Smalltalk › Squeak › Squeak - Dev

Why is ModificationForbidden not an Error?

‹ Previous Topic Next Topic ›
 
classic Classic list List threaded Threaded
♦
♦
 54 messages Options
123
Jakob Reschke
Reply | Threaded
Open this post in threaded view
♦
♦
|

Re: Debugger - Proceed button (was: Why is ModificationForbidden not an Error?)

Jakob Reschke
Interesting: the Orange Book on p. 396 states that if you press proceed in the full debugger, the result of the interrupted message send is assumed to be the result of the last expression that you evaluated (e. g. via print it) in the debugger. Or nil if you did not evaluate anything.

Seems to be no longer the case though. Also we have "return entered value" now.

Am Sa., 11. Apr. 2020 um 21:13 Uhr schrieb Jakob Reschke <[hidden email]>:
Think of this: you may not be able to reasonably proceed after an unresumable error without modifying the system or the context. But the IDE lets you do just that: you can change something on the stack in the debugger, or implement the missing method, then proceed and violà, you just reasonably proceeded from an otherwise unresumable error.

I suppose the methods you mentioned are recursive/repeating to allow for exactly that kind of workflow.

One should naturally be allowed to Proceed from the notifier window of a Halt or Warning.

Which leads us to the topic of exception-specific or context-specific buttons in the notifier once again. I don't remember which topic it was, but I wished for that already once during the last few months. Maybe it was the deprecation warnings and now we have an explanation how to deal with Warnings in the notifier and those text actions that allow to disable the warnings on the spot. And as always I'd like to point out that Common Lisp has a nice concept for responding to exceptions both automatically and interactively, with user-code-registered restart operations that can be invoked from the debugger: http://www.gigamonkeys.com/book/beyond-exception-handling-conditions-and-restarts.html In Smalltalk you can already use #return, #retry, #resume etc in an exception handler, but you cannot access the handlers nicely from the debugger, and you cannot "resume somewhere along the way to the exception".

Am Sa., 11. Apr. 2020 um 16:38 Uhr schrieb Thiede, Christoph <[hidden email]>:

Just another thought: I see some confusion around the Proceed button in the debugger, and I felt the same confusion sometimes ago. Please forgive me for the sacrilege, but should we maybe question its general existence?

Depending on the domain, it actually performs a mix of #retry (made possible by the quite confusing recursive implementation of Object >> #at:, Object >> #doesNotUnderstand: and others, I did not yet found any other motivation than the Proceed button to use recursion here) and ignore (#resumeUnchecked:, especially useful for UnhandledWarnings and Halts). Would it be a reasonable goal to eliminate this button in the pre-debugger window and replace it with two buttons, Restart and Ignore? We could hide even hide the restart button if not appropriate (i.e., the exception is not an error).

What do you think?
And it would be great if anyone here could explain why Object >> #at: & Co. are recursive! :-)

Best,
Christoph

Von: Squeak-dev <[hidden email]> im Auftrag von Thiede, Christoph
Gesendet: Samstag, 11. April 2020 16:32 Uhr
An: Chris Muller; The general-purpose Squeak developers list
Betreff: Re: [squeak-dev] Why is ModificationForbidden not an Error?
 

Hi all! Thank you very much for having this interesting discussion :-)


@Chris:

> > -1. :-) Warnings are Notifications,

> As are Errors.  Right?

Nope, sorry ;-)
 

> The two main use cases of ModificationForbidden present opposite perspectives onto it.  For "protection from accidentally modifying a literal in a CompiledMethod", I understand the inclination to make it an Error.  However, for the context of db handling, [#markDirty + #resume] is normal processing, not an "error", and not even exceptional, either, so perhaps this is just a semantic irritation sensitivity on my part.. sorry. 

> But if they want to use ModificationForbidden for a Write Barrier, they'll probably want to extricate it from Error in the handler:
> 
>    [ myDbApp doStuff ]
>      on: ModificationForbidden
>      do:
>           [ : forbidden |
>           forbidden object beWritableObject.
>           forbidden resumptionValue: forbidden retryModificationNoResume.
>           forbidden resume: forbidden resumptionValue ]
>      on: Error
>      do: [ : err | myDbApp logErrorAndNotifyUser ]

This clarification was very helpful for me. I was not aware of your second use case before.

In my opinion, we are talking about two completely different use cases for the same exception.
Literal protection is a low-level error, comparable to out-of-bounds things and primitive failures. You almost never do want to ignore or fix them.
Write barriers for #markDirty, on the other hand, sound like a domain-specific topic to me that should neither raise an error, nor eventually signal an UnhandledError, but be resumed automatically (unless handled differently) by a #defaultAction that removes the barrier (and additional handlers could, if desired, turn on some cache or so).
I have never dealt with Magma or any other DB framework for Smalltalk, but why do you (or would you) use these VM-based mechanisms for a high-level feature? Without knowing any details about your application, personally I would probably design an own exception (DirtyModification?) for that purpose. This would allow you to clearly distinguish between low-level errors ("whoops, I just made an attempt to change a read-only code literal") and higher-level exceptions (DirtyModification). If we would follow my proposal to raise ModificationForbidden from Object instead of Context, you could also consider to override #modificationForbiddenFor:at:put: in your database objects to raise DirtyModification instead of ModificationForbidden (in the same way as some classes override #error or #primitiveError).

However, focusing again on the literal protection aspect, I still don't see when the current default #resume behavior of ModificationForbidden would be ever helpful. MF >> #resume calls Exception >> #resume: which does nothing more than to return resumptionValue! When do we actually need this resumptionValue?
Why can't we design MF like the following:

#resume - not possible, will signal IllegalResumeAttempt
#retryModification - retries the modification and returns nothing special
#forceModification: - makes the object to modify writable, retries the modification and, optionally, makes the object read-only again

> If we don't want to break things (that are somehow wrong according to contemporary notion), we could make it a Warning in the Squeak 5.x release stream and turn it into an error with Squeak 6.0. That is: make it an Error today in Trunk, but if we would create a 5.4 release, we would have to remember changing it back... :-/

IIRC ModificationForbidden was introduced in 6.0alpha the first time?

Best,
Christoph

Von: Squeak-dev <[hidden email]> im Auftrag von Nicolas Cellier <[hidden email]>
Gesendet: Samstag, 11. April 2020 11:16:00
An: Chris Muller; The general-purpose Squeak developers list
Betreff: Re: [squeak-dev] Why is ModificationForbidden not an Error?
 
In this case we might want specialized subclasses...

Le sam. 11 avr. 2020 à 03:45, Chris Muller <[hidden email]> a écrit :
I think so, because if you try to use it for something else, it'll get entangled with your application's standard error handling.  Regular apps have error handling like:

   [ myApp doStuff ] on: Error do: [ : err | myApp logErrorAndNotifyUser ]

and so for the use-case, Protect CompiledMethod Literals from Accidental Modification, inheriting from Error will allow the best backward compatibility with existing handlers.

But if they want to use ModificationForbidden for a Write Barrier, they'll probably want to extricate it from Error in the handler:

   [ myDbApp doStuff ]
     on: ModificationForbidden
     do:
          [ : forbidden |
          forbidden object beWritableObject.
          forbidden resumptionValue: forbidden retryModificationNoResume.
          forbidden resume: forbidden resumptionValue ]
     on: Error
     do: [ : err | myDbApp logErrorAndNotifyUser ]

But now that I'm handling ModificationForbidden separately, what if I want Protect CompiledMethod Literals from Accidental Modification, too?  I'm no longer handling correctly for that, because the handler has to assume they're signaled in the context of the DB use case and not the Protection use case.

 - Chris

On Fri, Apr 10, 2020 at 12:06 PM tim Rowledge <[hidden email]> wrote:


> On 2020-04-09, at 6:55 PM, Chris Muller <[hidden email]> wrote:
>
> The two main use cases of ModificationForbidden present opposite perspectives onto it.

In that case perhaps we actually need two different signals?

tim
--
tim Rowledge; [hidden email]; http://www.rowledge.org/tim
Useful random insult:- Has an inferiority complex, but not a very good one.
marcel.taeumel
Reply | Threaded
Open this post in threaded view
♦
♦
|

Re: Why is ModificationForbidden not an Error?

marcel.taeumel
In reply to this post by Christoph Thiede
> Warnings are Notifications

Best,
Marcel

Am 11.04.2020 16:32:56 schrieb Thiede, Christoph <[hidden email]>:

Hi all! Thank you very much for having this interesting discussion :-)


@Chris:

> > -1. :-) Warnings are Notifications,

> As are Errors.  Right?

