Typed memory management via static capabilities

Abstract

Region-based memory management is an alternative to standard tracing garbage collection that makes operations such as memory deallocation explicit but verifiably safe. In this article, we present a new compiler intermediate language, called the Capability Language (CL), that supports region-based memory management and enjoys a provably safe type system. Unlike previous regionbased type systems, region lifetimes need not be lexically scoped, and yet the language may be checked for safety without complex analyses. Therefore, our type system may be deployed in settings such as extensible operating systems where both the performance and safety of untrusted code is important. The central novelty of the language is the use of static capabilities to specify the permissibility of various operations, such as memory access and deallocation. In order to ensure capabilities are relinquished properly, the type system tracks aliasing information using a form of bounded quantification. Moreover, unlike previous work on region-based type systems, the proof of soundness of our type system is relatively simple, employing only standard syntactic techniques. In order to show how our language may be used in practice, we show how to translate a variant of Tofte and Talpin's high-level type-and-effects system for region-based memory management into our language. When combined with known region inference algorithms, this translation provides a way to compile source-level languages to CL.

Experience with safe manual memory-management in cyclone

“…Our unique pointers are closely related to typing mechanisms suggested by other researchers, including linear types [30], ownership types [8], alias types [27], and capability types [31]. The critical idea with all of these proposals is to make it easy to track locally the state of an object by forbidding uncontrolled aliasing.…”

Fine-Grained Access Control with Object-Sensitive Roles

“…The computational effects we track are the privileged operations that a function may invoke, which determine the roles that are allowed to invoke the function. Roles are also similar to capabilities [29], which are a dual to effects. However, roles are disjunctive rather than conjunctive: it is sufficient for an execution to hold any of a function's roles, while capability systems require all capabilities to be held to ensure proper execution.…”

Dynamic rebinding for marshalling and update, via redex-time and destruct-time reduction

“…In Proteus, updates occur at the granularity of individual definitions (whether types, variables or functions) as in λ update (rather than modules as in λ mod update ). Replacement definitions may have different types in comparision with their originals, and a novel type system based on capabilities (Walker et al 2000) is used to ensure type safety. The fact that possible update points are made explicit in the program text is a key to balancing the flexibility and safety of the system.…”