10 Extort: when errors exist

The greatest mistake is to imagine that we never err.

10.1 Errors

We have added multiple, disjoint types, but mostly swept issues of errors under the rug by considering type mismatches as meaningless. Now let’s redesign the semantics to specify the error behavior of such programs.

We’ll call it Extort.

Nothing changes in the syntax of Extort from the previous language, although we will need to talk about two kinds of results from evaluating programs: values and errors. We will say that evaluation produces an answer, which is either a value or error:

10.2 Meaning of Extort programs

Languages adopt several approaches to type mismatches:

• Prohibit such programs statically with a type system (e.g. OCaml, Java)

• Coerce values to different types (e.g. JavaScript)

• Signal a run-time error (e.g. Racket)

• Leave the behavior unspecified (e.g. Scheme, C)

We’ve previously seen the last approach. Now let’s do what Racket does and signal an error.

The meaning of Extort programs that have type errors will now be defined as 'err:

• (add1 #f): means 'err.

• (zero? #t): means 'err.

• (if (zero? #f) 1 2): means 'err.

Now what does the semantics say about (add1 #f)? What about (if 7 #t -2)?

The signature of the interpreter is extended to produce answers. Each use of a Racket primitive is guarded by checking the type of the arguments and an error is produced if the check fails. Errors are also propagated when a subexpression produces an error:

We can confirm the interpreter computes the right result for the examples given earlier:

Examples

> (interp (Prim1 'add1 (Bool #f)))

'err

> (interp (Prim1 'zero? (Bool #t)))

'err

> (interp (If (Prim1 'zero? (Bool #f)) (Int 1) (Int 2)))

'err

The statement of correctness stays the same, but now observe that there is no way to crash the interpreter with any Expr value.

10.3 A Compiler for Extort

Suppose we want to compile (add1 #f), what needs to happen? Just as in the interpreter, we need to check the integerness of the argument’s value before doing the addition operation.

extort/main.c

#include <stdio.h>
#include <stdlib.h>
#include "values.h"
#include "print.h"
#include "runtime.h"

FILE* in;
FILE* out;
void (*error_handler)();

void error_exit()
{
  printf("err\n");
  exit(1);
}

void raise_error()
{
  return error_handler();
}

int main(int argc, char** argv)
{
  in = stdin;
  out = stdout;
  error_handler = &error_exit;
  
  val_t result;

  result = entry();
  print_result(result);
  if (val_typeof(result) != T_VOID)
    putchar('\n');

  return 0;
}

Most of the work of error checking happens in the code emitted for primitive operations. Whenever an error is detected, control jumps to a label called 'err that immediately calls raise_error:

extort/compile-ops.rkt

#lang racket

(provide (all-defined-out))

(require "ast.rkt" "types.rkt" a86/ast)

(define rax 'rax) ; return

(define rdi 'rdi) ; arg

(define r8  'r8)  ; scratch in +, -

(define r9  'r9)  ; scratch in assert-type

;; Op0 -> Asm

(define (compile-op0 p)

(match p

['void      (seq (Mov rax val-void))]

['read-byte (seq (Call 'read_byte))]

['peek-byte (seq (Call 'peek_byte))]))

;; Op1 -> Asm

(define (compile-op1 p)

(match p

['add1

(seq (assert-integer rax)

(Add rax (value->bits 1)))]

['sub1

(seq (assert-integer rax)

(Sub rax (value->bits 1)))]

['zero?

(let ((l1 (gensym)))

(seq (assert-integer rax)

(Cmp rax 0)

(Mov rax val-true)

(Je l1)

(Mov rax val-false)

(Label l1)))]

['char?

(let ((l1 (gensym)))

(seq (And rax mask-char)

(Xor rax type-char)

(Cmp rax 0)

(Mov rax val-true)

(Je l1)

(Mov rax val-false)

(Label l1)))]

['char->integer

(seq (assert-char rax)

(Sar rax char-shift)

(Sal rax int-shift))]

['integer->char

(seq (assert-codepoint)

(Sar rax int-shift)

(Sal rax char-shift)

(Xor rax type-char))]

['eof-object? (eq-imm val-eof)]

['write-byte

(seq (assert-byte)

(Mov rdi rax)

(Call 'write_byte)

(Mov rax val-void))]))

