A

Mathieu hofman:, I actually don't want to misrepresent. I I I'm not.. I I haven't gone back to the proposal. Recently.

A

Mathieu hofman:, but it I believe it's around.

A

Mathieu hofman: create like transferring and right buffer into a a frozen states. is that right, deck?.

B

Jack works: yes,. There is also another.

B

Jack works: another target for this proposal,, which is.. If the.

B

Jack works: give the slice of a.

B

Jack works: currents are a buffer to others.

B

Jack works:, it must be mutable or immutable. this. This is also useful.

A

Mathieu hofman: yeah.

A

mathieu hofman:, so mathieu hofman: as residents for things that exist currently in the ecosystem.

A

Mathieu hofman: there is the web blob api,, which basically.

A

Mathieu hofman: is a representation of of bites.

A

Mathieu hofman: that you cannot mutate because you can. you have to access.. You have to request a an array buffer which ends up giving you a copy,, a mutable copy of of device.

A

Mathieu hofman:, so that that it would be an approach.

A

Mathieu hofman: that that that's a precedence in the in the in the platform, or in the ecosystem.

A

Mathieu hofman: this topic, also somewhat initially relates to something that I've been advocating for in plenary and outside of it,, which is for.

A

Mathieu hofman:, currently the already buffer api mathieu hofman:, doesn't preclude, copy on right organization,, but no engines actually do them.

A

Mathieu hofman:. And if you think about it., how being able to.

A

Mathieu hofman: create a limited array,, but for a view that cannot be mutated, is.

A

Mathieu hofman:, it's similar to copyright minimization, where you create another, potentially array, buffer. that you are guaranteed to not,, cannot go, and you take the backing. Buffer.

A

Mathieu hofman: so.

A

Mathieu hofman: in general,, I'm wondering what would be the best approach to.

A

Mathieu hofman: have a representation of.

A

Mathieu hofman: immutable bytes in the platform.

A

C

Mark s. miller, (mm, agoric):, so I want to express an opinion that that the copy on right technique is is,. You know well, very valuable.. I would like to,, you know, be nice to to see it happen. It doesn't subsume the need for an immutable,, because the copy and right technique still doesn't give you.

C

Mark s. miller, (mm, agoric):, a pointer that I mean an object reference that can be shared., that.

C

Mark s. miller, (mm, agoric):, that only gives access to.

C

Mark s. miller, (mm, agoric):, a fixed set of bytes.

A

Mathieu hofman: correct., but in my opinion it is red events when you consider an approach like blob.

A

Mathieu hofman: where? mark s. miller, (mm, agoric): yeah,, but blob., but blob only creates a fresh copy when you ask it for a buffer because of the absence of the possibility of a frozen buffer.

A

Mathieu hofman: right?, but the.

D

Mathieu hofman: point is,. If you have copy on the right blog can.,.

A

Mathieu hofman:, when you create a blog from an array buffer,, you create a copy from the area. buffer.

A

Mathieu hofman: log will never mutated so internally. if it was a platform thing like.

A

Mathieu hofman: there could be optimization there and then. whenever someone wants to copy of the the bytes again, see copy on the right of the internal buffer that was captured by the blob.

A

Mathieu hofman:, if nothing is modified,, could end up being backed by the same backing. Buffer.

C

Mark s. miller, (mm, agoric):, so the so that does make sense.. That means the blob itself is the thing that you share.. If you want to share a mutable access to a set of buttons., the thing that I find disturbing about it from an api point of view is just the multiplication of similar abstractions that you've got.. You know we we would.

C

Mark s. miller, (mm, agoric):, we already have array, buffer and you into it arrays and data views.. I've never actually found myself wanting to use a data view., I'm not sure why we need it. In addition to the others.

C

Mark s. miller, (mm,, agoric): and then, on top of of those 3, we would additionally have blobs in order to just get the mutable one.

C

Mark s. miller, (mm, agoric):, I'd like to hear from peter in particular about what model was already done with regard to the round form.

C

Mark s. miller, (mm, agoric): of of these various abstractions,. What what they're.

C

Mark s. miller, (mm, agoric):, whether it's it confirmed,, whether it's beyond the current,, spec or not,. What what the actual semantics are? That's provided by excess when things are in wrong.

A

Mathieu hofman: before it., just quickly., a quick answer.. I I would say, like there- are 3 different 3, distinct things.. The views are that are used on on the the array buffer.. It carries the ability to go and mutate a a that back in data. and then the blog.

A

Mathieu hofman: is basically a way to pass around an immutable version of the device., so the blob of contents,, the line type of the.

B

Mathieu hofman: yes,, correct it blog., the wet blog has also other things like the man type, which may not be relevant. in. In our case, it was more of a concept of.

