Comment by dnautics
4 hours ago
I think this is wrong. Type systems should be simpler, and you should design it so that your language is easily and correctly statically checked. Not all invariants necessarily have to be verified at the same cadence (compile time)
> you should design it so that your language is easily and correctly statically checked.
You do that by making the type system more sophisticated.
If you have a really important invariant that you really don't want to be violated due to run-time behavior/input, it's a huge benefit to have a compiler that can statically check that it actually can't be. That's one of the main benefits of having type systems, not just describing the shape of data structures in memory.
You can perform static analysis outside of the compiler without putting things in the type system?
C is a bad language to do this with for various reasons, but as a simple example:
There is absolutely no reason why static analysis should not be able to see what the problem is here.
Sure, but what it is that makes you believe the compiler shouldn't be the one doing that analysis? Should it catch
``` ((void()(void) free)(buf); ((void()(void) free)(buf); ```
It's been my experience people invested in static analysis think of it like some wholly additive extension.
Compiler-independent static analysis is code applying rules. Someone has to write all the rules, align them with the language and the compiler. The user rarely reads the static analyzer's code or full rule definitions and is blissfully unaware of the full set of disconnects, inconsistences, and gaps between the coverage of the two.
They only notice divergence in the analysis when it generates a false-positive warning or error.
Static analysis adds compilation overhead. Sure, but I'd hazard that re-reading and in to some degree repeating the parsing/translation process that the compiler is going to do also introduces overhead.
There are some languages that demonstrate sta-by-compiler capabilities with heinous compile times, but it doesn't have to be that way. We can engineer better, but at some point it requires a price. Better comments, boilerplate of some kind or another, annotating intent over idiom.
A complex type system isn't ideal; with the right set of primitives you can achieve sophistication without complexity.
``` Freeable buf = malloc(SIZE); free(buf); // compiler error, you didn't check buf isn't valid. free(buf); // compiler error still if you fixed the above, free makes buf invalid. ```
"Making the compiler do STA makes it slow". I don't think that's proven one way or the other. There are examples both ways. "complex" type systems frequently have slow compilers, but if you look more closely that's usually because they're trying to compensate for the disconnect between organically emerged complexity in their under-designed type systems.
uintptr_t x = opaque((uintptr_t)p); free((void *)x); free(p);
How will you find such violations if opaque comes from so or some ffi, so compiler can't see through? you can't. It's heuristics. Sound type system is much stronger
typesystems can be considered a kind of static analysis
But what does static analysis work on? The source code. If it's not in the source code, the static analyzer can't check it. So if you want to check something, even with a static analyzer, then you need some way to talk about that thing in the source code, which means it has to be part of the source language.
Now, sure, you could have some kind of annotations in the comments or something, and a static analyzer that checked those, and you could get that to check pretty much anything that can be checked statically. But at that point, it's not really part of the language, is it?
So you prefer runtime crashes to compiler diagnostics, just so the type system can be "simpler"? I find these priorities backwards.
> So you prefer runtime crashes
Do you not understand what static analysis is?
We understand that static analysis is often less bulletproof than a compiler's type system. It doesn't always catch everything. If it does, it often says "may", and then you have to sort out the false positives from the real problems, and there can be a lot of them.
And if you don't take every problem seriously, and do a full investigation, then you are risking a real problem that you don't fix, which can turn into... a runtime crash.