;; Op2 -> Asm

(define (compile-op2 p)

(match p

['+

(seq (Pop r8)

(assert-integer r8)

(assert-integer rax)

(Add rax r8))]

['-

(seq (Pop r8)

(assert-integer r8)

(assert-integer rax)

(Sub r8 rax)

(Mov rax r8))]))

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

(define (assert-type mask type)

(λ (arg)

(seq (Mov r9 arg)

(And r9 mask)

(Cmp r9 type)

(Jne 'err))))

(define (type-pred mask type)

(let ((l (gensym)))

(seq (And rax mask)

(Cmp rax type)

(Mov rax (value->bits #t))

(Je l)

(Mov rax (value->bits #f))

(Label l))))

(define assert-integer

(assert-type mask-int type-int))

(define assert-char

(assert-type mask-char type-char))

(define (assert-codepoint)

(let ((ok (gensym)))

(seq (assert-integer rax)

(Cmp rax (value->bits 0))

(Jl 'err)

(Cmp rax (value->bits 1114111))

(Jg 'err)

(Cmp rax (value->bits 55295))

(Jl ok)

(Cmp rax (value->bits 57344))

(Jg ok)

(Jmp 'err)

(Label ok))))

(define (assert-byte)

(seq (assert-integer rax)

(Cmp rax (value->bits 0))

(Jl 'err)

(Cmp rax (value->bits 255))

(Jg 'err)))

;; Imm -> Asm

(define (eq-imm imm)

(let ((l1 (gensym)))

(seq (Cmp rax imm)

(Mov rax val-true)

(Je l1)

(Mov rax val-false)

(Label l1))))

All that’s left for the top-level compile function to declare an external label 'raise_error that will be defined by the run-time system and to emit a label called 'err that calls raise_error, otherwise this part of the compiler doesn’t change:

extort/compile.rkt

#lang racket

(provide (all-defined-out))

(require "ast.rkt" "types.rkt" "compile-ops.rkt" a86/ast)

;; Registers used

(define rax 'rax) ; return

(define rsp 'rsp) ; stack

;; Expr -> Asm

(define (compile e)

(prog (Extern 'peek_byte)

(Extern 'read_byte)

(Extern 'write_byte)

(Extern 'raise_error)

(Global 'entry)

(Label 'entry)

(Sub 'rsp 8)

(compile-e e)

(Add 'rsp 8)

(Ret)

;; Error handler

(Label 'err)

(Call 'raise_error)))

;; Expr -> Asm

(define (compile-e e)

(match e

[(Int i)            (compile-value i)]

[(Bool b)           (compile-value b)]

[(Char c)           (compile-value c)]

[(Eof)              (compile-value eof)]

[(Prim0 p)          (compile-prim0 p)]

[(Prim1 p e)        (compile-prim1 p e)]

[(If e1 e2 e3)      (compile-if e1 e2 e3)]

[(Begin e1 e2)      (compile-begin e1 e2)]))

;; Value -> Asm

(define (compile-value v)

(seq (Mov rax (value->bits v))))

;; Op0 -> Asm

(define (compile-prim0 p)

(compile-op0 p))

;; Op1 Expr -> Asm

(define (compile-prim1 p e)

(seq (compile-e e)

(compile-op1 p)))

;; Op2 Expr Expr -> Asm

(define (compile-prim2 p e1 e2)

(seq (compile-e e1)

(Push rax)

(compile-e e2)

(compile-op2 p)))

;; Expr Expr Expr -> Asm

(define (compile-if e1 e2 e3)

(let ((l1 (gensym 'if))

(l2 (gensym 'if)))

(seq (compile-e e1)

(Cmp rax val-false)

(Je l1)

(compile-e e2)

(Jmp l2)

(Label l1)

(compile-e e3)

(Label l2))))

;; Expr Expr -> Asm

(define (compile-begin e1 e2)

(seq (compile-e e1)

(compile-e e2)))

Since the interpreter and compiler have well defined specifications for what should happen when type errors occur, we can test in the usual way again:

Examples

> (define (check-correctness e)     (check-equal? (match (asm-interp (compile e))                     ['err 'err]                     [b (bits->value b)])                   (interp e)                   e))

> (check-correctness (Prim1 'add1 (Int 7)))

> (check-correctness (Prim1 'add1 (Bool #f)))