<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
h2
{mso-style-priority:9;
mso-style-link:"Heading 2 Char";
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:18.0pt;
font-family:"Calibri",sans-serif;
font-weight:bold;}
h3
{mso-style-priority:9;
mso-style-link:"Heading 3 Char";
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:13.5pt;
font-family:"Calibri",sans-serif;
font-weight:bold;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0cm;
font-size:10.0pt;
font-family:"Courier New";}
span.Heading2Char
{mso-style-name:"Heading 2 Char";
mso-style-priority:9;
mso-style-link:"Heading 2";
font-family:"Calibri Light",sans-serif;
color:#2F5496;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;}
span.pl-k
{mso-style-name:pl-k;}
span.pl-en
{mso-style-name:pl-en;}
span.pl-c
{mso-style-name:pl-c;}
span.pl-smi
{mso-style-name:pl-smi;}
span.pl-c1
{mso-style-name:pl-c1;}
span.Heading3Char
{mso-style-name:"Heading 3 Char";
mso-style-priority:9;
mso-style-link:"Heading 3";
font-family:"Calibri Light",sans-serif;
color:#1F3763;}
span.EmailStyle31
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:886141858;
mso-list-template-ids:-1416219572;}
@list l0:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:36.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:72.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:"Courier New";
mso-bidi-font-family:"Times New Roman";}
@list l0:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:108.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:144.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level5
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:180.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:216.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:252.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level8
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:288.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:324.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1
{mso-list-id:1108349301;
mso-list-template-ids:-1185116790;}
@list l1:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:36.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l1:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:72.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:"Courier New";
mso-bidi-font-family:"Times New Roman";}
@list l1:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:108.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:144.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1:level5
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:180.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:216.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:252.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1:level8
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:288.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:324.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l2
{mso-list-id:1761022977;
mso-list-template-ids:1666981550;}
@list l2:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:36.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l2:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:72.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:"Courier New";
mso-bidi-font-family:"Times New Roman";}
@list l2:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:108.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l2:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:144.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l2:level5
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:180.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l2:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:216.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l2:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:252.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l2:level8
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:288.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l2:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:324.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
ol
{margin-bottom:0cm;}
ul