Nope, sorry ;-)
 

> The two main use cases of ModificationForbidden present opposite perspectives onto it.  For "protection from accidentally modifying a literal in a CompiledMethod", I understand the inclination to make it an Error.  However, for the context of db handling, [#markDirty + #resume] is normal processing, not an "error", and not even exceptional, either, so perhaps this is just a semantic irritation sensitivity on my part.. sorry. 

> But if they want to use ModificationForbidden for a Write Barrier, they'll probably want to extricate it from Error in the handler:
> 
>    [ myDbApp doStuff ]
>      on: ModificationForbidden
>      do:
>           [ : forbidden |
>           forbidden object beWritableObject.
>           forbidden resumptionValue: forbidden retryModificationNoResume.
>           forbidden resume: forbidden resumptionValue ]
>      on: Error
>      do: [ : err | myDbApp logErrorAndNotifyUser ]

This clarification was very helpful for me. I was not aware of your second use case before.

In my opinion, we are talking about two completely different use cases for the same exception.
Literal protection is a low-level error, comparable to out-of-bounds things and primitive failures. You almost never do want to ignore or fix them.
Write barriers for #markDirty, on the other hand, sound like a domain-specific topic to me that should neither raise an error, nor eventually signal an UnhandledError, but be resumed automatically (unless handled differently) by a #defaultAction that removes the barrier (and additional handlers could, if desired, turn on some cache or so).
I have never dealt with Magma or any other DB framework for Smalltalk, but why do you (or would you) use these VM-based mechanisms for a high-level feature? Without knowing any details about your application, personally I would probably design an own exception (DirtyModification?) for that purpose. This would allow you to clearly distinguish between low-level errors ("whoops, I just made an attempt to change a read-only code literal") and higher-level exceptions (DirtyModification). If we would follow my proposal to raise ModificationForbidden from Object instead of Context, you could also consider to override #modificationForbiddenFor:at:put: in your database objects to raise DirtyModification instead of ModificationForbidden (in the same way as some classes override #error or #primitiveError).

However, focusing again on the literal protection aspect, I still don't see when the current default #resume behavior of ModificationForbidden would be ever helpful. MF >> #resume calls Exception >> #resume: which does nothing more than to return resumptionValue! When do we actually need this resumptionValue?
Why can't we design MF like the following:

#resume - not possible, will signal IllegalResumeAttempt
#retryModification - retries the modification and returns nothing special
#forceModification: - makes the object to modify writable, retries the modification and, optionally, makes the object read-only again

> If we don't want to break things (that are somehow wrong according to contemporary notion), we could make it a Warning in the Squeak 5.x release stream and turn it into an error with Squeak 6.0. That is: make it an Error today in Trunk, but if we would create a 5.4 release, we would have to remember changing it back... :-/

IIRC ModificationForbidden was introduced in 6.0alpha the first time?

Best,
Christoph

Von: Squeak-dev <[hidden email]> im Auftrag von Nicolas Cellier <[hidden email]>
Gesendet: Samstag, 11. April 2020 11:16:00
An: Chris Muller; The general-purpose Squeak developers list
Betreff: Re: [squeak-dev] Why is ModificationForbidden not an Error?
 
In this case we might want specialized subclasses...

Le sam. 11 avr. 2020 à 03:45, Chris Muller <[hidden email]> a écrit :
I think so, because if you try to use it for something else, it'll get entangled with your application's standard error handling.  Regular apps have error handling like:

   [ myApp doStuff ] on: Error do: [ : err | myApp logErrorAndNotifyUser ]

and so for the use-case, Protect CompiledMethod Literals from Accidental Modification, inheriting from Error will allow the best backward compatibility with existing handlers.

But if they want to use ModificationForbidden for a Write Barrier, they'll probably want to extricate it from Error in the handler:

   [ myDbApp doStuff ]
     on: ModificationForbidden
     do:
          [ : forbidden |
          forbidden object beWritableObject.
          forbidden resumptionValue: forbidden retryModificationNoResume.
          forbidden resume: forbidden resumptionValue ]
     on: Error
     do: [ : err | myDbApp logErrorAndNotifyUser ]

But now that I'm handling ModificationForbidden separately, what if I want Protect CompiledMethod Literals from Accidental Modification, too?  I'm no longer handling correctly for that, because the handler has to assume they're signaled in the context of the DB use case and not the Protection use case.

 - Chris

On Fri, Apr 10, 2020 at 12:06 PM tim Rowledge <[hidden email]> wrote:


> On 2020-04-09, at 6:55 PM, Chris Muller <[hidden email]> wrote:
>
> The two main use cases of ModificationForbidden present opposite perspectives onto it.

In that case perhaps we actually need two different signals?

tim
--
tim Rowledge; [hidden email]; http://www.rowledge.org/tim
Useful random insult:- Has an inferiority complex, but not a very good one.
Eliot Miranda-2
Reply | Threaded
Open this post in threaded view
♦
♦
|

Re: Why is ModificationForbidden not an Error?

Eliot Miranda-2
In reply to this post by Christoph Thiede
Hi Christoph,

On Sat, Apr 11, 2020 at 7:32 AM Thiede, Christoph <[hidden email]> wrote:

Hi all! Thank you very much for having this interesting discussion :-)


@Chris:

> > -1. :-) Warnings are Notifications,

> As are Errors.  Right?

Nope, sorry ;-)
 

> The two main use cases of ModificationForbidden present opposite perspectives onto it.  For "protection from accidentally modifying a literal in a CompiledMethod", I understand the inclination to make it an Error.  However, for the context of db handling, [#markDirty + #resume] is normal processing, not an "error", and not even exceptional, either, so perhaps this is just a semantic irritation sensitivity on my part.. sorry. 

> But if they want to use ModificationForbidden for a Write Barrier, they'll probably want to extricate it from Error in the handler:
> 
>    [ myDbApp doStuff ]
>      on: ModificationForbidden
>      do:
>           [ : forbidden |
>           forbidden object beWritableObject.
>           forbidden resumptionValue: forbidden retryModificationNoResume.
>           forbidden resume: forbidden resumptionValue ]
>      on: Error
>      do: [ : err | myDbApp logErrorAndNotifyUser ]

This clarification was very helpful for me. I was not aware of your second use case before.

In my opinion, we are talking about two completely different use cases for the same exception.

There are many use cases for the same exception, just as there are many use cases for bounds violations or divide by zero, or,  or, ....  The point is that at the point where the exception is raised neither the VM nor the code immediately above it knows what the use case is, and the exception is raised precisely to find out how the exception should be handled, which means that sears hing for the exception/.handling the exception is about discovering what the particular use case *is*.  Sio no, one can't magically intuit what the high level use case is at the point of failure.  That's *why* we have exception systems.


 
Literal protection is a low-level error, comparable to out-of-bounds things and primitive failures. You almost never do want to ignore or fix them.
Write barriers for #markDirty, on the other hand, sound like a domain-specific topic to me that should neither raise an error, nor eventually signal an UnhandledError, but be resumed automatically (unless handled differently) by a #defaultAction that removes the barrier (and additional handlers could, if desired, turn on some cache or so).
I have never dealt with Magma or any other DB framework for Smalltalk, but why do you (or would you) use these VM-based mechanisms for a high-level feature? Without knowing any details about your application, personally I would probably design an own exception (DirtyModification?) for that purpose. This would allow you to clearly distinguish between low-level errors ("whoops, I just made an attempt to change a read-only code literal") and higher-level exceptions (DirtyModification). If we would follow my proposal to raise ModificationForbidden from Object instead of Context, you could also consider to override #modificationForbiddenFor:at:put: in your database objects to raise DirtyModification instead of ModificationForbidden (in the same way as some classes override #error or #primitiveError).

