Typing Lists and Tuples in Elixir

Now we acquire got been engaged on a form machine for the Elixir programming language. The form machine gives sound slack typing: it can safely interface static and dynamic code, and if the program form tests, this could also merely now not get form errors at runtime.

You may want to to stress form errors. The form systems faded at scale on the present time manufacture now not pronounce the absense of any runtime errors, but handiest typing ones. Many programming languages error when gaining access to the “head” of an empty list, most languages elevate on division by zero or when computing the logarithm of adverse numbers on a unswerving domain, and others also can merely fail to allocate memory or when a number overflows/underflows.

Language designers and maintainers need to outline the boundaries of what also can merely additionally be represented as typing errors and how that impacts the get of libraries. The fair of this article is to focus on these kinds of choices within the context of lists and tuples in Elixir’s on-going form machine work.

On this article, the words “elevate” and “exceptions” describe something surprising came about, and now not a mechanism for preserve watch over-waft. Other programming languages also can merely name them “panics” or “faults”.

The head of a list

Imagine you are designing a programming language and you settle on to provide a head characteristic, which returns the pinnacle – the principle ingredient – of a list, you per chance also can merely be conscious of three solutions.

The predominant likelihood, the one demonstrate in loads of programming languages, is to acquire interplay if an empty list is given. Its implementation in Elixir would be something akin to:

$ list(a) -> a
def head([head | _]), manufacture:  head
def head([]), manufacture:  elevate "empty list"

Since the kind machine can not differentiate between an empty list and a non-empty list, you won’t rep any typing violations at assemble-time, but an error is raised at runtime for empty lists.

An substitute would be to come an likelihood form, neatly encoding that the characteristic also can merely fail (or now not):

$ list(a) -> likelihood(a)
def head([head | _]), manufacture:  {:okay, head}
def head([]), manufacture:  :none

This approach will be quite redundant. Returning an likelihood form usually forces the caller to sample match on the returned likelihood. Whereas many programming languages provide capabilities to invent likelihood values, one also can merely additionally get rid of the further wrapping and in the present day sample match on the list as a substitute. So in jam of:

case head(list) manufacture
  {:okay, head} -> # there is a head
  :none -> # manufacture what you settle on to manufacture
end

That you just can apt write:

case list manufacture
  [head | _] -> # there is a head
  [] -> # manufacture what you settle on to manufacture
end

Both examples above are restricted by the truth the kind machine can not distinguish between empty and non-empty lists and subsequently their handling need to happen at runtime. If we get rid of this limitations, lets outline head as follows:

$ non_empty_list(a) -> a
def head([head | _]), manufacture:  head

And now we get a typing violation at assemble-time if an empty list is given as argument. There will not be one of these thing as a likelihood tagging and no runtime exceptions. Use-grab?

The trouble with the above is that now it is responsibility of the language users to illustrate the list is now not empty. To illustrate, have faith this code:

list = convert_json_array_to_elixir_list(json_array_as_string)
head(list)

In the instance above, since convert_json_array_to_elixir_list also can merely return an empty list, there is a typing violation at assemble-time. To get to the underside of it, we resolve to illustrate the end outcomes of convert_json_array_to_elixir_list is now not an empty list earlier than calling head:

list = convert_json_array_to_elixir_list(json_array_as_string)

if list == [] manufacture
  elevate "empty list"
end

head(list)

But, at this level, we could as neatly apt expend sample matching and any other time get rid of head:

case convert_json_array_to_elixir_list(json_array_as_string) manufacture
  [head | _] -> # there is a head
  [] -> # manufacture what you settle on to manufacture
end

Most of us would demand that encoding more records into the kind machine would bring handiest benefits but there is a stress here: the more you encode into styles, the more you per chance also can merely settle on to illustrate to your programs.

Whereas totally different developers will make a selection sure idioms over others, I’m now not convinced there may per chance be one clearly superior approach here. Having head elevate a runtime error will be basically the most pragmatic approach if the developer expects the list to be non-empty within the principle jam. Returning likelihood will get rid of the exception by forcing users to explicitly tackle the end result, but outcomes in more boilerplate when when put next with sample matching, significantly if the user does not demand empty lists. And, finally, together with unswerving styles method there’ll be more for developers to illustrate.

What about Elixir?

On tale of region-theoretic styles, we’ll per chance distinguish between empty lists and non-empty lists in Elixir’s form machine, since sample matching on them is a celebrated language idiom. Moreover, a entire lot of capabilities in Elixir, corresponding to String.wreck up/2 are guaranteed to come non-empty lists, which may per chance then be neatly encoded staunch into a characteristic’s return form.

Elixir additionally has the capabilities hd (for head) and tl (for tail) inherited from Erlang, which are legit guards. They handiest fetch non-empty lists as arguments, that may per chance now be enforced by the kind machine too.

This covers nearly all expend conditions but one: what occurs whilst you can per chance decide to get staunch of entry to the principle ingredient of a list, which has now not been proven to be empty? That you just can expend sample matching and conditionals for these conditions, but as seen above, this can lead to celebrated boilerplate corresponding to:

if list == [] manufacture
  elevate "surprising empty list"
end

Luckily, it is celebrated in Elixir to make expend of the ! suffix to encode the skill for runtime errors for legit inputs. For these conditions, we are in a position to also merely introduce List.first! (and doubtlessly List.drop_first! for the tail variant).

