Group Borrowing: Zero-Cost Memory Safety with Fewer Restrictions
18 points by Verdagon
18 points by Verdagon
Hey all, it’s been a while =) I saw this proposal from Nick and thought it was so interesting that I should revive my languishing language blog to talk about it. Hope y’all enjoy, and happy to answer any questions about his memory safety model!
Is this the same as https://antelang.org/blog/stable_mutable_refs/?
Nope! Ante’s approach is also pretty cool, but it’s taking a fundamentally different path.
I like how Jon Goodwin categorized it (from https://pling.jondgoodwin.com/post/interior-references-and-shared-mutable/):
… the safety issue with resizable/single-owner and sum types only arises when we change an object’s shape in between obtaining an interior reference and dereferencing that interior reference. There are several approaches we might take to prevent this sequence of events.
- Invalidate borrowed interior references whenever we detect a shape change. When this logic entirely happens within a single function, we could enforce this. Logic spread out across function boundaries makes it significantly more difficult to detect and restrict this pattern.
- Invalidate shape changes whenever we know a borrowed interior references exist. This bears the same difficulty as above.
- Do not allow shape changes to objects referred to by shared, mutable references.1 Thus, arrays would not be resizable and sum-typed values could not be altered to hold a value of a different type. These restrictions are achievable, but significantly reduce their capability.
- Do not allow the creation of interior references to array/sum values pointed to by shared, mutable references. This is easily accomplished. Although this imposes some restrictions, these restrictions have workarounds: indexing can be used to retrieve values from arrays and the value enclosed by a sum type can be copied in or out.
In Jon’s words, Nick is making #1 and #2 work. Ante and Cone are doing a form of #3 and/or #4.
Glad to see more folks tackling this problem, since the Rust design tradeoffs never sat right with me.
The Scala folks are making some good progress on this as well right now: