OXIDE: THE ESSENCE OF RUST Aaron J. Weiss Northeastern University - - PowerPoint PPT Presentation

▶
oxide the essence of rust
SMART_READER_LITE
LIVE PREVIEW

OXIDE: THE ESSENCE OF RUST Aaron J. Weiss Northeastern University - - PowerPoint PPT Presentation

May 17, 2023 363 likes •1.27k views

OXIDE: THE ESSENCE OF RUST Aaron J. Weiss Northeastern University Rusts rich type system and ownership model guarantee memory-safety and thread-safety enabling you to eliminate many classes of bugs at compile-time. the

slide-1
SLIDE 1

OXIDE: THE ESSENCE OF RUST

Aaron J. Weiss Northeastern University

slide-2
SLIDE 2

“

Rust’s rich type system and

  • wnership model guarantee

memory-safety and thread-safety — enabling you to eliminate many classes of bugs at compile-time. – the official Rust website

slide-3
SLIDE 3

BORROW CHECKING

slide-4
SLIDE 4

WHAT IS A BORROW CHECKER?

struct State { ../ } fn main() { let mut state = State { ../ }; let init = read_state(&state); update_state(&mut state); let fin = read_state(&state); consume_state(state); /0 cannot use `state` anymore }

slide-5
SLIDE 5

WHAT IS A BORROW CHECKER?

struct State { ../ } fn main() { let mut state = State { ../ }; let init = read_state(&state); update_state(&mut state); let fin = read_state(&state); consume_state(state); /0 cannot use `state` anymore } &state

borrow

slide-6
SLIDE 6

WHAT IS A BORROW CHECKER?

struct State { ../ } fn main() { let mut state = State { ../ }; let init = read_state(&state); update_state(&mut state); let fin = read_state(&state); consume_state(state); /0 cannot use `state` anymore } &mut state

borrow mutable borrow

slide-7
SLIDE 7

WHAT IS A BORROW CHECKER?

struct State { ../ } fn main() { let mut state = State { ../ }; let init = read_state(&state); update_state(&mut state); let fin = read_state(&state); consume_state(state); /0 cannot use `state` anymore } state

move borrow mutable borrow

slide-8
SLIDE 8

WHAT IS A BORROW CHECKER?

fn update_state(state: &mut State) { if should_reset(state) { *state = State { ../ }; } else { (*state).count += 1 } }

slide-9
SLIDE 9

A BORROW CHECKER IS...

Ownership & Flexible Alias Protection

📗 ✒

⊕

🧿

slide-10
SLIDE 10

OXIDE IS OUR EFFORT TO FORMALIZE BORROW CHECKING

slide-11
SLIDE 11

OUR EXAMPLE PROGRAM IN OXIDE

struct State { ../ } fn main() { letprov<'a, 'b, 'c> { let state = State { ../ }; let init = read_state:;<'a>(&'a shrd state); update_state:;<'b>(&'b uniq state); let fin = read_state:;<'c>(&'c shrd state); consume_state(state); } }

slide-12
SLIDE 12

OUR EXAMPLE PROGRAM IN OXIDE

struct State { ../ } fn main() { letprov<'a, 'b, 'c> { let state = State { ../ }; let init = read_state:;<'a>(&'a shrd state); update_state:;<'b>(&'b uniq state); let fin = read_state:;<'c>(&'c shrd state); consume_state(state); } } shrd uniq shrd

slide-13
SLIDE 13

OUR EXAMPLE PROGRAM IN OXIDE

struct State { ../ } fn main() { letprov<'a, 'b, 'c> { let state = State { ../ }; let init = read_state:;<'a>(&'a shrd state); update_state:;<'b>(&'b uniq state); let fin = read_state:;<'c>(&'c shrd state); consume_state(state); } } letprov<'a, 'b, 'c> { } shrd uniq shrd

slide-14
SLIDE 14

OUR EXAMPLE PROGRAM IN OXIDE

struct State { ../ } fn main() { letprov<'a, 'b, 'c> { let state = State { ../ }; let init = read_state:;<'a>(&'a shrd state); update_state:;<'b>(&'b uniq state); let fin = read_state:;<'c>(&'c shrd state); consume_state(state); } } 'a 'b 'c letprov<'a, 'b, 'c> { } shrd uniq shrd

