Null-Safety in the Practical Type System (PTS)

Type any

The set of allowed values for the root type any is empty — its cardinality is zero. Simply put, type any doesn't have a value.

This implies that it's impossible to create an object of type any. Objects can only be created for some child-types/descendants of any. Type any is therefore called a non-instantiable (or abstract) type, and styled in italic in the above diagram.

Moreover, nobody is allowed to define child-types of any. Type any is a so-called sealed type. Its child-types are fixed: non_null and null.

The PTS source code for any looks like this:

type any \
    factories: none \            (1)
    child_types: non_null, null  (2)
.

(1) Instances of any can't be created.

(2) non_null and null are the only child-types.

Type non_null

Type non_null is a child of type any.

The set of allowed values for type non_null is empty too — its cardinality is zero. Simply put, type non_null doesn't have a value.

Like type any, type non_null is a non-instantiable type too. It's also a sealed type, as will be explained in the next PTS article.

Type null

Type null is a child of type any.

As seen already in a previous section, type null has a single value, called null, in its set of allowed values. The cardinality of type null is one. Simply put, type null has only one value: null.

Unlike types any and non_null, type null is an instantiable (or concrete) type.

Like any and non_null, null is also a sealed type. There are no child-types of null, and nobody is allowed to create child-types.

Other Types

All remaining built-in types not shown in the diagram (string, number, list, etc.), as well as all user-defined types (e.g. customer, supplier, product), inherit from non_null.

Rules

According to the important Liskov substitution principle, any type in a type inheritance tree is compatible with all its parent types.

Applying this principle to the above type inheritance tree implies the following rules:

• Any value of any type can be assigned to an object reference declared to be of type any.

  For example, a function with an input parameter of type any can be called with the following values: null, "foo", 123, or any other value of any other type.

• null is an invalid value for object references of type non_null (or any of its descendants).

  For example:

  • A function with an input parameter of type non_null cannot be called with null as input. But any value of every other type ("foo", 123, etc.) is allowed as input.

  • A function with an input parameter type that's a descendant of non_null (e.g. string, customer) cannot be called with null as input.

    Note

    This is exactly the opposite of what's allowed in many popular languages, such as C, Java, JavaScript, Python, Ruby, where every object reference can be null. In Java, for example, null can be assigned to an input parameter of type String.

• It doesn't make sense to declare an object reference of type null. Therefore the compiler doesn't allow it.

  For example, a function input parameter cannot be of type null.

  Type null can only be used as a member of a union type, as explained in the next section.

Operator is

The is operator checks whether an expression is of a given type. The result is a boolean value. For example, "foo" is string evaluates to true, while 123 is string evaluates to false.

Hence, this operator is useful to check whether a given expression evaluates to null. Here is an example:

if customer.email_address is null then
    write_line ( "No email address!" )
else
    send_email ( email_address )
.

Instead of is, we can use is not to invert the check. Hence the above code can also be written like this:

if customer.email_address is not null then
    send_email ( email_address )
else
    write_line ( "No email address!" )
.

Besides using is in an if statement, we can also use it in an if expression:

const has_email = if customer.email_address is null then "no" else "yes"
write_line ( """Customer has email: {{has_email}}""" )

The Safe Navigation Operator (?)

The Wikipedia article Safe navigation operator states:

Before looking at how this operator works in PTS, let's see why we need it in the first place.

Suppose we want to get the phone number of an employee's manager by first getting the employee's department, then the manager of the department, and finally the manager's phone number.

If none of the objects in the chain can be null (i.e. they are all non-nullable), then the code might look like this in Java:

final String phoneNumber = employee.getDepartment().getManager().getPhoneNumber();

Here is the corresponding PTS code:

const phone_number = employee.department.manager.phone_number

Now let's suppose that later on the data model is changed, and every object in the chain (i.e. employee, department and manager) can now be null (i.e. they change from non-nullable to nullable). In that case:

• The above Java code still compiles, but a NullPointerException is thrown at run-time if any object in the chain is null.

• The above PTS code doesn't compile anymore, due to the built-in null-safety. There is no risk of a null pointer error at run-time.

