Semantic Subtyping in Luau – Roblox Weblog

Luau is the primary programming language to place the ability of semantic subtyping within the arms of tens of millions of creators.

Minimizing false positives

One of many points with sort error reporting in instruments just like the Script Evaluation widget in Roblox Studio is false positives. These are warnings which might be artifacts of the evaluation, and don’t correspond to errors which may happen at runtime. For instance, this system

native x = CFrame.new()
native y
if (math.random()) then
  y = CFrame.new()
else
  y = Vector3.new()
finish
native z = x * y

stories a sort error which can’t occur at runtime, since CFrame helps multiplication by each Vector3 and CFrame. (Its sort is ((CFrame, CFrame) -> CFrame) & ((CFrame, Vector3) -> Vector3).)

False positives are particularly poor for onboarding new customers. If a type-curious creator switches on typechecking and is straight away confronted with a wall of spurious crimson squiggles, there’s a sturdy incentive to right away change it off once more.

Inaccuracies in sort errors are inevitable, since it’s unimaginable to resolve forward of time whether or not a runtime error will likely be triggered. Sort system designers have to decide on whether or not to dwell with false positives or false negatives. In Luau that is decided by the mode: strict mode errs on the aspect of false positives, and nonstrict mode errs on the aspect of false negatives.

Whereas inaccuracies are inevitable, we attempt to take away them every time attainable, since they end in spurious errors, and imprecision in type-driven tooling like autocomplete or API documentation.

Subtyping as a supply of false positives

One of many sources of false positives in Luau (and plenty of different related languages like TypeScript or Circulate) is subtyping. Subtyping is used every time a variable is initialized or assigned to, and every time a operate is known as: the sort system checks that the kind of the expression is a subtype of the kind of the variable. For instance, if we add sorts to the above program

native x : CFrame = CFrame.new()
native y : Vector3 | CFrame
if (math.random()) then
  y = CFrame.new()
else
  y = Vector3.new()
finish
native z : Vector3 | CFrame = x * y

then the sort system checks that the kind of CFrame multiplication is a subtype of (CFrame, Vector3 | CFrame) -> (Vector3 | CFrame).

Subtyping is a really helpful function, and it helps wealthy sort constructs like sort union (T | U) and intersection (T & U). For instance, quantity? is applied as a union sort (quantity | nil), inhabited by values which might be both numbers or nil.

Sadly, the interplay of subtyping with intersection and union sorts can have odd outcomes. A easy (however quite synthetic) case in older Luau was:

native x : (quantity?) & (string?) = nil
native y : nil = nil
y = x -- Sort '(quantity?) & (string?)' couldn't be transformed into 'nil'
x = y

This error is brought on by a failure of subtyping, the outdated subtyping algorithm stories that (quantity?) & (string?) is just not a subtype of nil. This can be a false optimistic, since quantity & string is uninhabited, so the one attainable inhabitant of (quantity?) & (string?) is nil.

That is a man-made instance, however there are actual points raised by creators brought on by the issues, for instance https://devforum.roblox.com/t/luau-recap-july-2021/1382101/5. At present, these points largely have an effect on creators making use of subtle sort system options, however as we make sort inference extra correct, union and intersection sorts will turn out to be extra frequent, even in code with no sort annotations.

This class of false positives now not happens in Luau, as we’ve moved from our outdated strategy of syntactic subtyping to an alternate referred to as semantic subtyping.

Syntactic subtyping

AKA “what we did earlier than.”

Syntactic subtyping is a syntax-directed recursive algorithm. The fascinating circumstances to cope with intersection and union sorts are:

• Reflexivity: T is a subtype of T
• Intersection L: (T₁ & … & Tⱼ) is a subtype of U every time a few of the Tᵢ are subtypes of U
• Union L: (T₁ | … | Tⱼ) is a subtype of U every time all the Tᵢ are subtypes of U
• Intersection R: T is a subtype of (U₁ & … & Uⱼ) every time T is a subtype of all the Uᵢ
• Union R: T is a subtype of (U₁ | … | Uⱼ) every time T is a subtype of a few of the Uᵢ.

For instance:

• By Reflexivity: nil is a subtype of nil
• so by Union R: nil is a subtype of quantity?
• and: nil is a subtype of string?
• so by Intersection R: nil is a subtype of (quantity?) & (string?).

