Oxide: The Essence of Rust (1903.00982v4)

Abstract: Rust claims to advance industrial programming by bridging the gap between low-level systems programming and high-level application programming. At the heart of the argument that this enables programmers to build more reliable and efficient software is the borrow checker - a novel approach to ownership that aims to balance type system expressivity with usability. And yet, to date there is no core type system that captures Rust's notion of ownership and borrowing, and hence no foundation for research on Rust to build upon. In this work, we set out to capture the essence of this model of ownership by developing a type systems account of Rust's borrow checker. We present Oxide, a formalized programming language close to source-level Rust (but with fully-annotated types). This presentation takes a new view of lifetimes as an approximation of the provenances of references, and our type system is able to automatically compute this information through a substructural typing judgment. We provide the first syntactic proof of type safety for borrow checking using progress and preservation. Oxide is a simpler formulation of borrow checking - including recent features such as non-lexical lifetimes - that we hope researchers will be able to use as the basis for work on Rust.

• The paper introduces Oxide (λ), a formalized language capturing Rust's core principles, specifically its borrow checker through a region-based type system.
• It presents formal semantics via typing rules and ownership safety judgments to declaratively model Rust's unique handling of aliases and references.
• The authors validated Oxide through an implementation compiling a substantial subset of Rust tests, demonstrating its faithfulness to Rust's semantics and value for understanding its design.

The paper "Oxide: The Essence of Rust" introduces Oxide (\lang), a formalized programming language that captures the core principles of Rust, with a particular focus on modeling Rust's borrow checker within a type system. The authors aim to provide a structured, high-level understanding of Rust's ownership and borrowing semantics. They identify Rust's borrow checker as a novel implementation that centrally manages ownership and references through a notion of regions, distinct from lexical lifetimes, more traditionally used in static types to track references in the language.

Key Contributions and Concepts:

1. Region-Based Alias Management:
   • The type system in \lang models lifetimes as sets of locations (regions) approximating reference origins. This representation provides a static abstraction over borrow semantics, enabling the checker to validate usage without explicit memory management directives.
   • Regions consist of loans that abstract potential memory addresses, and this facilitates the borrow checker's task of tracking aliasing contexts dynamically.
2. Type System Design:
   • \lang supports a variety of types including sized, unsized, dead, and maybe dead types, integrating concepts of ownership directly into the type system. These distinct type categories allow the type system to maintain rules (such as linearity of variables for non-copyable data) while managing resources efficiently.
   • Functions in \lang are polymorphic and can define bounds on lifetime (region) relationships.
3. Formal Semantics for Rust’s Borrow Checker:
   • Borrow checking is implemented declaratively through typing rules and ownership safety judgments. This ensures that usage conditions for unique (alias free) and shared references within expressions are well maintained—distinct from algorithmic constraints that previous implementations opted for.
   • Region rewriting and outlives features within the type system allow \lang to systematically handle references and track valid lifetimes.
4. Syntactic Type Safety:
   • The authors present proofs for progress and preservation to demonstrate that well-typed \lang programs maintain intended semantics throughout execution, ensuring guarantees about memory and concurrency safety.
   • The paper tackles operational semantics by introducing values with closure environments that necessitate careful scoping in order to manage memory and references.
5. Tested Semantics:
   • \lang's validity and robustness were supported by an implementation capable of compiling a substantial subset of Rust test cases, enhancing its real-world applicability. This tested semantics aligns with Rust's compiler, demonstrating the approach's faithfulness.
6. Comparison to Related Work:
   • The paper draws a distinction from RustBelt that stays closer to Rust's MIR, focusing instead on a source-level reasoning approach. Unlike Featherweight Rust or Polonius, \lang's design takes into account Rust's non-lexical lifetimes and broader language features such as closures.

The overarching goal of \lang is an elucidation of Rust's core semantic principles, aimed at educating and grounding future research in Rust's unique type system innovations. Through this formalism, the paper provides valuable insights into the implications of Rust's design model for aliasing, resource life management, and safe systems programming.