Oxide: The Essence of Rust

Abstract

Rust is a major advancement in industrial programming languages due in large part to its success in bridging the gap between low-level systems programming and high-level application programming. This success has ultimately empowered programmers to more easily build reliable and efficient software, and at its heart lies a novel approach to ownership that balances type system expressivity with usability.In this work, we set out to capture the essence of this model of ownership by developing a type systems account of Rust's borrow checker. To that end, we present Oxide, a formalized programming language close to source-level Rust (but with fully-annotated types). This presentation takes a new view of lifetimes as approximate provenances of references, and our type system is able to automatically compute this information through a flow-sensitive substructural typing judgment for which we prove syntactic type safety using progress and preservation. The result is a simpler formulation of borrow checking -including recent features such as non-lexical lifetimes -that we hope researchers will be able to use as the basis for work on Rust.CCS Concepts: • Theory of computation → Semantics and reasoning; • Software and its engineering → Formal language definitions.

Modular Information Flow through Ownership

“…While the algorithm is implemented itself as a Rust program, our goal here is to provide a description of it that is both concise (for clarity of communication) and precise (for amenability to proof). We therefore base our description on Oxide [35], a formal model of Rust. At a high-level, Oxide provides three ingredients: 1.…”

“…Θ 2 Again, this rule (and many others) contain aspects of Oxide that are not essential for understanding information flow such as the subtyping judgment 𝜏 1 ≲ 𝜏 2 or the metafunction gc-loans. For brevity we will not cover these aspects here, and instead refer the interested reader to Weiss et al [35]. We have deemphasized (in grey) the judgments which are not important to understanding our information flow additions.…”

“…1. We provide a precise description of how Flowistry computes information flow by embedding its definition within Oxide [35], a formal model of Rust (Section 2). 2.…”

Executable formal semantics for the POSIX shell

“…Whole-language semantics. There have been a variety of efforts at building language semantics for whole, real languages: for JavaScript [Guha et al 2010;Maffeis et al 2008], for C [Blazy and Leroy 2009;Ellison and Rosu 2012;Kang et al 2015;Krebbers et al 2014;Memarian et al 2016], and for Rust [Jung et al 2017;Weiss et al 2018Weiss et al , 2019, to name a few. Approaches to such whole-language semantics fall broadly into two styles of modeling: large semantics that cover a broad range of language constructs, using light syntactic sugar; and small semantics that cover a narrow range of language constructs, using heavy syntactic sugar/elaboration.…”

Kindly Bent to Free Us

“…Rust's lifetime system is more explicit and more expressive than Affe, however Rust does not provide type inference and only provides partial lifetime inference. Recently, Weiss et al (2019) formalized Rust's ownership discipline, including non-lexical lifetimes. We believe this work could help us improve our handling of regions and of successive exclusive borrows.…”