{margin-bottom:0cm;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple style='word-wrap:break-word'><div class=WordSection1><p class=MsoNormal>Hi Philip,<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>TBH I was slightly surprised with this email, as the interpretation about deref I had in my head was exactly what you are proposing as the new semantics.<o:p></o:p></p><p class=MsoNormal>I just looked again at LangRef and I see it could be interpreted in the way you describe. Because it mentions a pointer with deref attribute can be always dereferenced, irrespective of whether the pointer is free<span style='font-family:"Times New Roman",serif'>’</span>d or not.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>FWIW, Alive2 already implements the semantics you describe. For example, introducing a load after a call with a deref attribute is UB as the pointer may be free<span style='font-family:"Times New Roman",serif'>’</span>d by the callee: <a href="https://alive2.llvm.org/ce/z/dz2wYy">https://alive2.llvm.org/ce/z/dz2wYy</a> (but works with nofree: <a href="https://alive2.llvm.org/ce/z/XsHEn-">https://alive2.llvm.org/ce/z/XsHEn-</a>)<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>TL;DR: Please go ahead!<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Nuno<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b>From:</b> Philip Reames <br><b>Sent:</b> 17 March 2021 21:22<br><b>To:</b> llvm-dev@lists.llvm.org<br><b>Cc:</b> Artur Pilipenko <apilipenko@azul.com>; Nick Lewycky <nicholas@mxc.ca><br><b>Subject:</b> [llvm-dev] RFC: Decomposing deref(N) into deref(N) + nofree<o:p></o:p></p></div></div><p class=MsoNormal><o:p> </o:p></p><p>TLDR: We should change the existing dereferenceability related attributes to imply point in time facts only, and re-infer stronger global dereferenceability facts where needed.<o:p></o:p></p><h2><a href="https://github.com/preames/public-notes/blob/master/deref+nofree.rst#id1">Meta</a><o:p></o:p></h2><p>If you prefer to read proposals in a browser, you can read this email <a href="https://github.com/preames/public-notes/blob/master/deref+nofree.rst">here</a>.<o:p></o:p></p><p>This proposal greatly benefited from multiple rounds of feedback from Johannes, Artur, and Nick. All remaining mistakes are my own.<o:p></o:p></p><p>Johannes deserves a lot of credit for driving previous iterations on this design. In particular, I want to note that we've basically returned to something Johannes first proposed several years ago, before we had specified the nofree attribute family.<o:p></o:p></p><h2><a href="https://github.com/preames/public-notes/blob/master/deref+nofree.rst#id2">The Basic Problem</a><o:p></o:p></h2><p>We have a long standing semantic problem with the way we define dereferenceability facts which makes it difficult to express C++ references, or more generally, dereferenceability on objects which may be freed at some point in the program. The current structure does lend itself well to memory which can't be freed. As discussed in detail a bit later, we want to seamlessly support both use cases.<o:p></o:p></p><p>The basic statement of the problem is that a piece of memory marked with deref(N) is assumed to remain dereferenceable indefinitely. For an object which can be freed, marking it as deref can enable unsound transformations in cases like the following:<o:p></o:p></p><pre>o = deref(N) alloc();<o:p></o:p></pre><pre>if (c) free(o)<o:p></o:p></pre><pre>while(true) {<o:p></o:p></pre><pre> if (c) break;<o:p></o:p></pre><pre> // With the current semantics, we will hoist o.f above the loop<o:p></o:p></pre><pre> v = o.f;<o:p></o:p></pre><pre>}<o:p></o:p></pre><p>Despite this, Clang does emit the existing dereferenceable attribute in some problematic cases. We have observed miscompiles as a result, and optimizer has an assortment of hacks to try not to be too aggressive and miscompile too widely.<o:p></o:p></p><h2><a href="https://github.com/preames/public-notes/blob/master/deref+nofree.rst#id3">Haven't we already solved this?</a><o:p></o:p></h2><p>This has been discussed relatively extensively in the past, included an accepted review (<a href="https://reviews.llvm.org/D61652">https://reviews.llvm.org/D61652</a>) which proposed splitting the dereferenceable attribute into two to adress this. However, this change never landed and recent findings reveal that we both need a broader solution, and have an interesting oppurtunity to take advantage of other recent work.<o:p></o:p></p><p>The need for a broader solution comes from the observation that deref(N) is not the only attribute with this problem. deref_or_null(N) is a fairly obvious case we'd known about with the previous proposal, but it was recently realized that other allocation related facts have this problem as well. We now have specific examples with allocsize(N,M) - and the baked in variants in MemoryBuiltins - and suspect there are other attributes, either current or future, with the same challenge.