Hi Guille,

On Nov 19, 2015, at 9:11 AM, Guillermo Polito <guillermopolito@gmail.com> wrote:


On 19 nov 2015, at 5:46 p.m., Cl��ment Bera <bera.clement@gmail.com> wrote:



2015-11-19 10:33 GMT+01:00 Guillermo Polito <guillermopolito@gmail.com>:
I know we can :) and I did some prototypes already as part of my thesis.

The question is if that is a design we *want* or not.

There is a misunderstanding.

Nope :) I understood you well. And yes, you misunderstood my answer :P. I know that the VM already provides the necessary primitives and I know how to use them ^^.

I am not talking about prototypes. The operations are in the production VM and are stable. That's why I say you can use it. 

I meant prototypes of mirrors on the image side. I know and used the primitives. The questions are if we want to have a mirror library, if we want core tools (such as the inspector) to use it instead of delegating reflective operations to objects. Also there are many different mirror designs we can come up with. The design I have in mind is pretty much aligned with the idea of mirrors that Camille has in mind where there are low level mirrors to manipulate objects as the VM know them, and then high level mirrors implementing the language concerns AND application specific mirrors. But then this kind of mirror implementation is a beast in itself :)

Good question.  Let's be clear there are two issues here.  One, that shouldn't be in doubt, is that Pharo should use the simple mirror primitives I provided that are already in the VM asap both to provide low level inspectors for proxies and to make the debugger/execution simulator correct.  Note that process termination, where a high-priority process terminates a lower one, and end up invoking the execution simulation machinery in getting to a point where unwind blocks can be executed, so the correctness issue can bite in the base system, not just when debugging.

The other issue is your question, should there be a proper set of mirror objects as described by Gilad Bracha.  The rationale for proper mirrors is security; to avoid making dangerous primitives like instVarAt: and object:instVarAt: (not to mention allInstances, allObjects, class itself, etc etc) generally available so people can write secure code.  This is a great rationale, and makes sense, but the current system is a /long/ way away from that.  A truly secure system (meaning a single Smalltalk system which could allow untrusted Smalltalk scripts to run within it and not provide these scripts with the ability to break (into) code in the system) would require much more work than merely providing proper mirrors.  The whole system of object access, method access, class manipulation needs to be implemented in a secure manner.  That's a great long term project, but just adding mirrors is very far from enough.

Our experience at Cadence where we have used the newspeak mirror system in a non secure squeak host, is that mirrors introduce a lot of complexity and performance overhead and so we've been eliminating their use.  Our application provides an SOC domain model that used to be manipulated by mirrors, but we're phasing that out because it costs so much in performance.

So my considered opinion is that we should not add proper mirrors to current Pharo, because we will pay the performance and complexity penalties but not get the security reward.  Instead, there should be research projects on small simple systems that attempt to architect a usable secure Smalltalk environment, and when that architecture  demonstrates its viability to port the architecture into Pharo.  I think that's years away.

HTH

Also, answering Stephan Eggermont below:

1 Is it an improvement on the current situation?

I believe it is. Mirrors allow to extract the reflective behavior in separate objects. With them we would be able to inspect instances of classes that have no methods at all.

Moreover, it would clean up objects��� API because there will be no more meta-level methods in the base classes. This would avoid name clashes like #name in metaclasses that was discussed the other day.

2 Is it blocking an improvement direction we want to take?

I do not completely understand the question.
I just can say that I think having mirrors is an interesting direction.

3 Can it be tested quickly?

A basic mirror implementation that only exposes VM internals could be easy to implement and test. Adapting the eye inspector to use a mirror instead of a normal object is also fairly easy, at lest for a first implementation. Of course the question always is doing it for real: I do not know how much time would it take to make all tools work as well.


There is no need to implement additional VM support to debug this kind of objects as it's already done and stable.
 


