Rely-Guarantee Protocols

Abstract

Abstract. The use of shared mutable state, commonly seen in object-oriented systems, is often problematic due to the potential conflicting interactions between aliases to the same state. We present a substructural type system outfitted with a novel lightweight interference control mechanism, rely-guarantee protocols, that enables controlled aliasing of shared resources. By assigning each alias separate roles, encoded in a novel protocol abstraction in the spirit of rely-guarantee reasoning, our type system ensures that challenging uses of shared state will never interfere in an unsafe fashion. In particular, rely-guarantee protocols ensure that each alias will never observe an unexpected value, or type, when inspecting shared memory regardless of how the changes to that shared state (originating from potentially unknown program contexts) are interleaved at run-time.

Designing with Static Capabilities and Effects: Use, Mention, and Invariants

“…These systems maintain a global invariant that for any two aliases, the permissions granted via one reference are a subset of the interference assumed by the other, in both directions. The early papers on rely-guarantee references [27], rely-guarantee protocols [43], and Pony [12] give particularly thorough accounts of this. This notion of compatibility between aliases is imposed any time references are duplicated, and in the case of systems like Kappa [5], joined as well.…”

“…2 They have also been used to infer method purity [33,32]: if a method accepts only (transitively) read-only inputs (including the receiver), it has no externally-visible side effects. 3 In other contexts, program behavior can be constrained by building more fine-grained capabilities that grant not only all-or-none permission to mutate, but can grant permission for only certain kinds of mutation, and can therefore enforce nuanced invariants by restricting which capabilities can coexist for the same resource [27,25,28,43,44,5,6].…”

Manifest sharing with session types

“…From the point of view of protocol expression, our work is related to the line of research that uses typestate [Strom and Yemini 1986] for protocol checking [Bierhoff and Aldrich 2007;DeLine and Fähndrich 2004;Fähndrich and DeLine 2002;Militão et al 2014] or program verification [Nistor et al 2014], in a sequential, object-oriented context. Whereas first approaches [DeLine and Fähndrich 2004] support a rather restricted set of aliasing patterns to facilitate modular protocol checking, subsequent approaches lift some of the imposed restrictions, notably by combining aliasing information with typestate [Bierhoff and Aldrich 2007;Naden et al 2012] or rely-guaranteebased reasoning [Militão et al 2014]. Most closely related to our work is Fähndrich's and DeLine's work [2002] on adoption and focus for protocol checking in an object-oriented language.…”

Refinement types for TypeScript

“…Their approach allows refinement types over mutable data, but resolving their proof obligations depends on theorem-proving, which hinders automation. Militão et al [23] present Rely-Guarantee Protocols that can model complex aliasing interactions, and, compared to Gordon's work, allow temporary inconsistencies, can recover from shared state via ownership tracking, and resort to more lightweight proving mechanisms.…”