A

Mathieu hofman: being able to carry.

A

Mathieu hofman: a a container to to pass around that. That represents a mutable bytes.

C

Mark s. miller, (mm, agoric): okay,. Let me just check when you said things like.

C

Mark s. miller, (mm, agoric): additional information like the mime type.

C

Mark s. miller, (mm, agoric):, is there anything else besides the bytes in the mind, type?.

C

Mathieu hofman:, sorry for the phrase,, it has additional things. one. Is that additional information like my so the mine type.? The other thing it has a that's not relevant, is an ability to create web streams to read the the backing data which obviously, we wouldn't be able to bring in the well.. I mean.

A

Mathieu hofman:, what teams are have mathieu hofman: too much deep ties into the web platform to be able to be brought in the language.

C

Mark s. miller, (mm, agoric): okay.

C

mark s. miller, (mm, agoric): okay.

A

Mathieu hofman:, it was more of a concept of a an object to pass around or a buffers.

A

Mark s. miller, (mm, agoric): okay.

C

Mark s. miller, (mm, agoric): yeah., so so that that means that a blob without a blobby thing.

C

Mark s. miller, (mm, agoric): without the mind type mark s. miller, (mm, agoric):, would, on the web platform, not subsume the blob., so the blob,, the web blog,, would continue to exist.

C

Mark s. miller, (mm,, agoric): and so now you've got similar but different things for people on the web platform.

C

Mathieu hofman: a platform blog could be a base class potentially for a web level.

C

Mark s. miller, (mm, agoric): well,, that's base., base class versus some class is still.

C

Mark s. miller, (mm, agoric): 2 different things. mathieu hofman: yeah.

C

mark s. miller, (mm, agoric):, so,, peter.

D

Peter hoddie: hey, mark., you guys hear me?.

C

Mark s. miller, (mm, agoric): yeah.

D

Peter hoddie:, I mean,, so what we've done in excess.

D

Peter hoddie: is,, I mean,, I think, pretty light compared to a lot of the things that approaches. we've been discussing.. Our goal with. the mutability, has has always been not to introduce new things.

D

Peter hoddie: as much as possible. peter hoddie:, and so you know,, we they sort of 2 questions.. This one is: what's the runtime behavior of a mutual or a buffers., and what's the, how do you create them?.

D

Peter hoddie: I'll start with the time, because it's basically invisible. you just have a ray buffers, and they act exactly.

D

Peter hoddie: an immutable array. buffer,. You acts exactly like a regular array buffer until you try to write to it, at which point. it, of course, throws an exception.

D

Peter hoddie:, that's it.

D

jack, works:, yeah., peter hoddie:. It's nothing. you a developer to learn when they're you.

C

Peter hoddie:, and and and how does one create an immutable array. buffer,, that's the that's the part that is slightly magical.

D

Peter hoddie: usual way in our environment that people create in mutable ray buffer. Is they create a mutable,, a regular array, buffer.

D

Peter hoddie:, prior to what in javascript, is called lockdown. and when that.

D

Peter hoddie: that that when the build peter hoddie:, it's the lockdown phase that any array buffers were created up to that point, become a mutable array buffers because they are moved to wrong for storage..

D

Peter hoddie: and so that is, that's magic at the engine level.

D

Peter hoddie: that makes them immutable.. There is some time facility to make an array buffer inutable,, and that is the petrify.

D

Peter hoddie: function.

D

peter hoddie:, it's a general purpose way to make things., and so we just apply that to a.

D

Peter hoddie: okay.. What is that?.

C

Mark s. miller, (mm, agoric):, the the there is a. so I I know you use the term, petrify.

C

Mark s. miller, (mm, agoric): daniel einberg has a proposed,, has a written down proposal on petrified, and matthew use the term petrify.. I don't know if we're all talking about the same thing.

C

Peter hoddie:, my usage of the term,, because I was.

E

Daniel ehrenberg: trying to correspond to what peter was doing, and he conceived as taking away his ability to use the term.

E

Daniel ehrenberg: just ignored my thing.. It was just one document.

C

Peter hoddie: okay. mark s. miller, (mm, agoric): okay., so so, peter,. Let's talk. tell us about what you have in mind in general for the semantics of petrify.

D

Peter hoddie:, what petrified does you peter hoddie: it?, as if.

D

Peter hoddie:, you had the entire object to wrong., so that means everything about about the the instance,, the the public fields,, the.

D

Peter hoddie:, private fields,, private methods., peter hoddie:, and he buffers internal slots,, all of them.

D

Peter hoddie: kind of mutable., you understand this.

D

Peter hoddie:, so on a behavior which is desirable in general, it is.

D

Peter hoddie:, that's fine., so you know we see our petrify as a tool that could then be used to help build.