However, focusing again on the literal protection aspect, I still don't see when the current default #resume behavior of ModificationForbidden would be ever helpful. MF >> #resume calls Exception >> #resume: which does nothing more than to return resumptionValue! When do we actually need this resumptionValue?
Why can't we design MF like the following:

#resume - not possible, will signal IllegalResumeAttempt
#retryModification - retries the modification and returns nothing special
#forceModification: - makes the object to modify writable, retries the modification and, optionally, makes the object read-only again

> If we don't want to break things (that are somehow wrong according to contemporary notion), we could make it a Warning in the Squeak 5.x release stream and turn it into an error with Squeak 6.0. That is: make it an Error today in Trunk, but if we would create a 5.4 release, we would have to remember changing it back... :-/

IIRC ModificationForbidden was introduced in 6.0alpha the first time?

Best,
Christoph

Von: Squeak-dev <[hidden email]> im Auftrag von Nicolas Cellier <[hidden email]>
Gesendet: Samstag, 11. April 2020 11:16:00
An: Chris Muller; The general-purpose Squeak developers list
Betreff: Re: [squeak-dev] Why is ModificationForbidden not an Error?
 
In this case we might want specialized subclasses...

Le sam. 11 avr. 2020 à 03:45, Chris Muller <[hidden email]> a écrit :
I think so, because if you try to use it for something else, it'll get entangled with your application's standard error handling.  Regular apps have error handling like:

   [ myApp doStuff ] on: Error do: [ : err | myApp logErrorAndNotifyUser ]

and so for the use-case, Protect CompiledMethod Literals from Accidental Modification, inheriting from Error will allow the best backward compatibility with existing handlers.

But if they want to use ModificationForbidden for a Write Barrier, they'll probably want to extricate it from Error in the handler:

   [ myDbApp doStuff ]
     on: ModificationForbidden
     do:
          [ : forbidden |
          forbidden object beWritableObject.
          forbidden resumptionValue: forbidden retryModificationNoResume.
          forbidden resume: forbidden resumptionValue ]
     on: Error
     do: [ : err | myDbApp logErrorAndNotifyUser ]

But now that I'm handling ModificationForbidden separately, what if I want Protect CompiledMethod Literals from Accidental Modification, too?  I'm no longer handling correctly for that, because the handler has to assume they're signaled in the context of the DB use case and not the Protection use case.

 - Chris

On Fri, Apr 10, 2020 at 12:06 PM tim Rowledge <[hidden email]> wrote:


> On 2020-04-09, at 6:55 PM, Chris Muller <[hidden email]> wrote:
>
> The two main use cases of ModificationForbidden present opposite perspectives onto it.

In that case perhaps we actually need two different signals?

tim
--
tim Rowledge; [hidden email]; http://www.rowledge.org/tim
Useful random insult:- Has an inferiority complex, but not a very good one.







--
_,,,^..^,,,_
best, Eliot
marcel.taeumel
Reply | Threaded
Open this post in threaded view
♦
♦
|

Re: Why is ModificationForbidden not an Error?

marcel.taeumel
Hi all!

So, we make ModificationForbidden a (resumable) Error for now? Is this the conclusion? Is there already a change in the inbox for this?

---

Side note: From its current behavior. ModificationForbidden should specialize Warning. But then we really should consider updating TestCase >> timeOut:after: to also catch Warning.

Best,
Marcel

Am 21.04.2020 06:05:10 schrieb Eliot Miranda <[hidden email]>:

Hi Christoph,

On Sat, Apr 11, 2020 at 7:32 AM Thiede, Christoph <[hidden email]> wrote:

Hi all! Thank you very much for having this interesting discussion :-)


@Chris:

> > -1. :-) Warnings are Notifications,

> As are Errors.  Right?

Nope, sorry ;-)
 

> The two main use cases of ModificationForbidden present opposite perspectives onto it.  For "protection from accidentally modifying a literal in a CompiledMethod", I understand the inclination to make it an Error.  However, for the context of db handling, [#markDirty + #resume] is normal processing, not an "error", and not even exceptional, either, so perhaps this is just a semantic irritation sensitivity on my part.. sorry. 

> But if they want to use ModificationForbidden for a Write Barrier, they'll probably want to extricate it from Error in the handler:
> 
>    [ myDbApp doStuff ]
>      on: ModificationForbidden
>      do:
>           [ : forbidden |
>           forbidden object beWritableObject.
>           forbidden resumptionValue: forbidden retryModificationNoResume.
>           forbidden resume: forbidden resumptionValue ]
>      on: Error
>      do: [ : err | myDbApp logErrorAndNotifyUser ]

This clarification was very helpful for me. I was not aware of your second use case before.

In my opinion, we are talking about two completely different use cases for the same exception.

There are many use cases for the same exception, just as there are many use cases for bounds violations or divide by zero, or,  or, ....  The point is that at the point where the exception is raised neither the VM nor the code immediately above it knows what the use case is, and the exception is raised precisely to find out how the exception should be handled, which means that sears hing for the exception/.handling the exception is about discovering what the particular use case *is*.  Sio no, one can't magically intuit what the high level use case is at the point of failure.  That's *why* we have exception systems.


 
Literal protection is a low-level error, comparable to out-of-bounds things and primitive failures. You almost never do want to ignore or fix them.
Write barriers for #markDirty, on the other hand, sound like a domain-specific topic to me that should neither raise an error, nor eventually signal an UnhandledError, but be resumed automatically (unless handled differently) by a #defaultAction that removes the barrier (and additional handlers could, if desired, turn on some cache or so).
I have never dealt with Magma or any other DB framework for Smalltalk, but why do you (or would you) use these VM-based mechanisms for a high-level feature? Without knowing any details about your application, personally I would probably design an own exception (DirtyModification?) for that purpose. This would allow you to clearly distinguish between low-level errors ("whoops, I just made an attempt to change a read-only code literal") and higher-level exceptions (DirtyModification). If we would follow my proposal to raise ModificationForbidden from Object instead of Context, you could also consider to override #modificationForbiddenFor:at:put: in your database objects to raise DirtyModification instead of ModificationForbidden (in the same way as some classes override #error or #primitiveError).

However, focusing again on the literal protection aspect, I still don't see when the current default #resume behavior of ModificationForbidden would be ever helpful. MF >> #resume calls Exception >> #resume: which does nothing more than to return resumptionValue! When do we actually need this resumptionValue?
Why can't we design MF like the following:

#resume - not possible, will signal IllegalResumeAttempt
#retryModification - retries the modification and returns nothing special
#forceModification: - makes the object to modify writable, retries the modification and, optionally, makes the object read-only again

> If we don't want to break things (that are somehow wrong according to contemporary notion), we could make it a Warning in the Squeak 5.x release stream and turn it into an error with Squeak 6.0. That is: make it an Error today in Trunk, but if we would create a 5.4 release, we would have to remember changing it back... :-/

IIRC ModificationForbidden was introduced in 6.0alpha the first time?

Best,
Christoph

Von: Squeak-dev <[hidden email]> im Auftrag von Nicolas Cellier <[hidden email]>
Gesendet: Samstag, 11. April 2020 11:16:00
An: Chris Muller; The general-purpose Squeak developers list
Betreff: Re: [squeak-dev] Why is ModificationForbidden not an Error?
 
In this case we might want specialized subclasses...

Le sam. 11 avr. 2020 à 03:45, Chris Muller <[hidden email]> a écrit :
I think so, because if you try to use it for something else, it'll get entangled with your application's standard error handling.  Regular apps have error handling like:

   [ myApp doStuff ] on: Error do: [ : err | myApp logErrorAndNotifyUser ]

and so for the use-case, Protect CompiledMethod Literals from Accidental Modification, inheriting from Error will allow the best backward compatibility with existing handlers.

But if they want to use ModificationForbidden for a Write Barrier, they'll probably want to extricate it from Error in the handler:

   [ myDbApp doStuff ]
     on: ModificationForbidden
     do:
          [ : forbidden |
          forbidden object beWritableObject.
          forbidden resumptionValue: forbidden retryModificationNoResume.
          forbidden resume: forbidden resumptionValue ]
     on: Error
     do: [ : err | myDbApp logErrorAndNotifyUser ]

But now that I'm handling ModificationForbidden separately, what if I want Protect CompiledMethod Literals from Accidental Modification, too?  I'm no longer handling correctly for that, because the handler has to assume they're signaled in the context of the DB use case and not the Protection use case.