slide-15
SLIDE 15

OUR EXAMPLE PROGRAM IN OXIDE

struct State { ../ } fn main() { letprov<'a, 'b, 'c> { let state = State { ../ }; let init = read_state:;<'a>(&'a shrd state); update_state:;<'b>(&'b uniq state); let fin = read_state:;<'c>(&'c shrd state); consume_state(state); } } 'a 'b 'c 'a 'b 'c letprov<'a, 'b, 'c> { } shrd uniq shrd

slide-16
SLIDE 16

PROVENANCES AS A ‘POINTS-TO’ ANALYSIS

&'a shrd state &'b uniq state

A reference with type…

slide-17
SLIDE 17

PROVENANCES AS A ‘POINTS-TO’ ANALYSIS

&'a shrd state &'b uniq state

state

'a

points to A reference with type…

slide-18
SLIDE 18

PROVENANCES AS A ‘POINTS-TO’ ANALYSIS

&'a shrd state &'b uniq state

state

'a

points to

state

'b

points to A reference with type…

slide-19
SLIDE 19

PROVENANCES AS A ‘POINTS-TO’ ANALYSIS

&'a shrd state &'b uniq state

Γ ::= ∙ | Γ ♮ ℱ ℱ ::= ∙ | ℱ, | ℱ, x : T 'a |-? { p1 … pn }

state

'a

points to

state

'b

points to A reference with type…

slide-20
SLIDE 20

struct State { ../ } fn main() { letprov<'a, 'b, 'c> { let state = State { ../ }; let init = read_state :;<'a>(&'a shrd state); update_state :;<'b>(&'b uniq state); let fin = read_state :;<'c>(&'c shrd state); consume_state(state); } }

TYPECHECKING A MOVE EXPRESSION

slide-21
SLIDE 21

TYPECHECKING A MOVE EXPRESSION

consume_state(state);

slide-22
SLIDE 22

TYPECHECKING A MOVE EXPRESSION

consume_state(state);

state is not aliased Γ(state) = State Δ; Γ ⊢ : state State

slide-23
SLIDE 23

struct State { ../ } fn main() { letprov<'a, 'b, 'c> { let state = State { ../ }; let init = read_state :;<'a>(&'a shrd state); update_state :;<'b>(&'b uniq state); let fin = read_state :;<'c>(&'c shrd state); consume_state(state); } }

TYPECHECKING A BORROW EXPRESSION

slide-24
SLIDE 24

TYPECHECKING A BORROW EXPRESSION

update_state:;<'b>(&'b uniq state);

slide-25
SLIDE 25

TYPECHECKING A BORROW EXPRESSION

update_state:;<'b>(&'b uniq state);

state is not aliased Γ(state) = State Δ; Γ ⊢&'a uniq state : &'a uniq State

slide-26
SLIDE 26

TYPECHECKING A BORROW EXPRESSION

update_state:;<'b>(&'b uniq state);

state is not aliased Γ(state) = State Δ; Γ ⊢&'a uniq state : &'a uniq State state is not uniquely aliased Γ(state) = State Δ; Γ ⊢&'a shrd state : &'a shrd State

slide-27
SLIDE 27

OWNERSHIP SAFETY: “IS NOT ALIASED”

Δ; Γ ⊢ x ⇒ { … }

uniq

Δ; Γ ⊢ x ⇒ { … }

shrd
slide-28
SLIDE 28

OWNERSHIP SAFETY: “IS NOT ALIASED”

Δ; Γ ⊢ω π ⇒ { p1 … pn }

ω ::= uniq | shrd π ::= x | π . n | π . f

Δ; Γ ⊢ x ⇒ { … }

uniq

Δ; Γ ⊢ x ⇒ { … }

shrd
slide-29
SLIDE 29

OWNERSHIP SAFETY: “IS NOT ALIASED”

Δ; Γ ⊢ω π ⇒ { p1 … pn }

ω ::= uniq | shrd π ::= x | π . n | π . f

places

Δ; Γ ⊢ x ⇒ { … }

uniq

Δ; Γ ⊢ x ⇒ { … }

shrd
slide-30
SLIDE 30

OWNERSHIP SAFETY: “IS NOT ALIASED”