D

Peter hoddie: other apis,, such as.

D

Peter hoddie:, the the, you know, make it a mutable slice, for example, that jack works was talking. About.

D

Peter hoddie:, I think we're peter hoddie:. We we we really,, I think, for us.. The important thing is that.

D

Peter hoddie: mutable buffers are just regular buffers that.

D

Peter hoddie: fail when you try to write, and nothing more. the semantics of how they're created. we're., I think we're flexible on.

D

Peter hoddie: we've done something that works really nicely for our environments,, but we understand that it. It may be too powerful to have, as a feature in the line.

C

Mark s. miller, (mm, agoric): is petrify one level, or.

C

Peter hoddie:, I do.

C

mark s. miller, (mm, agoric):. I'm sorry.

D

Peter hoddie:, it really goes for it.

C

Mark s. miller, (mm, agoric):, it's it's, it's transitive.

D

Peter hoddie:, because otherwise I mean it., it could like, if you called it on a typed array. for example,. It wouldn't get to the array. Buffer.

D

Peter hoddie: okay. I mean, again, semantics,, are.

D

Peter hoddie: we. we're happy to happy, to explore different ways of doing that., but it solves problems for our environment.

C

Mark s. miller, (mm, agoric): okay., so the.

C

Mark s. miller, (mm, agoric):, so, matthew,, when you talk about super freeze, would super freeze, be the.

C

Mark s. miller, (mm, agoric):, the shallow step., you know the the one-level step that petrify then repeats transitively.

A

Mathieu hofman: I. so when I talked about super freeze before.

A

Mathieu hofman:, I think it was more in in in my mind, it was more of a.

A

Mathieu hofman: the cache free.. So if, if we were,, you wouldn't keep asking the question about whether the target object is is frozen or not.

A

Mathieu hofman: and it didn't have different cement on what can be frozen or.

A

Mathieu hofman: yeah, it it didn't, have a difference in any of what can be frozen on how far it's in our closing.

C

Mark s. miller, (mm, agoric): okay., so so one of the things that we have talked about in these meetings that that.

C

Mark s. miller, (mm, agoric): is mark s. miller, (mm, agoric): having something like freeze.. You know.

C

Mark s. miller, (mm, agoric): that also.

C

mark s. miller, (mm, agoric): as it froze the properties froze them in such,. You know,. Basically, if a an object that was super frozen,, let's say.

C

Mark s. miller, (mm, agoric): or if, if this mark s. miller, (mm, agoric):, would be one in which you can objects that inherit from a super frozen object., you can override the properties with assignment without running into the override mistake.. That would be one of the nice things to bundle.. There is the main thing that peter was talking about.

C

Mark s. miller, (mm, agoric):, which is mark s. miller, (mm, agoric): having internal properties, and and.

C

Mark s. miller, (mm, agoric):, you other non mark s. miller, (mm,, agoric):, non-named property state, get for us and have some questions about that.. But for.

A

Mathieu hofman:, I feel like new freezing internal states and internal slots, is a difference question than than what I.

A

Mathieu hofman: was thinking about for super freeze.

A

mathieu, hofman: and,, as I've expressed before.. I believe that should be based on a protocol instead of instead of the current of of what's freeze, does,, which is basically very in intrusive and and mutation objects.

A

Mathieu hofman: without the objects.

C

Mark s. miller, (mm, agoric): okay., so I certainly agree that it needs the objects consent in the sense that that one should be able to create a class of instances that.

C

Mark s. miller, (mm, agoric):, where the private fields cannot be.

C

mark s. miller, (mm, agoric): you know,, cannot be locked down by a client, because I can threaten the integrity of the. The of the instances can be an attack.

C

Mark s. miller, (mm, agoric):, the other, the other one is all of the cases. you.

C

Mark s. miller, (mm, agoric): peter., maybe if you could explain the.

C

Mark s. miller, (mm, agoric):, the impurities.

C

mark s. miller, (mm, agoric): query on excess,, because I think that is strongly.

C

Mark s. miller, (mm, agoric): very informative with regard to the rest of this conversation., I'm thinking in particular, about.

C

Mark s. miller, (mm, agoric):, the inability to mark s. miller, (mm, agoric): petrify, your super freeze, or whatever a closure that captures.

C

Mark s. miller, (mm, agoric):, assignable variables.

D

Peter hoddie: sure,, I mean., so I think that call is currently called the abilities.

D

Peter hoddie: or immutability. sorry., that's that's the name that it's actually currently available, under. and it's sort of like, I mean, it.. It walks the same path through the object transitively as petrify.

D

Peter hoddie:, it's basically looking for all the things that petrified would.

D

Peter hoddie: to make it. peter hoddie:, so it returns a a a list of.

