Skip to content

Commit 0f4ee01

Browse files
committed
Added abstract
1 parent b822b76 commit 0f4ee01

File tree

4 files changed

+56
-16
lines changed

4 files changed

+56
-16
lines changed

docs/P3444R0.html

Lines changed: 20 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -449,7 +449,19 @@ <h1 class="title" style="text-align:center">Memory Safety without
449449
</table>
450450
</header>
451451
<div style="clear:both">
452-
<h1 data-number="1" id="safe-references"><span class="header-section-number">1</span> Safe references<a href="#safe-references" class="self-link"></a></h1>
452+
<h1 data-number="1" id="abstract"><span class="header-section-number">1</span> Abstract<a href="#abstract" class="self-link"></a></h1>
453+
<p>This proposal describes the implementation of a memory-safe reference
454+
type that does not use lifetime annotations. The goal of the proposal is
455+
to:</p>
456+
<ol type="1">
457+
<li>Explore the viability of memory safety without lifetime
458+
parameters.</li>
459+
<li>Explain the infeasibility of making legacy lvalue and rvalue
460+
references memory safe.</li>
461+
<li>Address common objections to safety models that use lifetime
462+
annotations.</li>
463+
</ol>
464+
<h1 data-number="2" id="safe-references"><span class="header-section-number">2</span> Safe references<a href="#safe-references" class="self-link"></a></h1>
453465
<p>“Safe C++”<span class="citation" data-cites="safecpp">[<a href="https://safecpp.org/draft.html" role="doc-biblioref">safecpp</a>]</span> introduced a comprehensive
454466
design for compile-time memory safety in C++. The borrow checking model
455467
in Safe C++ requires lifetime parameters, a feature that increases
@@ -535,7 +547,7 @@ <h1 data-number="1" id="safe-references"><span class="header-section-number">1</
535547
<em>ref-qualifier</em>, the implicit object parameter outlives the
536548
invented lifetime. In turn, this invented lifetime outlives the returned
537549
safe reference.</p>
538-
<h2 data-number="1.1" id="exclusivity"><span class="header-section-number">1.1</span> Exclusivity<a href="#exclusivity" class="self-link"></a></h2>
550+
<h2 data-number="2.1" id="exclusivity"><span class="header-section-number">2.1</span> Exclusivity<a href="#exclusivity" class="self-link"></a></h2>
539551
<ul>
540552
<li><code class="sourceCode cpp">T<span class="op">%</span></code> is a
541553
<em>mutable safe reference</em>. It cannot alias other references to
@@ -706,7 +718,7 @@ <h2 data-number="1.1" id="exclusivity"><span class="header-section-number">1.1</
706718
<em>unsafe-block</em> is that the legacy references <em>do not
707719
alias</em> and <em>do not dangle</em>:
708720
<code class="sourceCode cpp"><span class="op">%*</span>x</code>.</p>
709-
<h2 data-number="1.2" id="constraint-rules"><span class="header-section-number">1.2</span> Constraint rules<a href="#constraint-rules" class="self-link"></a></h2>
721+
<h2 data-number="2.2" id="constraint-rules"><span class="header-section-number">2.2</span> Constraint rules<a href="#constraint-rules" class="self-link"></a></h2>
710722
<p>This proposal implements two sets of constraint rules. Free functions
711723
constrain return references by the shortest of the argument lifetimes.
712724
Non-static member functions constrain return references by the implicit
@@ -891,7 +903,7 @@ <h2 data-number="1.2" id="constraint-rules"><span class="header-section-number">
891903
free function constraint rules. The program fails borrow checking when
892904
the returned reference <code class="sourceCode cpp">value2</code> is
893905
used after the expiration of its key temporary.</p>
894-
<h1 data-number="2" id="second-class-references"><span class="header-section-number">2</span> Second-class references<a href="#second-class-references" class="self-link"></a></h1>
906+
<h1 data-number="3" id="second-class-references"><span class="header-section-number">3</span> Second-class references<a href="#second-class-references" class="self-link"></a></h1>
895907
<p>References can be taxonimized into two classes:<span class="citation" data-cites="second-class">[<a href="https://borretti.me/article/second-class-references" role="doc-biblioref">second-class</a>]</span></p>
896908
<ul>
897909
<li>First-class references can pass data into functions, be returned
