//: Ingredients of a recipe are meant to be immutable unless they're also
//: products. This layer will start enforcing this check.
//:
//: One hole for now: variables in surrounding spaces are implicitly mutable.
//: [tag: todo]

:(scenario can_modify_ingredients_that_are_also_products)
# mutable container
def main [
  local-scope
  p:point <- merge 34, 35
  p <- foo p
]
def foo p:point -> p:point [
  local-scope
  load-ingredients
  p <- put p, x:offset, 34
]
$error: 0

:(scenario can_modify_ingredients_that_are_also_products_2)
def main [
  local-scope
  p:&:point <- new point:type
  p <- foo p
]
# mutable address to container
def foo p:&:point -> p:&:point [
  local-scope
  load-ingredients
  *p <- put *p, x:offset, 34
]
$error: 0

:(scenario can_modify_ingredients_that_are_also_products_3)
def main [
  local-scope
  p:&:@:num <- new number:type, 3
  p <- foo p
]
# mutable address
def foo p:&:@:num -> p:&:@:num [
  local-scope
  load-ingredients
  *p <- put-index *p, 0, 34
]
$error: 0

:(scenario ignore_literal_ingredients_for_immutability_checks)
def main [
  local-scope
  p:&:d1 <- new d1:type
  q:num <- foo p
]
def foo p:&:d1 -> q:num [
  local-scope
  load-ingredients
  x:&:d1 <- new d1:type
  *x <- put *x, p:offset, 34  # ignore this 'p'
  return 36
]
container d1 [
  p:num
  q:num
]
$error: 0

:(scenario cannot_modify_immutable_ingredients)
% Hide_errors = true;
def main [
  local-scope
  x:&:num <- new number:type
  foo x
]
# immutable address to primitive
def foo x:&:num [
  local-scope
  load-ingredients
  *x <- copy 34
]
+error: foo: cannot modify 'x' in instruction '*x <- copy 34' because it's an ingredient of recipe foo but not also a product

:(scenario cannot_modify_immutable_containers)
% Hide_errors = true;
def main [
  local-scope
  x:point-number <- merge 34, 35, 36
  foo x
]
# immutable container
def foo x:point-number [
  local-scope
  load-ingredients
  # copy an element: ok
  y:point <- get x, xy:offset
  # modify the element: boom
  # This could be ok if y contains no addresses, but we're not going to try to be that smart.
  # It also makes the rules easier to reason about. If it's just an ingredient, just don't try to change it.
  y <- put y, x:offset, 37
]
+error: foo: cannot modify 'y' in instruction 'y <- put y, x:offset, 37' because that would modify 'x' which is an ingredient of recipe foo but not also a product

:(scenario can_modify_immutable_pointers)
def main [
  local-scope
  x:&:num <- new number:type
  foo x
]
def foo x:&:num [
  local-scope
  load-ingredients
  # modify the address, not the payload
  x <- copy null
]
$error: 0

:(scenario can_modify_immutable_pointers_but_not_their_payloads)
% Hide_errors = true;
def main [
  local-scope
  x:&:num <- new number:type
  foo x
]
def foo x:&:num [
  local-scope
  load-ingredients
  # modify address; ok
  x <- new number:type
  # modify payload: boom
  # this could be ok, but we're not going to try to be that smart
  *x <- copy 34
]
+error: foo: cannot modify 'x' in instruction '*x <- copy 34' because it's an ingredient of recipe foo but not also a product

:(scenario cannot_call_mutating_recipes_on_immutable_ingredients)
% Hide_errors = true;
def main [
  local-scope
  p:&:point <- new point:type
  foo p
]
def foo p:&:point [
  local-scope
  load-ingredients
  bar p
]
def bar p:&:point -> p:&:point [
  local-scope
  load-ingredients
  # p could be modified here, but it doesn't have to be, it's already marked
  # mutable in the header
]
+error: foo: cannot modify 'p' in instruction 'bar p' because it's an ingredient of recipe foo but not also a product

:(scenario cannot_modify_copies_of_immutable_ingredients)
% Hide_errors = true;
def main [
  local-scope
  p:&:point <- new point:type
  foo p
]
def foo p:&:point [
  local-scope
  load-ingredients
  q:&:point <- copy p
  *q <- put *q, x:offset, 34
]
+error: foo: cannot modify 'q' in instruction '*q <- put *q, x:offset, 34' because that would modify p which is an ingredient of recipe foo but not also a product