Δ; Γ ⊢ω π ⇒ { p1 … pn }

ω ::= uniq | shrd π ::= x | π . n | π . f

places place expressions

Δ; Γ ⊢ x ⇒ { … }

uniq

Δ; Γ ⊢ x ⇒ { … }

shrd
slide-31
SLIDE 31

THE STORY SO FAR

Γ(state) = State Δ; Γ ⊢ : state State Γ(state) = State Δ; Γ ⊢ &'a shrd state : &'a shrd State Γ(state) = State Δ; Γ ⊢&'a uniq state : &'a uniq State state is not aliased state is not aliased state is not uniquely aliased

slide-32
SLIDE 32

THE STORY SO FAR

Γ(state) = State Δ; Γ ⊢ : state State Γ(state) = State Δ; Γ ⊢ &'a shrd state : &'a shrd State Γ(state) = State Δ; Γ ⊢&'a uniq state : &'a uniq State state Δ; Γ ⊢uniq ⇒ { } state state Δ; Γ ⊢uniq ⇒ { } state state Δ; Γ ⊢shrd ⇒ { } state

slide-33
SLIDE 33

A BIT OF A SNAG

Γ(state) = State Δ; Γ ⊢ : state State state Δ; Γ ⊢uniq ⇒ { } state

Can we use state again?

slide-34
SLIDE 34

A BIT OF A SNAG

Γ(state) = State Δ; Γ ⊢ : state State state Δ; Γ ⊢uniq ⇒ { } state

Can we use state again?

slide-35
SLIDE 35

A CONVENTIONAL APPROACH... ?

⊢ Γ ↝ Γ1 ⊞ Γ2

Convention:

slide-36
SLIDE 36

A CONVENTIONAL APPROACH... ?

⊢ Γ ↝ Γ1 ⊞ Γ2

Convention: Rust:

struct Point(i32, i32) let pt = Point(5, 6); ../ add_one(pt.0); ../ add_one(pt.1);

slide-37
SLIDE 37

AN (UN)CONVENTIONAL APPROACH

Environment passing! Γ(state) = State state Δ; Γ ⊢uniq ⇒ { } state Δ; Γ ⊢ : state State

slide-38
SLIDE 38

AN (UN)CONVENTIONAL APPROACH

Environment passing! Γ(state) = State state Δ; Γ ⊢uniq ⇒ { } state Δ; Γ ⊢ : state State

slide-39
SLIDE 39

AN (UN)CONVENTIONAL APPROACH

Environment passing! Γ(state) = State state Δ; Γ ⊢uniq ⇒ { } state Δ; Γ ⊢ : state State ⇒ Γ[state |-? State ]

†

Δ; Γ ⊢ : state State

slide-40
SLIDE 40

EXAMPLE: PROJECTING OUT OF A TUPLE

slide-41
SLIDE 41

EXAMPLE: PROJECTING OUT OF A TUPLE

  • ; x : (i32, i32)
slide-42
SLIDE 42

EXAMPLE: PROJECTING OUT OF A TUPLE

  • ; x : (i32, i32)⊢
slide-43
SLIDE 43

EXAMPLE: PROJECTING OUT OF A TUPLE

  • ; x : (i32, i32)⊢ x.0 : i32
slide-44
SLIDE 44

EXAMPLE: PROJECTING OUT OF A TUPLE

  • ; x : (i32, i32)⊢ x.0 : i32 ⇒
slide-45
SLIDE 45

EXAMPLE: PROJECTING OUT OF A TUPLE

  • ; x : (i32, i32)⊢ x.0 : i32 ⇒ x : (i32, i32)

†

slide-46
SLIDE 46

Δ; Γ ⊢ &'a shrd state : &'a shrd State Δ; Γ ⊢ &'a uniq state : &'a uniq State

GOOD FOR PROVENANCE TRACKING, TOO!

Γ(state) = State Γ(state) = State state Δ; Γ ⊢ uniq ⇒ { } state state Δ; Γ ⊢ shrd ⇒ { } state

slide-47
SLIDE 47

Δ; Γ ⊢ &'a shrd state : &'a shrd State Δ; Γ ⊢ &'a uniq state : &'a uniq State

GOOD FOR PROVENANCE TRACKING, TOO!

Γ(state) = State Γ(state) = State state Δ; Γ ⊢ uniq ⇒ { } state Δ; Γ ⊢&'a uniq state : &'a uniq State ⇒ Γ['a |-? {state}] state Δ; Γ ⊢ shrd ⇒ { } state

slide-48
SLIDE 48

Δ; Γ ⊢ &'a shrd state : &'a shrd State Δ; Γ ⊢ &'a uniq state : &'a uniq State

GOOD FOR PROVENANCE TRACKING, TOO!

