Refine export types

We export values under their singleton types only if the
original value was already public. Otherwise this would
provoke a leak.

Author: odersky

compiler/src/dotty/tools/dotc/core/SymDenotations.scala

@@ -1251,6 +1251,9 @@ object SymDenotations {
       else defn.RootClass
     }
 
+    final def isPublic(implicit ctx: Context): Boolean =
+      accessBoundary(owner) == defn.RootClass
+
     /** The primary constructor of a class or trait, NoSymbol if not applicable. */
     def primaryConstructor(implicit ctx: Context): Symbol = NoSymbol
 

compiler/src/dotty/tools/dotc/typer/Namer.scala

@@ -977,8 +977,10 @@ class Namer { typer: Typer =>
                   coord = span)
               else {
                 val (maybeStable, mbrInfo) =
-                  if (mbr.symbol.isStableMember) (StableRealizable, ExprType(path.tpe.select(mbr.symbol)))
-                  else (EmptyFlags, mbr.info.ensureMethodic)
+                  if (mbr.symbol.isStableMember && mbr.symbol.isPublic)
+                    (StableRealizable, ExprType(path.tpe.select(mbr.symbol)))
+                  else
+                    (EmptyFlags, mbr.info.ensureMethodic)
                 val mbrFlags = Exported | Method | Final | maybeStable | mbr.symbol.flags & RetainedExportFlags
                 ctx.newSymbol(cls, alias, mbrFlags, mbrInfo, coord = span)
               }

docs/docs/reference/other-new-features/export.md

@@ -75,8 +75,7 @@ Export aliases are always `final`. Aliases of delegates are again defines as del
    not marked `override`.
  - However, export aliases can implement deferred members of base classes.
 
-Export aliases for value definitions are marked by the compiler as "stable" and their result types are the singleton types of the aliased definitions. This means
-that they can be used as parts of stable identifier paths, even though they are technically methods. For instance, the following is OK:
+Export aliases for public value definitions are marked by the compiler as "stable" and their result types are the singleton types of the aliased definitions. This means that they can be used as parts of stable identifier paths, even though they are technically methods. For instance, the following is OK:
 ```scala
   class C { type T }
   object O { val c: C = ... }

tests/neg/export-leaks.scala

@@ -11,12 +11,4 @@ object Signature {
   object O2 {
     private[Signature] val foo: T = ???
   }
-  export O2._ // OK
-      // The reason this works is that private escape checking only looks at real private members,
-      // not at private[C] members. So, by itself the expansion of the export
-      //   <stable> def foo: O2.foo.type = O2.foo
-      // is legal. The underlying type of `O2.foo.type` does violate no-escape rules, but we do not
-      // check for it. Maybe we should. But then the question comes up whether we should
-      // also check all possible supertypes of a type for privacy violations. These are more
-      // general questions that are not related to exports.
-}
+  export O2._ // error: non-private method foo refers to private type T