:(scenario can_modify_copies_of_mutable_ingredients)
def main [
  local-scope
  p:&:point <- new point:type
  foo p
]
def foo p:&:point -> p:&:point [
  local-scope
  load-ingredients
  q:&:point <- copy p
  *q <- put *q, x:offset, 34
]
$error: 0

:(scenario cannot_modify_address_inside_immutable_ingredients)
% Hide_errors = true;
container foo [
  x:&:@:num  # contains an address
]
def main [
  # don't run anything
]
def foo a:&:foo [
  local-scope
  load-ingredients
  x:&:@:num <- get *a, x:offset  # just a regular get of the container
  *x <- put-index *x, 0, 34  # but then a put-index on the result
]
+error: foo: cannot modify 'x' in instruction '*x <- put-index *x, 0, 34' because that would modify a which is an ingredient of recipe foo but not also a product

:(scenario cannot_modify_address_inside_immutable_ingredients_2)
container foo [
  x:&:@:num  # contains an address
]
def main [
  # don't run anything
]
def foo a:&:foo [
  local-scope
  load-ingredients
  b:foo <- merge null
  # modify b, completely unrelated to immutable ingredient a
  x:&:@:num <- get b, x:offset
  *x <- put-index *x, 0, 34
]
$error: 0

:(scenario cannot_modify_address_inside_immutable_ingredients_3)
% Hide_errors = true;
def main [
  # don't run anything
]
def foo a:&:@:&:num [
  local-scope
  load-ingredients
  x:&:num <- index *a, 0  # just a regular index of the array
  *x <- copy 34  # but then modify the result
]
+error: foo: cannot modify 'x' in instruction '*x <- copy 34' because that would modify a which is an ingredient of recipe foo but not also a product

:(scenario cannot_modify_address_inside_immutable_ingredients_4)
def main [
  # don't run anything
]
def foo a:&:@:&:num [
  local-scope
  load-ingredients
  b:&:@:&:num <- new {(address number): type}, 3
  # modify b, completely unrelated to immutable ingredient a
  x:&:num <- index *b, 0
  *x <- copy 34
]
$error: 0

:(scenario latter_ingredient_of_index_is_immutable)
def main [
  # don't run anything
]
def foo a:&:@:&:@:num, b:num -> a:&:@:&:@:num [
  local-scope
  load-ingredients
  x:&:@:num <- index *a, b
  *x <- put-index *x, 0, 34
]
$error: 0

:(scenario can_traverse_immutable_ingredients)
container test-list [
  next:&:test-list
]
def main [
  local-scope
  p:&:test-list <- new test-list:type
  foo p
]
def foo p:&:test-list [
  local-scope
  load-ingredients
  p2:&:test-list <- bar p
]
def bar x:&:test-list -> y:&:test-list [
  local-scope
  load-ingredients
  y <- get *x, next:offset
]
$error: 0

:(scenario treat_optional_ingredients_as_mutable)
def main [
  k:&:num <- new number:type
  test k
]
# recipe taking an immutable address ingredient
def test k:&:num [
  local-scope
  load-ingredients
  foo k
]
# ..calling a recipe with an optional address ingredient
def foo -> [
  local-scope
  load-ingredients
  k:&:num, found?:bool <- next-ingredient
  # we don't further check k for immutability, but assume it's mutable
]
$error: 0

:(scenario treat_optional_ingredients_as_mutable_2)
% Hide_errors = true;
def main [
  local-scope
  p:&:point <- new point:type
  foo p
]
def foo p:&:point [
  local-scope
  load-ingredients
  bar p
]
def bar [
  local-scope
  load-ingredients
  p:&:point <- next-ingredient  # optional ingredient; assumed to be mutable
]
+error: foo: cannot modify 'p' in instruction 'bar p' because it's an ingredient of recipe foo but not also a product

//: when checking for immutable ingredients, remember to take space into account
:(scenario check_space_of_reagents_in_immutability_checks)
def main [
  a:space/names:new-closure <- new-closure
  b:&:num <- new number:type
  run-closure b:&:num, a:space
]
def new-closure [
  local-scope
  x:&:num <- new number:type
  return default-space/names:new-closure
]
def run-closure x:&:num, s:space/names:new-closure [
  local-scope
  load-ingredients
  0:space/names:new-closure <- copy s
  # different space; always mutable
  *x:&:num/space:1 <- copy 34
]
$error: 0

:(before "End Transforms")
Transform.push_back(check_immutable_ingredients);  // idempotent