Yay! Sadly, utilizing these guidelines:

• quantity isn’t a subtype of nil
• so by Union L: (quantity?) isn’t a subtype of nil
• and: string isn’t a subtype of nil
• so by Union L: (string?) isn’t a subtype of nil
• so by Intersection L: (quantity?) & (string?) isn’t a subtype of nil.

That is typical of syntactic subtyping: when it returns a “sure” consequence, it’s right, however when it returns a “no” consequence, it is likely to be improper. The algorithm is a conservative approximation, and since a “no” consequence can result in sort errors, this can be a supply of false positives.

Semantic subtyping

AKA “what we do now.”

Moderately than pondering of subtyping as being syntax-directed, we first take into account its semantics, and later return to how the semantics is applied. For this, we undertake semantic subtyping:

• The semantics of a sort is a set of values.
• Intersection sorts are regarded as intersections of units.
• Union sorts are regarded as unions of units.
• Subtyping is considered set inclusion.

For instance:

and since subtypes are interpreted as set inclusions:

So in line with semantic subtyping, (quantity?) & (string?) is equal to nil, however syntactic subtyping solely helps one path.

That is all positive and good, but when we need to use semantic subtyping in instruments, we’d like an algorithm, and it seems checking semantic subtyping is non-trivial.

Semantic subtyping is difficult

NP-hard to be exact.

We are able to scale back graph coloring to semantic subtyping by coding up a graph as a Luau sort such that checking subtyping on sorts has the identical consequence as checking for the impossibility of coloring the graph

For instance, coloring a three-node, two coloration graph will be performed utilizing sorts:

sort Purple = "crimson"
sort Blue = "blue"
sort Colour = Purple | Blue
sort Coloring = (Colour) -> (Colour) -> (Colour) -> boolean
sort Uncolorable = (Colour) -> (Colour) -> (Colour) -> false

Then a graph will be encoded as an overload operate sort with subtype Uncolorable and supertype Coloring, as an overloaded operate which returns false when a constraint is violated. Every overload encodes one constraint. For instance a line has constraints saying that adjoining nodes can’t have the identical coloration:

sort Line = Coloring
  & ((Purple) -> (Purple) -> (Colour) -> false)
  & ((Blue) -> (Blue) -> (Colour) -> false)
  & ((Colour) -> (Purple) -> (Purple) -> false)
  & ((Colour) -> (Blue) -> (Blue) -> false)

A triangle is analogous, however the finish factors additionally can’t have the identical coloration:

sort Triangle = Line
  & ((Purple) -> (Colour) -> (Purple) -> false)
  & ((Blue) -> (Colour) -> (Blue) -> false)

Now, Triangle is a subtype of Uncolorable, however Line is just not, because the line will be 2-colored. This may be generalized to any finite graph with any finite variety of colours, and so subtype checking is NP-hard.

We cope with this in two methods:

• we cache sorts to cut back reminiscence footprint, and
• hand over with a “Code Too Complicated” error if the cache of sorts will get too massive.

Hopefully this doesn’t come up in observe a lot. There may be good proof that points like this don’t come up in observe from expertise with sort programs like that of Commonplace ML, which is EXPTIME-complete, however in observe it’s important to exit of your method to code up Turing Machine tapes as sorts.

Sort normalization

The algorithm used to resolve semantic subtyping is sort normalization. Moderately than being directed by syntax, we first rewrite sorts to be normalized, then examine subtyping on normalized sorts.

A normalized sort is a union of:

• a normalized nil sort (both by no means or nil)
• a normalized quantity sort (both by no means or quantity)
• a normalized boolean sort (both by no means or true or false or boolean)
• a normalized operate sort (both by no means or an intersection of operate sorts) and many others

As soon as sorts are normalized, it’s easy to examine semantic subtyping.

Each sort will be normalized (sigh, with some technical restrictions round generic sort packs). The essential steps are:

• eradicating intersections of mismatched primitives, e.g. quantity & bool is changed by by no means, and
• eradicating unions of features, e.g. ((quantity?) -> quantity) | ((string?) -> string) is changed by (nil) -> (quantity | string).

For instance, normalizing (quantity?) & (string?) removes quantity & string, so all that’s left is nil.

Our first try at implementing sort normalization utilized it liberally, however this resulted in dreadful efficiency (advanced code went from typechecking in lower than a minute to working in a single day). The explanation for that is annoyingly easy: there may be an optimization in Luau’s subtyping algorithm to deal with reflexivity (T is a subtype of T) that performs an inexpensive pointer equality examine. Sort normalization can convert pointer-identical sorts into semantically-equivalent (however not pointer-identical) sorts, which considerably degrades efficiency.

