Typed memory management in a calculus of capabilities

Abstract

Region-based memory management is an alternative to standard tracing garbage collection that makes potentially dangerous operations such as memory deallocation explicit but verifiably safe. In this article, we present a new compiler intermediate language, called the Capability Calculus, that supports region-based memory management and enjoys a provably safe type system. Unlike previous region-based type systems, region lifetimes need not be lexically scoped and yet the language may be checked for safety without complex analyses. Therefore, our type system may be deployed in settings such as extensible operating systems where both the performance and safety of untrusted code is important.The central novelty of the language is the use of static capabilities to specify the permissibility of various operations, such as memory access and deallocation. In order to ensure capabilities are relinquished properly, the type system tracks aliasing information using a form of bounded quantification. Moreover, unlike previous work on region-based type systems, the proof of soundness of our type system is relatively simple, employing only standard syntactic techniques.In order to show our language may be used in practice, we show how to translate a variant of Tofte and Talpin's high-level type-and-effects system for region-based memory management into our language. When combined with known region inference algorithms, this translation provides a way to compile source-level languages to the Capability Calculus.

A Capability Calculus for Concurrency and Determinism

“…4 Ideally, we would like to use the largest capability-respecting set, but such a set is not recursive (because it is reducible from the halting problem). Instead, we use a type system to compute a safe approximation of the set.…”

“…Dynamically Created Channels: Dynamically created channels can be handled in much the same way heap allocated objects are handled in the capability calculus [4] (we only show the rule for the case where c is rendezvous):…”

“…We cast our system as a capability calculus [4]. The capability calculus was originally proposed as a framework for reasoning about resources in sequential computation, but has recently been extended to reason about determinism in concurrent programs [3,11].…”

Polymorphic Fractional Capabilities

“…The capability calculus [5] was originally proposed as a framework for regionbased memory management, that is, a system for guaranteeing that a deallocated region is never accessed. The capability calculus is a good framework for statically reasoning about properties of general program resources such as memory regions [5], reference cells [4], and communication channels [14].…”

“…The capability calculus is a good framework for statically reasoning about properties of general program resources such as memory regions [5], reference cells [4], and communication channels [14]. Researchers [4,13] extended the framework to fractional capabilities ( [4] called them fractional permissions), allowing (1) more flexibility by letting the capabilities range over rational numbers, which allows reasoning about concurrent reads and writes, and (2) efficient inference via a reduction to (rational) linear programming, whereas no efficient inference is known for the non-fractional calculi 1 .…”