The Java code could be fixed as follows:

String phoneNumber = null;
if ( employee != null ) {
    Department department = employee.getDepartment();
    if ( department != null ) {
        Manager manager = department.getManager();
        if ( manager != null ) {
            phoneNumber = manager.getPhoneNumber();
        }
    }
}

The PTS code also mutates into an if-monster, and phone_number can't be a constant anymore, it must be a variable:

variable phone_number = null
if employee is not null then
    const department = employee.department
    if department is not null then
        const manager = department.manager
        if manager is not null then
            phone_number = manager.phone_number
        .
    .
.

This PTS code can be simplified by using the safe navigation operator (?), followed by null. The code is now a one-liner again:

const phone_number = employee?null.department?null.manager?null.phone_number

Instead of writing ?null, we can also simply write ?:

const phone_number = employee?.department?.manager?.phone_number

This code is semantically equivalent to its verbose counterpart that uses nested if statements. The evaluation of the compound expression is aborted as soon as null is encountered in the chain. The inferred type for constant phone_number is string or null.

In PTS, usage of the ? operator is not restricted to type null — it may be used with any type (e.g. ?error, ?string, ?list<string>).

If no type is specified, the type defaults to null, since that's the most frequent use case. Therefore we can simply write ? instead of ?⁠null.

Multiple ? operators can be chained, to check for different types. For example, if the intermediate values in the chain are retrieved from functions that can return null or an error, we could write:

const phone_number = get_employee()?null?error \
    .get_department()?null?error \
    .get_manager()?null?error \
    .get_phone_number()

Now the evaluation of the expression is aborted as soon as an intermediate result evaluates to type null or error. The inferred type for phone_number is string or null or error.

Operator if_is

The if_is operator provides one of two possible values, depending on the type of an expression. Thus, if_is is used to execute a ternary operation involving a type.

Its syntax is as follows:

<expression_1> "if_is" <type> ":" <expression_2>

If <expression_1> evaluates to an instance of type <type>, then the result is <expression_2>, else the result is <expression_1>.

Operator if_is is often useful to provide a default value when an expression evaluates to null.

Suppose that product.comment is of type string or null. Now consider the following code that assigns a string to constant text:

const text = if product.comment is not null then product.comment else "No comment"

The code can be simplified by using the if_is operator:

const text = product.comment if_is null : "No comment"

This statement is semantically equivalent to the first statement that uses an if then else expression. If product.comment evaluates to a string, then that string is assigned to text. If product.comment evaluates to null, then the string "No comment" is assigned to text.

Instead of if_is null : the shorthand if_null : (or if_null:) can be used:

const text = product.comment if_null: "No comment"

string pageTitle = suppliedTitle ?? "Default Title";

const page_title = supplied_title if_null: "Default Title"

Besides the obvious benefit of succinct code, using if_null provides other advantages:

• Code duplication is eliminated, since product.comment appears twice in the statement using an if expression, but only once in the code using if_null.

• The code executes faster, because product.comment is only evaluated once.

• The code can't end up in nasty (and sometimes very difficult to debug) run-time errors that can occur if product.comment is mutable.

  Consider the first version:

  const text = if product.comment is not null then product.comment else "No comment"

  Imagine a multithreaded application where product.comment is mutable, and the first evaluation of product.comment results in a string, while the second evaluation results in null because another thread has changed its value between the two evaluations. In that case null would erroneously be assigned to text.

  A problem like this (aka a race condition) is typically very unlikely to happen. Most likely, it never happens during development/tests. But later (maybe much later), when the code is executed millions of times a day in production, the likeliness increases, and suddenly an incredibly nasty bug appears randomly — very difficult to debug.

const comment = product.comment
const text = if comment is not null then comment else "No comment"

const text = product.comment if_null: "No comment"

Operator if_is can be used with any type, not just with null:

const object_displayed = object if_is password: "secret"

Several if_is operators can be chained. This is useful, for example, to stop the evaluation of an expression as soon as a value of a given type is encountered.

Consider an application to create digital documents. Suppose that the font used to render the document is determined in a cascading fashion: If the font is explicitly defined by an option in the document, then that font is used. If no font is defined in the document, then the application looks for a font defined in a shared config file. If the config file doesn't specify a font, then a hard-coded default font is used as fallback.