<o:p></o:p></p><p>The opportunity comes from the addition of "nofree" attribute. Up until recently, we really didn't have a good notion of "free"ing an allocation in the abstract machine model. We used to comingle this with our notion of capture. (i.e. We'd assume that functions which could free must also capture.) With the explicit notion of "nofree", we have an approach available to us we didn't before.<o:p></o:p></p><h2><a href="https://github.com/preames/public-notes/blob/master/deref+nofree.rst#id4">The Proposal Itself</a><o:p></o:p></h2><p>The basic idea is that we're going to redefine the currently globally scoped attributes (deref, deref_or_null, and allocsize) such that they imply a point in time fact only and then combine that with nofree to recover the previous global semantics.<o:p></o:p></p><p>More specifically:<o:p></o:p></p><ul type=disc><li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l2 level1 lfo1'>A deref attribute on a function parameter will imply that the memory is dereferenceable for a specified number of bytes at the instant the function call occurs.<o:p></o:p></li><li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l2 level1 lfo1'>A deref attribute on a function return will imply that the memory is dereferenceable at the moment of return.<o:p></o:p></li></ul><p>We will then use the point in time fact combined with other information to drive inference of the global facts. While in principle we may loose optimization potential, we believe this is sufficient to infer the global facts in all practical cases we care about.<o:p></o:p></p><p>Sample inference cases:<o:p></o:p></p><ul type=disc><li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l1 level1 lfo2'>A deref(N) argument to a function with the nofree and nosync function attribute is known to be globally dereferenceable within the scope of the function call. We need the nosync to ensure that no other thread is freeing the memory on behalf of the callee in a coordinated manner.<o:p></o:p></li><li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l1 level1 lfo2'>An argument with the attributes deref(N), noalias, and nofree is known to be globally dereferenceable within the scope of the function call. This relies on the fact that free is modeled as writing to the memory freed, and thus noalias ensures there is no other argument which can be freed. (See discussion below.)<o:p></o:p></li><li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l1 level1 lfo2'>A memory allocation in a function with a garbage collector which guarantees collection occurs only at explicit safepoints and uses the gc.statepoint infrastructure, is known to be globally dereferenceable if there are no calls to gc.statepoint anywhere in the module. This effectively refines the abstract machine model used for garbage collection before lowering by RS4GC to disallow explicit deallocation (for collectors which opt in).<o:p></o:p></li></ul><p>The items above are described in terms of deref(N) for ease of description. The other attributes are handle analogously.<o:p></o:p></p><p><strong><span style='font-family:"Calibri",sans-serif'>Explanation</span></strong><o:p></o:p></p><p>The "deref(N), noalias, + nofree" argument case requires a bit of explanation as it involves a bunch of subtleties.<o:p></o:p></p><p>First, the current wording of nofree argument attribute implies that the callee can not arrange for another thread to free the object on it's behalf. This is different than the specification of the nofree function attribute. There is no "nosync" equivalent for function attributes.<o:p></o:p></p><p>Second, the noalias argument attribute is subtle. There's a couple of sub-cases worth discussing:<o:p></o:p></p><ul type=disc><li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo3'>If the noalias argument is written to (reminder: free is modeled as a write), then it must be the only copy of the pointer passed to the function and there can be no copies passed through memory used in the scope of function.<o:p></o:p></li><li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo3'>If the noalias argument is only read from, then there may be other copies of the pointer. However, all of those copies must also be read only. If the object was freed through one of those other copies, then we must have at least one writeable copy and having the noalias on the read copy was undefined behavior to begin with.<o:p></o:p></li></ul><p>Essentially, what we're doing with noalias is using it to promote a fact about the pointer to a fact about the object being pointed to. Code structure wise, we should probably write it exactly that way.