On 18 nov 2015, at 5:29 p.m., Cl��ment Bera <bera.clement@gmail.com> wrote:



2015-11-18 8:43 GMT-03:00 Guillermo Polito <guillermopolito@gmail.com>:
I���d like to discuss also the possibility to add those low level operations on mirrors objects, that could be packaged separately from the kernel of the language. Adding them on a first step is easy, then making all tools use them is the hard/timeconsuming part, yes.

All the needed operations already exist. You can put them on your mirror objects without any problem.



On 18 nov 2015, at 12:35 p.m., Cl��ment Bera <bera.clement@gmail.com> wrote:

Hello,

This is known and was discussed on the bug tracker.

The problem is that currently Pharo has many tools and classes: EyeInspector in the debugger, GTInspector outside, the debugger itself, the in-image interpreter in the Context class ... that need to be changed to support debugging objects that basically cannot receive any message.

We are aware of the solution but fixing it for all the toolkits and classes is quite some work. In addition, if not tested, someone will break it because he won't understand that an inspected object can't receive any message because the expected behavior of an object with no DNU behavior and no methods inherited from Object is to freeze the system. 

It's a lot of fun doing that though.

Clement

2015-11-17 21:39 GMT-03:00 Eliot Miranda <eliot.miranda@gmail.com>:
Hi Esteban,

On Tue, Nov 17, 2015 at 1:37 PM, Esteban A. Maringolo <emaringolo@gmail.com> wrote:

2015-11-17 14:37 GMT-03:00 Eliot Miranda <eliot.miranda@gmail.com>:
> Hi Esteban,
>
> I think EyeInspector needs to handle classes that don't inherit from
> Object specially. Instead of asking the instance it should ask the class.
> You should be able to use the Context methods for mirror primitives to
> extract state without sending messages to the instance. Then the special
> version of EyeInspector for ProtoObject subclasses can ask this like

Yes, an special inspector for ProtoObject subclasses would be required, but I couldn't find one already suited for this purpose.

> (thisContext objectClass: object) isIndexable ifTrue:
> [size := thisContext objectSize: object]

I don't know if your code was meant to be accurate or just a guideline of how this could be implemented, but Context doesn't implement #objectClass: nor #objectSize:


Find attached.  I think you'll find they are in the Spur version.  You might think of back-porting their use in Context form Spur; that'll make the debugger able to handle proxies.

> Basically both the Inspector and the Debugger's execution simulation
> machinery need to treat encapsulators such as MessageArchiver with kid
> gloves. One *must not* cause inspecting or debugging to send messages
> through the encapsulator. Instead, all access to the object should be
> through primitives that don't send messages to the objects.

I know that dealing with Proxies and similar objects is tricky, I had to deal with my own subclasses of ProtoObject in Dolphin, but there the class implemented all that was needed to interact with the environment tools.

Hiwever, to me all this is a kind of black magic, I read the blue book years ago and can understand it, but I do understand it as I understand the mechanics of my car, however when it breaks down I take it to the specialist :)

Well, the thing to think of is that inside the VM objects are just a sequence of words, and the VM, while it sends messages, doesn't send messages to objects to update their state; it just accesses the state directly.  So in an execution simulation method such as

Context methods for instruction decoding
pushReceiverVariable: offset
    self push: (receiver instVarAt: offset + 1)

that will send the message instVarAt: to the receiver, and if the receiver is a proxy, that will go through the proixie's doesNotUnderstand: method and send instVarAt: the the object the proxy wraps, which won't do the right thing at all.  Instead it needs to be written

Context methods for instruction decoding
pushReceiverVariable: offset
    self push: (self object: receiver instVarAt: offset + 1)

which reaches into the object without sending any messages to it.  I understand that this will appear in Spur, because I made it part of the bootstrap, but if I were you I would integrate these changes into the current version asap.  The debugger won't work properly with proxies, encapsulators etc otherwise.

_,,,^..^,,,_
best, Eliot