 - Chris

On Fri, Apr 10, 2020 at 12:06 PM tim Rowledge <[hidden email]> wrote:


> On 2020-04-09, at 6:55 PM, Chris Muller <[hidden email]> wrote:
>
> The two main use cases of ModificationForbidden present opposite perspectives onto it.

In that case perhaps we actually need two different signals?

tim
--
tim Rowledge; [hidden email]; http://www.rowledge.org/tim
Useful random insult:- Has an inferiority complex, but not a very good one.







--
_,,,^..^,,,_
best, Eliot
timrowledge
Reply | Threaded
Open this post in threaded view
♦
♦
|

Re: Why is ModificationForbidden not an Error?

timrowledge


> On 2020-04-22, at 3:20 AM, Marcel Taeumel <[hidden email]> wrote:
>
> Hi all!
>
> So, we make ModificationForbidden a (resumable) Error for now? Is this the conclusion?

It's a super-low-level error that ought to be handled really really closely to where the error was raised. As Eliot mentioned, the VM can't know the circumstances and just raises it; the the closest possible handler should be in place that *does* know the circumstances. That way Chris gets to spot that is it a database issue and handle things properly, including likely raising a new error for higher level code.

Given having a handler really close to the source, perhaps we are better off keeping it non-resumable and using one of the other approaches to continuing like #retryUsing: (ExceptionTester>>#simpleRetryUsingTest is the only example in the clean image) ?


tim
--
tim Rowledge; [hidden email]; http://www.rowledge.org/tim
Strange OpCodes: BFM: Branch on Full Moon



Eliot Miranda-2
Reply | Threaded
Open this post in threaded view
♦
♦
|

Re: Why is ModificationForbidden not an Error?

Eliot Miranda-2
Hi All,

On Wed, Apr 22, 2020 at 10:59 AM tim Rowledge <[hidden email]> wrote:


> On 2020-04-22, at 3:20 AM, Marcel Taeumel <[hidden email]> wrote:
>
> Hi all!
>
> So, we make ModificationForbidden a (resumable) Error for now? Is this the conclusion?

Yes, I hope so :-)
 

It's a super-low-level error that ought to be handled really really closely to where the error was raised. As Eliot mentioned, the VM can't know the circumstances and just raises it; the the closest possible handler should be in place that *does* know the circumstances. That way Chris gets to spot that is it a database issue and handle things properly, including likely raising a new error for higher level code.

As I've already mentioned what one can do, and the VisualWorks version does do, for GemStone-style persistence, as add behavior to the exception so one can specify a per-object response.

So if the exception is unhandled, then before it raises an UnhandledError it checks an identity dictionary, which maps object to message, and if the read-only object that was the cause of the error is in the dictionary, instead the exception performs the message with the object as an argument.  So a database layer can add the objects it is managing to the map in ModificationForbidden, and mark them as read-only.  Then any and all attempts at modifying these objects will cause the database man ager to be notified.

So very simply we can have a pluggable solution that allows different clients to map the exception into different responses as desired.
So can we please stop wasting time discussing this and get on with implementing it?  The GemStone folks have understood how to manage ModificationForbidden for years and the use of it has been in production.  We simply need to catch up.  We're nearly there.

Please don't make me explain this idea once again ;-)

>
>
> Given having a handler really close to the source, perhaps we are better off keeping it non-resumable and using one of the other approaches to continuing like #retryUsing: (ExceptionTester>>#simpleRetryUsingTest is the only example in the clean image) ? 


tim
--
tim Rowledge; [hidden email]; http://www.rowledge.org/tim
Strange OpCodes: BFM: Branch on Full Moon





--
_,,,^..^,,,_
best, Eliot
marcel.taeumel
Reply | Threaded
Open this post in threaded view
♦
♦
|

Re: Why is ModificationForbidden not an Error?

marcel.taeumel
Hi Eliot.

Please find attached a change set. Like this? Here are some examples:

array := #(1 2 3).

ModificationForbidden
for: array
send: #showln:
to: Transcript.

ModificationForbidden
for: array
send: (MessageSend receiver: Transcript selector: #showln:).

"Try out."
array at: 1 put: #foo.


Best,
Marcel

Am 23.04.2020 01:50:42 schrieb Eliot Miranda <[hidden email]>:

Hi All,

On Wed, Apr 22, 2020 at 10:59 AM tim Rowledge <[hidden email]> wrote:


> On 2020-04-22, at 3:20 AM, Marcel Taeumel <[hidden email]> wrote:
>
> Hi all!
>
> So, we make ModificationForbidden a (resumable) Error for now? Is this the conclusion?

Yes, I hope so :-)
 

It's a super-low-level error that ought to be handled really really closely to where the error was raised. As Eliot mentioned, the VM can't know the circumstances and just raises it; the the closest possible handler should be in place that *does* know the circumstances. That way Chris gets to spot that is it a database issue and handle things properly, including likely raising a new error for higher level code.

As I've already mentioned what one can do, and the VisualWorks version does do, for GemStone-style persistence, as add behavior to the exception so one can specify a per-object response.

So if the exception is unhandled, then before it raises an UnhandledError it checks an identity dictionary, which maps object to message, and if the read-only object that was the cause of the error is in the dictionary, instead the exception performs the message with the object as an argument.  So a database layer can add the objects it is managing to the map in ModificationForbidden, and mark them as read-only.  Then any and all attempts at modifying these objects will cause the database man ager to be notified.

So very simply we can have a pluggable solution that allows different clients to map the exception into different responses as desired.
So can we please stop wasting time discussing this and get on with implementing it?  The GemStone folks have understood how to manage ModificationForbidden for years and the use of it has been in production.  We simply need to catch up.  We're nearly there.

Please don't make me explain this idea once again ;-)

>
>
> Given having a handler really close to the source, perhaps we are better off keeping it non-resumable and using one of the other approaches to continuing like #retryUsing: (ExceptionTester>>#simpleRetryUsingTest is the only example in the clean image) ? 


tim
--
tim Rowledge; [hidden email]; http://www.rowledge.org/tim
Strange OpCodes: BFM: Branch on Full Moon





--
_,,,^..^,,,_
best, Eliot



modification-forbidden-update.1.cs (2K) Download Attachment
Eliot Miranda-2
Reply | Threaded
Open this post in threaded view
♦
♦
|

Re: Why is ModificationForbidden not an Error?

Eliot Miranda-2
Hi Marcel,

On Thu, Apr 23, 2020 at 3:15 AM Marcel Taeumel <[hidden email]> wrote:
Hi Eliot.

Please find attached a change set. Like this? Here are some examples:

array := #(1 2 3).

ModificationForbidden
for: array
send: #showln:
to: Transcript.

ModificationForbidden
for: array
send: (MessageSend receiver: Transcript selector: #showln:).

"Try out."
array at: 1 put: #foo.

Yes, this looks good.  Exactly the kind of thing. The only issue now is what is a convenient signature for the message send in ManagedObjects.  We should consult with the GemSTone folks and perhaps look at the VisualWorks code.  I'm cc'ing Martin McClure for comment.

Best,
Marcel

Am 23.04.2020 01:50:42 schrieb Eliot Miranda <[hidden email]>:

Hi All,

On Wed, Apr 22, 2020 at 10:59 AM tim Rowledge <[hidden email]> wrote:


> On 2020-04-22, at 3:20 AM, Marcel Taeumel <[hidden email]> wrote:
>
> Hi all!
>
> So, we make ModificationForbidden a (resumable) Error for now? Is this the conclusion?

Yes, I hope so :-)
 

It's a super-low-level error that ought to be handled really really closely to where the error was raised. As Eliot mentioned, the VM can't know the circumstances and just raises it; the the closest possible handler should be in place that *does* know the circumstances. That way Chris gets to spot that is it a database issue and handle things properly, including likely raising a new error for higher level code.

As I've already mentioned what one can do, and the VisualWorks version does do, for GemStone-style persistence, as add behavior to the exception so one can specify a per-object response.

So if the exception is unhandled, then before it raises an UnhandledError it checks an identity dictionary, which maps object to message, and if the read-only object that was the cause of the error is in the dictionary, instead the exception performs the message with the object as an argument.  So a database layer can add the objects it is managing to the map in ModificationForbidden, and mark them as read-only.  Then any and all attempts at modifying these objects will cause the database man ager to be notified.