Γ(state) = State Γ(state) = State state Δ; Γ ⊢ uniq ⇒ { } state Δ; Γ ⊢&'a uniq state : &'a uniq State ⇒ Γ['a |-? {state}] Δ; Γ ⊢ &'a shrd state : &'a shrd State⇒ Γ['a |-? {state}] state Δ; Γ ⊢ shrd ⇒ { } state

slide-49
SLIDE 49

INTRODUCTIONS, IT’S A PLEASURE TO MEET YOU!

struct State { ../ } fn main() { letprov<'a, 'b, 'c> { let state = State { ../ }; let init = read_state :;<'a>(&'a shrd state); update_state :;<'b>(&'b uniq state); let fin = read_state :;<'c>(&'c shrd state); consume_state(state); } }

slide-50
SLIDE 50

INTRODUCTIONS, IT’S A PLEASURE TO MEET YOU!

letprov<'a, 'b, 'c> let state = State { ../ };

slide-51
SLIDE 51

INTRODUCTIONS, IT’S A PLEASURE TO MEET YOU!

letprov<'a, 'b, 'c> let state = State { ../ };

'a is not in Γ Δ; Γ ⊢letprov<'a> { e } : T ⇒ Γ′ Δ; Γ, e : T ⊢ 'a |-? {} ⇒ Γ′ , 'a |-? {…}

slide-52
SLIDE 52

INTRODUCTIONS, IT’S A PLEASURE TO MEET YOU!

letprov<'a, 'b, 'c> let state = State { ../ };

state is not in Γ Δ; Γ ⊢let state = State { ../ }; e : () Δ; Γ, e : T ⊢ state : State state : … Δ; Γ ⊢State { ../ } : State ⇒ Γ ⇒ Γ′ , ⇒ Γ′ 'a is not in Γ Δ; Γ ⊢letprov<'a> { e } : T ⇒ Γ′ Δ; Γ, e : T ⊢ 'a |-? {} ⇒ Γ′ , 'a |-? {…}

slide-53
SLIDE 53

SEQUENCING IS STRAIGHTFORWARD

Δ; Γ ⊢e1; e2 : T2 ⇒ Γ2 Δ; Γ ⊢e1 : T1 ⇒ Γ1 Δ; Γ1 ⊢e2 : T2 ⇒ Γ2 Flow environments forward!

slide-54
SLIDE 54

'a is not in Γ Δ; Γ ⊢letprov<'a> { e } : T ⇒ Γ′ Δ; Γ, e : T ⊢ 'a |-? {} ⇒ Γ′ , 'a |-? {…} state is not in Γ Δ; Γ ⊢let state = State { ../ }; e : () Δ; Γ, e : T ⊢ state : State state : … Δ; Γ ⊢State { ../ } : State ⇒ Γ ⇒ Γ′ , ⇒ Γ′

SEQUENCING IS STRAIGHTFORWARD

Δ; Γ ⊢e1; e2 : T2 ⇒ Γ2 Δ; Γ ⊢e1 : T1 ⇒ Γ1 Δ; Γ1 ⊢e2 : T2 ⇒ Γ2 Flow environments forward!

slide-55
SLIDE 55

'a is not in Γ Δ; Γ ⊢letprov<'a> { e } : T ⇒ Γ′ Δ; Γ, e : T ⊢ 'a |-? {} ⇒ Γ′ , 'a |-? {…} state is not in Γ Δ; Γ ⊢let state = State { ../ }; e : () Δ; Γ, e : T ⊢ state : State state : … Δ; Γ ⊢State { ../ } : State ⇒ Γ ⇒ Γ′ , ⇒ Γ′

SEQUENCING IS STRAIGHTFORWARD

Δ; Γ ⊢e1; e2 : T2 ⇒ Γ2 Δ; Γ ⊢e1 : T1 ⇒ Γ1 Δ; Γ1 ⊢e2 : T2 ⇒ Γ2 Flow environments forward! Environment ordering matters!