@@ -989,7 +1001,7 @@ <h1 data-number="2" id="second-class-references"><span class="header-section-num
9891001
adding simplified safe references was an easy extension. If the
9901002
community is able to fill in our gaps in knowledge around this sort of
9911003
reference, the compiler could accommodate those advances as well.</p>
992-
<h1 data-number="3" id="other-aspects-of-safety"><span class="header-section-number">3</span> Other aspects of safety<a href="#other-aspects-of-safety" class="self-link"></a></h1>
1004+
<h1 data-number="4" id="other-aspects-of-safety"><span class="header-section-number">4</span> Other aspects of safety<a href="#other-aspects-of-safety" class="self-link"></a></h1>
9931005
<p>As detailed in the Safe C++<span class="citation" data-cites="safecpp">[<a href="https://safecpp.org/draft.html" role="doc-biblioref">safecpp</a>]</span> proposal, there are four
9941006
categories of memory safety:</p>
9951007
<ol type="1">
@@ -1023,7 +1035,7 @@ <h1 data-number="3" id="other-aspects-of-safety"><span class="header-section-num
10231035
recent Android study on memory safety<span class="citation" data-cites="android">[<a href="https://security.googleblog.com/2024/09/eliminating-memory-safety-vulnerabilities-Android.html?m=1" role="doc-biblioref">android</a>]</span>, the benefits of rewriting are
10241036
often not worth the costs. What we have to prioritize is the transition
10251037
to safe coding practices<span class="citation" data-cites="safe-coding">[<a href="https://blog.google/technology/safety-security/tackling-cybersecurity-vulnerabilities-through-secure-by-design/" role="doc-biblioref">safe-coding</a>]</span> for new code.</p>
1026-
<h1 data-number="4" id="achieving-first-class-references"><span class="header-section-number">4</span> Achieving first-class
1038+
<h1 data-number="5" id="achieving-first-class-references"><span class="header-section-number">5</span> Achieving first-class
10271039
references<a href="#achieving-first-class-references" class="self-link"></a></h1>
10281040
<p>The presented design is as far as I could go to address the goal of
10291041
“memory safety without lifetime parameters.” But safe references aren’t
@@ -1217,7 +1229,7 @@ <h1 data-number="4" id="achieving-first-class-references"><span class="header-se
12171229
<code class="sourceCode cpp">string_view</code> lifetimes, causing a
12181230
borrow checker failure further from the source and leaving the developer
12191231
without the possibility of a fix.</p>
1220-
<h1 data-number="5" id="lifetime-parameters"><span class="header-section-number">5</span> Lifetime parameters<a href="#lifetime-parameters" class="self-link"></a></h1>
1232+
<h1 data-number="6" id="lifetime-parameters"><span class="header-section-number">6</span> Lifetime parameters<a href="#lifetime-parameters" class="self-link"></a></h1>
12211233
<p>If there’s a community-wide research effort among compiler experts to
12221234
evolve safe references it may be possible to get them into a state to
12231235
support the abstractions most important for C++. But soundness reasoning
@@ -1310,7 +1322,7 @@ <h1 data-number="5" id="lifetime-parameters"><span class="header-section-number"
13101322
interfacing the two languages. The easier it is to interoperate with
13111323
Rust, the more options and freedom companies have to fulfill with their
13121324
security mandate.<span class="citation" data-cites="rust-interop">[<a href="https://security.googleblog.com/2024/02/improving-interoperability-between-rust-and-c.html" role="doc-biblioref">rust-interop</a>]</span></p>
1313-
<h1 data-number="6" id="bibliography"><span class="header-section-number">6</span> References<a href="#bibliography" class="self-link"></a></h1>
1325+
<h1 data-number="7" id="bibliography"><span class="header-section-number">7</span> References<a href="#bibliography" class="self-link"></a></h1>
13141326
<div id="refs" class="references csl-bib-body hanging-indent" data-entry-spacing="1" role="doc-bibliography">
13151327
<div id="ref-android" class="csl-entry" role="doc-biblioentry">
13161328
[android] Eliminating Memory Safety Vulnerabilites at the Source. <a href="https://security.googleblog.com/2024/09/eliminating-memory-safety-vulnerabilities-Android.html?m=1"><div class="csl-block">https://security.googleblog.com/2024/09/eliminating-memory-safety-vulnerabilities-Android.html?m=1</div></a>

