Check exports for private leaks

Author: odersky

compiler/src/dotty/tools/dotc/core/tasty/TreeUnpickler.scala

@@ -844,7 +844,7 @@ class TreeUnpickler(reader: TastyReader,
       goto(end)
       setSpan(start, tree)
       if (!sym.isType) { // Only terms might have leaky aliases, see the documentation of `checkNoPrivateLeaks`
-        sym.info = ta.avoidPrivateLeaks(sym, tree.sourcePos)
+        sym.info = ta.avoidPrivateLeaks(sym)
       }
 
       if (ctx.mode.is(Mode.ReadComments)) {

compiler/src/dotty/tools/dotc/typer/Checking.scala

@@ -470,7 +470,7 @@ object Checking {
    *
    *  @return The `info` of `sym`, with problematic aliases expanded away.
    */
-  def checkNoPrivateLeaks(sym: Symbol, pos: SourcePosition)(implicit ctx: Context): Type = {
+  def checkNoPrivateLeaks(sym: Symbol)(implicit ctx: Context): Type = {
     class NotPrivate extends TypeMap {
       var errors: List[() => String] = Nil
 
@@ -531,7 +531,7 @@ object Checking {
     }
     val notPrivate = new NotPrivate
     val info = notPrivate(sym.info)
-    notPrivate.errors.foreach(error => ctx.errorOrMigrationWarning(error(), pos))
+    notPrivate.errors.foreach(error => ctx.errorOrMigrationWarning(error(), sym.sourcePos))
     info
   }
 

compiler/src/dotty/tools/dotc/typer/Namer.scala

@@ -873,7 +873,7 @@ class Namer { typer: Typer =>
       denot.info = typeSig(sym)
       invalidateIfClashingSynthetic(denot)
       Checking.checkWellFormed(sym)
-      denot.info = avoidPrivateLeaks(sym, sym.sourcePos)
+      denot.info = avoidPrivateLeaks(sym)
     }
   }
 
@@ -982,6 +982,7 @@ class Namer { typer: Typer =>
                 val mbrFlags = Exported | Method | Final | maybeStable | mbr.symbol.flags & RetainedExportFlags
                 ctx.newSymbol(cls, alias, mbrFlags, mbrInfo, coord = span)
               }
+            forwarder.info = avoidPrivateLeaks(forwarder)
             val forwarderDef =
               if (forwarder.isType) tpd.TypeDef(forwarder.asType)
               else {
@@ -1146,7 +1147,7 @@ class Namer { typer: Typer =>
 
       Checking.checkWellFormed(cls)
       if (isDerivedValueClass(cls)) cls.setFlag(Final)
-      cls.info = avoidPrivateLeaks(cls, cls.sourcePos)
+      cls.info = avoidPrivateLeaks(cls)
       cls.baseClasses.foreach(_.invalidateBaseTypeCache()) // we might have looked before and found nothing
       cls.setNoInitsFlags(parentsKind(parents), bodyKind(rest))
       if (cls.isNoInitsClass) cls.primaryConstructor.setFlag(StableRealizable)

compiler/src/dotty/tools/dotc/typer/TypeAssigner.scala

@@ -155,8 +155,8 @@ trait TypeAssigner {
   def avoidingType(expr: Tree, bindings: List[Tree])(implicit ctx: Context): Type =
     avoid(expr.tpe, localSyms(bindings).filter(_.isTerm))
 
-  def avoidPrivateLeaks(sym: Symbol, pos: SourcePosition)(implicit ctx: Context): Type =
-    if (!sym.isOneOf(PrivateOrSynthetic) && sym.owner.isClass) checkNoPrivateLeaks(sym, pos)
+  def avoidPrivateLeaks(sym: Symbol)(implicit ctx: Context): Type =
+    if (!sym.isOneOf(PrivateOrSynthetic) && sym.owner.isClass) checkNoPrivateLeaks(sym)
     else sym.info
 
   private def toRepeated(tree: Tree, from: ClassSymbol)(implicit ctx: Context): Tree =

tests/neg/export-leaks.scala

@@ -0,0 +1,22 @@
+// Check that exports do not leak private types
+object Signature {
+
+  private type T
+
+  object O1 {
+    private[Signature] def bar: T = ???
+  }
+  export O1._ // error: non-private method bar refers to private type T
+
+  object O2 {
+    private[Signature] val foo: T = ???
+  }
+  export O2._ // OK
+      // The reason this works is that private escape checking only looks at real private members,
+      // not at private[C] members. So, by itself the expansion of the export
+      //   <stable> def foo: O2.foo.type = O2.foo
+      // is legal. The underlying type of `O2.foo.type` does violate no-escape rules, but we do not
+      // check for it. Maybe we should. But then the question comes up whether we should
+      // also check all possible supertypes of a type for privacy violations. These are more
+      // general questions that are not related to exports.
+}

tests/pos/export-enum.scala

@@ -0,0 +1,15 @@
+object Signature {
+
+  enum MatchDegree {
+    case NoMatch, ParamMatch, FullMatch
+  }
+  export MatchDegree._
+
+  // Check that exported values have singeleton types
+  val x: MatchDegree.NoMatch.type = NoMatch
+
+  // Check that the following two methods are not exported.
+  // Exporting them would lead to a double definition.
+  def values: Array[MatchDegree] = ???
+  def valueOf($name: String): MatchDegree = ???
+}