So very simply we can have a pluggable solution that allows different clients to map the exception into different responses as desired.
So can we please stop wasting time discussing this and get on with implementing it?  The GemStone folks have understood how to manage ModificationForbidden for years and the use of it has been in production.  We simply need to catch up.  We're nearly there.

Please don't make me explain this idea once again ;-)

>
> Given having a handler really close to the source, perhaps we are better off keeping it non-resumable and using one of the other approaches to continuing like #retryUsing: (ExceptionTester>>#simpleRetryUsingTest is the only example in the clean image) ? 

tim
--
tim Rowledge; [hidden email]; http://www.rowledge.org/tim
Strange OpCodes: BFM: Branch on Full Moon
_,,,^..^,,,_
best, Eliot
_,,,^..^,,,_
best, Eliot
Chris Muller-3
Reply | Threaded
Open this post in threaded view
♦
♦
|

Re: Why is ModificationForbidden not an Error?

Chris Muller-3
In reply to this post by Eliot Miranda-2
Hi Eliot,

Thanks for your patience with our questions while we get up to speed understanding how to use this new feature.
 
It's a super-low-level error that ought to be handled really really closely to where the error was raised. As Eliot mentioned, the VM can't know the circumstances and just raises it; the the closest possible handler should be in place that *does* know the circumstances. That way Chris gets to spot that is it a database issue and handle things properly, including likely raising a new error for higher level code.

As I've already mentioned what one can do, and the VisualWorks version does do, for GemStone-style persistence, as add behavior to the exception so one can specify a per-object response.

So if the exception is unhandled, then before it raises an UnhandledError it checks an identity dictionary, which maps object to message, and if the read-only object that was the cause of the error is in the dictionary, instead the exception performs the message with the object as an argument.  So a database layer can add the objects it is managing to the map in ModificationForbidden, and mark them as read-only.  Then any and all attempts at modifying these objects will cause the database man ager to be notified. 
 So very simply we can have a pluggable solution that allows different clients to map the exception into different responses as desired. 

But an object in your db table could easily be an Array literal held by a CompiledMethod, not expected to change, but persistent by reference nonetheless.  So if the application did then modify it accidentally, instead of Forbidden protection, your DB manager would happily modify it.  It's this separation of use-cases is all what the question was about I think, not a big deal, we've lived with unprotected CM literals for this long already, and I've never needed WriteBarrier for anything other than a DB.

However, I still don't see the path for how to use this in a complex multi-db Magma application with oblivious objects (e.g., Morphs).  It's not something any of the GemStone clients I consulted at as developer or DBA ever had to contend with either, but perhaps not something you're targeting.  Squeak is a different animal...  I will stay tuned here and watch for the answers as they unfold...

 - Chris
 
So can we please stop wasting time discussing this and get on with implementing it?  The GemStone folks have understood how to manage ModificationForbidden for years and the use of it has been in production.  We simply need to catch up.  We're nearly there.   
 

Please don't make me explain this idea once again ;-)

>
>
> Given having a handler really close to the source, perhaps we are better off keeping it non-resumable and using one of the other approaches to continuing like #retryUsing: (ExceptionTester>>#simpleRetryUsingTest is the only example in the clean image) ? 


tim
--
tim Rowledge; [hidden email]; http://www.rowledge.org/tim
Strange OpCodes: BFM: Branch on Full Moon





--
_,,,^..^,,,_
best, Eliot
Eliot Miranda-2
Reply | Threaded
Open this post in threaded view
♦
♦
|

Re: Why is ModificationForbidden not an Error?

Eliot Miranda-2


On Apr 23, 2020, at 5:55 PM, Chris Muller <[hidden email]> wrote:


Hi Eliot,

Thanks for your patience with our questions while we get up to speed understanding how to use this new feature.
 
It's a super-low-level error that ought to be handled really really closely to where the error was raised. As Eliot mentioned, the VM can't know the circumstances and just raises it; the the closest possible handler should be in place that *does* know the circumstances. That way Chris gets to spot that is it a database issue and handle things properly, including likely raising a new error for higher level code.

As I've already mentioned what one can do, and the VisualWorks version does do, for GemStone-style persistence, as add behavior to the exception so one can specify a per-object response.

So if the exception is unhandled, then before it raises an UnhandledError it checks an identity dictionary, which maps object to message, and if the read-only object that was the cause of the error is in the dictionary, instead the exception performs the message with the object as an argument.  So a database layer can add the objects it is managing to the map in ModificationForbidden, and mark them as read-only.  Then any and all attempts at modifying these objects will cause the database man ager to be notified. 
 So very simply we can have a pluggable solution that allows different clients to map the exception into different responses as desired. 

But an object in your db table could easily be an Array literal held by a CompiledMethod, not expected to change, but persistent by reference nonetheless.  So if the application did then modify it accidentally, instead of Forbidden protection, your DB manager would happily modify it.  It's this separation of use-cases is all what the question was about I think, not a big deal, we've lived with unprotected CM literals for this long already, and I've never needed WriteBarrier for anything other than a DB.

Since objects get added to the collection intentionally the array literal would not be added and hence the manager would not modify it.  Your example is a straw man.


However, I still don't see the path for how to use this in a complex multi-db Magma application with oblivious objects (e.g., Morphs).  It's not something any of the GemStone clients I consulted at as developer or DBA ever had to contend with either, but perhaps not something you're targeting.  Squeak is a different animal...  I will stay tuned here and watch for the answers as they unfold...

The objects that get added to the wrote barrier management collection get added by managers that want to manage specific objects, not arbitrary objects. Can you see that a DB manager would add objects it has materialized from the DB that it wanted to transparently write-back in modification, and no others?


 - Chris
 
So can we please stop wasting time discussing this and get on with implementing it?  The GemStone folks have understood how to manage ModificationForbidden for years and the use of it has been in production.  We simply need to catch up.  We're nearly there.   
 

Please don't make me explain this idea once again ;-)

>
>
> Given having a handler really close to the source, perhaps we are better off keeping it non-resumable and using one of the other approaches to continuing like #retryUsing: (ExceptionTester>>#simpleRetryUsingTest is the only example in the clean image) ? 


tim
--
tim Rowledge; [hidden email]; http://www.rowledge.org/tim
Strange OpCodes: BFM: Branch on Full Moon





--
_,,,^..^,,,_
best, Eliot
Chris Muller-4
Reply | Threaded
Open this post in threaded view
♦
♦
|

Re: Why is ModificationForbidden not an Error?

Chris Muller-4
So if the exception is unhandled, then before it raises an UnhandledError it checks an identity dictionary, which maps object to message, and if the read-only object that was the cause of the error is in the dictionary, instead the exception performs the message with the object as an argument.  So a database layer can add the objects it is managing to the map in ModificationForbidden, and mark them as read-only.  Then any and all attempts at modifying these objects will cause the database man ager to be notified. 
 So very simply we can have a pluggable solution that allows different clients to map the exception into different responses as desired. 

But an object in your db table could easily be an Array literal held by a CompiledMethod, not expected to change, but persistent by reference nonetheless.  So if the application did then modify it accidentally, instead of Forbidden protection, your DB manager would happily modify it.  It's this separation of use-cases is all what the question was about I think, not a big deal, we've lived with unprotected CM literals for this long already, and I've never needed WriteBarrier for anything other than a DB.

Since objects get added to the collection intentionally the array literal would not be added and hence the manager would not modify it.  

How would the manager know not to add it?  It can't be by checking #isReadOnlyObject, since that presents the same paradox -- requiring the manager to know the business of whatever other use-case has it set.  If it assumed it was for CM-literal protection, it wouldn't add it, but what if it was just some debugging or something?
 
Your example is a straw man.  


However, I still don't see the path for how to use this in a complex multi-db Magma application with oblivious objects (e.g., Morphs).  It's not something any of the GemStone clients I consulted at as developer or DBA ever had to contend with either, but perhaps not something you're targeting.  Squeak is a different animal...  I will stay tuned here and watch for the answers as they unfold...

The objects that get added to the wrote barrier management collection get added by managers that want to manage specific objects, not arbitrary objects. Can you see that a DB manager would add objects it has materialized from the DB that it wanted to transparently write-back in modification, and no others?

Yes, absolutely.  The manager will get every ModificationForbidden signal under its code whether its meant for the DB or not.  Existence in a global table means handle it, otherwise pass it up the stack.  But this means the DB is now occupying the use of the readOnly bit, not available for other applications or use-cases.