Gaining access to tuples

Now that now we acquire discussed lists, we are in a position to focus on about tuples. In a approach, tuples are more stressful than lists for 2 reasons:

1. A listing is a chain where all ingredients acquire the same form (be it a list(integer()) or list(integer() or ride alongside with the waft())), while tuples lift the types of every and every ingredient

2. We natively get staunch of entry to tuples by index, in jam of its head and tail, such elem(tuple, 0)

In the upcoming v1.18 liberate, Elixir’s novel form machine will strengthen tuple styles, and they are written between curly brackets. To illustrate, the File.read/1 characteristic would acquire the return form {:okay, binary()} or {:error, posix()}, reasonably equivalent to on the present time’s typespecs.

The tuple form can additionally specify a minimal dimension, as you per chance can additionally write: {atom(), integer(), ...} . This manner the tuple has now not less than two ingredients, the principle being an atom() and the second being an integer(). This definition is required for form inference in patterns and guards. As a minimum, a guard is_integer(elem(tuple, 1)) tells you the tuple has now not less than two ingredients, with the second one being an integer, but nothing in regards to the unreal ingredients and the tuple total dimension.

With tuples strengthen merged into predominant, we resolve to answer questions corresponding to which more or less assemble-time warnings and runtime exceptions tuple operations, corresponding to elem(tuple, index) also can merely emit. Straight away, we all know that it raises if:

1. the index is out of bounds, as in elem({:okay, "hello"}, 3)

2. the index is adverse, as in elem({:okay, 123}, -1)

When typing elem(tuple, index), one likelihood is to make expend of “avoid all runtime errors” as our guiding light and invent elem return likelihood styles, corresponding to: {:okay, price} or :none. This makes sense for an out of bounds error, but additionally can merely nonetheless it additionally return :none if the index is adverse? One could argue that they are both out of bounds. On the unreal hand, a definite index will be loyal searching on the tuple dimension but a adverse index is repeatedly invalid. From this level of view, encoding an repeatedly invalid price as an :none also can merely additionally be detrimental to the developer expertise, hiding logical bugs in jam of (loudly) blowing up.

One other likelihood is to invent these programs invalid. If we totally acquire elem/2 from the language and you would handiest get staunch of entry to tuples through sample matching (or by together with a literal notation corresponding to tuple.0), then all skill bugs also can merely additionally be caught by the kind checker. Nonetheless, some recordsdata constructions, corresponding to array in Erlang depend upon dynamic tuple get staunch of entry to, and implementing these would be now not skill.

But one other likelihood is to encode integers themselves as values within the kind machine. In the same method that Elixir’s form machine supports the values :okay and :error as styles, lets strengthen every integer, corresponding to 13 and -42 as styles as neatly (or mumble subsets, corresponding to neg_integer(), zero() and pos_integer()). This manner, the kind machine would know the skill values of index all over form checking, permitting us to pass complex expressions to elem(tuple, index), and emit typing errors if the indexes are invalid. Nonetheless, do not put out of your mind that encoding more records into styles also can merely drive developers to additionally demonstrate that these indexes are inside bounds in loads of other conditions.

All over any other time, there are totally different replace-offs, and we should always always lift one which finest fit into Elixir expend and semantics on the present time.

What about Elixir?

The approach we are taking in Elixir is two-fold:

• If the index is a literal integer, this could also merely originate an unswerving get staunch of entry to on the tuple ingredient. This manner elem(tuple, 1) will work if we are in a position to illustrate the tuple has now not less than dimension 2, in every other case you acquire a form error

• If the index is now not a literal integer, the characteristic will fallback to a dynamic form signature

Let’s develop on the second level.

At a conventional stage, lets describe elem with the kind signature of tuple(a), integer() -> a. Nonetheless, the trouble with this signature is that it does not speak the kind machine (nor users) the skill for a runtime error. Luckily, because Elixir will provide a slack form machine, lets encode the kind signature as dynamic({...a}), integer() -> dynamic(a). By encoding the argument and return form as dynamic, developers who desire a truly static program will be notified of a typing error, while present developers who depend upon dynamic facets of the language can continue to manufacture so, and these alternatives are in actuality encoded into the styles.

Total,

• For static programs (these that manufacture now not expend the dynamic() form), elem/2 will validate that the principle argument is a tuple of identified shape, and the second argument is a literal integer which is greater than or equal to zero and no more than the tuple dimension. This guarantees no runtime exceptions.

• Leisurely programs can acquire the same semantics (and runtime exceptions) as on the present time.

Abstract

I am hoping this article outlines one of the most get choices as we bring a slack form machine to Elixir. Though supporting tuples and lists is a “desk stakes” characteristic in most form systems, bringing them to Elixir became any other to know how the kind machine will work alongside with a entire lot of language idioms, as well to give a foundation for future choices. The largest bewitch aways are:

1. Sort security is a commitment from every aspect. In case you can per chance esteem your form machine to rep some distance more bugs thru more unswerving styles, you are going to settle on to illustrate more typically that your programs are free of sure typing violations.

2. Given now not everything will be encoded as styles, exceptions are indispensable. Even within the presence of likelihood styles, it will now not be helpful for developers if elem(tuple, index) returned :none for adverse indexes.

3. Elixir’s convention of the expend of the suffix ! to encode the skill for runtime exceptions for a legit domain (the input styles) neatly enhances the kind machine, as it can again static programs avoid the boilerplate of adjusting :none/:error into exceptions for astonishing scenarios.

4. The expend of dynamic() in characteristic signatures is a mechanism available in Elixir’s form machine to signal that a characteristic has dynamic behaviour and also can merely elevate runtime errors, permitting violations to be reported on programs which may per chance well per chance per chance be searching for to dwell fully static. Corresponding to how other static languages provide dynamic behaviour through Any or Dynamic styles.

The form machine became made skill thanks to a partnership between CNRS and Faraway. The reach work is for the time being subsidized by Fresha (they are hiring!), Starfish*, and Dashbit.

Elated typing!