slide-56
SLIDE 56

BRANCHES CAUSE INFORMATION LOSS

Δ; Γ ⊢if e1 { e2 } else { e3 } : T ⇒ Γ2 ⋓ Γ3 Δ; Γ ⊢ e1 : Bool⇒ Γ1 Δ; Γ1 ⊢e2 : T ⇒ Γ2 Δ; Γ1 ⊢e3 : T ⇒ Γ3

slide-57
SLIDE 57

BRANCHES CAUSE INFORMATION LOSS

Δ; Γ ⊢if e1 { e2 } else { e3 } : T ⇒ Γ2 ⋓ Γ3 Δ; Γ ⊢ e1 : Bool⇒ Γ1 Δ; Γ1 ⊢e2 : T ⇒ Γ2 Δ; Γ1 ⊢e3 : T ⇒ Γ3

slide-58
SLIDE 58

BRANCHES CAUSE INFORMATION LOSS

Δ; Γ ⊢if e1 { e2 } else { e3 } : T ⇒ Γ2 ⋓ Γ3 Δ; Γ ⊢ e1 : Bool⇒ Γ1 Δ; Γ1 ⊢e2 : T ⇒ Γ2 Δ; Γ1 ⊢e3 : T ⇒ Γ3

if cond { &'a uniq x } else { &'a uniq y } /0 'a |-? {x, y}

slide-59
SLIDE 59

BRANCHES CAUSE INFORMATION LOSS

Δ; Γ ⊢if e1 { e2 } else { e3 } : T ⇒ Γ2 ⋓ Γ3 Δ; Γ ⊢ e1 : Bool⇒ Γ1 Δ; Γ1 ⊢e2 : T ⇒ Γ2 Δ; Γ1 ⊢e3 : T ⇒ Γ3

if cond { &'a uniq x } else { &'a uniq y } /0 'a |-? {x, y}

x

'a

y

slide-60
SLIDE 60

SOME SIMPLE SUBTYPING

Types can differ in their provenances!

Δ; Γ ⊢T1 <; T2

slide-61
SLIDE 61

SOME SIMPLE SUBTYPING

Types can differ in their provenances! Combine provenances when they do!

Δ; Γ ⊢T1 <; T2 ⇒ Γ′

slide-62
SLIDE 62

SOME SIMPLE SUBTYPING

Types can differ in their provenances! Combine provenances when they do!

Δ; Γ ⊢T1 <; T2 ⇒ Γ′ Δ; Γ ⊢&'a shrd State <; &'b shrd State ⇒ Γ′ Δ; Γ ⊢'a :? 'b ⇒ Γ′ Δ; Γ ⊢State <; State ⇒ Γ′

slide-63
SLIDE 63

SUBTYPING BY EXAMPLE

if cond { &'a uniq x /0 'a |-? {x}, 'b |-? {} } else { &'b uniq y /0 'a |-? {}, 'b |-? {y} } /0 'a |-? {x, y}, 'b |-? {x, y}

slide-64
SLIDE 64

ASSIGNMENT “REGAINS” INFORMATION

slide-65
SLIDE 65

ASSIGNMENT “REGAINS” INFORMATION

  • ; x : i32, y : i32, 'a |-? { x, y }, z : &'a uniq i32 ⊢
slide-66
SLIDE 66

ASSIGNMENT “REGAINS” INFORMATION

  • ; x : i32, y : i32, 'a |-? { x, y }, z : &'a uniq i32 ⊢

*z :> x : ()

slide-67
SLIDE 67

ASSIGNMENT “REGAINS” INFORMATION

  • ; x : i32, y : i32, 'a |-? { x, y }, z : &'a uniq i32 ⊢

*z :> x : ()

⇒

slide-68
SLIDE 68

ASSIGNMENT “REGAINS” INFORMATION

  • ; x : i32, y : i32, 'a |-? { x, y }, z : &'a uniq i32 ⊢

*z :> x : ()

⇒ x : i32, y : i32, 'a |-? { x }, z : &'a uniq i32

slide-69
SLIDE 69

FUNCTIONS AND APPLICATION

struct State { ../ } fn main() { letprov<'a, 'b, 'c> { let state = State { ../ }; let init = read_state :;<‘a>(&'a shrd state); update_state :;<'b>(&'b uniq state); let fin = read_state :;<'c>(&'c state); consume_state(state); } }

slide-70
SLIDE 70

FUNCTIONS AND APPLICATION

read_state:;<‘a>(&'a shrd state)

slide-71
SLIDE 71

FUNCTIONS AND APPLICATION

read_state:;<‘a>(&'a shrd state)

