But before I delve into my latest proposal, I want to briefly discuss a key difference between my previous model and this one:
"Types as Contracts" was a fully "validity"-based model, while "Stacked Borrows" is (to some extent) "access"-based.
+**Update:**
+Since publishing this post, I have written [another]({% post_url 2018-11-16-stacked-borrows-implementation %}) blog post about a slightly adjusted version of Stacked Borrows (the first version that actually got implemented).
+That other post is self-contained, so if you are just interested in the current state of Stacked Borrows, I suggest you go there.
+Only go on reading here if you want some additional historic context.
+**/Update**
+
## 1 Validity-based vs. Access-based
An "access"-based model is one where certain properties -- in this case, mutable references being unique and shared references pointing to read-only memory -- are only enforced when the reference is actually used to *access* memory.
let y = unsafe { & *raw }; // Now memory gets frozen (recording the timestamp)
let _val = *y; // Okay because memory was frozen since `y` was created
*x = 3; // This "reactivates" `x` by unfreezing and popping the stack.
- let z = unsafe { & *raw }; // Now memory gets frozen *again*
+ let z = &*x; // Now memory gets frozen *again*
*y // This is UB! Memory has been frozen strictly after `y` got created.
}
{% endhighlight %}
I hope you now have a clear idea of the basic structure of the model I am proposing: The stack of borrows, the freeze flag, and references tagged with the time at which they got created.
The full model is not quite as simple, but it is not much more complicated either.
-We need two add just two more concepts: Retagging and barriers.
+We need to add just two more concepts: Retagging and barriers.
### 4.1 Retagging
- Compute `new_bor` from `new_tag` and the type of the reference being created.
- `reactivate(bor)`.
- If this is a function argument coming in: `loc.borrows.push(FnBarrier(stack_height))`.
- - `initiate(new_bor)`. Note that this is a NOP if `new_bor` is already active -- in particular, if the location is frozen and this is a shared reference with interior mutability, we do *not* push anything on top of the barrier. This is important, because we do not want to push that might unfreeze the location when being reactivated.
+ - `initiate(new_bor)`. Note that this is a NOP if `new_bor` is already active -- in particular, if the location is frozen and this is a shared reference with interior mutability, we do *not* push anything on top of the barrier. This is important, because any reactivation that unfreezes this location must lead to UB while the barrier is still present.
- Change reference tag to `new_tag`.
* Any time a raw pointer is created from a reference, we might have to do a raw reborrow.
- `reactivate(bor)`.
* Any time a function returns, we have to clean up the barriers.
- Iterate over all of memory and remove the matching `FnBarrier`. This is where the "stack" becomes a bit of a lie, because we also remove barriers from the middle of a stack.<br>
This could be optimized by adding an indirection, so we just have to record somewhere that this function call has ended.
+* Any time memory is deallocated, this counts as mutation, so the usual rules for that apply. After that, the stacks of the deallocated bytes must not contain any barriers.
If you want to test your own understanding of "Stacked Borrows", I invite you to go back to [Section 2.2 of "Types as Contracts"]({% post_url 2017-07-17-types-as-contracts %}#22-examples) and look at the three examples here.
projects / web.git / blobdiff