Fix box adaptation

Author: Linyxus

compiler/src/dotty/tools/dotc/cc/CheckCaptures.scala

@@ -991,13 +991,23 @@ class CheckCaptures extends Recheck, SymTransformer:
           }
 
           // Capture set of the term after adaptation
-          val cs1 = cs ++ leaked
+          val cs1 = if covariant then cs ++ leaked else cs
+
+          def checkLeaked: Boolean =
+            covariant || leaked.subCaptures(cs1, frozen = false).isOK || {
+              report.error(
+                em"""$expected cannot be box-converted to $actual
+                    |since the additional capture set $leaked resulted from box conversion is not allowed in $actual""", pos)
+              false
+            }
 
           // Compute the adapted type
           def adaptedType(resultBoxed: Boolean) =
             if (styp1 eq styp) && leaked.isAlwaysEmpty && boxed == resultBoxed then actual
             else styp1.capturing(if alwaysConst then CaptureSet(cs1.elems) else cs1).forceBoxStatus(resultBoxed)
 
+          checkLeaked
+
           if needsAdaptation then
             val criticalSet =          // the set which is not allowed to have `cap`
               if covariant then cs1    // can't box with `cap`

tests/neg-custom-args/captures/box-adapt-contra.scala

@@ -0,0 +1,18 @@
+import language.experimental.captureChecking
+
+trait Cap
+
+def useCap[X](x: X): (X -> Unit) -> Unit = ???
+
+def test1(c: Cap^): Unit =
+  val f: (Cap^{c} -> Unit) -> Unit = useCap[Cap^{c}](c)  // error
+
+def test2(c: Cap^, d: Cap^): Unit =
+  def useCap1[X](x: X): (X => Unit) -> Unit = ???
+  val f1: (Cap^{c} => Unit) ->{c} Unit = useCap1[Cap^{c}](c)  // ok
+
+  def useCap2[X](x: X): (X ->{c} Unit) -> Unit = ???
+  val f2: (Cap^{c} -> Unit) ->{c} Unit = useCap2[Cap^{c}](c)  // ok
+
+  def useCap3[X](x: X): (X ->{d} Unit) -> Unit = ???
+  val f3: (Cap^{c} -> Unit) ->{cap} Unit = useCap3[Cap^{c}](c)  // error

tests/neg-custom-args/captures/box-unsoundness.scala

@@ -2,12 +2,12 @@
 class CanIO { def use(): Unit = () }
 def use[X](x: X): (op: X -> Unit) -> Unit = op => op(x)
 def test(io: CanIO^): Unit =
-  val f: (CanIO^ => Unit) -> Unit = use[CanIO^](io)  //
-  val _: (CanIO^ => Unit) -> Unit = f  // error
+  val f: (CanIO^ => Unit) -> Unit = use[CanIO^](io)  // error
+  val _: (CanIO^ => Unit) -> Unit = f
 
-  val g1 = () => f(x => x.use())  // error
+  val g1 = () => f(x => x.use())
 
   val a1 = f(x => x.use())
   val a2 = () => f(x => x.use())
-  val g2: () -> Unit = a2        // error
-  // was UNSOUND: g uses the capability io but has an empty capture set
+  val g2: () -> Unit = a2
+  // was UNSOUND: g uses the capability io but has an empty capture set