:(code)
void check_immutable_ingredients(const recipe_ordinal r) {
  // to ensure an address reagent isn't modified, it suffices to show that
  //   a) we never write to its contents directly,
  //   b) we never call 'put' or 'put-index' on it, and
  //   c) any non-primitive recipe calls in the body aren't returning it as a product
  const recipe& caller = get(Recipe, r);
  trace(9991, "transform") << "--- check mutability of ingredients in recipe " << caller.name << end();
  if (!caller.has_header) return;  // skip check for old-style recipes calling next-ingredient directly
  for (int i = 0;  i < SIZE(caller.ingredients);  ++i) {
    const reagent& current_ingredient = caller.ingredients.at(i);
    if (is_present_in_products(caller, current_ingredient.name)) continue;  // not expected to be immutable
    // End Immutable Ingredients Special-cases
    set<reagent, name_and_space_lt> immutable_vars;
    immutable_vars.insert(current_ingredient);
    for (int i = 0;  i < SIZE(caller.steps);  ++i) {
      const instruction& inst = caller.steps.at(i);
      check_immutable_ingredient_in_instruction(inst, immutable_vars, current_ingredient.name, caller);
      if (inst.operation == INDEX && SIZE(inst.ingredients) > 1 && inst.ingredients.at(1).name == current_ingredient.name) continue;
      update_aliases(inst, immutable_vars);
    }
  }
}

void update_aliases(const instruction& inst, set<reagent, name_and_space_lt>& current_ingredient_and_aliases) {
  set<int> current_ingredient_indices = ingredient_indices(inst, current_ingredient_and_aliases);
  if (!contains_key(Recipe, inst.operation)) {
    // primitive recipe
    switch (inst.operation) {
      case COPY:
        for (set<int>::iterator p = current_ingredient_indices.begin();  p != current_ingredient_indices.end();  ++p)
          current_ingredient_and_aliases.insert(inst.products.at(*p).name);
        break;
      case GET:
      case INDEX:
      case MAYBE_CONVERT:
        // current_ingredient_indices can only have 0 or one value
        if (!current_ingredient_indices.empty() && !inst.products.empty()) {
          if (is_mu_address(inst.products.at(0)) || is_mu_container(inst.products.at(0)) || is_mu_exclusive_container(inst.products.at(0)))
            current_ingredient_and_aliases.insert(inst.products.at(0));
        }
        break;
      default: break;
    }
  }
  else {
    // defined recipe
    set<int> contained_in_product_indices = scan_contained_in_product_indices(inst, current_ingredient_indices);
    for (set<int>::iterator p = contained_in_product_indices.begin();  p != contained_in_product_indices.end();  ++p) {
      if (*p < SIZE(inst.products))
        current_ingredient_and_aliases.insert(inst.products.at(*p));
    }
  }
}

set<int> scan_contained_in_product_indices(const instruction& inst, set<int>& ingredient_indices) {
  set<reagent, name_and_space_lt> selected_ingredients;
  const recipe& callee = get(Recipe, inst.operation);
  for (set<int>::iterator p = ingredient_indices.begin();  p != ingredient_indices.end();  ++p) {
    if (*p >= SIZE(callee.ingredients)) continue;  // optional immutable ingredient
    selected_ingredients.insert(callee.ingredients.at(*p));
  }
  set<int> result;
  for (int i = 0;  i < SIZE(callee.products);  ++i) {
    const reagent& current_product = callee.products.at(i);
    const string_tree* contained_in_name = property(current_product, "contained-in");
    if (contained_in_name && selected_ingredients.find(contained_in_name->value) != selected_ingredients.end())
      result.insert(i);
  }
  return result;
}

bool is_mu_container(const reagent& r) {
  return is_mu_container(r.type);
}
bool is_mu_container(const type_tree* type) {
  if (!type) return false;
  if (!type->atom)
    return is_mu_container(get_base_type(type));
  if (type->value == 0) return false;
  if (!contains_key(Type, type->value)) return false;  // error raised elsewhere
  type_info& info = get(Type, type->value);
  return info.kind == CONTAINER;
}

bool is_mu_exclusive_container(const reagent& r) {
  return is_mu_exclusive_container(r.type);
}
bool is_mu_exclusive_container(const type_tree* type) {
  if (!type) return false;
  if (!type->atom)
    return is_mu_exclusive_container(get_base_type(type));
  if (type->value == 0) return false;
  if (!contains_key(Type, type->value)) return false;  // error raised elsewhere
  type_info& info = get(Type, type->value);
  return info.kind == EXCLUSIVE_CONTAINER;
}

