Fix unsafe cases in capability subtyping implementation

packages/collections/map.pony

@@ -63,12 +63,7 @@ class HashMap[K, V, H: HashFunction[K] val]
     try
       (let i, let found) = _search(key)
 
-      let k = if found then
-        _array(i)? as (K^, _)
-      else
-        consume key
-      end
-      match _array(i)? = (consume k, consume value)
+      match _array(i)? = (consume key, consume value)
       | (_, let v: V) =>
         return consume v
       else

packages/itertools/iter.pony

@@ -89,7 +89,7 @@ class Iter[A] is Iterator[A]
         fun ref next(): A => _v
       end
 
-  fun ref map_stateful[B](f: {ref(A!): B ?}): Iter[B]^ =>
+  fun ref map_stateful[B](f: {ref(A!): B^ ?}): Iter[B]^ =>
     """
     Allows stateful transformaion of each element from the iterator, similar
     to `map`.
@@ -103,12 +103,12 @@ class Iter[A] is Iterator[A]
           f(_iter.next()?)?
       end)
 
-  fun ref filter_stateful(f: {ref(A!): Bool ?}): Iter[A]^ =>
+  fun ref filter_stateful(f: {ref(A!): Bool ?}): Iter[A!]^ =>
     """
     Allows filtering of elements based on a stateful adapter, similar to
     `filter`.
     """
-    Iter[A](
+    Iter[A!](
       object
         var _next: (A! | _None) = _None
 
@@ -140,9 +140,9 @@ class Iter[A] is Iterator[A]
             true
           end
 
-        fun ref next(): A ? =>
+        fun ref next(): A! ? =>
           match _next = _None
-          | let a: A => consume a
+          | let a: A! => a
           else
             if _iter.has_next() then
               _find_next()
@@ -153,7 +153,7 @@ class Iter[A] is Iterator[A]
           end
       end)
 
-  fun ref filter_map_stateful[B](f: {ref(A!): (B | None) ?}): Iter[B]^ =>
+  fun ref filter_map_stateful[B](f: {ref(A!): (B^ | None) ?}): Iter[B]^ =>
     """
     Allows stateful modification to the stream of elements from an iterator,
     similar to `filter_map`.
@@ -189,9 +189,8 @@ class Iter[A] is Iterator[A]
           end
 
         fun ref next(): B ? =>
-          match _next
+          match _next = _None
           | let b: B =>
-            _next = _None
             consume b
           else
             if _iter.has_next() then
@@ -372,7 +371,7 @@ class Iter[A] is Iterator[A]
           (_i = _i + 1, _iter.next()?)
       end)
 
-  fun ref filter(f: {(A!): Bool ?} box): Iter[A]^ =>
+  fun ref filter(f: {(A!): Bool ?} box): Iter[A!]^ =>
     """
     Return an iterator that only returns items that match the predicate `f`.
 
@@ -416,7 +415,7 @@ class Iter[A] is Iterator[A]
     end
     error
 
-  fun ref filter_map[B](f: {(A!): (B | None) ?} box): Iter[B]^ =>
+  fun ref filter_map[B](f: {(A!): (B^ | None) ?} box): Iter[B]^ =>
     """
     Return an iterator which applies `f` to each element. If `None` is
     returned, then the iterator will try again by applying `f` to the next
@@ -431,7 +430,7 @@ class Iter[A] is Iterator[A]
     `1 4 7`
     ```
     """
-    filter_map_stateful[B]({(a: A!): (B | None) ? => f(a)? })
+    filter_map_stateful[B]({(a: A!): (B^ | None) ? => f(a) ? })
 
   fun ref flat_map[B](f: {(A!): Iterator[B] ?} box): Iter[B]^ =>
     """
@@ -562,7 +561,7 @@ class Iter[A] is Iterator[A]
     else error
     end
 
-  fun ref map[B](f: {(A!): B ?} box): Iter[B]^ =>
+  fun ref map[B](f: {(A!): B^ ?} box): Iter[B]^ =>
     """
     Return an iterator where each item's value is the application of the given
     function to the value in the original iterator.
@@ -575,7 +574,7 @@ class Iter[A] is Iterator[A]
     ```
     `1 4 9`
     """
-    map_stateful[B]({(a: A!): B ? => f(a)? })
+    map_stateful[B]({(a: A!): B^ ? => f(a) ? })
 
   fun ref nth(n: USize): A ? =>
     """
@@ -655,7 +654,7 @@ class Iter[A] is Iterator[A]
     end
     this
 
-  fun ref skip_while(f: {(A!): Bool ?} box): Iter[A]^ =>
+  fun ref skip_while(f: {(A!): Bool ?} box): Iter[A!]^ =>
     """
     Skip values of the iterator while the predicate `f` returns true.
 