I hope this critique isn't taken to mean I don't think this isn't a good feature for the VM and image.  I do.  Everything is a balance of features and limitations.  I'm still trying to determine whether Magma can benefit from this, and I have to get deeply critical to find the right decision.  I will be following this feature closely, thanks for your patience with my questions.

 - Chris
marcel.taeumel
Reply | Threaded
Open this post in threaded view
♦
♦
|

Re: Why is ModificationForbidden not an Error?

marcel.taeumel
>  But this means the DB is now occupying the use of the readOnly bit, not available for other applications or use-cases.

Hmmm... ManagedObjects could be partitioned among multiple applications. For example, a game loading some save state could come across some read-only objects and then choses how to manage those. Another application could do this as well, not interfering with the first one. Both might be considered "small DB managers" so to say.

Of course, that check "myDomainObject isReadOnlyObject" would become standard procedure for such DBs, wouldn't it?

Best,
Marcel

Am 24.04.2020 05:26:56 schrieb Chris Muller <[hidden email]>:

So if the exception is unhandled, then before it raises an UnhandledError it checks an identity dictionary, which maps object to message, and if the read-only object that was the cause of the error is in the dictionary, instead the exception performs the message with the object as an argument.  So a database layer can add the objects it is managing to the map in ModificationForbidden, and mark them as read-only.  Then any and all attempts at modifying these objects will cause the database man ager to be notified. 
 So very simply we can have a pluggable solution that allows different clients to map the exception into different responses as desired. 

But an object in your db table could easily be an Array literal held by a CompiledMethod, not expected to change, but persistent by reference nonetheless.  So if the application did then modify it accidentally, instead of Forbidden protection, your DB manager would happily modify it.  It's this separation of use-cases is all what the question was about I think, not a big deal, we've lived with unprotected CM literals for this long already, and I've never needed WriteBarrier for anything other than a DB.

Since objects get added to the collection intentionally the array literal would not be added and hence the manager would not modify it.  

How would the manager know not to add it?  It can't be by checking #isReadOnlyObject, since that presents the same paradox -- requiring the manager to know the business of whatever other use-case has it set.  If it assumed it was for CM-literal protection, it wouldn't add it, but what if it was just some debugging or something?
 
Your example is a straw man.  


However, I still don't see the path for how to use this in a complex multi-db Magma application with oblivious objects (e.g., Morphs).  It's not something any of the GemStone clients I consulted at as developer or DBA ever had to contend with either, but perhaps not something you're targeting.  Squeak is a different animal...  I will stay tuned here and watch for the answers as they unfold...

The objects that get added to the wrote barrier management collection get added by managers that want to manage specific objects, not arbitrary objects. Can you see that a DB manager would add objects it has materialized from the DB that it wanted to transparently write-back in modification, and no others?

Yes, absolutely.  The manager will get every ModificationForbidden signal under its code whether its meant for the DB or not.  Existence in a global table means handle it, otherwise pass it up the stack.  But this means the DB is now occupying the use of the readOnly bit, not available for other applications or use-cases.

I hope this critique isn't taken to mean I don't think this isn't a good feature for the VM and image.  I do.  Everything is a balance of features and limitations.  I'm still trying to determine whether Magma can benefit from this, and I have to get deeply critical to find the right decision.  I will be following this feature closely, thanks for your patience with my questions.

 - Chris
timrowledge
Reply | Threaded
Open this post in threaded view
♦
♦
|

Re: Why is ModificationForbidden not an Error?

timrowledge


> On 2020-04-24, at 3:10 AM, Marcel Taeumel <[hidden email]> wrote:
>
> >  But this means the DB is now occupying the use of the readOnly bit, not available for other applications or use-cases.
>
> Hmmm... ManagedObjects could be partitioned among multiple applications. For example, a game loading some save state could come across some read-only objects and then choses how to manage those. Another application could do this as well, not interfering with the first one. Both might be considered "small DB managers" so to say.
>
> Of course, that check "myDomainObject isReadOnlyObject" would become standard procedure for such DBs, wouldn't it?

The fact that there is a helpful default handler for an exception does not (should not!) mean you can't catch it and do something more to your liking

tim
--
tim Rowledge; [hidden email]; http://www.rowledge.org/tim
Design simplicity: It was developed on a shoe-string budget.



Jakob Reschke
Reply | Threaded
Open this post in threaded view
♦
♦
|

Re: Why is ModificationForbidden not an Error?

Jakob Reschke
In reply to this post by marcel.taeumel
Domain and "data storage" layers are intermixed here, hence the trouble with the concept of read-only. If you don't want such a distinction of layers by using different objects in the first place, then I suggest to at least use separate protocols. So yes, use different managers for different kinds of read-onliness. Your domain-specific layer can still delegate to the VM write barrier if that works well. And different applications can still access the same kind/layer of read-onliness, so Eliot's proposal to have one registry for the VM write barrier handling remains valid.

I'd say each domain should also have an own exception class in this case. As an implementation detail, it could inherit from the base ModificationForbidden... or hide the concrete class behind an accessor.



Marcel Taeumel <[hidden email]> schrieb am Fr., 24. Apr. 2020, 12:10:
>  But this means the DB is now occupying the use of the readOnly bit, not available for other applications or use-cases.

Hmmm... ManagedObjects could be partitioned among multiple applications. For example, a game loading some save state could come across some read-only objects and then choses how to manage those. Another application could do this as well, not interfering with the first one. Both might be considered "small DB managers" so to say.

Of course, that check "myDomainObject isReadOnlyObject" would become standard procedure for such DBs, wouldn't it?

Best,
Marcel

Am 24.04.2020 05:26:56 schrieb Chris Muller <[hidden email]>:

So if the exception is unhandled, then before it raises an UnhandledError it checks an identity dictionary, which maps object to message, and if the read-only object that was the cause of the error is in the dictionary, instead the exception performs the message with the object as an argument.  So a database layer can add the objects it is managing to the map in ModificationForbidden, and mark them as read-only.  Then any and all attempts at modifying these objects will cause the database man ager to be notified. 
 So very simply we can have a pluggable solution that allows different clients to map the exception into different responses as desired. 

But an object in your db table could easily be an Array literal held by a CompiledMethod, not expected to change, but persistent by reference nonetheless.  So if the application did then modify it accidentally, instead of Forbidden protection, your DB manager would happily modify it.  It's this separation of use-cases is all what the question was about I think, not a big deal, we've lived with unprotected CM literals for this long already, and I've never needed WriteBarrier for anything other than a DB.

Since objects get added to the collection intentionally the array literal would not be added and hence the manager would not modify it.  

How would the manager know not to add it?  It can't be by checking #isReadOnlyObject, since that presents the same paradox -- requiring the manager to know the business of whatever other use-case has it set.  If it assumed it was for CM-literal protection, it wouldn't add it, but what if it was just some debugging or something?
 
Your example is a straw man.  


However, I still don't see the path for how to use this in a complex multi-db Magma application with oblivious objects (e.g., Morphs).  It's not something any of the GemStone clients I consulted at as developer or DBA ever had to contend with either, but perhaps not something you're targeting.  Squeak is a different animal...  I will stay tuned here and watch for the answers as they unfold...

The objects that get added to the wrote barrier management collection get added by managers that want to manage specific objects, not arbitrary objects. Can you see that a DB manager would add objects it has materialized from the DB that it wanted to transparently write-back in modification, and no others?

Yes, absolutely.  The manager will get every ModificationForbidden signal under its code whether its meant for the DB or not.  Existence in a global table means handle it, otherwise pass it up the stack.  But this means the DB is now occupying the use of the readOnly bit, not available for other applications or use-cases.

I hope this critique isn't taken to mean I don't think this isn't a good feature for the VM and image.  I do.  Everything is a balance of features and limitations.  I'm still trying to determine whether Magma can benefit from this, and I have to get deeply critical to find the right decision.  I will be following this feature closely, thanks for your patience with my questions.

 - Chris
Eliot Miranda-2
Reply | Threaded
Open this post in threaded view
♦
♦
|

Re: Why is ModificationForbidden not an Error?

