Revert "Revert "Implement sealed type variables""

This reverts commit 4942724.

# Conflicts:
#	compiler/src/dotty/tools/dotc/cc/Setup.scala
#	compiler/src/dotty/tools/dotc/core/Definitions.scala
#	tests/neg-custom-args/captures/heal-tparam-cs.scala
#	tests/neg-custom-args/captures/usingLogFile-alt.check
#	tests/neg-custom-args/captures/usingLogFile-alt.scala
#	tests/pos-special/stdlib/Test1.scala

Author: odersky

compiler/src/dotty/tools/dotc/cc/CaptureSet.scala

@@ -82,10 +82,7 @@ sealed abstract class CaptureSet extends Showable:
 
   /** Does this capture set contain the root reference `cap` as element? */
   final def isUniversal(using Context) =
-    elems.exists {
-      case ref: TermRef => ref.symbol == defn.captureRoot
-      case _ => false
-    }
+    elems.exists(_.isGenericRootCapability)
 
   /** Does this capture set contain the root reference `cap` as element? */
   final def containsRoot(using Context) =

compiler/src/dotty/tools/dotc/cc/CheckCaptures.scala

@@ -140,6 +140,21 @@ object CheckCaptures:
           case tpe =>
             report.error(em"$elem: $tpe is not a legal element of a capture set", elem.srcPos)
 
+  /** Report an error if some part of `tp` contains the root capability in its capture set */
+  def disallowRootCapabilitiesIn(tp: Type, what: String, have: String, addendum: String, pos: SrcPos)(using Context) =
+    val check = new TypeTraverser:
+      def traverse(t: Type) =
+        if variance >= 0 then
+          t.captureSet.disallowRootCapability: () =>
+            def part = if t eq tp then "" else i"the part $t of "
+            report.error(
+              em"""$what cannot $have $tp since
+                  |${part}that type captures the root capability `cap`.
+                  |$addendum""",
+              pos)
+        traverseChildren(t)
+    check.traverse(tp)
+
   /** Attachment key for bodies of closures, provided they are values */
   val ClosureBodyValue = Property.Key[Unit]
 
@@ -672,11 +687,17 @@ class CheckCaptures extends Recheck, SymTransformer:
       val tryOwner = ccState.tryBlockOwner.remove(tree).getOrElse(ctx.owner)
       val saved = curEnv
       curEnv = Env(tryOwner, EnvKind.Regular, CaptureSet.Var(curEnv.owner), curEnv)
-      try
+      val tp = try
         inContext(ctx.withOwner(tryOwner)):
           super.recheckTry(tree, pt)
         finally
           curEnv = saved
+      if allowUniversalInBoxed && Feature.enabled(Feature.saferExceptions) then
+        disallowRootCapabilitiesIn(tp,
+          "Result of `try`", "have type",
+          "This is often caused by a locally generated exception capability leaking as part of its result.",
+          tree.srcPos)
+      tp
 
     /* Currently not needed, since capture checking takes place after ElimByName.
      * Keep around in case we need to get back to it

compiler/src/dotty/tools/dotc/cc/Setup.scala

@@ -481,6 +481,16 @@ class Setup extends PreRecheck, SymTransformer, SetupAPI:
           for case arg: TypeTree <- args do
             transformTT(arg, boxed = true, exact = false, rootTarget = ctx.owner) // type arguments in type applications are boxed
 
+          if allowUniversalInBoxed then
+            val polyType = fn.tpe.widen.asInstanceOf[TypeLambda]
+            for case (arg: TypeTree, pinfo, pname) <- args.lazyZip(polyType.paramInfos).lazyZip((polyType.paramNames)) do
+              if pinfo.bounds.hi.hasAnnotation(defn.Caps_SealedAnnot) then
+                def where = if fn.symbol.exists then i" in an argument of ${fn.symbol}" else ""
+                CheckCaptures.disallowRootCapabilitiesIn(arg.knownType,
+                  i"Sealed type variable $pname", "be instantiated to",
+                  i"This is often caused by a local capability$where\nleaking as part of its result.",
+                  tree.srcPos)
+
         case tree: TypeDef if tree.symbol.isClass =>
           inContext(ctx.withOwner(tree.symbol)):
             traverseChildren(tree)

compiler/src/dotty/tools/dotc/core/Definitions.scala

@@ -983,6 +983,7 @@ class Definitions {
     @tu lazy val Caps_unsafeBox: Symbol = CapsUnsafeModule.requiredMethod("unsafeBox")
     @tu lazy val Caps_unsafeUnbox: Symbol = CapsUnsafeModule.requiredMethod("unsafeUnbox")
     @tu lazy val Caps_unsafeBoxFunArg: Symbol = CapsUnsafeModule.requiredMethod("unsafeBoxFunArg")
+    @tu lazy val Caps_SealedAnnot: ClassSymbol = requiredClass("scala.caps.Sealed")
     @tu lazy val expandedUniversalSet: CaptureSet = CaptureSet(captureRoot.termRef)
 
