You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: wip/tree-borrows.md
+11-9Lines changed: 11 additions & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,13 +7,13 @@ This is not a guide! See the [Tree Borrows paper](https://plf.inf.ethz.ch/resear
7
7
Changes since publication of the paper:
8
8
9
9
* Interior-Mutable shared references are no longer treated like raw pointers, instead they use the new `Cell` permission. This permission allows all foreign and local accesses.
10
-
* Mirroring Stacked Borrows, structs which contain an UnsafeCell now have that UnsafeCell's position tracked more finely-grained. It is no longer sufficient to just have an UnsafeCell somewhere in a struct to mark this as being interior-mutable everyhwere.
10
+
* Mirroring Stacked Borrows, structs which contain an UnsafeCell now have that UnsafeCell's position tracked more finely-grained. It is no longer sufficient to just have an UnsafeCell somewhere in a struct to mark this as being interior-mutable everywhere.
11
11
12
12
## MiniRust
13
13
14
-
Tree Borrows is documented in [MiniRust](https://github.com/minirust/minirust/tree/master/spec/mem/tree_borrows). MiniRust is written as literate code and should be readable without further explanation.
14
+
Tree Borrows is fully documented in [MiniRust](https://github.com/minirust/minirust/tree/master/spec/mem/tree_borrows). MiniRust is written as literate code and should be readable without further explanation. The MiniRust version of Tree Borrows is the authoritative version, and it will be updated to reflect future changes. MiniRust defines all of Tree Borrows, including the more obscure features.
15
15
16
-
Instead of yet again defining Tree Borrows in prose here, we refer to this.
16
+
Instead of yet again defining Tree Borrows in prose here, we refer to MiniRust. The information below is not normative and only a summary of what is already explained in MiniRust.
17
17
18
18
19
19
### High-level summary
@@ -26,27 +26,29 @@ These differences are not reflected in the state machines in the paper, we refer
26
26
27
27
28
28
### Differences between MiniRust and Miri
29
-
MiniRust includes an idealized implementation of Tree Borrows. In particular, it models provenance/tags as tree addresses, which uniquely identify a node in the borrow tree. Miri however uses unique IDs, with the Tree being tracked more implicitly has relations between these IDs. This is an implementation detail and not relevant for understanding the semantics.
29
+
MiniRust includes an idealized implementation of Tree Borrows, intended for easy readability.
30
+
In particular, it models provenance/tags as tree addresses, which uniquely identify a node in the borrow tree. Miri however uses unique integer IDs, with the Tree being tracked more implicitly as maps/relations between these nodes. The precise implementation of the tree is an implementation detail and not relevant for the semantics.
31
+
30
32
Besides this representation difference, Miri also includes a number of optimizations that make Tree Borrows have acceptable performance. These include
31
33
* skipping nodes based on past foreign accesses, exploiting idempotence properties in the state machine
32
34
* garbage collection of unused references, which allows shrinking trees
33
-
* skipping nodes based on the permissions found there
35
+
* skipping nodes based on the permissions found therein
34
36
35
37
## Concepts Inherited From Stacked Borrows
36
38
37
39
### Retags
38
40
Tree Borrows has retags happen in the same place as Stacked Borrows. But note that Tree Borrows treats raw pointer retags as NOPs, i.e. it does not attempt to track these.
39
41
40
42
### Protectors
41
-
Like Stacked Borrows, Tree Borrows has protectors. These serve to ensure that references remain live throughout a function. Like Stacked Borrows, Tree Borrows has strong and weak protectors, and it protects the same values the same way.
43
+
Like Stacked Borrows, Tree Borrows has protectors. These serve to ensure that references remain live throughout a function. Protectors are strong and weak, as in SB, and they protect the same places in the same way.
42
44
43
45
### Implicit Reads and Writes
44
46
Like Stacked Borrows, Tree Borrows performs implicit accesses as part of retags. Unlike Stacked Borrows, these are always reads, even for `&mut` references.
45
47
46
-
Also unlike Stacked Borrows, Tree Borrows has implicit accesses happen on protector end. These can be writes. See the section on "protector end semantics" in the paper for more info.
48
+
A new concept in TB are protector end accesses. These can be writes. See the section on "protector end semantics" in the paper for more info.
47
49
48
50
### UnsafeCell tracking
49
-
Like Stacked Borrows, Tree Borrows tracks where there are UnsafeCells, and treats these offsets differently from other offsets. UnsafeCells are tracked in structs and tuple fields, but enums are not inspected further.
51
+
Like Stacked Borrows, Tree Borrows tracks where there are UnsafeCells, and treats these bytes differently from other bytes. UnsafeCells are tracked in structs and tuple fields, but enums are not inspected further.
50
52
51
53
### Accesses
52
54
Besides for the aforementioned differences in the handling of retags, what counted as a read or write in Stacked Borrows also counts as a read or write in Tree Borrows. These places are not surprising.
@@ -60,4 +62,4 @@ The following is a list of things that are _not_ UB in Tree Borrows. Some people
60
62
61
63
## Other problems
62
64
* The interaction of protector end writes with the data race model is not fully thought out.
63
-
* Finding a good model of exposed provenance in Tree Borrows (that does not use angelic nondeterminism) is an open research question. Until then, Tree Borrows does not support `-Zmiri-permissive-provenance`
65
+
* Finding a good model of exposed provenance in Tree Borrows (that does not use angelic nondeterminism) is an open research question. Until then, Tree Borrows does not support `-Zmiri-permissive-provenance`.
0 commit comments