:(before "End Types")
// reagent comparison -- only in the context of a single recipe
struct name_and_space_lt {
  bool operator()(const reagent& a, const reagent& b) const;
};
:(code)
bool name_and_space_lt::operator()(const reagent& a, const reagent& b) const {
  int aspace = 0, bspace = 0;
  if (has_property(a, "space")) aspace = to_integer(property(a, "space")->value);
  if (has_property(b, "space")) bspace = to_integer(property(b, "space")->value);
  if (aspace != bspace) return aspace < bspace;
  return a.name < b.name;
}

:(scenarios transform)
:(scenario immutability_infects_contained_in_variables)
% Hide_errors = true;
container test-list [
  value:num
  next:&:test-list
]
def main [
  local-scope
  p:&:test-list <- new test-list:type
  foo p
]
def foo p:&:test-list [  # p is immutable
  local-scope
  load-ingredients
  p2:&:test-list <- test-next p  # p2 is immutable
  *p2 <- put *p2, value:offset, 34
]
def test-next x:&:test-list -> y:&:test-list/contained-in:x [
  local-scope
  load-ingredients
  y <- get *x, next:offset
]
+error: foo: cannot modify 'p2' in instruction '*p2 <- put *p2, value:offset, 34' because that would modify p which is an ingredient of recipe foo but not also a product

