是否有被视为“安全"的 GHC 扩展列表? [英] Is there a list of GHC extensions that are considered 'safe'?

问题描述

有时，如果没有至少一种语言扩展，我想编写的一段代码是不合法的.当试图在研究论文中实现想法时尤其如此，这些论文倾向于使用在撰写论文时可用的任何一个漂亮的、超扩展的 GHC 版本，而没有明确说明实际需要哪些扩展.

Occasionally, a piece of code I want to write isn't legal without at least one language extension. This is particularly true when trying to implement ideas in research papers, which tend to use whichever spiffy, super-extended version of GHC was available at the time the paper was written, without making it clear which extensions are actually required.

结果是我经常在我的 .hs 文件的顶部看到这样的东西:

The result is that I often end up with something like this at the top of my .hs files:

{-# LANGUAGE TypeFamilies
           , MultiParamTypeClasses
           , FunctionalDependencies
           , FlexibleContexts
           , FlexibleInstances
           , UndecidableInstances
           , OverlappingInstances #-}

我不介意这一点，但我常常觉得自己在做出盲目的牺牲以安抚 GHC 的大神.它抱怨某段代码在没有语言扩展 X 的情况下无效，所以我为 X 添加了一个编译指示.然后它要求我启用 Y，所以我为 Y 添加一个编译指示.当这完成时，我已经启用三个或四个我不太了解的语言扩展，我不知道哪些是安全的".

I don't mind that, but often I feel as though I'm making blind sacrifices to appease the Great God of GHC. It complains that a certain piece of code isn't valid without language extension X, so I add a pragma for X. Then it demands that I enable Y, so I add a pragma for Y. By the time this finishes, I've enable three or four language extensions that I don't really understand, and I have no idea which ones are 'safe'.

解释我所说的安全"是什么意思:

To explain what I mean by 'safe':

• 我理解UndecidableInstances是安全的，因为虽然它可能会导致编译器无法终止，但只要代码通过编译就不会产生意外的副作用.

• I understand that UndecidableInstances is safe, because although it may cause the compiler to not terminate, as long as the code compiles it won't have unexpected side effects.

另一方面，OverlappingInstances 显然是不安全的，因为它让我很容易不小心编写导致运行时错误的代码.

On the other hand, OverlappingInstances is clearly unsafe, because it makes it very easy for me to accidentally write code that gives runtime errors.

所以我的问题是:

是否有一份被认为安全"和不安全"的 GHC 扩展列表?

Is there a list of GHCextensions which are considered 'safe' and which are 'unsafe'?

推荐答案

最好看看什么 SafeHaskell 允许:

It's probably best to look at what SafeHaskell allows:

安全语言

安全语言(通过 -XSafe 启用)以两种不同的方式限制事物:

The Safe Language (enabled through -XSafe) restricts things in two different ways:

1. 完全禁止某些 GHC LANGUAGE 扩展.
2. 某些 GHC LANGUAGE 扩展在功能上受到限制.

以下正是属于每个类别的标志和扩展:

Below is precisely what flags and extensions fall into each category:

• 完全禁止:GeneralizedNewtypeDeriving、TemplateHaskell
• 受限功能:OverlappingInstances、ForeignFunctionInterface、RULES、Data.Typeable
  • 请参阅下方的受限功能

  受限和禁用的 GHC Haskell 功能

  在安全语言方言中，我们限制了以下 Haskell 语言功能:

  In the Safe language dialect we restrict the following Haskell language features:

