add MoSeL paper

[web.git] / ralf / _posts / 2018-01-31-sharing-for-a-lifetime.md

diff --git a/ralf/_posts/2018-01-31-sharing-for-a-lifetime.md b/ralf/_posts/2018-01-31-sharing-for-a-lifetime.md
index 8dd10daab96c7b8969e30050bf7bdf54a99c6742..0b7a4549a886f778204471fb34435b6f31e51362 100644 (file)
--- a/ralf/_posts/2018-01-31-sharing-for-a-lifetime.md
+++ b/ralf/_posts/2018-01-31-sharing-for-a-lifetime.md
@@ -135,7 +135,7 @@ This is not so say that the last word on interior mutability has been spoken; th
 
 Either way, this model has certainly helped me not only in the formal work on RustBelt, but also in thinking about the Rust type system itself.
 For example, I briefly wondered why `Cell` is not covariant.
-Indeed, if `U <: T`, then it is perfectly safe to turn a `Cell<T>` into a `Cell<U>` -- that is to say, whenever some sequence of bytes is valid at `Cell<T>`, it is also valid at `Cell<U>`.
+Indeed, if `T <: U`, then it is perfectly safe to turn a `Cell<T>` into a `Cell<U>` -- that is to say, whenever some sequence of bytes is valid at `Cell<T>`, it is also valid at `Cell<U>`.
 (In fact, the owned invariant for `Cell<T>` is *exactly the same* as the one for `T`!)
 That's precisely what we need for covariance, right?
 Well, not exactly -- because our types have two invariants, we also have to require that whenever a pointer is a shared `Cell<T>`, it is a shared `Cell<U>`, and that is decisively *not* true!