Disable reach capabilities in nested closures appearing without @use

With our current @use scheme, this is unsound. We leave the possibility to re-enable
as a Config option which is disabled by default and comes with a warning that enabling
it would be unsound.

Author: odersky

compiler/src/dotty/tools/dotc/cc/CaptureOps.scala

@@ -28,12 +28,16 @@ object ccConfig:
   inline val allowUnsoundMaps = false
 
   /** If enabled, use a special path in recheckClosure for closures
-   *  that are eta expansions. This can improve some error messages but
-   *  currently leads to unsoundess for handling reach capabilities.
-   *  TODO: The unsoundness needs followin up.
+   *  that are eta expansions. This can improve some error messages.
    */
   inline val handleEtaExpansionsSpecially = true
 
+  /** Don't require @use for reach capabilities that are accessed
+   *  only in a nested closure. This is unsound without additional
+   *  mitigation measures, as shown by unsound-reach-5.scala.
+   */
+  inline val deferredReaches = false
+
   /** If true, use existential capture set variables */
   def useExistentials(using Context) =
     Feature.sourceVersion.stable.isAtLeast(SourceVersion.`3.5`)

compiler/src/dotty/tools/dotc/cc/CheckCaptures.scala

@@ -819,13 +819,15 @@ class CheckCaptures extends Recheck, SymTransformer:
       if Synthetics.isExcluded(sym) then sym.info
       else
         // If rhs ends in a closure or anonymous class, the corresponding symbol
-        def nestedClosure(rhs: Tree)(using Context): Symbol = rhs match
-          case Closure(_, meth, _) => meth.symbol
-          case Apply(fn, _) if fn.symbol.isConstructor && fn.symbol.owner.isAnonymousClass => fn.symbol.owner
-          case Block(_, expr) => nestedClosure(expr)
-          case Inlined(_, _, expansion) => nestedClosure(expansion)
-          case Typed(expr, _) => nestedClosure(expr)
-          case _ => NoSymbol
+        def nestedClosure(rhs: Tree)(using Context): Symbol =
+          if !ccConfig.deferredReaches then NoSymbol
+          else rhs match
+            case Closure(_, meth, _) => meth.symbol
+            case Apply(fn, _) if fn.symbol.isConstructor && fn.symbol.owner.isAnonymousClass => fn.symbol.owner
+            case Block(_, expr) => nestedClosure(expr)
+            case Inlined(_, _, expansion) => nestedClosure(expansion)
+            case Typed(expr, _) => nestedClosure(expr)
+            case _ => NoSymbol
 
         val saved = curEnv
         val localSet = capturedVars(sym)

tests/neg-custom-args/captures/method-uses.scala

@@ -18,12 +18,12 @@ def test2(xs: List[() => Unit]) =
   ()
 
 def test3(xs: List[() => Unit]): () ->{xs*} Unit = () =>
-  println(xs.head)  // ok
+  println(xs.head)  // error, ok under deferredReaches
 
-  def test4(xs: List[() => Unit]) = () => xs.head // ok
+  def test4(xs: List[() => Unit]) = () => xs.head // error, ok under deferredReaches
 
   def test5(xs: List[() => Unit]) = new:
-    println(xs.head) // ok
+    println(xs.head) // error, ok under deferredReaches
 
   def test6(xs: List[() => Unit]) =
     val x= new { println(xs.head) } // error

tests/neg-custom-args/captures/unsound-reach-5.scala

@@ -0,0 +1,22 @@
+class IO
+
+def f(xs: List[() => Unit]): () ->{xs*} Unit = () =>
+  println(xs.head) // error
+
+def test(io: IO^)(ys: List[() ->{io} Unit]) =
+  val x = () =>
+    val z = f(ys)
+    z()
+  val _: () -> Unit = x // !!! ys* gets lost
+  ()
+
+def test(io: IO^) =
+  def ys: List[() ->{io} Unit] = ???
+  val x = () =>
+    val z = f(ys)
+    z()
+  val _: () -> Unit = x // !!! io gets lost
+  ()
+
+
+