Verify that no ARC counter access reads a nonpositive value under C20

Establish a sound verification or analysis technique that can prove, for the core of Rust’s Atomic Reference Counting (ARC) algorithm under the C20 memory consistency model, that no atomic access of the reference-count field ever reads a value v ≤ 0 (Equation (2): “No access of the counter reads a value v ≤ 0”), thereby removing the current assumption required by the C20 proof.

Background

To prove the correctness of the core ARC algorithm under C20, the paper identifies two properties that must hold: (1) all accesses of the counter are either increments or release decrements, and (2) no access of the counter reads a value v ≤ 0. While (1) can be addressed via a syntactic/static approach (e.g., a type system), the authors do not have a method to verify (2).

Because reasoning about fences and relaxed accesses is subtle under C20, the paper’s C20-based verification assumes property (2) rather than proving it. The authors explicitly leave the task of verifying property (2) as an open problem, highlighting the need for a modular proof or analysis that ensures the counter is never observed at or below zero.