Δ; Γ ⊢read_state:;<'a>(&'a shrd state) : T ⇒ Γ′ read_state : ∀<'p>(&'p shrd State) -? T Δ; Γ ⊢ ⇒ Γf &'a shrd state :&'a shrd State Δ; Γf ⊢ ⇒ Γ′

slide-72
SLIDE 72

FUNCTIONS AND APPLICATION

read_state:;<‘a>(&'a shrd state)

Δ; Γ ⊢read_state:;<'a>(&'a shrd state) : T ⇒ Γ′ read_state : ∀<'p>(&'p shrd State) -? T Δ; Γ ⊢ ⇒ Γf &'a shrd state :&'a shrd State Δ; Γf ⊢ ⇒ Γ′ read_state : ∀<'p>(&'p shrd State) -? T Δ; Γ ⊢ ⇒ Γf

slide-73
SLIDE 73

FUNCTIONS AND APPLICATION

read_state:;<‘a>(&'a shrd state)

Δ; Γ ⊢read_state:;<'a>(&'a shrd state) : T ⇒ Γ′ read_state : ∀<'p>(&'p shrd State) -? T Δ; Γ ⊢ ⇒ Γf &'a shrd state :&'a shrd State Δ; Γf ⊢ ⇒ Γ′ read_state : ∀<'p>(&'p shrd State) -? T Δ; Γ ⊢ ⇒ Γf Σ; Σ(read_state) = fn update_state<'p>(state: &'p shrd State) -? T { e }

slide-74
SLIDE 74

FUNCTIONS AND APPLICATION

read_state:;<‘a>(&'a shrd state)

Δ; Γ ⊢read_state:;<'a>(&'a shrd state) : T ⇒ Γ′ read_state : ∀<'p>(&'p shrd State) -? T Δ; Γ ⊢ ⇒ Γf &'a shrd state :&'a shrd State Δ; Γf ⊢ ⇒ Γ′ Σ; Σ; Σ; read_state : ∀<'p>(&'p shrd State) -? T Δ; Γ ⊢ ⇒ Γf Σ; Σ(read_state) = fn update_state<'p>(state: &'p shrd State) -? T { e }

slide-75
SLIDE 75

CLOSURES MOVE THEIR FREE VARIABLES

free-vars(|y: i32| -? i32 { x + y }) = x ℱ

c = x : i32

Σ; Δ; Γ ♮ ℱ

c , y : i32 ⊢ x + y : i32 ⇒ Γ′ ♮ ℱ

Σ; Δ; Γ ⊢|y: i32| -? i32 { x + y } : (i32) -? i32 ⇒ Γ′ ℱ

c
slide-76
SLIDE 76

CLOSURES MOVE THEIR FREE VARIABLES

free-vars(|y: i32| -? i32 { x + y }) = x ℱ

c = x : i32

Σ; Δ; Γ ♮ ℱ

c , y : i32 ⊢ x + y : i32 ⇒ Γ′ ♮ ℱ

Σ; Δ; Γ ⊢|y: i32| -? i32 { x + y } : (i32) -? i32 ⇒ Γ′ ℱ

c

Σ; Δ; Γ ⊢add_x(5) : i32 ⇒ Γf add_x : (i32) -? i32 Σ; Δ; Γ ⊢ ⇒ Γf 5 : i32 Σ; Δ; Γf ⊢ ⇒ Γf ℱ

c
slide-77
SLIDE 77

LET’S STEP BACK A BIT

slide-78
SLIDE 78

REBORROWING

struct Point(i32, i32) letprov<'r, 'x, 'y> { let pt = Point(5, 6); let r = &'r uniq pt; /0 'r |-? { pt } let x = &'x uniq (*r).0; /0 'x |-? { pt, (*r).0 } let y = &'y uniq (*r).1; /0 'y |-? { pt, (*r).1 } r }

slide-79
SLIDE 79

REBORROWING

struct Point(i32, i32) letprov<'r, 'x, 'y> { let pt = Point(5, 6); let r = &'r uniq pt; /0 'r |-? { pt } let x = &'x uniq (*r).0; /0 'x |-? { pt, (*r).0 } let y = &'y uniq (*r).1; /0 'y |-? { pt, (*r).1 } r }