D

Peter hoddie:, all of the things that are not in that in that path.

D

Peter hoddie:, and so it's a peter hoddie:, it's really just a diagnostic tool. doesn't do anything. It just tells you whether this object is has any,. It will stay in it or not. and so, if it doesn't,, it conforms to.

D

Peter hoddie:, the definition of pure that the mark that you've described before.

C

Mark s. miller, (mm,, agoric):, okay., and, and so so when you so with regard to petrify,. If you pre petrify an object that that.

C

Mark s. miller, (mm, agoric): that inherently contains state that can't be wronged like a closure that captures assignable variables.. What does petrified?? What does petrified do in that case,.

D

Peter hoddie: we could, actually makes that.

D

Peter hoddie:, there's 2 options actually again depends on on how everything is set up.

D

Peter hoddie:, the default behave like if you were to do it at runtime.

D

Peter hoddie:, it's called by that.

D

Peter hoddie: that closure would actually become muted.

D

Peter hoddie: would not be assigned to the variables.

D

peter hoddie:. You know.

D

Peter hoddie:, however, okay.

D

Peter hoddie:, the petrified, was applied by the linker as part of moving something to wrong.

D

Peter hoddie:, you could notice the.

D

Are writable, and.

D

Peter hoddie: that would allow access to.

D

Peter hoddie: necessary.

D

Peter hoddie: yeah. that was good. but but.

C

Mark s. miller, (mm, agoric): okay,, so that that is certainly a petrified., that's too powerful to be a generally available. Language. primitive. I think, with regard to this issue. About. you know, classes,.

C

Mark s. miller, (mm, agoric): could be attacked,. I think. to change in the semantics of the cl and closure is part of the sort of most important thing about a closure,. Is it's encapsulation semantics.

C

Mark s. miller, (mm, agoric): and from the outside of a closure to cause the it's internal variables to become unassignable is, is pretty violent., so I would,. I would just.

C

Mark s. miller, (mm, agoric): consider closures to have implicitly, always opted, out, have no option to opt in, and that classes probably would need to opt in, to be petrified and otherwise are implicitly opted. Out.

D

Mathieu hofman: that that makes sense.

A

Mathieu hofman: so.

A

Mathieu hofman: so, for my to here, like itrifies rather than here for ray buffer,, because.

A

Mathieu hofman: is one case where you need to move.

A

Mathieu hofman: free for petrify, the internal states.

A

Mathieu hofman: however. I,, as I mentioned, like.

A

Mathieu hofman:, I I'm wondering if there is the better approach. here- is a is a protocol. Based.

A

Mathieu hofman:, it's a portable is the approach for certification, or or whatever in the name, would be. we're. instances.

A

Mathieu hofman: of objects that are willing to be put in.. The immutable states have this symbol on it. That can be.

A

Mathieu hofman: in votes., mathieu, hofman: and once it is in votes, the.

A

Mathieu hofman: we'll, we'll perform the step to mute, to freeze its own states.

A

Mathieu hofman: now the the question is,. How do you verify that? indeed,, the the the object is is, in fact, mutable.. Give me annual.

C

Mark s. miller, (mm,, agoric):, yeah, that's.: that's why I'm thinking about the the protocol being an opt-in, or opt out rather than a method that actually does something.

C

Mark s. miller, (mm, agoric): because then,, if you're up,, if you've opted in.

C

Mark s. miller, (mm, agoric): or have not, have not opted out. Whichever way we go.

C

Mark s. miller, (mm, agoric): and you get petrified,, then it's still the machine that does the petrification.. It's just the object that that that enabled it to proceed.

F

Michael fig:, what if,, what if the state of the object is kept in the side? Table, and not just a private field, or a member of the class.

C

Mark s. miller, (mm, agoric): oh,, great question.

C

Mathieu hofman: which, by the way, is., and it's also a central question with regard to.

C

Mark s. miller, (mm, agoric):, the semantics of where is the mutability in a class., the a derived class where the base might be doing a return. Override.

C

Mark s. miller, (mm, agoric):, if the drive class has private fields, as we know,, it's not a consistent theory.

C

Mark s. miller, (mm, agoric): to ascribe the immutability to the instances., because the instances that are return, overwritten might already be.

C

Mark s. miller, (mm, agoric): be immutable.

C

Mark s. miller, (mm,, agoric): and and peter I'm. wondering about also about excess. what it stance there is with regard to the.

C

Mark s. miller, (mm, agoric): impurities queries., if you've got a class with.

C

Mark s. miller, (mm, agoric):, a derived class, with private fields.

C

Mark s. miller, (mm, agoric): and you petrify, the class.

C

Mark s. miller, (mm, agoric): what happens?.