Eliot Miranda-2
In reply to this post by timrowledge

> On Apr 24, 2020, at 9:55 AM, tim Rowledge <[hidden email]> wrote:
>
>
>>> On 2020-04-24, at 3:10 AM, Marcel Taeumel <[hidden email]> wrote:
>>>
>>> But this means the DB is now occupying the use of the readOnly bit, not available for other applications or use-cases.
>>
>> Hmmm... ManagedObjects could be partitioned among multiple applications. For example, a game loading some save state could come across some read-only objects and then choses how to manage those. Another application could do this as well, not interfering with the first one. Both might be considered "small DB managers" so to say.
>>
>> Of course, that check "myDomainObject isReadOnlyObject" would become standard procedure for such DBs, wouldn't it?
>
> The fact that there is a helpful default handler for an exception does not (should not!) mean you can't catch it and do something more to your liking

+1.

>
> tim
> --
> tim Rowledge; [hidden email]; http://www.rowledge.org/tim
> Design simplicity: It was developed on a shoe-string budget.
>
>
>

Eliot Miranda-2
Reply | Threaded
Open this post in threaded view
♦
♦
|

Re: Why is ModificationForbidden not an Error?

Eliot Miranda-2
In reply to this post by Jakob Reschke


On Apr 24, 2020, at 9:59 AM, Jakob Reschke <[hidden email]> wrote:


Domain and "data storage" layers are intermixed here, hence the trouble with the concept of read-only. If you don't want such a distinction of layers by using different objects in the first place, then I suggest to at least use separate protocols. So yes, use different managers for different kinds of read-onliness. Your domain-specific layer can still delegate to the VM write barrier if that works well. And different applications can still access the same kind/layer of read-onliness, so Eliot's proposal to have one registry for the VM write barrier handling remains valid.

I'd say each domain should also have an own exception class in this case. As an implementation detail, it could inherit from the base ModificationForbidden... or hide the concrete class behind an accessor.

No.  That is unnecessary.  The issue is to separate intercepting an attempt to write to a read-only object from what happens in response to that attempt.  And that’s what the ManagedObjects/defaultAction mechanism does.  Attempts to write are caught and other objects handle what happens in response.

Thinking of this issue in the co text of exception handlers doesn’t make sense.  Writes happen all over the system, and not necessarily within the dynamic extent of some computation.  The exception handler is global.  So one won’t be able to establish exception handlers for all cases.  Instead, the global exception system dispatches a per-object-specific response through ManagedObjects.




Marcel Taeumel <[hidden email]> schrieb am Fr., 24. Apr. 2020, 12:10:
>  But this means the DB is now occupying the use of the readOnly bit, not available for other applications or use-cases.

Hmmm... ManagedObjects could be partitioned among multiple applications. For example, a game loading some save state could come across some read-only objects and then choses how to manage those. Another application could do this as well, not interfering with the first one. Both might be considered "small DB managers" so to say.

Of course, that check "myDomainObject isReadOnlyObject" would become standard procedure for such DBs, wouldn't it?

Best,
Marcel

Am 24.04.2020 05:26:56 schrieb Chris Muller <[hidden email]>:

So if the exception is unhandled, then before it raises an UnhandledError it checks an identity dictionary, which maps object to message, and if the read-only object that was the cause of the error is in the dictionary, instead the exception performs the message with the object as an argument.  So a database layer can add the objects it is managing to the map in ModificationForbidden, and mark them as read-only.  Then any and all attempts at modifying these objects will cause the database man ager to be notified. 
 So very simply we can have a pluggable solution that allows different clients to map the exception into different responses as desired. 

But an object in your db table could easily be an Array literal held by a CompiledMethod, not expected to change, but persistent by reference nonetheless.  So if the application did then modify it accidentally, instead of Forbidden protection, your DB manager would happily modify it.  It's this separation of use-cases is all what the question was about I think, not a big deal, we've lived with unprotected CM literals for this long already, and I've never needed WriteBarrier for anything other than a DB.

Since objects get added to the collection intentionally the array literal would not be added and hence the manager would not modify it.  

How would the manager know not to add it?  It can't be by checking #isReadOnlyObject, since that presents the same paradox -- requiring the manager to know the business of whatever other use-case has it set.  If it assumed it was for CM-literal protection, it wouldn't add it, but what if it was just some debugging or something?
 
Your example is a straw man.  


However, I still don't see the path for how to use this in a complex multi-db Magma application with oblivious objects (e.g., Morphs).  It's not something any of the GemStone clients I consulted at as developer or DBA ever had to contend with either, but perhaps not something you're targeting.  Squeak is a different animal...  I will stay tuned here and watch for the answers as they unfold...

The objects that get added to the wrote barrier management collection get added by managers that want to manage specific objects, not arbitrary objects. Can you see that a DB manager would add objects it has materialized from the DB that it wanted to transparently write-back in modification, and no others?

Yes, absolutely.  The manager will get every ModificationForbidden signal under its code whether its meant for the DB or not.  Existence in a global table means handle it, otherwise pass it up the stack.  But this means the DB is now occupying the use of the readOnly bit, not available for other applications or use-cases.

I hope this critique isn't taken to mean I don't think this isn't a good feature for the VM and image.  I do.  Everything is a balance of features and limitations.  I'm still trying to determine whether Magma can benefit from this, and I have to get deeply critical to find the right decision.  I will be following this feature closely, thanks for your patience with my questions.

 - Chris
Ron Teitelbaum
Reply | Threaded
Open this post in threaded view
♦
♦
|

Re: Why is ModificationForbidden not an Error?

Ron Teitelbaum
Hi all,

I'd like to add some color here.  I worked with Versant for many many years.  This problem bites you so hard you need a tourniquet just to survive it.  

Imagine looking at your code and trying to understand why something that looks so simple is completely wrong!  You spend a huge amount of time trying to understand why the code doesn't actually do what it SAYS it will do.  How is this possible?  You read and read, you start writing things down but no it is impossible. You feel like you must be missing something extremely simple or are just losing your mind. Then you decide ok I'll take this step by step and validate every message to see exactly where it breaks.  You have been looking at this error for over 72 hours straight because someone is standing over your shoulder waiting to ship the product they promised would be available a week ago.

So you get to a method Integer fortyTwo.  And it returns #(0) instead of #(42).  What the hell is that!!!!  The code says ^#(42)!!!!.  You can see it right there!!!  Then it hits you.  I've been bit by a literal variable change!  You add copy and now everything works just like you expected it to.  Now you need to get the trounequat because after you kicked the trash can you split your knee on the table.  Then you go to talk to your colleague and he falls asleep while you are talking to him and his head hits the keyboard.  You ask your boss who looks nearly as bad as the comatose colleague what you should do and he says "Save the code!"  So you save the code and roll your colleague under the table so nobody steps on him.

This doesn't happen you think??  Well on Versant you couldn't even change the method if the database was holding onto the litteral!  Trying to accept a method gave you a database error!!!  Oh great fun that was!

Some people have learned the hard way with litteral blood that copy is essential, and for those that haven't you can save them a lot of pain.  Changing litterals without the copy is always wrong especially if it will eventually be stored in a database.  Imagine doing direct manipulation on a litteral.  Now try to explain what happened since the code never actually changed anything!!! How the hell did that happen!!

Try it yourself and then imagine my barely open eyes trying in vain to understand what happened!

Integer class >> fortyTwo
    ^#(42)

Integer fortyTwo  #(42)
Integer fortyTwo at: 1 put: 0.  
Integer fortyTwo #(0)

Go back and look at the method.  Hasn't changed still says ^#(42).  Good luck debugging that!

I hope that adds some color around this issue. Ok back to your regularly scheduled program!

All the best,

Ron Teitelbaum



On Fri, Apr 24, 2020 at 1:16 PM Eliot Miranda <[hidden email]> wrote:


On Apr 24, 2020, at 9:59 AM, Jakob Reschke <[hidden email]> wrote:


Domain and "data storage" layers are intermixed here, hence the trouble with the concept of read-only. If you don't want such a distinction of layers by using different objects in the first place, then I suggest to at least use separate protocols. So yes, use different managers for different kinds of read-onliness. Your domain-specific layer can still delegate to the VM write barrier if that works well. And different applications can still access the same kind/layer of read-onliness, so Eliot's proposal to have one registry for the VM write barrier handling remains valid.