<o:p></o:p></p><p><strong><span style='font-family:"Calibri",sans-serif'>Result</span></strong><o:p></o:p></p><p>It's important to acknowledge that with this change, we will lose the ability to specify global dereferenceability of arguments and return values in the general case. We believe the current proposal allows us to recover that fact for all interesting cases, but if we've missed an important use case we may need to iterate a bit.<o:p></o:p></p><p>We've discussed a few alternatives (below) which could be revisited if it turns out we are missing an important use case.<o:p></o:p></p><h2><a href="https://github.com/preames/public-notes/blob/master/deref+nofree.rst#id5">Use Cases</a><o:p></o:p></h2><p><strong><span style='font-family:"Calibri",sans-serif'>C++ References</span></strong> -- A C++ reference implies that the value pointed to is dereferenceable at point of declaration, and that the reference itself is non-null. Of particular note, an object pointed to through a reference can be freed without introducing UB.<o:p></o:p></p><div><pre><span class=pl-k>class</span> <span class=pl-en>A</span> { <span class=pl-k>int</span> f; };<o:p></o:p></pre><pre><o:p> </o:p></pre><pre><span class=pl-k>void</span> <span class=pl-en>ugly_delete</span>(A &a) { <span class=pl-k>delete</span> &a; }<o:p></o:p></pre><pre><span class=pl-en>ugly_delete</span>(*<span class=pl-k>new</span> A());<o:p></o:p></pre><pre><o:p> </o:p></pre><pre><span class=pl-k>void</span> <span class=pl-en>ugly_delete2</span>(A &a, A *a2) {<o:p></o:p></pre><pre> <span class=pl-k>if</span> (unknown)<o:p></o:p></pre><pre> <span class=pl-c>// a.f can be *proven* deref here as it's deref on entry,</span><o:p></o:p></pre><pre> <span class=pl-c>// and no free on path from entry to here.</span><o:p></o:p></pre><pre> x = a.<span class=pl-smi>f</span>;<o:p></o:p></pre><pre> <span class=pl-k>delete</span> a2;<o:p></o:p></pre><pre>}<o:p></o:p></pre><pre><span class=pl-k>auto</span> *a = <span class=pl-k>new</span> A();<o:p></o:p></pre><pre><span class=pl-en>ugly_delete2</span>(*a, a);<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>A &<span class=pl-en>foo</span>() {...}<o:p></o:p></pre><pre>A &a = foo();<o:p></o:p></pre><pre><span class=pl-k>if</span> (unknown)<o:p></o:p></pre><pre> <span class=pl-k>delete</span> b;<o:p></o:p></pre><pre><span class=pl-c>// If a and b point to the same object, a.f may not be deref here</span><o:p></o:p></pre><pre><span class=pl-k>if</span> (unknown2)<o:p></o:p></pre><pre> a.f;<o:p></o:p></pre></div><p><strong><span style='font-family:"Calibri",sans-serif'>Garbage Collected Objects (Java)</span></strong> -- LLVM supports two models of GCed objects, the abstract machine and the physical machine model. The later is essentially the same as that for c++ as deallocation points (at safepoints) are explicit. The former has objects conceptually live forever (i.e. reclaimation is handled outside the model).<o:p></o:p></p><div><pre><span class=pl-k>class</span> <span class=pl-en>A</span> { <span class=pl-k>int</span> f; }<o:p></o:p></pre><pre><o:p> </o:p></pre><pre><span class=pl-k>void</span> foo(<span class=pl-smi>A</span> a) {<o:p></o:p></pre><pre> <span class=pl-c1>...</span><o:p></o:p></pre><pre> <span class=pl-c>// a.f is trivially deref anywhere in foo</span><o:p></o:p></pre><pre> x <span class=pl-k>=</span> a<span class=pl-k>.</span>f;<o:p></o:p></pre><pre>}<o:p></o:p></pre><pre><o:p> </o:p></pre><pre><span class=pl-smi>A</span> a <span class=pl-k>=</span> <span class=pl-k>new</span> <span class=pl-smi>A</span>();<o:p></o:p></pre><pre><span class=pl-c1>...</span><o:p></o:p></pre><pre><span class=pl-c>// a.f is trivially deref following it's definition</span><o:p></o:p></pre><pre>x <span class=pl-k>=</span> a<span class=pl-k>.</span>f;<o:p></o:p></pre><pre><o:p> </o:p></pre><pre><span class=pl-smi>A</span> foo();<o:p></o:p></pre><pre>a <span class=pl-k>=</span> foo();<o:p></o:p></pre><pre><span class=pl-c1>...</span><o:p></o:p></pre><pre><span class=pl-c>// a.f is (still) trivially deref</span><o:p></o:p></pre><pre>x <span class=pl-k>=</span> a<span class=pl-k>.</span>f;<o:p></o:p></pre></div><p><strong><span style='font-family:"Calibri",sans-serif'>Rust Borrows</span></strong> -- A rust reference argument (e.g. "borrow") points to an object whose lifetime is guaranteed to be longer than the reference's defining scope. As such, the object is dereferenceable through the scope of the function. Today, rustc does emit a dereferenceable attribute using the current globally dereferenceable semantic.