D

Peter hoddie:, this is private fields in the in the prototype. Class, like in a classes drive from is that what you're, asking? where?.

C

Mark s. miller, (mm, agoric): what I'm saying, the the. If the I suppose this is more relevant for the one level.

C

Mark s. miller, (mm, agoric):, one case.

C

Mark s. miller, (mm, agoric):, if you mark s. miller, (mm, agoric):, no, it's it's all. No sorry, that's not true., it's relevant even for the transitive case.. If you petrify a drive, class.

C

Mark s. miller, (mm, agoric):, it's still the case that the base class,, even if petrified. might be a might have a constructor that returns.

C

Mark s. miller, (mm, agoric):, just the object, constructor,, the the object, prototype object, or something that.

C

Mark s. miller, (mm, agoric): is,, you know, really really needs to be immutable.

C

Mark s. miller, (mm,, agoric): and therefore, when the drive class seems to be adding.

C

Mark s. miller, (mm, agoric): fields to the mark s. miller, (mm, agoric): return override object.. You cannot count for that. Mutability. there's! No as mutability that's on the instance.

C

Mark s. miller, (mm, agoric):, so you so the only thing left is to account for the mutability as the hidden week map inside the class,, which is how the semantics is described,. Anyway.

C

Mark s. miller, (mm, agoric):, but that means that a class they're a drive class with private fields cannot be considered pure.

C

Mark s. miller, (mm, agoric):, unless you verify that unless, unless less, something somehow verifies that the entire chain.

C

Mark s. miller, (mm, agoric):, inheritance training above it never engages in return. override,, which would be a little bit magical.

D

Peter hoddie: is that I mean or sorry I'm.

D

peter hoddie:. It may be just me getting confused,, but we're we're sort of mixing the.

D

Peter hoddie: back to the class peter hoddie:, petrified with peter hoddie: you. bye. peter hoddie:. I'm not sure I can use that apart.. Sorry.

C

Mark s. miller, (mm, agoric):, so so, if it wasn't for a turn, override a consistent theory of where the mutability is of private fields, would be that the mutability is on the instances.

C

Mark s. miller, (mm, agoric):, and that means that a petrified class., which is,, which which would,, which the the the impurities query could verify, was transitively mutable,, could still have.

C

Mark s. miller, (mm, agoric): mutable instances mark s. miller, (mm, agoric):, whose private fields could be mutated.

C

Mark s. miller, (mm, agoric):, the the the problem with that theory.

C

Mark s. miller, (mm, agoric):, is that mark s. miller, (mm, agoric):. If the class that declares those fields is a derived class.

C

Mark s. miller, (mm, agoric): and the base class that it inherits from.

C

Mark s. miller, (mm, agoric): might be returning an object. That's already immutable.

C

Mark s. miller, (mm, agoric):, the semantics demands that the the so to speak, addition of private fields to the returned, object.

C

Mark s. miller, (mm, agoric): still work.

C

mark s. miller, (mm, agoric):, but the only., but the way the semantics describes that, and I,. I would say that the only consistent way the semantics can describe. it.

C

Mark s. miller, (mm, agoric):, is to a scribes a mutable state to a hidden week map in the class.

C

Mark s. miller, (mm, agoric):, rather than to mutable state in the instance,, because in this case there's mutability. that's for instance., but the instances themselves have been verified not to be mutable..

A

Mathieu hofman:, I I I I I disagree here like.. If, if you have a constructor that returns an immutable.

A

Mathieu hofman: instance,, you just simply cannot create a class of.

A

Mathieu hofman: of that.

C

Mark s. miller, (mm, agoric):, I mean, the language mark s. miller, (mm, agoric): does create drive classes of that right. Now.

A

Mathieu hofman:, but if you can create a class,, it just won't be functional.

A

Mathieu hofman:, it's it's the same. it's., it's the same kind of a issue.. If you,, if you have a construction that returns a frozen object, today, and then.

A

Mathieu hofman: and then the direct class tries to to our properties.

C

Mark s. miller, (mm, agoric):, no, no;, the drive class tries to add mark s. miller, (mm, agoric): private fields to a frozen.

C

Mathieu hofman: object returned by the super class.. It works right, now.

A

Mathieu hofman: properties to a frozen super.. It won't work.

A

Mathieu hofman:, but but what I'm.? What I'm saying is that private field is the equivalent of like privacy, field and petrified in the equivalent of frozen and adding public.

C

Mark s. miller, (mm, agoric):, okay, okay., so okay, good. good., so so what?. So what we're saying is that.

C

Mark s. miller, (mm, agoric): in a hypothetical.

C

Mark s. miller, (mm, agoric):, you know, in an in a, in a. you know, javascript with petrify. the way we would define hardened javascript is, we'd be very specific.