:(code)
void check_immutable_ingredient_in_instruction(const instruction& inst, const set<reagent, name_and_space_lt>& current_ingredient_and_aliases, const string& original_ingredient_name, const recipe& caller) {
  // first check if the instruction is directly modifying something it shouldn't
  for (int i = 0;  i < SIZE(inst.products);  ++i) {
    if (has_property(inst.products.at(i), "lookup")
        && current_ingredient_and_aliases.find(inst.products.at(i)) != current_ingredient_and_aliases.end()) {
      string current_product_name = inst.products.at(i).name;
      if (current_product_name == original_ingredient_name)
        raise << maybe(caller.name) << "cannot modify '" << current_product_name << "' in instruction '" << to_original_string(inst) << "' because it's an ingredient of recipe " << caller.name << " but not also a product\n" << end();
      else
        raise << maybe(caller.name) << "cannot modify '" << current_product_name << "' in instruction '" << to_original_string(inst) << "' because that would modify " << original_ingredient_name << " which is an ingredient of recipe " << caller.name << " but not also a product\n" << end();
      return;
    }
  }
  // check if there's any indirect modification going on
  set<int> current_ingredient_indices = ingredient_indices(inst, current_ingredient_and_aliases);
  if (current_ingredient_indices.empty()) return;  // ingredient not found in call
  for (set<int>::iterator <style>pre { line-height: 125%; }
td.linenos .normal { color: inherit; background-color: transparent; padding-left: 5px; padding-right: 5px; }
span.linenos { color: inherit; background-color: transparent; padding-left: 5px; padding-right: 5px; }
td.linenos .special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }
span.linenos.special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }
.highlight .hll { background-color: #ffffcc }
.highlight .c { color: #888888 } /* Comment */
.highlight .err { color: #a61717; background-color: #e3d2d2 } /* Error */
.highlight .k { color: #008800; font-weight: bold } /* Keyword */
.highlight .ch { color: #888888 } /* Comment.Hashbang */
.highlight .cm { color: #888888 } /* Comment.Multiline */
.highlight .cp { color: #cc0000; font-weight: bold } /* Comment.Preproc */
.highlight .cpf { color: #888888 } /* Comment.PreprocFile */
.highlight .c1 { color: #888888 } /* Comment.Single */
.highlight .cs { color: #cc0000; font-weight: bold; background-color: #fff0f0 } /* Comment.Special */
.highlight .gd { color: #000000; background-color: #ffdddd } /* Generic.Deleted */
.highlight .ge { font-style: italic } /* Generic.Emph */
.highlight .ges { font-weight: bold; font-style: italic } /* Generic.EmphStrong */
.highlight .gr { color: #aa0000 } /* Generic.Error */
.highlight .gh { color: #333333 } /* Generic.Heading */
.highlight .gi { color: #000000; background-color: #ddffdd } /* Generic.Inserted */
.highlight .go { color: #888888 } /* Generic.Output */
.highlight .gp { color: #555555 } /* Generic.Prompt */
.highlight .gs { font-weight: bold } /* Generic.Strong */
.highlight .gu { color: #666666 } /* Generic.Subheading */
.highlight .gt { color: #aa0000 } /* Generic.Traceback */
.highlight .kc { color: #008800; font-weight: bold } /* Keyword.Constant */
.highlight .kd { color: #008800; font-weight: bold } /* Keyword.Declaration */
.highlight .kn { color: #008800; font-weight: bold } /* Keyword.Namespace */
.highlight .kp { color: #008800 } /* Keyword.Pseudo */
.highlight .kr { color: #008800; font-weight: bold } /* Keyword.Reserved */
.highlight .kt { color: #888888; font-weight: bold } /* Keyword.Type */
.highlight .m { color: #0000DD; font-weight: bold } /* Literal.Number */
.highlight .s { color: #dd2200; background-color: #fff0f0 } /* Literal.String */
.highlight .na { color: #336699 } /* Name.Attribute */
.highlight .nb { color: #003388 } /* Name.Builtin */
.highlight .nc { color: #bb0066; font-weight: bold } /* Name.Class */
.highlight .no { color: #003366; font-weight: bold } /* Name.Constant */
.highlight .nd { color: #555555 } /* Name.Decorator */
.highlight .ne { color: #bb0066; font-weight: bold } /* Name.Exception */
.highlight .nf { color: #0066bb; font-weight: bold } /* Name.Function */
.highlight .nl { color: #336699; font-style: italic } /* Name.Label */
.highlight .nn { color: #bb0066; font-weight: bold } /* Name.Namespace */
.highlight .py { color: #336699; font-weight: bold } /* Name.Property */
.highlight .nt { color: #bb0066; font-weight: bold } /* Name.Tag */
.highlight .nv { color: #336699 } /* Name.Variable */
.highlight .ow { color: #008800 } /* Operator.Word */
.highlight .w { color: #bbbbbb } /* Text.Whitespace */
.highlight .mb { color: #0000DD; font-weight: bold } /* Literal.Number.Bin */
.highlight .mf { color: #0000DD; font-weight: bold } /* Literal.Number.Float */
.highlight .mh { color: #0000DD; font-weight: bold } /* Literal.Number.Hex */
.highlight .mi { color: #0000DD; font-weight: bold } /* Literal.Number.Integer */
.highlight .mo { color: #0000DD; font-weight: bold } /* Literal.Number.Oct */
.highlight .sa { color: #dd2200; background-color: #fff0f0 } /* Literal.String.Affix */
.highlight .sb { color: #dd2200; background-color: #fff0f0 } /* Literal.String.Backtick */
.highlight .sc { color: #dd2200; background-color: #fff0f0 } /* Literal.String.Char */
.highlight .dl { color: #dd2200; background-color: #fff0f0 } /* Literal.String.Delimiter */
.highlight .sd { color: #dd2200; background-color: #fff0f0 } /* Literal.String.Doc */
.highlight .s2 { color: #dd2200; background-color: #fff0f0 } /* Literal.String.Double */
.highlight .se { color: #0044dd; background-color: #fff0f0 } /* Literal.String.Escape */
.highlight .sh { color: #dd2200; background-color: #fff0f0 } /* Literal.String.Heredoc */
.highlight .si { color: #3333bb; background-color: #fff0f0 } /* Literal.String.Interpol */
.highlight .sx { color: #22bb22; background-color: #f0fff0 } /* Literal.String.Other */
.highlight .sr { color: #008800; background-color: #fff0ff } /* Literal.String.Regex */
.highlight .s1 { color: #dd2200; background-color: #fff0f0 } /* Literal.String.Single */
.highlight .ss { color: #aa6600; background-color: #fff0f0 } /* Literal.String.Symbol */
.highlight .bp { color: #003388 } /* Name.Builtin.Pseudo */
.highlight .fm { color: #0066bb; font-weight: bold } /* Name.Function.Magic */
.highlight .vc { color: #336699 } /* Name.Variable.Class */
.highlight .vg { color: #dd7700 } /* Name.Variable.Global */
.highlight .vi { color: #3333bb } /* Name.Variable.Instance */
.highlight .vm { color: #336699 } /* Name.Variable.Magic */
.highlight .il { color: #0000DD; font-weight: bold } /* Literal.Number.Integer.Long */</style><div class="highlight"><pre><span></span><span class="cp">&lt;!DOCTYPE HTML PUBLIC &quot;-//W3C//DTD HTML 4.01//EN&quot; &quot;http://www.w3.org/TR/html4/strict.dtd&quot;&gt;</span>
<span