<o:p></o:p></p><div><pre><span class=pl-k>pub</span> <span class=pl-k>fn</span> <span class=pl-en>square</span>(num: <span class=pl-k>&i32</span>) -> <span class=pl-k>i32</span> {<o:p></o:p></pre><pre> num <span class=pl-k>*</span> num<o:p></o:p></pre><pre>}<o:p></o:p></pre><pre><span class=pl-en>square</span>(<span class=pl-k>&</span><span class=pl-c1>5</span>);<o:p></o:p></pre><pre><o:p> </o:p></pre><pre><span class=pl-c>// a could be noalias, but isn't today</span><o:p></o:p></pre><pre><span class=pl-k>pub</span> <span class=pl-k>fn</span> <span class=pl-en>bar</span>(a: <span class=pl-k>&mut</span> <span class=pl-k>i32</span>, b: <span class=pl-k>&i32</span>) {<o:p></o:p></pre><pre> <span class=pl-k>*</span>a <span class=pl-k>=</span> a <span class=pl-k>*</span> b<o:p></o:p></pre><pre>}<o:p></o:p></pre><pre><o:p> </o:p></pre><pre><span class=pl-en>bar</span>(<span class=pl-k>&mut</span> <span class=pl-c1>5</span>, <span class=pl-k>&</span><span class=pl-c1>2</span>);<o:p></o:p></pre><pre><o:p> </o:p></pre><pre><span class=pl-c>// At first appearance, rust does not allow returning references. So return</span><o:p></o:p></pre><pre><span class=pl-c>// attributes are not relevant. This seems like a major language hole, so this</span><o:p></o:p></pre><pre><span class=pl-c>// should probably be checked with a language expert.</span><o:p></o:p></pre></div><h2><a href="https://github.com/preames/public-notes/blob/master/deref+nofree.rst#id6">Migration</a><o:p></o:p></h2><p>Existing bytecode will be upgraded to the weaker non-global semantics. This provides forward compatibility, but does lose optimization potential for previously compiled bytecode.<o:p></o:p></p><p>C++ and GC'd language frontends don't change.<o:p></o:p></p><p>Rustc should emit noalias where possible. In particular, 'a' in the case 'bar' above is currently not marked noalias and results in lost optimization potential as a result of this change. According to the rustc code, this is legal, but currently blocked on a noalias related miscompile. See <a href="https://github.com/rust-lang/rust/issues/54462">https://github.com/rust-lang/rust/issues/54462</a> and <a href="https://github.com/rust-lang/rust/issues/54878">https://github.com/rust-lang/rust/issues/54878</a> for further details. (My current belief is that all llvm side blockers have been resolved.)<o:p></o:p></p><p>Frontends which want the global semantics should emit noalias, nofree, and nosync where appropriate. If this is not enough to recover optimizations in common cases, please explain why not. It's possible we've failed to account for something.<o:p></o:p></p><h2><a href="https://github.com/preames/public-notes/blob/master/deref+nofree.rst#id7">Alternative Designs</a><o:p></o:p></h2><p>All of the alternate designs listed focus on recovering the full global deref semantics. Our hope is that any common case we've missed can be resolved with additional inference rules instead.<o:p></o:p></p><h3><a href="https://github.com/preames/public-notes/blob/master/deref+nofree.rst#id8">Extend nofree to object semantics</a><o:p></o:p></h3><p>The nofree argument attribute current describes whether an object can freed through some particular copy of the pointer. We could strength the semantics to imply that the object is not freed through any copy of the pointer in the specified scope.<o:p></o:p></p><p>Doing so greatly weakens our ability to infer the nofree property. The current nofree property when combined with capture tracking in the caller is enough to prove interest deref facts over calls. We don't want to loose the ability to infer that since it enables interesting transforms (such as code reordering over calls).<o:p></o:p></p><h3><a href="https://github.com/preames/public-notes/blob/master/deref+nofree.rst#id9">Add a separate nofreeobj attribute</a><o:p></o:p></h3><p>Rather than change nofree, we could add a parallel attribute with the stronger object property. This - combined with deref(N) as a point in time fact - would be enough to recover the current globally deferenceable semantics.<o:p></o:p></p><p>The downside of this alternative is a) possible overkill, and b) the "ugly" factor of having two similar but not quite identical attributes.<o:p></o:p></p><h3><a href="https://github.com/preames/public-notes/blob/master/deref+nofree.rst#id10">Add an orthogonal attribute to promote pointer facts to object ones</a><o:p></o:p></h3><p>To address the weakness of the former alternative, we could specify an attribute which strengthens arbitrary pointer facts to object facts. Examples of current pointer facts are attributes such as readonly, and writeonly.<o:p></o:p></p><p>This has not been well explored; there's a huge possible design space here.<o:p></o:p></p></div></body></html>