<div dir="ltr">Allowing extensions within a module to introduce stored properties would be a great addition to the language, but it's a completely different matter. A language shouldn't dictate file structure. It may make sense to keep related classes in the same file for easier access rather than having tiny files for every scope. "scoped" is much clearer about intent then "private". It says that something must be hidden in the scope regardless of where the code is.</div><br><div class="gmail_quote"><div dir="ltr">On Sat, Feb 27, 2016 at 8:04 PM Joe Groff via swift-evolution <<a href="mailto:swift-evolution@swift.org">swift-evolution@swift.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Drew Crawford via swift-evolution<br>
<<a href="mailto:swift-evolution@swift.org" target="_blank">swift-evolution@swift.org</a>> wrote:<br>
>> I’m unsure what you are imagining here - compiler protection of class<br>
>> details from within a closure completion handler that is also part of<br>
>> your class definition?<br>
><br>
> What i mean here is simply<br>
><br>
> class Foo {<br>
> ///it is undefined behavior to access this variable except from specialQueue<br>
> private var _specialQueueOnly = 0<br>
><br>
> public var specialQueueOnly: Int {<br>
> var i: I! = nil<br>
> dispatch_sync(specialQueue) {<br>
> i = _specialQueueOnly<br>
> }<br>
> return i<br>
> }<br>
> }<br>
><br>
> The lynchpin of this defensive programming technique is that only these<br>
> 12 lines of code have any risk of a threading bug, and we can trivially<br>
> inspect the 12 lines. So our safety hangs on two tentpegs:<br>
><br>
> 1. That "private" in "private var _specialQueue" is compiler enforcement<br>
> against other files trying to access this ivar<br>
> 2. That the file itself is 12 (or other minimal number of) lines and<br>
> trivially inspectable.<br>
><br>
> Should we violate any of these constraints, we lose our safety.<br>
<br>
Allowing extensions within a module to introduce stored properties might be<br>
another possible way of enabling this, since you could then factor the<br>
private storage and its concurrency-safe accessors into a separate file.<br>
Looking further into the future, our concurrency model will hopefully have<br>
some mechanism for isolating state, by actors or some other means.<br>
<br>
-Joe<br>
<br>
><br>
>> It may be that I’m unfamiliar with UITableViewCellContentView (as it is not documented).<br>
><br>
><br>
> Well, that is kind of the point: Objective-C's access control worked, and<br>
> prevented you from knowing about this class.<br>
><br>
> But to provide a more accessible illustration, consider the case where we<br>
> have some motivation to hide Foo from the rest of our<br>
> framework[/module/target/application/executable/library]. This is more<br>
> likely to happen in a UIKit-sized project, where there are hundreds of<br>
> public classes, and probably thousands of "internal" ones, and a typical<br>
> class has motivation to touch 5 or 6 other classes, of the thousands that may be available.<br>
><br>
> In Swift, each internal class is visible to every other class. But that<br>
> is not especially workable at UIKit scale; if every class can potentially<br>
> reach every other class we are in for an adventure when one of the<br>
> hundred developers on your team decides that some UITableView<br>
> implementation detail you've never heard of should be accessing some<br>
> UILocalNotification detail you've also never heard of. So we need some<br>
> kind of "fencing" within a large framework to make good neighbors.<br>
><br>
> This is solved very easily: we can group several related classes into one<br>
> file, and some of the classes are private. Many ordinary people today<br>
> group related classes into a file as a fencing mechanism even not at<br>
> UIKit-scale. So a file can access all of its own classes, but not all<br>
> the classes of other files. That creates the "fence", and now your<br>
> coworker cannot draw a line between some UITableView secret class and some<br>
> UILocalNotification secret class, and your desk will not be dented from<br>
> the impact of your forehead.<br>
><br>
> The problem now is that while fixing this situation we have broken one of<br>
> our safety tentpegs. We earlier required that Foo.swift be only 12 lines<br>
> for thread safety, but now Foo is contained in a larger file so as to<br>
> create a fence. So we can solve one of these problems or the other one,<br>
> but never both at the same time.<br>
><br>
> "local" effectively resolves this dilemma, because if our<br>
> _specialQueueOnly variable is local, then it is not the /file/ which must<br>
> be kept to 12 lines, but the /scope/. So we could group an unlimited<br>