C

Mark s. miller, (mm, agoric): that mark s. miller, (mm, agoric): that all of the primordials are not just transitively frozen and immutable by by virtue of the absence.

C

Mark s. miller, (mm, agoric): of private fields, which they let me both of of internal slots, which they have right. now.

C

Mark s. miller, (mm, agoric): we've been very careful about that with regard to the to all of the safe primordials. That is not just the but that, in addition, we would we would be specifying.

C

Mark s. miller, (mm, agoric): that all of the shared, all of the shared safe primordials.

C

Mark s. miller, (mm, agoric): are petrified. and therefore.

C

Mark s. miller, (mm, agoric): cannot be mark s. miller. (Mm, agoric): enhanced by our return. override and subclassing. is that correct?.

A

Mathieu hofman: no,, I don't understand like, how is, and that that goes back to here's question.

A

Mathieu hofman:, how is itifying a class which, by the class, doesn't create petrified instances?.

C

Mark s. miller, (mm, agoric):, no, no,. I understand that that's the point.

C

mark s. miller, (mm, agoric):. We the if we.

C

Mark s. miller, (mm, agoric):, if, if you have a super class, that returns the object, constructor and the object constructor is.

C

Mark s. miller, (mm, agoric):, simply transitively frozen or just frozen,, is simply frozen and known to not have any internal slots.. Then the existing language, semantics.

C

Mark s. miller, (mm, agoric): still demands that the.

C

Mark s. miller, (mm, agoric): that the sub class.

C

Mark s. miller, (mm, agoric): so to speak,, add pro,, be able to successfully add private fields to it, and that's the thing that you want to prohibit.

C

Mark s. miller, (mm, agoric): for mark s. miller, (mm, agoric):, the primordials in a future hardened javascript.

C

Mark s. miller, (mm, agoric): because mark s. miller, (mm, agoric): in a future hardened javascript,. What what I think you're saying is, we would like to.

C

Mark s. miller, (mm, agoric): ascribe the mutability of the private fields to the instance and a consistent theory for doing that.

C

Mark s. miller, (mm, agoric): would be that if we consider.

C

Mark s. miller, (mm, agoric):, all of the the objects that that we really want to be immutable,, even if they have.

C

Mark s. miller, (mm, agoric):, no internal slots.. If we really wanted them to be considered, immutable, we've got to petrify them.

C

Mark s. miller, (mm,, agoric): or super freeze them or something., the freezing. freezing them,, which is what we're doing now, combined with knowledge of no internal slots,, is not adequate to consider them to not be mutable..

C

Mark s. miller, (mm,, agoric): and then,, if you super,, freeze them such that they really are immutable.

C

Mark s. miller, (mm, agoric): and then a sub-class tries to extend.

C

Mark s. miller, (mm, agoric):, their instance, their, their,, so to speak, instant state with with new private fields,, enhance them with private fields that that would fail.

C

Mark s. miller, (mm, agoric):, and it's only if that fails, that you have a theory that can ascribe what would have been the mutability to the instance rather than the class?.

A

Mathieu hofman:, I'm not sure.. I follow,, because I still don't believe.

A

Mathieu hofman: that any of the intrinsic instructors should create.

A

Mathieu hofman:, I don't see why it should.

C

Peter hoddie:, I'm not talking about the object, constructor itself.

C

Mark s. miller, (mm, agoric):, just as an example of an object that hardened javascript needs to be immutable.

E

Daniel ehrenberg: yeah. so daniel ehrenberg:, about about this topic in general, about disallowing private fields on certain objects.

E

Daniel ehrenberg:, I'm personally fine with this direction. I do want to remind this group that it's was requests from from here.

E

Daniel ehrenberg:, that made it so that we did say that, frozen out. All these things could allow would allow private fields.. It was that we got the requirement that to have the weekmap analogy.

E

Daniel ehrenberg: so.

E

Daniel ehrenberg:, maybe we should also think about how.

E

Daniel ehrenberg:, when analyzing proposals,, we could figure out these issues.

E

Daniel ehrenberg:, ahead of time, because you were already thinking a lot about hardened primordials and such.

E

Daniel ehrenberg:, and maybe that maybe that would have flown into the design of of private fields.

A

Mathieu hofman:, I I think mathieu hofman:. I I think we just missed it at that point.. We didn't. We didn't think about that. Problem. I mean I wasn't around, so I you didn't think of it., so I I I was around, and it's probably my fault, and I I think I saw it justin still here.

C

Mark s. miller, (mm, agoric): justin ridgewell.

C

daniel ehrenberg:. I think he was here earlier.. I don't see him now.

C

Mark s. miller, (mm, agoric):, I think justin actually argued for something much like what I'm arguing for now.

