Access to protected fields of a self-type is inconsistent

[coreywoodfield]

Compiler version

3.3.0

Minimized code

Test.scala

package test.base

class Test {
  protected def foo(): Unit = ()
}

SamePackageSubclass.scala

package test.base

class SamePackageSubclass { this: Test =>
  foo()
}

SubPackageSubclass.scala

package test.base.sub

import test.base.Test

class SubPackageSubclass { this: Test =>
  foo()
}

DiffPackageSubclass.scala

package test.other

import test.base.Test

class DiffPackageSubclass { this: Test =>
  foo()
}

Output

-- Error: DiffPackageSubclass.scala:6:2 --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
6 |  foo()
  |  ^^^
  |  illegal access to protected method foo in class Test from class DiffPackageSub
1 error found

Expectation

I would expect all three classes to be able to access foo or all three classes to not be able to access foo. Instead, the classes that are within/under the original classes package are able to access foo and the one outside is not.

In scala 2, having a self type gave you access to the protected members of that self type. In scala 3, having a self type only gives you access to protected members of that self type if you're in the same package.

[dwijnand]

I don't know specifically, but instinctually this feels like something a spree team can tackle in a spree. If anyone has any further details, please comment.

[odersky]

I don't think we want to fix that. The rules for protected access are very subtle, in particular when accessing a protected member foo the current instance must be a subclass of the owner of foo. (It's the same in Java, and is intended to make protected safe). This is clearly not the case here.

[som-snytt]

The inconsistency is that only the last usage is disallowed, as though the member definition were

protected[p] def f() = ()

(Java protected is also package-visible, so hopefully this behavior is not somehow mandated by Java interop.)

Same example for convenient pasting. I did not check separate compilation.

package p {
  class C {
    protected def f() = ()
  }
  class X {
    this: C =>
    def g() = f()
  }
}
package p.s {
  import p._
  class Y {
    this: C =>
    def g() = f()
  }
}
package q {
  import p._
  class Z {
    this: C =>
    def g() = f() // illegal access to protected method f in class C from class Z
  }
}

The obvious error is the familiar message

package p {
  class A {
    val c = new C
    def g() = c.f()
  }
}

explains

12 |    def g() = c.f()
   |              ^^^
   |              method f cannot be accessed as a member of (A.this.c : p.C) from class A.
   |               Access to protected method f not permitted because enclosing class A in package p
   |               is not a subclass of class C in package p where target is defined

[coreywoodfield]

☝️ I agree that "when accessing a protected member foo the current instance must be a subclass of the owner of foo" and that "this is clearly not the case here."

I'm not necessarily saying that self-types should grant access to protected members. I'm pointing out that sometimes they do and sometimes they do not.

If we want the behavior to match the current scala 2 behavior, we would make self-types grant access to protected members always. Given that @som-snytt just filed scala/bug#12839, I assume that's not what we want.

Even if we don't want the behavior to match the current scala 2 behavior, though, I think this is still a bug that needs to be fixed. I couldn't find the scala 3 language specification but the scala 2.13 language spec says

The protected modifier applies to class member definitions. Protected members of a class can be accessed from within

• the template of the defining class,
• all templates that have the defining class as a base class,
• the companion module of any of those classes.

p.X and p.s.Y in @som-snytt's example compile in scala 3 even though they should not (according to the language spec) have access to protected members of p.C.

In scala 2, self-types consistently grant access to protected members, which is a bug. In scala 3, self-types can still grant access to protected members. They do not do so in all cases that they do in scala 2, but they still do sometimes.

I wasn't 100% certain which way we'd go on this, so the original post was perhaps a bit unclear. I said "I would expect all three classes to be able to access foo or all three classes to not be able to access foo" (emphasis added). It seems like the correct behavior would be for all three classes to not be able to access foo (this is not the actual behavior). Should I open a new issue that more clearly notes that as the issue and doesn't worry about the inconsistency, or could we just reopen this one?

[odersky]

Protected is always visible in same package. That explains the difference, I think.

[coreywoodfield]

Protected is always visible in same package. That explains the difference, I think.

My impression was that that was the meaning/behavior of protected in java, but not in scala. The scala 2.13 language spec, referenced in my above comment, doesn't say anything about things in the same package being able to have access. And the following code fails to compile in both scala 2 and 3 (2.13.10 and 3.3.0, specifically) indicating that protected is not always visible in the same package

package a

class B {
  protected def foo = ()
}

object C {
  def bar = new B().foo
}

scala 2 error:

Test.scala:8: error: method foo in class B cannot be accessed as a member of a.B from object C in package a
 Access to protected method foo not permitted because
 enclosing object C in package a is not a subclass of
 class B in package a where target is defined
  def bar = new B().foo
                    ^
1 error

scala 3 error:

-- [E173] Reference Error: Test.scala:8:20 ------------------------------------------------------------------------------------------------------------------------------------------------------------------------
8 |  def bar = new B().foo
  |            ^^^^^^^^^^^
  |            method foo cannot be accessed as a member of a.B from module class C$.
  |             Access to protected method foo not permitted because enclosing object C in package a
  |             is not a subclass of class B in package a where target is defined
1 error found

B and C are in the same package but B#foo is not accessible by C

[odersky]

All right, that's precisely the clause I was talking about when I wrote that access to protected is very subtle. That rule comes on top of the other access rules.

I don't have the time to go back and unravel and explain all the precise rules. If someone else wants to do it, to explain the precise behavior and maybe propose a specific change, I am fine with that. But I really think we are good as it is, no need to spend more time on it.

[som-snytt]

We are playing with Prof Odersky's marbles. Or is it a baseball?