   @tu lazy val PureClass: Symbol = requiredClass("scala.Pure")
@@ -1034,6 +1035,7 @@ class Definitions {
   @tu lazy val UncheckedAnnot: ClassSymbol = requiredClass("scala.unchecked")
   @tu lazy val UncheckedStableAnnot: ClassSymbol = requiredClass("scala.annotation.unchecked.uncheckedStable")
   @tu lazy val UncheckedVarianceAnnot: ClassSymbol = requiredClass("scala.annotation.unchecked.uncheckedVariance")
+  @tu lazy val UncheckedCapturesAnnot: ClassSymbol = requiredClass("scala.annotation.unchecked.uncheckedCaptures")
   @tu lazy val VolatileAnnot: ClassSymbol = requiredClass("scala.volatile")
   @tu lazy val WithPureFunsAnnot: ClassSymbol = requiredClass("scala.annotation.internal.WithPureFuns")
   @tu lazy val CaptureCheckedAnnot: ClassSymbol = requiredClass("scala.annotation.internal.CaptureChecked")

compiler/src/dotty/tools/dotc/core/Types.scala

@@ -4086,10 +4086,15 @@ object Types {
 
     protected def toPInfo(tp: Type)(using Context): PInfo
 
+    /** If `tparam` is a sealed type parameter symbol of a polymorphic method, add
+     *  a @caps.Sealed annotation to the upperbound in `tp`.
+     */
+    protected def addSealed(tparam: ParamInfo, tp: Type)(using Context): Type = tp
+
     def fromParams[PI <: ParamInfo.Of[N]](params: List[PI], resultType: Type)(using Context): Type =
       if (params.isEmpty) resultType
       else apply(params.map(_.paramName))(
-        tl => params.map(param => toPInfo(tl.integrate(params, param.paramInfo))),
+        tl => params.map(param => toPInfo(addSealed(param, tl.integrate(params, param.paramInfo)))),
         tl => tl.integrate(params, resultType))
   }
 
@@ -4411,6 +4416,16 @@ object Types {
         resultTypeExp: PolyType => Type)(using Context): PolyType =
       unique(new PolyType(paramNames)(paramInfosExp, resultTypeExp))
 
+    override protected def addSealed(tparam: ParamInfo, tp: Type)(using Context): Type =
+      tparam match
+        case tparam: Symbol if tparam.is(Sealed) =>
+          tp match
+            case tp @ TypeBounds(lo, hi) =>
+              tp.derivedTypeBounds(lo,
+                AnnotatedType(hi, Annotation(defn.Caps_SealedAnnot, tparam.span)))
+            case _ => tp
+        case _ => tp
+
     def unapply(tl: PolyType): Some[(List[LambdaParam], Type)] =
       Some((tl.typeParams, tl.resType))
   }

compiler/src/dotty/tools/dotc/parsing/Parsers.scala

@@ -3194,7 +3194,9 @@ object Parsers {
      *                         id [HkTypeParamClause] TypeParamBounds
      *
      *  DefTypeParamClause::=  ‘[’ DefTypeParam {‘,’ DefTypeParam} ‘]’
-     *  DefTypeParam      ::=  {Annotation} id [HkTypeParamClause] TypeParamBounds
+     *  DefTypeParam      ::=  {Annotation}
+     *                         [`sealed`]                                    -- under captureChecking
+     *                         id [HkTypeParamClause] TypeParamBounds
      *
      *  TypTypeParamClause::=  ‘[’ TypTypeParam {‘,’ TypTypeParam} ‘]’
      *  TypTypeParam      ::=  {Annotation} id [HkTypePamClause] TypeBounds
@@ -3204,24 +3206,24 @@ object Parsers {
      */
     def typeParamClause(ownerKind: ParamOwner): List[TypeDef] = inBrackets {
 
-      def variance(vflag: FlagSet): FlagSet =
-        if ownerKind == ParamOwner.Def || ownerKind == ParamOwner.TypeParam then
-          syntaxError(em"no `+/-` variance annotation allowed here")
-          in.nextToken()
-          EmptyFlags
-        else
-          in.nextToken()
-          vflag
+      def checkVarianceOK(): Boolean =
+        val ok = ownerKind != ParamOwner.Def && ownerKind != ParamOwner.TypeParam
+        if !ok then syntaxError(em"no `+/-` variance annotation allowed here")
+        in.nextToken()
+        ok
 
       def typeParam(): TypeDef = {
         val isAbstractOwner = ownerKind == ParamOwner.Type || ownerKind == ParamOwner.TypeParam
         val start = in.offset
-        val mods =
-          annotsAsMods()
-          | (if (ownerKind == ParamOwner.Class) Param | PrivateLocal else Param)
-          | (if isIdent(nme.raw.PLUS) then variance(Covariant)
-             else if isIdent(nme.raw.MINUS) then variance(Contravariant)
-             else EmptyFlags)
+        var mods = annotsAsMods() | Param
+        if ownerKind == ParamOwner.Class then mods |= PrivateLocal
+        if Feature.ccEnabled && in.token == SEALED then
+          mods |= Sealed
+          in.nextToken()
+        if isIdent(nme.raw.PLUS) && checkVarianceOK() then
+          mods |= Covariant
+        else if isIdent(nme.raw.MINUS) && checkVarianceOK() then
+          mods |= Contravariant
         atSpan(start, nameStart) {
           val name =
             if (isAbstractOwner && in.token == USCORE) {