C

Mark s. miller, (mm, agoric): and I didn't see the implications at the time encounter argued for the.

C

Mark s. miller, (mm, agoric): the pure week map. now the tree.

C

Mathieu hofman: so.

E

Daniel ehrenberg: well, justin just an argued, a lot of things. but yeah, the the surprise. At the week map analogy extending in these sorts of directions.

E

Daniel ehrenberg: was sort of widely held among the committee.

E

Daniel ehrenberg: and I was defending the weekmap analogy because it it it. it made sense that it was what mark was advocating for, and that's what we went. With.

E

Daniel ehrenberg: but daniel ehrenberg:, I'm not., I'm not sure. there was.. There was definitely some skepticism.

E

Michael fig:, I I guess the question that I was trying to ask is.

F

Michael fig:, if we don't take the week map analogy as analogy., if we say yes,, we have some side week, map in which we're putting objects in properties.

F

Michael fig:, how do we ensure that petrify, actually make sure that that those properties frozen.

F

Mathieu hofman:, I I don't think it's too.

C

Michael fig:, so in in the case,, which is which is that's, why that's? What he's. protocol proposal was about that.

F

Michael fig:, a given object to kind of keep trying to it's book keeping everywhere.

C

Mark s. miller, (mm, agoric):, so there, there's so the I mean.

C

Mark s. miller, (mm, agoric): for a a genuine external week map that the object doesn't know about the protocol proposal doesn't enable the object.

C

Mark s. miller, (mm, agoric): to do anything about week, maps that it's a key end that it doesn't know about. and I think that's a feature,, not a, but with regard to classes.

C

Mark s. miller, (mm, agoric): in the hidden week, map theory of class private fields., because the week map is reachable from the class.. The a transit of petrify.

C

Mark s. miller, (mm, agoric):, if allowed to succeed, mark s. miller, (mm, agoric): by whatever you know,, whatever opt in or opt out with the.. If.

C

Mark s. miller, (mm, agoric):, if you had transitively petrify a class., then the by the weak math theory that would necessarily walk down.

C

Mark s. miller, (mm, agoric): the week map, which, by the way,, has a has an even worse problem,, which is,, if you walk., if you really lock down the week, map.

C

Mark s. miller, (mm, agoric):, then you can't.

C

Mathieu hofman: even create new instances of the class, and that you can't create the whole week map and I I, or pitrify the whole week map at this.. What you can do.

A

Mathieu hofman: is freeze the value associated to your entry.

A

Mathieu hofman: in in the week map and make sure that you're not allowed to replace the value at any time,. So it can only be used, but not for sense,, basically. and and that that's just weird semantics for a for a week. not like that..

C

Mark s. miller, (mm, agoric): yeah,, I I think we all agree that this is weird. the question is,. How do we get out of the dilemma?.

F

Mathieu hofman: I'm saying that the array buffer allergy is an interesting one, too.

F

Michael fig:, because who's saying that the individual bytes are actually properties of the array buffer that are reachable by, anyway?.

F

Michael fig:, are they actually built into the week map.

F

Michael fig: that we're talking about. mark s. miller, (mm, agoric):, so they so they have to be reachable by.

C

Mark s. miller, (mm, agoric):, the array buffer.

C

mark s. miller, (mm, agoric):. If the array buffer mark s. miller, (mm, agoric):, has intrinsic behavior.

C

Mark s. miller, (mm, agoric): that is dependent on them right?, I mean the thing about an object that happens to be a key in a week map that it that it doesn't know about.

C

Mark s. miller, (mm, agoric): it. that object can't have any methods that depend on the contents of that week, map., because then it would that, because it could only do that if it knew about the link map. it's a week. Map was somehow a relatively reachable from it.

C

Michael fig: yeah.- and this is where matthews., pointing out of of the semantics of that internal week. Map.

F

Michael fig: are weird. michael fig: and to get peter's behavior of how do you actually.

F

Michael fig: petrify and ray buffer?, michael fig:, you have to do something similar with its properties.. You can't just say, okay.. These bytes are not frozen,, because if you from free spikes,, it doesn't really matter., but you do.

F

Michael fig: actually changing the property of the the way that contains the bytes. right?.

A

Mathieu hofman: yeah., which one, in.

A

Mathieu hofman: in my opinion,, you can only.

A

Mathieu hofman: ask, for the instance mathieu hofman: to petrify itself.

A

mathieu hofman:, and then you need a predicates to verify if that instance is actually verified.

A

Mathieu hofman: and and then it mathieu, hofman: and then you're back at the problem of what happens to petrified instance.

A

Mathieu hofman:, I guess you cannot use them anymore as a new with map keys.