docs/draft-lifetimes.html

Lines changed: 20 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -449,7 +449,19 @@ <h1 class="title" style="text-align:center">Memory Safety without
449449
</table>
450450
</header>
451451
<div style="clear:both">
452-
<h1 data-number="1" id="safe-references"><span class="header-section-number">1</span> Safe references<a href="#safe-references" class="self-link"></a></h1>
452+
<h1 data-number="1" id="abstract"><span class="header-section-number">1</span> Abstract<a href="#abstract" class="self-link"></a></h1>
453+
<p>This proposal describes the implementation of a memory-safe reference
454+
type that does not use lifetime annotations. The goal of the proposal is
455+
to:</p>
456+
<ol type="1">
457+
<li>Explore the viability of memory safety without lifetime
458+
parameters.</li>
459+
<li>Explain the infeasibility of making legacy lvalue and rvalue
460+
references memory safe.</li>
461+
<li>Address common objections to safety models that use lifetime
462+
annotations.</li>
463+
</ol>
464+
<h1 data-number="2" id="safe-references"><span class="header-section-number">2</span> Safe references<a href="#safe-references" class="self-link"></a></h1>
453465
<p>“Safe C++”<span class="citation" data-cites="safecpp">[<a href="https://safecpp.org/draft.html" role="doc-biblioref">safecpp</a>]</span> introduced a comprehensive
454466
design for compile-time memory safety in C++. The borrow checking model
455467
in Safe C++ requires lifetime parameters, a feature that increases
@@ -535,7 +547,7 @@ <h1 data-number="1" id="safe-references"><span class="header-section-number">1</
535547
<em>ref-qualifier</em>, the implicit object parameter outlives the
536548
invented lifetime. In turn, this invented lifetime outlives the returned
537549
safe reference.</p>
538-
<h2 data-number="1.1" id="exclusivity"><span class="header-section-number">1.1</span> Exclusivity<a href="#exclusivity" class="self-link"></a></h2>
550+
<h2 data-number="2.1" id="exclusivity"><span class="header-section-number">2.1</span> Exclusivity<a href="#exclusivity" class="self-link"></a></h2>
539551
<ul>
540552
<li><code class="sourceCode cpp">T<span class="op">%</span></code> is a
541553
<em>mutable safe reference</em>. It cannot alias other references to
@@ -706,7 +718,7 @@ <h2 data-number="1.1" id="exclusivity"><span class="header-section-number">1.1</
706718
<em>unsafe-block</em> is that the legacy references <em>do not
707719
alias</em> and <em>do not dangle</em>:
708720
<code class="sourceCode cpp"><span class="op">%*</span>x</code>.</p>
709-
<h2 data-number="1.2" id="constraint-rules"><span class="header-section-number">1.2</span> Constraint rules<a href="#constraint-rules" class="self-link"></a></h2>
721+
<h2 data-number="2.2" id="constraint-rules"><span class="header-section-number">2.2</span> Constraint rules<a href="#constraint-rules" class="self-link"></a></h2>
710722
<p>This proposal implements two sets of constraint rules. Free functions
711723
constrain return references by the shortest of the argument lifetimes.
712724
Non-static member functions constrain return references by the implicit
@@ -891,7 +903,7 @@ <h2 data-number="1.2" id="constraint-rules"><span class="header-section-number">
891903
free function constraint rules. The program fails borrow checking when
892904
the returned reference <code class="sourceCode cpp">value2</code> is
893905
used after the expiration of its key temporary.</p>
894-
<h1 data-number="2" id="second-class-references"><span class="header-section-number">2</span> Second-class references<a href="#second-class-references" class="self-link"></a></h1>
906+
<h1 data-number="3" id="second-class-references"><span class="header-section-number">3</span> Second-class references<a href="#second-class-references" class="self-link"></a></h1>
895907
<p>References can be taxonimized into two classes:<span class="citation" data-cites="second-class">[<a href="https://borretti.me/article/second-class-references" role="doc-biblioref">second-class</a>]</span></p>
896908
<ul>
897909
<li>First-class references can pass data into functions, be returned
@@ -989,7 +1001,7 @@ <h1 data-number="2" id="second-class-references"><span class="header-section-num
9891001
adding simplified safe references was an easy extension. If the
9901002
community is able to fill in our gaps in knowledge around this sort of
9911003
reference, the compiler could accommodate those advances as well.</p>
992-
<h1 data-number="3" id="other-aspects-of-safety"><span class="header-section-number">3</span> Other aspects of safety<a href="#other-aspects-of-safety" class="self-link"></a></h1>
1004+
<h1 data-number="4" id="other-aspects-of-safety"><span class="header-section-number">4</span> Other aspects of safety<a href="#other-aspects-of-safety" class="self-link"></a></h1>
9931005
<p>As detailed in the Safe C++<span class="citation" data-cites="safecpp">[<a href="https://safecpp.org/draft.html" role="doc-biblioref">safecpp</a>]</span> proposal, there are four
9941006
categories of memory safety:</p>
9951007
<ol type="1">
@@ -1023,7 +1035,7 @@ <h1 data-number="3" id="other-aspects-of-safety"><span class="header-section-num
10231035
recent Android study on memory safety<span class="citation" data-cites="android">[<a href="https://security.googleblog.com/2024/09/eliminating-memory-safety-vulnerabilities-Android.html?m=1" role="doc-biblioref">android</a>]</span>, the benefits of rewriting are
10241036
often not worth the costs. What we have to prioritize is the transition
10251037
to safe coding practices<span class="citation" data-cites="safe-coding">[<a href="https://blog.google/technology/safety-security/tackling-cybersecurity-vulnerabilities-through-secure-by-design/" role="doc-biblioref">safe-coding</a>]</span> for new code.</p>
1026-
<h1 data-number="4" id="achieving-first-class-references"><span class="header-section-number">4</span> Achieving first-class
1038+
<h1 data-number="5" id="achieving-first-class-references"><span class="header-section-number">5</span> Achieving first-class
10271039
references<a href="#achieving-first-class-references" class="self-link"></a></h1>
10281040
<p>The presented design is as far as I could go to address the goal of
10291041
“memory safety without lifetime parameters.” But safe references aren’t
@@ -1217,7 +1229,7 @@ <h1 data-number="4" id="achieving-first-class-references"><span class="header-se
12171229
<code class="sourceCode cpp">string_view</code> lifetimes, causing a
12181230
borrow checker failure further from the source and leaving the developer
12191231
without the possibility of a fix.</p>
1220-
<h1 data-number="5" id="lifetime-parameters"><span class="header-section-number">5</span> Lifetime parameters<a href="#lifetime-parameters" class="self-link"></a></h1>
1232+
<h1 data-number="6" id="lifetime-parameters"><span class="header-section-number">6</span> Lifetime parameters<a href="#lifetime-parameters" class="self-link"></a></h1>
12211233
<p>If there’s a community-wide research effort among compiler experts to
12221234
evolve safe references it may be possible to get them into a state to
12231235
support the abstractions most important for C++. But soundness reasoning
@@ -1310,7 +1322,7 @@ <h1 data-number="5" id="lifetime-parameters"><span class="header-section-number"
13101322
interfacing the two languages. The easier it is to interoperate with
13111323
Rust, the more options and freedom companies have to fulfill with their
13121324
security mandate.<span class="citation" data-cites="rust-interop">[<a href="https://security.googleblog.com/2024/02/improving-interoperability-between-rust-and-c.html" role="doc-biblioref">rust-interop</a>]</span></p>
1313-
<h1 data-number="6" id="bibliography"><span class="header-section-number">6</span> References<a href="#bibliography" class="self-link"></a></h1>
1325+
<h1 data-number="7" id="bibliography"><span class="header-section-number">7</span> References<a href="#bibliography" class="self-link"></a></h1>
13141326
<div id="refs" class="references csl-bib-body hanging-indent" data-entry-spacing="1" role="doc-bibliography">
13151327
<div id="ref-android" class="csl-entry" role="doc-biblioentry">
13161328
[android] Eliminating Memory Safety Vulnerabilites at the Source. <a href="https://security.googleblog.com/2024/09/eliminating-memory-safety-vulnerabilities-Android.html?m=1"><div class="csl-block">https://security.googleblog.com/2024/09/eliminating-memory-safety-vulnerabilities-Android.html?m=1</div></a>