compiler/src/dotty/tools/dotc/typer/Checking.scala

@@ -518,7 +518,12 @@ object Checking {
         // note: this is not covered by the next test since terms can be abstract (which is a dual-mode flag)
         // but they can never be one of ClassOnlyFlags
     if !sym.isClass && sym.isOneOf(ClassOnlyFlags) then
-      fail(em"only classes can be ${(sym.flags & ClassOnlyFlags).flagsString}")
+      val illegal = sym.flags & ClassOnlyFlags
+      if sym.is(TypeParam)
+          && illegal == Sealed
+          && Feature.ccEnabled && cc.allowUniversalInBoxed
+      then () // OK
+      else fail(em"only classes can be ${illegal.flagsString}")
     if (sym.is(AbsOverride) && !sym.owner.is(Trait))
       fail(AbstractOverrideOnlyInTraits(sym))
     if sym.is(Trait) then

library/src/scala/caps.scala

@@ -46,3 +46,9 @@ import annotation.experimental
       def unsafeBoxFunArg: T => U = f
 
   end unsafe
+
+  /** An annotation that expresses the sealed modifier on a type parameter
+   *  Should not be directly referred to in source
+   */
+  @deprecated("The Sealed annotation should not be directly used in source code.\nUse the `sealed` modifier on type parameters instead.")
+  class Sealed extends annotation.Annotation

tests/neg-custom-args/captures/heal-tparam-cs.scala

@@ -1,31 +1,31 @@
 import language.experimental.captureChecking
 
-trait Cap { def use(): Unit }
+trait Capp { def use(): Unit }
 
-def localCap[T](op: (lcap: caps.Cap) ?-> (c: Cap^{lcap}) => T): T = ???
+def localCap[sealed T](op: (c: Capp^{cap}) => T): T = ???
 
-def main(io: Cap^{cap}, net: Cap^{cap}): Unit = {
+def main(io: Capp^{cap}, net: Capp^{cap}): Unit = {
 
-  val test1 = localCap { c => // error
+  val test1 = localCap { c => // should be error
     () => { c.use() }
   }
 
-  val test2: (c: Cap^{cap}) -> () ->{cap} Unit =
-    localCap { c =>  // should work (was error)
-      (c1: Cap^{cap}) => () => { c1.use() }
+  val test2: (c: Capp^{cap}) -> () ->{cap} Unit =
+    localCap { c =>  // should work
+      (c1: Capp^{cap}) => () => { c1.use() }
     }
 
-  val test3: (c: Cap^{io}) -> () ->{io} Unit =
+  val test3: (c: Capp^{io}) -> () ->{io} Unit =
     localCap { c =>  // should work
-      (c1: Cap^{io}) => () => { c1.use() }
+      (c1: Capp^{io}) => () => { c1.use() }
     }
 
-  val test4: (c: Cap^{io}) -> () ->{net} Unit =
+  val test4: (c: Capp^{io}) -> () ->{net} Unit =
     localCap { c =>  // error
-      (c1: Cap^{io}) => () => { c1.use() }
+      (c1: Capp^{io}) => () => { c1.use() }
     }
 
-  def localCap2[T](op: (c: Cap^{io}) => T): T = ???
+  def localCap2[sealed T](op: (c: Capp^{io}) => T): T = ???
 
   val test5: () ->{io} Unit =
     localCap2 { c =>  // ok

tests/pos-custom-args/captures/i15749a.scala

@@ -1,4 +1,3 @@
-// TODO: Adapt to levels
 class Unit
 object u extends Unit
 
@@ -11,12 +10,12 @@ def test =
   def wrapper[T](x: T): Wrapper[T] =
     [X] => (op: T ->{cap} X) => op(x)
 
-  def strictMap[A <: Top, B <: Top](mx: Wrapper[A])(f: A ->{cap} B): Wrapper[B] =
+  def strictMap[A <: Top, sealed B <: Top](mx: Wrapper[A])(f: A ->{cap} B): Wrapper[B] =
     mx((x: A) => wrapper(f(x)))
 
   def force[A](thunk: Unit ->{cap} A): A = thunk(u)
 
-  def forceWrapper[A](mx: Wrapper[Unit ->{cap} A]): Wrapper[A] =
+  def forceWrapper[sealed A](mx: Wrapper[Unit ->{cap} A]): Wrapper[A] =
     // Γ ⊢ mx: Wrapper[□ {cap} Unit => A]
     // `force` should be typed as ∀(□ {cap} Unit -> A) A, but it can not
     strictMap[Unit ->{cap} A, A](mx)(t => force[A](t)) // error