A

Mathieu hofman:, because that wouldn't affect as state today.

F

Michael fig:, like new private field, to me.

A

Mathieu hofman:, I guess that's not a problem if all of the good path from the instance itself.

A

Mathieu hofman:, so I guess that is the difference. yeah,, maybe not. I,. I take that back.

A

Mathieu hofman: petrification., you can always associate states to to an object as long as the objects itself, and in the so.. Now now it becomes a question of, like the the the functions that are are that are reachable from the objects.

A

Mathieu hofman:, whatever they can access in their scope,, whether.

A

Mathieu hofman: those things are petrified or like not allows seating. Anything with the instance that that's just., I'm having a hard time wrapping my head around like what it means to be.

A

Mathieu hofman: for for an object to be pitching friday.

C

Mark s. miller, (mm, agoric):, so I mean that's, that's the beautiful thing about the the transitive notion.

C

Mark s. miller, (mm,, agoric): of of petrified or or purity.

C

Mark s. miller, (mm, agoric): is that mark s. miller, (mm, agoric): and I a a a., let's say no argument,, method of the object, or.

C

Mark s. miller, (mm, agoric):, that to pay that depends on state means that the state has to be reachable from the object., and that means that if the object is transitively pure. that the methods of the object only have access.

C

Mark s. miller, (mm, agoric): only., have you know a direct. How only have I have only captured access.

C

Mark s. miller, (mm, agoric): to mark s. miller, (mm, agoric): to pure state,, and therefore can't mark s. miller, (mm, agoric): bring about mutable behavior.

A

Mathieu hofman:, but but they also, it says, that, like any.

A

Mathieu hofman: other functions that are closed over by those methods, cannot.

A

Mathieu hofman: in any way have a path mark s. miller, (mm, agoric):, to look up. state associated to that object.. The.

C

Mark s. miller, (mm, agoric):, you know, the purity, probably stops.. I mean that well necessarily stops.

C

Mark s. miller, (mm, agoric): at where,, if it reaches closures that capture, assignable variables.

C

Mathieu hofman: or closures that.

A

Mathieu hofman: contain a week map where the.

C

Mathieu hofman:, where the week map itself.

A

Mathieu hofman:, where, where it be by itself, is,, is not frozen. or yeah.

A

Mark s. miller, (mm, agoric):, yeah, yeah,, I mean,, if they,, if, if they closure the captures., a a constant variable where the value of the variable is not petrified.

C

Mark s. miller, (mm, agoric):, then the closure is not.

A

Mathieu hofman: okay., so it's not a so so that that also we're actually getting at time.. But that also means that.

A

Mathieu hofman:, with 2 different implementations of this, have the same notion of whether an object certified or not like? are. Are they guaranteed to be able to make the same kind of.

A

Mathieu hofman: transitive checks.

A

Mathieu hofman: right mathieu hofman: like some implementations. for example,, when you have a closure. I'll capture, the whole.

A

Mathieu hofman:, all of it mathieu hofman: all of the context, only capture a subset of the context that it that is reachable.. What, if that subset is, is petrified, but the bigger subset, isn't, and then some, some, some,. Some engines, wouldn't be able to consider it as aified or another would..

F

Michael fig: and what is direct to value.

F

Mark s. miller, (mm, agoric): yeah,, I I.

C

Mark s. miller, (mm,, agoric): yeah,, I think, there's I mean,, there's 2. there's 2 problems. There. one is a closure.

C

Mark s. miller, (mm, agoric):, whose implementation, after.

C

Mark s. miller, (mm, agoric):, more state., then the semantic model of closures would have a capture.

C

Mark s. miller, (mm, agoric): and the other one is a closure that captures less state than the semantic model that imply the first case, I think, is easy,, which is.

C

Mark s. miller, (mm, agoric): you,, can. it's,, you know you can just consider the subset of what the implementation is. Retaining.

C

Mark s. miller, (mm, agoric): that corresponds to the name, to the, to to be variables named freely in the closure. you don't have to cap. You, don't, have to look at the entire record.

C

Mark s. miller, (mm, agoric):, the other problem, though,, which is a compiler,, decides that a variable is dead.

C

Mark s. miller, (mm,, agoric): or whatever, and drops it., even though it's a variable, that's used freely in the closure, and therefore applied to be captured.. I I do agree that that's.

C

Mark s. miller, (mm, agoric): a mark s. miller, (mm, agoric):, that's that's going to be a possibly show stopping problems., certainly a hard problem.

C

Mark s. miller, (mm, agoric): at trying to get engines to agree on a common deterministic semantics. there.

A

Mathieu hofman: all right,, we're mathieu hofman:. We at time thanks. everyone for.

A

Mathieu hofman: discussion. bye.