@@ -709,7 +708,7 @@ class Iter[A] is Iterator[A]
           end
       end)
 
-  fun ref take_while(f: {(A!): Bool ?} box): Iter[A]^ =>
+  fun ref take_while(f: {(A!): Bool ?} box): Iter[A!]^ =>
     """
     Return an iterator that returns values while the predicate `f` returns
     true. This iterator short-circuits the first time that `f` returns false or
@@ -723,7 +722,7 @@ class Iter[A] is Iterator[A]
     ```
     `1 2 3`
     """
-    Iter[A](
+    Iter[A!](
       object
         var _done: Bool = false
         var _next: (A! | None) = None
@@ -733,9 +732,9 @@ class Iter[A] is Iterator[A]
           else _try_next()
           end
 
-        fun ref next(): A ? =>
+        fun ref next(): A! ? =>
           if (_next isnt None) or _try_next() then
-            (_next = None) as A
+            (_next = None) as A!
           else error
           end
 
@@ -751,7 +750,7 @@ class Iter[A] is Iterator[A]
                 _done = true
                 return false
               end
-            _done = try not f(_next as A)? else true end
+            _done = try not f(_next as A!)? else true end
             not _done
           end
       end)

src/libponyc/expr/lambda.c

@@ -250,8 +250,9 @@ bool expr_lambda(pass_opt_t* opt, ast_t** astp)
         continue;
 
       // Must have a supercap of the def's receiver cap (if present).
-      if((ast_id(receiver_cap) != TK_NONE) && !is_cap_sub_cap(
-        ast_id(def_receiver_cap), TK_NONE, ast_id(receiver_cap), TK_NONE)
+      if((ast_id(receiver_cap) != TK_NONE) && (ast_id(receiver_cap) != TK_AT) &&
+        !is_cap_sub_cap(ast_id(def_receiver_cap), TK_NONE,
+        ast_id(receiver_cap), TK_NONE)
         )
         continue;
 

src/libponyc/type/alias.c

@@ -211,7 +211,8 @@ static ast_t* consume_single(ast_t* type, token_id ccap)
     default: {}
   }
 
-  if(!is_cap_sub_cap(tcap, TK_NONE, ccap, TK_NONE))
+  // We're only modifying the cap, not the type, so the bounds are the same.
+  if(!is_cap_sub_cap_bound(tcap, TK_NONE, ccap, TK_NONE))
   {
     ast_free_unattached(type);
     return NULL;

src/libponyc/type/cap.c

@@ -70,7 +70,7 @@ bool is_cap_sub_cap(token_id sub, token_id subalias, token_id super,
       return false;
   }
 
-  if((sub == super) || (super == TK_TAG))
+  if(super == TK_TAG)
     return true;
 
   // Every possible instantiation of sub must be a subtype of every possible
@@ -80,6 +80,7 @@ bool is_cap_sub_cap(token_id sub, token_id subalias, token_id super,
     case TK_ISO:
       switch(super)
       {
+        case TK_ISO:
         case TK_TRN:
         case TK_REF:
         case TK_VAL:
@@ -98,6 +99,7 @@ bool is_cap_sub_cap(token_id sub, token_id subalias, token_id super,
     case TK_TRN:
       switch(super)
       {
+        case TK_TRN:
         case TK_REF:
         case TK_VAL:
         case TK_BOX:
@@ -113,6 +115,7 @@ bool is_cap_sub_cap(token_id sub, token_id subalias, token_id super,
     case TK_REF:
       switch(super)
       {
+        case TK_REF:
         case TK_BOX:
           return true;
 
@@ -123,6 +126,7 @@ bool is_cap_sub_cap(token_id sub, token_id subalias, token_id super,
     case TK_VAL:
       switch(super)
       {
+        case TK_VAL:
         case TK_BOX:
         case TK_CAP_SHARE: // {val, tag}
           return true;
@@ -131,6 +135,7 @@ bool is_cap_sub_cap(token_id sub, token_id subalias, token_id super,
       }
       break;
 
+    case TK_BOX:
     case TK_CAP_READ: // {ref, val, box}
       switch(super)
       {
@@ -250,7 +255,8 @@ bool is_cap_sub_cap_bound(token_id sub, token_id subalias, token_id super,
   //
   // If both rcaps are generic/set capabilities, use the following rule:
   // every instantiation of the super rcap must be a supertype of some
-  // instantiation of the sub rcap.
+  // instantiation of the sub rcap (but not necessarily the same instantiation
+  // of the sub rcap).
   switch(sub)
   {
     case TK_ISO:
@@ -428,6 +434,7 @@ bool is_cap_compat_cap(token_id left_cap, token_id left_eph,
         case TK_VAL:
         case TK_BOX:
         case TK_CAP_READ:
+        case TK_CAP_SHARE:
         case TK_CAP_ALIAS:
           return true;
 
@@ -436,21 +443,10 @@ bool is_cap_compat_cap(token_id left_cap, token_id left_eph,
       break;
 
     case TK_CAP_READ:
-      switch(right_cap)
-      {
-        case TK_BOX:
-        case TK_CAP_ALIAS:
-          return true;
-
-        default: {}
-      }
-      break;
-
     case TK_CAP_ALIAS:
       switch(right_cap)
       {
         case TK_BOX:
-        case TK_CAP_READ:
           return true;
 
         default: {}
@@ -466,7 +462,6 @@ bool is_cap_compat_cap(token_id left_cap, token_id left_eph,
         case TK_VAL:
         case TK_BOX:
         case TK_CAP_SHARE:
-        case TK_CAP_ALIAS:
           return true;
 
         default: {}