Rely-guarantee references for refinement types over aliased mutable data

Abstract

Reasoning about side effects and aliasing is the heart of verifying imperative programs. Unrestricted side effects through one reference can invalidate assumptions about an alias. We present a new type system approach to reasoning about safe assumptions in the presence of aliasing and side effects, unifying ideas from reference immutability type systems and rely-guarantee program logics. Our approach, rely-guarantee references, treats multiple references to shared objects similarly to multiple threads in rely-guarantee program logics. We propose statically associating rely and guarantee conditions with individual references to shared objects. Multiple aliases to a given object may coexist only if the guarantee condition of each alias implies the rely condition for all other aliases. We demonstrate that existing reference immutability type systems are special cases of rely-guarantee references.In addition to allowing precise control over state modification, rely-guarantee references allow types to depend on mutable data while still permitting flexible aliasing. Dependent types whose denotation is stable over the actions of the rely and guarantee conditions for a reference and its data will not be invalidated by any action through any alias. We demonstrate this with refinement (subset) types that may depend on mutable data. As a special case, we derive the first reference immutability type system with dependent types over immutable data.We show soundness for our approach and describe experience using rely-guarantee references in a dependently-typed monadic DSL in COQ.

Specification and verification of a transient stack

“…This is a common pattern. Monotonic state has been studied in several contexts, beginning with ghost monotonic references [Pilkiewicz and Pottier 2011] or simple type systems equipped with monotonic references [Gordon et al 2013], and continuing with more powerful dependent type systems and program logics, such as 𝐹 ★ 𝐹 ★ 𝐹 ★ [Ahman et al. 2018] and Iris [Timany and Birkedal 2021].…”

A type system for extracting functional specifications from memory-safe imperative programs

“…There have been a number of concurrent separation logics that incorporate rely-guarantee reasoning [Dodds et al 2009;Feng 2009;Vafeiadis and Parkinson 2007]. There are even type systems that incorporate rely-guarantee [Gordon et al 2013]. There are also a number of metatheoretic frameworks for defining the semantics of separation logics that can support rely-guarantee reasoning [Bizjak and Birkedal 2017;Calcagno et al 2007;Dinsdale-Young et al 2013].…”

SteelCore: an extensible concurrent separation logic for effectful dependently typed programs

“…Since FCSL's model is predicative, it does not provide a way to dynamically allocate an invariant, making it impossible to model certain kinds of synchronization primitives, e.g., our generic interface for locks does not seem to be expressible in FCSL. On the other hand, FCSL provides several constructs for reasoning about concurrent programs mixing styles of reasoning from CSL with rely-guarantee reasoning, something which we haven't explored much: our use of monotonic references may play a role in this direction, particularly in connection with other related work on rely-guarantee references (Gordon et al 2013).…”