lifetimes/P3444R0.md

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,14 @@ author:
99
toc: false
1010
---
1111

12+
# Abstract
13+
14+
This proposal describes the implementation of a memory-safe reference type that does not use lifetime annotations. The goal of the proposal is to:
15+
16+
1. Explore the viability of memory safety without lifetime parameters.
17+
2. Explain the infeasibility of making legacy lvalue and rvalue references memory safe.
18+
3. Address common objections to safety models that use lifetime annotations.
19+
1220
# Safe references
1321

1422
"Safe C++"[@safecpp] introduced a comprehensive design for compile-time memory safety in C++. The borrow checking model in Safe C++ requires lifetime parameters, a feature that increases expressiveness but complicates the language's type system. This proposal describes an alternative style of borrow checking, guaranteeing lifetime safety without the involvement of lifetime annotations.

lifetimes/draft-lifetimes.md

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,14 @@ author:
99
toc: false
1010
---
1111

12+
# Abstract
13+
14+
This proposal describes the implementation of a memory-safe reference type that does not use lifetime annotations. The goal of the proposal is to:
15+
16+
1. Explore the viability of memory safety without lifetime parameters.
17+
2. Explain the infeasibility of making legacy lvalue and rvalue references memory safe.
18+
3. Address common objections to safety models that use lifetime annotations.
19+
1220
# Safe references
1321

1422
"Safe C++"[@safecpp] introduced a comprehensive design for compile-time memory safety in C++. The borrow checking model in Safe C++ requires lifetime parameters, a feature that increases expressiveness but complicates the language's type system. This proposal describes an alternative style of borrow checking, guaranteeing lifetime safety without the involvement of lifetime annotations.

0 commit comments

Comments
 (0)