Due to these efficiency points, we nonetheless use syntactic subtyping as our first examine for subtyping, and solely carry out sort normalization if the syntactic algorithm fails. That is sound, as a result of syntactic subtyping is a conservative approximation to semantic subtyping.

Pragmatic semantic subtyping

Off-the-shelf semantic subtyping is barely totally different from what’s applied in Luau, as a result of it requires fashions to be set-theoretic, which requires that inhabitants of operate sorts “act like features.” There are two the reason why we drop this requirement.

Firstly, we normalize operate sorts to an intersection of features, for instance a horrible mess of unions and intersections of features:

((quantity?) -> quantity?) | (((quantity) -> quantity) & ((string?) -> string?))

normalizes to an overloaded operate:

((quantity) -> quantity?) & ((nil) -> (quantity | string)?)

Set-theoretic semantic subtyping doesn’t help this normalization, and as a substitute normalizes features to disjunctive regular kind (unions of intersections of features). We don’t do that for ergonomic causes: overloaded features are idiomatic in Luau, however DNF is just not, and we don’t need to current customers with such non-idiomatic sorts.

Our normalization depends on rewriting away unions of operate sorts:

((A) -> B) | ((C) -> D)   →   (A & C) -> (B | D)

This normalization is sound in our mannequin, however not in set-theoretic fashions.

Secondly, in Luau, the kind of a operate software f(x) is B if f has sort (A) -> B and x has sort A. Unexpectedly, this isn’t at all times true in set-theoretic fashions, because of uninhabited sorts. In set-theoretic fashions, if x has sort by no means then f(x) has sort by no means. We don’t need to burden customers with the concept operate software has a particular nook case, particularly since that nook case can solely come up in useless code.

In set-theoretic fashions, (by no means) -> A is a subtype of (by no means) -> B, it doesn’t matter what A and B are. This isn’t true in Luau.

For these two causes (that are largely about ergonomics quite than something technical) we drop the set-theoretic requirement, and use pragmatic semantic subtyping.

Negation sorts

The opposite distinction between Luau’s sort system and off-the-shelf semantic subtyping is that Luau doesn’t help all negated sorts.

The frequent case for wanting negated sorts is in typechecking conditionals:

-- initially x has sort T
if (sort(x) == "string") then
  --  on this department x has sort T & string
else
  -- on this department x has sort T & ~string
finish

This makes use of a negated sort ~string inhabited by values that aren’t strings.

In Luau, we solely permit this sort of typing refinement on take a look at sorts like string, operate, Half and so forth, and not on structural sorts like (A) -> B, which avoids the frequent case of common negated sorts.

Prototyping and verification

Throughout the design of Luau’s semantic subtyping algorithm, there have been adjustments made (for instance initially we thought we had been going to have the ability to use set-theoretic subtyping). Throughout this time of speedy change, it was essential to have the ability to iterate rapidly, so we initially applied a prototype quite than leaping straight to a manufacturing implementation.

Validating the prototype was essential, since subtyping algorithms can have sudden nook circumstances. Because of this, we adopted Agda because the prototyping language. In addition to supporting unit testing, Agda helps mechanized verification, so we’re assured within the design.

The prototype doesn’t implement all of Luau, simply the practical subset, however this was sufficient to find refined function interactions that may most likely have surfaced as difficult-to-fix bugs in manufacturing.

Prototyping is just not good, for instance the principle points that we hit in manufacturing had been about efficiency and the C++ normal library, that are by no means going to be caught by a prototype. However the manufacturing implementation was in any other case pretty easy (or not less than as easy as a 3kLOC change will be).

Subsequent steps

Semantic subtyping has eliminated one supply of false positives, however we nonetheless have others to trace down:

• Overloaded operate purposes and operators
• Property entry on expressions of advanced sort
• Learn-only properties of tables
• Variables that change sort over time (aka typestates)

The hunt to take away spurious crimson squiggles continues!

Acknowledgments

Due to Giuseppe Castagna and Ben Greenman for useful feedback on drafts of this submit.

Alan coordinates the design and implementation of the Luau sort system, which helps drive most of the options of improvement in Roblox Studio. Dr. Jeffrey has over 30 years of expertise with analysis in programming languages, has been an energetic member of quite a few open-source software program tasks, and holds a DPhil from the College of Oxford, England.