  • ForeignFunctionInterface:这在大多数情况下是安全的，但不允许导入具有非 IO 类型的函数的外部导入声明.所有 FFI 导入都必须位于 IO Monad 中.
  • RULES:由于它们可以以意想不到的方式改变可信代码的行为，违反语义一致性，因此它们在功能上受到限制.具体来说，在使用 -XSafe 编译的模块 M 中定义的任何 RULES 都将被删除.RULES 定义在可信赖的模块中，M 导入仍然有效并且会像往常一样触发.
  • OverlappingInstances:此扩展可用于违反语义一致性，因为恶意代码可以通过改变导入类型的代码行为的方式重新定义类型实例(通过包含更具体的实例定义)不受信任的模块.对于使用 -XSafe 编译的模块 M 没有禁用扩展，但受到限制.虽然M 可以定义重叠的实例声明，但它们只能在M 中使用.如果在导入 M 的模块 N 中，在使用类型类函数的调用点，可以选择使用哪个实例(即重叠)和最具体选择是从 M(或任何其他 Safe 编译模块)，然后编译将失败.模块 N 是否被认为是安全的、值得信赖的或两者都不是，这无关紧要.
  • Data.Typeable:我们允许派生 Data.Typeable 的实例，但不允许手工制作实例.派生实例是由 GHC 机器生成的，应该是完全安全的，但手工制作的实例可能会谎报其类型，并允许类型之间进行不安全的强制转换.这是本着 SYB 原始设计的精神.
  • ForeignFunctionInterface: This is mostly safe, but foreign import declarations that import a function with a non-IO type are be disallowed. All FFI imports must reside in the IO Monad.
  • RULES: As they can change the behaviour of trusted code in unanticipated ways, violating semantic consistency they are restricted in function. Specifically any RULES defined in a module M compiled with -XSafe are dropped. RULES defined in trustworthy modules that M imports are still valid and will fire as usual.
  • OverlappingInstances: This extension can be used to violate semantic consistency, because malicious code could redefine a type instance (by containing a more specific instance definition) in a way that changes the behaviour of code importing the untrusted module. The extension is not disabled for a module M compiled with -XSafe but restricted. While M can define overlapping instance declarations, they can only be used in M. If in a module N that imports M, at a call site that uses a type-class function there is a choice of which instance to use (i.e overlapping) and the most specific choice is from M (or any other Safe compiled module), then compilation will fail. It is irrelevant if module N is considered Safe, or Trustworthy or neither.
  • Data.Typeable: We allow instances of Data.Typeable to be derived but we don't allow hand crafted instances. Derived instances are machine generated by GHC and should be perfectly safe but hand crafted ones can lie about their type and allow unsafe coercions between types. This is in the spirit of the original design of SYB.

  在安全语言方言中，我们完全禁用了以下 Haskell 语言功能:

  In the Safe language dialect we disable completely the following Haskell language features:

  • GeneralizedNewtypeDeriving:它可用于违反构造函数访问控制，允许不受信任的代码以数据类型作者不希望的方式操作受保护的数据类型.即可用于打破数据结构的不变量.
  • TemplateHaskell:特别危险，因为它甚至在编译时也会引起副作用，并且可用于访问抽象数据类型.使用 TH 很容易打破模块边界.
  • GeneralizedNewtypeDeriving: It can be used to violate constructor access control, by allowing untrusted code to manipulate protected data types in ways the data type author did not intend. I.e can be used to break invariants of data structures.
  • TemplateHaskell: Is particularly dangerous, as it can cause side effects even at compilation time and can be used to access abstract data types. It is very easy to break module boundaries with TH.

  我记得我读过 FunctionalDependencies 和 UndecidableInstances 的交互也可能是不安全的，因为除了允许无限的上下文堆栈深度 UndecidableInstances 还解除所谓的覆盖条件(第 7.6.3.2 节)，但我目前找不到对此的引用.

  I recall having read that the interaction of FunctionalDependencies and UndecidableInstances can also be unsafe, because beyond allowing an unlimited context stack depth UndecidableInstances also lifts the so-called coverage condition (section 7.6.3.2), but I can't find a cite for this at the moment.

  EDIT 2015-10-27:自从 GHC 获得对类型角色的支持后，GeneralizedNewtypeDeriving 不再不安全.(我不确定还有什么可能发生了变化.)

  EDIT 2015-10-27: Ever since GHC gained support for type roles, GeneralizedNewtypeDeriving is no longer unsafe. (I'm not sure what else might have changed.)

  这篇关于是否有被视为“安全"的 GHC 扩展列表?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！