> number of classes in Foo.swift, with no loss of confidence for our thread safety.<br>
><br>
> A better approach might be to realize that if global scope, target scope,<br>
> and file scope do not solve the visibility problem, perhaps yet another<br>
> scope will not totally solve the problem either. I fully expect Apple<br>
> will need a "vendor" scope for example (so that UIKit and CoreAnimation,<br>
> two public frameworks, can still have private APIs between them), and I<br>
> bet there are many more kinds of scopes that have not yet occurred to me.<br>
><br>
> Behind that realization lies the Rust system, which divorces visibility<br>
> from these arbitrary scopes that we seem to be struggling to fit into.<br>
> But that proposal isn't before us, and this one is. I prefer going<br>
> somewhere to staying here.<br>
><br>
> Drew<br>
><br>
><br>
>> On Feb 26, 2016, at 10:34 PM, David Waite<br>
>> <<a href="mailto:david@alkaline-solutions.com" target="_blank">david@alkaline-solutions.com</a>> wrote:<br>
>><br>
>><br>
>>> On Feb 26, 2016, at 8:44 PM, Drew Crawford via swift-evolution<br>
>>> <<a href="mailto:swift-evolution@swift.org" target="_blank">swift-evolution@swift.org</a><br>
>>> <mailto:<a href="mailto:swift-evolution@swift.org" target="_blank">swift-evolution@swift.org</a>>> wrote:<br>
>>> Threading is one especially pernicious case. If I have an ivar that is<br>
>>> only safe for access from one thread, I *need* compiler enforcement. I<br>
>>> *need* a guarantee that this ivar is only accessed through public<br>
>>> interface methods that can be audited to be threadsafe. Simply a<br>
>>> doccomment that says "bad programmer, don't do it" is not enough.<br>
>><br>
>> I’m unsure what you are imagining here - compiler protection of class<br>
>> details from within a closure completion handler that is also part of<br>
>> your class definition? I believe you would only get this with this local<br>
>> scope proposal if you structured your code such that callback blocks<br>
>> were functions outside your type definition.<br>
>><br>
>> If you are talking about access or modification of the inner state of a<br>
>> class and a manual audit of safety, that audit is of the file and not of<br>
>> the type or extension. I’m unsure if your concern is of having to split<br>
>> code into multiple files for safety, or that there is not a way to split<br>
>> code into multiple files to achieve safety in some particular scenario.<br>
>><br>
>>><br>
>>> This is not even a matter of "artistic choice" of whether or not I want<br>
>>> to follow "one file per class". I can achieve thread safety with<br>
>>> "private" ivars and "one file per class", but if my class is<br>
>>> UITableViewCellContentView (which is an implementation detail that<br>
>>> should be hidden even to most of UIKit) I am now forced to expose that<br>
>>> implementation detail to my entire team.<br>
>><br>
>>> This places me in the unconscionable situation of choosing between<br>
>>> whether I have thread safety or encapsulation, between whether my<br>
>>> coworker will accidentally create a threading bug or accidentally use a<br>
>>> class they ought not to use and I am unable to appropriately hide.<br>
>><br>
>> I’m not quite sure what you mean here - exposing that your class is a<br>
>> subclass of UITableViewCellContentView? Or that the rest of your team<br>
>> needs to code in different files from your class in order to maintain encapsulation?<br>
>><br>
>> It may be that I’m unfamiliar with UITableViewCellContentView (as it is not documented).<br>
>><br>
>> <snip><br>
>><br>
>>>> How much effort did you put into your review? A glance, a quick<br>
>>>> reading, or an in-depth study?<br>
>>> I've followed this from the earliest discussions. I've rethought my<br>
>>> position somewhat in response to the growing uncertainty about dropping<br>
>>> the NS prefix, which I think exposes some very real problems with visibility in Swift.<br>
>>><br>
>>> As that situation has developed, I no longer believe this proposal goes<br>
>>> far enough. But it does go somewhere, and we should not stay where we are.<br>
>><br>
>> I don’t understand how an access control proposal pertains to changes in<br>
>> the Foundation public API. What is the ideal end state in your mind, and<br>
>> in what way is this a step toward that?<br>
>><br>
>> -DW<br>
>><br>
>><br>
><br>
><br>
><br>
<br>
<br>
<br>
<br>
_______________________________________________<br>
swift-evolution mailing list<br>
<a href="mailto:swift-evolution@swift.org" target="_blank">swift-evolution@swift.org</a><br>
<a href="https://lists.swift.org/mailman/listinfo/swift-evolution" rel="noreferrer" target="_blank">https://lists.swift.org/mailman/listinfo/swift-evolution</a><br>
</blockquote></div>