I'd say each domain should also have an own exception class in this case. As an implementation detail, it could inherit from the base ModificationForbidden... or hide the concrete class behind an accessor.

No.  That is unnecessary.  The issue is to separate intercepting an attempt to write to a read-only object from what happens in response to that attempt.  And that’s what the ManagedObjects/defaultAction mechanism does.  Attempts to write are caught and other objects handle what happens in response.

Thinking of this issue in the co text of exception handlers doesn’t make sense.  Writes happen all over the system, and not necessarily within the dynamic extent of some computation.  The exception handler is global.  So one won’t be able to establish exception handlers for all cases.  Instead, the global exception system dispatches a per-object-specific response through ManagedObjects.




Marcel Taeumel <[hidden email]> schrieb am Fr., 24. Apr. 2020, 12:10:
>  But this means the DB is now occupying the use of the readOnly bit, not available for other applications or use-cases.

Hmmm... ManagedObjects could be partitioned among multiple applications. For example, a game loading some save state could come across some read-only objects and then choses how to manage those. Another application could do this as well, not interfering with the first one. Both might be considered "small DB managers" so to say.

Of course, that check "myDomainObject isReadOnlyObject" would become standard procedure for such DBs, wouldn't it?

Best,
Marcel

Am 24.04.2020 05:26:56 schrieb Chris Muller <[hidden email]>:

So if the exception is unhandled, then before it raises an UnhandledError it checks an identity dictionary, which maps object to message, and if the read-only object that was the cause of the error is in the dictionary, instead the exception performs the message with the object as an argument.  So a database layer can add the objects it is managing to the map in ModificationForbidden, and mark them as read-only.  Then any and all attempts at modifying these objects will cause the database man ager to be notified. 
 So very simply we can have a pluggable solution that allows different clients to map the exception into different responses as desired. 

But an object in your db table could easily be an Array literal held by a CompiledMethod, not expected to change, but persistent by reference nonetheless.  So if the application did then modify it accidentally, instead of Forbidden protection, your DB manager would happily modify it.  It's this separation of use-cases is all what the question was about I think, not a big deal, we've lived with unprotected CM literals for this long already, and I've never needed WriteBarrier for anything other than a DB.

Since objects get added to the collection intentionally the array literal would not be added and hence the manager would not modify it.  

How would the manager know not to add it?  It can't be by checking #isReadOnlyObject, since that presents the same paradox -- requiring the manager to know the business of whatever other use-case has it set.  If it assumed it was for CM-literal protection, it wouldn't add it, but what if it was just some debugging or something?
 
Your example is a straw man.  


However, I still don't see the path for how to use this in a complex multi-db Magma application with oblivious objects (e.g., Morphs).  It's not something any of the GemStone clients I consulted at as developer or DBA ever had to contend with either, but perhaps not something you're targeting.  Squeak is a different animal...  I will stay tuned here and watch for the answers as they unfold...

The objects that get added to the wrote barrier management collection get added by managers that want to manage specific objects, not arbitrary objects. Can you see that a DB manager would add objects it has materialized from the DB that it wanted to transparently write-back in modification, and no others?

Yes, absolutely.  The manager will get every ModificationForbidden signal under its code whether its meant for the DB or not.  Existence in a global table means handle it, otherwise pass it up the stack.  But this means the DB is now occupying the use of the readOnly bit, not available for other applications or use-cases.

I hope this critique isn't taken to mean I don't think this isn't a good feature for the VM and image.  I do.  Everything is a balance of features and limitations.  I'm still trying to determine whether Magma can benefit from this, and I have to get deeply critical to find the right decision.  I will be following this feature closely, thanks for your patience with my questions.

 - Chris
timrowledge
Reply | Threaded
Open this post in threaded view
♦
♦
|

Re: Why is ModificationForbidden not an Error?

timrowledge


> On 2020-04-24, at 11:37 AM, Ron Teitelbaum <[hidden email]> wrote:
>
> Hi all,
>
> I'd like to add some color here.

Preach it, brother!

See also the fun caused by a do: loop where the block results in an item being removed from the OrderedCollection you're iterating over.


tim
--
tim Rowledge; [hidden email]; http://www.rowledge.org/tim
"Bother" said Pooh as "Formating Drive C" appeared on the screen...



Chris Muller-3
Reply | Threaded
Open this post in threaded view
♦
♦
|

Re: Why is ModificationForbidden not an Error?

Chris Muller-3
In reply to this post by marcel.taeumel
Hi Marcel, 

My example refers to different use-cases operating on the *same* (identical) set of objects, setting and unsetting the read-only bit willy nilly to suit their purposes, and conflicting with each other.  There's only one bit per object.

As far as partitioning within ManagedObjects, I assure it's something you're *definitely* going to need, but you'll still need to ensure all users of beWritableObject, et al, in any one image, are coordinated.

 - Chris

On Fri, Apr 24, 2020 at 5:10 AM Marcel Taeumel <[hidden email]> wrote:
>  But this means the DB is now occupying the use of the readOnly bit, not available for other applications or use-cases.

Hmmm... ManagedObjects could be partitioned among multiple applications. For example, a game loading some save state could come across some read-only objects and then choses how to manage those. Another application could do this as well, not interfering with the first one. Both might be considered "small DB managers" so to say.

Of course, that check "myDomainObject isReadOnlyObject" would become standard procedure for such DBs, wouldn't it?

Best,
Marcel

Am 24.04.2020 05:26:56 schrieb Chris Muller <[hidden email]>:

So if the exception is unhandled, then before it raises an UnhandledError it checks an identity dictionary, which maps object to message, and if the read-only object that was the cause of the error is in the dictionary, instead the exception performs the message with the object as an argument.  So a database layer can add the objects it is managing to the map in ModificationForbidden, and mark them as read-only.  Then any and all attempts at modifying these objects will cause the database man ager to be notified. 
 So very simply we can have a pluggable solution that allows different clients to map the exception into different responses as desired. 

But an object in your db table could easily be an Array literal held by a CompiledMethod, not expected to change, but persistent by reference nonetheless.  So if the application did then modify it accidentally, instead of Forbidden protection, your DB manager would happily modify it.  It's this separation of use-cases is all what the question was about I think, not a big deal, we've lived with unprotected CM literals for this long already, and I've never needed WriteBarrier for anything other than a DB.

Since objects get added to the collection intentionally the array literal would not be added and hence the manager would not modify it.  

How would the manager know not to add it?  It can't be by checking #isReadOnlyObject, since that presents the same paradox -- requiring the manager to know the business of whatever other use-case has it set.  If it assumed it was for CM-literal protection, it wouldn't add it, but what if it was just some debugging or something?
 
Your example is a straw man.  


However, I still don't see the path for how to use this in a complex multi-db Magma application with oblivious objects (e.g., Morphs).  It's not something any of the GemStone clients I consulted at as developer or DBA ever had to contend with either, but perhaps not something you're targeting.  Squeak is a different animal...  I will stay tuned here and watch for the answers as they unfold...

The objects that get added to the wrote barrier management collection get added by managers that want to manage specific objects, not arbitrary objects. Can you see that a DB manager would add objects it has materialized from the DB that it wanted to transparently write-back in modification, and no others?

Yes, absolutely.  The manager will get every ModificationForbidden signal under its code whether its meant for the DB or not.  Existence in a global table means handle it, otherwise pass it up the stack.  But this means the DB is now occupying the use of the readOnly bit, not available for other applications or use-cases.

I hope this critique isn't taken to mean I don't think this isn't a good feature for the VM and image.  I do.  Everything is a balance of features and limitations.  I'm still trying to determine whether Magma can benefit from this, and I have to get deeply critical to find the right decision.  I will be following this feature closely, thanks for your patience with my questions.

 - Chris
Chris Muller-3
Reply | Threaded
Open this post in threaded view
♦
♦
|

Re: Why is ModificationForbidden not an Error?

Chris Muller-3
In reply to this post by timrowledge
The fact that there is a helpful default handler for an exception does not (should not!) mean you can't catch it and do something more to your liking

Only if you control the code.  For Magma-like transparency, it must be able to operate on oblivious objects which have ZERO knowledge of any database or handlers.  Cmd+s in an Inspector should be picked up and saved in the next DB commit, unless it's a CM-literal, in which case it should error immediately...
123
Free forum by Nabble Edit this page