Γ ⊢ &'a uniq state : &’a uniq State Γ(pt.0) = i32 (*r).0 Δ; Γ ⊢uniq ⇒ { } pt, (*r).0 Δ; Γ ⊢&'x uniq (*r).0 : &'x uniq Point ⇒ Γ['x |-? { pt, (*r).0 }]

slide-80
SLIDE 80

NON-LEXICAL LIFETIMES IN OXIDE

struct Point(i32, i32) fn main() { letprov<'x, 'y> { let pt = Point(6, 9); let x = &'x uniq pt; drop:;<&'x uniq Point>(x); let y = &'y uniq pt; } } drop:;<&'x uniq Point>(x);

slide-81
SLIDE 81

NON-LEXICAL LIFETIMES IN OXIDE

struct Point(i32, i32) fn main() { letprov<'x, 'y> { let pt = Point(6, 9); let x = &'x uniq pt; drop:;<&'x uniq Point>(x); let y = &'y uniq pt; } } drop:;<&'x uniq Point>(x); /0 drop:;<&'x uniq Point>(x);

slide-82
SLIDE 82

PROVING TYPE SAFETY FOR OXIDE

Progress Preservation

slide-83
SLIDE 83

PROVING TYPE SAFETY FOR OXIDE

Σ; ∙ ; Γ ⊢ e : T ⇒ Γ′ Σ ⊢ σ : Γ ∃σ′ , ′ . Σ ⊢ (σ; ) → (σ′ ; ′ ) e e e e is a value, e is an error term, or If and , then Progress Preservation

slide-84
SLIDE 84

PROVING TYPE SAFETY FOR OXIDE

Σ; ∙ ; Γ ⊢ e : T ⇒ Γ′ Σ ⊢ σ : Γ ∃σ′ , ′ . Σ ⊢ (σ; ) → (σ′ ; ′ ) e e e e is a value, e is an error term, or If and , then Progress Preservation Σ; ∙ ; Γ ⊢ e : T ⇒ Γ′ Σ ⊢ σ : Γ If , and , then Σ; Γ ⊨ σ Σ ⊢ (σ; ) → (σ′ ; ′ ) e e , , ∃Γi . Σ; ∙ ; Γi ⊢e’ : T ⇒ Γ′ Σ ⊢ σ′ : Γi , , and Σ; Γi ⊨ σ′

slide-85
SLIDE 85

ONCE MORE, WITH FEELING

free-vars(|y: i32| -? i32 { x + y }) = x ℱ

c = x : i32

Σ; Δ; Γ ♮ ℱ

c , y : i32 ⊢ x + y : i32 ⇒ Γ′ ♮ ℱ

Σ; Δ; Γ ⊢|y: i32| -? i32 { x + y } : (i32) -? i32 ⇒ Γ′ ℱ

c

read_state : ∀<'p>(&'p shrd State) -? T Σ; Δ; Γ ⊢ ⇒ Γf Σ(read_state) = fn update_state<'p>(state: &'p shrd State) -? T { e } 'a is not in Γ Σ; Δ; Γ ⊢letprov<'a> { e } : T ⇒ Γ′ Σ; Δ; Γ, e : T ⊢ 'a |-? {} ⇒ Γ′ , 'a |-? {…} state is not in Γ Σ; Δ; Γ ⊢let state = State { ../ }; e : () Σ; Δ; Γ, e : T ⊢ state : State state : … Σ; Δ; Γ ⊢State { ../ } : State ⇒ Γ ⇒ Γ′ , ⇒ Γ′ Σ; Δ; Γ ⊢ e1; e2 : T2 ⇒ Γ2 Σ; Δ; Γ ⊢e1 : T1 ⇒ Γ1 Σ; Δ; Γ1 ⊢e2 : T2 ⇒ Γ2 Γ(state) = State state Δ; Γ ⊢ ω ⇒ { } state Σ; Δ; Γ ⊢&'a ω state : &'a ω State ⇒ Γ['a |-? {state}]

slide-86
SLIDE 86

TAKEAWAYS

slide-87
SLIDE 87

TAKEAWAYS

OXIDE IS A FORMALIZATION OF BORROW CHECKING

slide-88
SLIDE 88

TAKEAWAYS

OXIDE IS A FORMALIZATION OF BORROW CHECKING

BORROW CHECKING COMBINES OWNERSHIP & ALIAS PROTECTION 📗 ✒

⊕

🧿

slide-89
SLIDE 89

TAKEAWAYS

OXIDE IS A FORMALIZATION OF BORROW CHECKING

BORROW CHECKING COMBINES OWNERSHIP & ALIAS PROTECTION 📗 ✒

⊕

🧿 👸 BORROW CHECKING IS SAFE