Without the if_is operator we would need to write verbose PTS code like this:

fn get_font ( context ) -> font

    variable font = context.document_font
    if font is not null then
        return font
    .
    
    font = context.config_font
    if font is not null then
        return font
    .

    return context.default_font
}

The if_is operator simplifies the code:

fn get_font ( context ) -> font =
    context.document_font if_null: context.config_font if_null: context.default_font

if ... is null Statement

In section Operator is we already saw how the is operator may be used in an if statement. Here is a reiteration of a previous example:

if customer.email_address is not null then
    send_email ( email_address )
else
    write_line ( "No email address!" )
.

case type of Statement

The case type of statement has already been introduced in section case type of Statement of the previous PTS article, titled Union Types in the Practical Type System.

Here is a reiteration of an example shown in that section:

case type of read_text_file ( file_path.create ( "example.txt" ) )
    
    is string as text // the string is stored in constant 'text'
        write_line ( "Content of file:" )
        write_line ( text ) // the previously defined constant 'text' is now used
    
    is null
        write_line ( "The file is empty." )
    
    is file_error as error
        write_line ( """The following error occurred: {{error.message}}""" )
.

As you can see, the second branch (is null) is executed when function read_text_file returns null.

const message = case type of read_text_file ( file_path.create ( "example.txt" ) ) \
    is string: "text" \
    is null: "no text" \
    is error: "file read error"
write_line ( "Result: " + message )            

assert Statement

Sometimes we know more than the compiler does. For example we might know that a function declared to return a value of type string or null will never return null in a given context.

In such cases we can use an assert statement to express our assumption:

const result string or null = get_string_or_null ( ... )
assert result is not null
...
const size = result.size // valid because 'result' has been asserted to be non-null

In the above code, assert is used to state that the value stored in result will never be null.

As we all know, "to err is human". Therefore the assumption result is not null is checked at run-time, and an error is generated if the assumption turns out to be wrong.

Besides asserting not null we can also assert null, or assert any other type for a given expression:

assert problem is null
assert names is list<string>
assert result is not error

As in other languages, the assert keyword is followed by any boolean expression. Hence, in addition to asserting the type of an expression, assert can be used to express a wide range of assumptions. It may be used to assert object/state conditions, loop invariants, or any other conditions that are helpful to reliably document the code, simplify it, or optimize its performance.

We can provide a specific error message to be displayed at run-time, using the error_message: property at the end of the statement. Here are a few examples:

assert employee.name.size <= 50
assert customer.phone_number.starts_with ( "+" ) \
    error_message: "Phone number doesn't start with '+'"
assert index >= 1 and index <= list.size \
    error_message: """Index ({{index}}) out of bounds (1..{{list.size}})"""

Clause on

Clause on is used to execute a return or throw statement if an expressions evaluates to a specified type.

The general syntax of the on clause is as follows:

<expression> "on" <type> ( "as" <identifier> ) ? ":" <return_or_throw_statement>

If <expression> matches <type> then <return_or_throw_statement> is executed. The optional <identifier> can be used to store the result of <expression> in a constant which can then be used in <return_or_throw_statement> (see examples below).

Let's see why this is useful.

Here's an example of a recurring code pattern:

const value = get_value_or_null()
if value is null then
    return null
.

We can use the on clause to write semantically equivalent, but shorter code:

const value = get_value_or_null() on null : return null

Besides a return statement, a throw statement can be used too, to abort program execution:

const value = get_value_or_null() on null : throw application_error.create (
    "Unexpected 'null' returned by 'get_value_or_null'." )

Any type can be used in an on clause, and several on clauses can be chained:

const value = get_value_or_null_or_error() \
    on null : return null \
    on error as e : return e

on null : return null and on error as e : return e are both used frequently in practice. Therefore, the shorthands ^on_null and ^on_error can be used instead. The above code becomes:

const value = get_value_or_null_or_error() ^on_null ^on_error

... which is also semantically equivalent to the following verbose code:

const value = get_value_or_null_or_error()
if value is null then
    return null
.
if value is error then
    return value
.

The on clause may be used at the end of a constant assignment, variable assignment, or function call:

// constant assignment
const c number = get_string_or_number() on string : return null

// variable assignment
variable v = get_string_or_number() on string : return null
v = get_number_or_null() ^null

// function call (return value is null or an error)
close_connections() ^error