3 ms·

I might be missing something, but this seems to require ownership annotations on all functions, e.g. a compatible and correct prototype for `fclose` to correctl

I might be missing something, but this seems to require ownership annotations on all functions, e.g. a compatible and correct prototype for `fclose` to correctly note that the owned `FILE *` is moved into the call. If that's correct, then this is somewhat practically limited: either pre-existing codebases will need to be retrofitted with an essentially bespoke set of macros, or the compiler will need to be "fail open" by default. The tradeoffs between these two are hard (substantial developer pain versus being ineffective against the bulk of a compiled program's API surface). (Also, this design appears to be for temporal safety only, not spatial safety. But again I might have missed something.)

JonChesterfield 3y ago
Compilers cheat when working with known libraries - they don't need annotations on known functions, much like they don't need the specific implementation of them to know the semantics. This occasionally goes wrong when the compiler assumes any function with a given name must be that function from libc, e.g. the programmer writes a function called `sin`, there's a risk of it being mistaken for the libm function.
- woodruffw 3y ago
  Right. It's less known libraries I'm worried about (libc can easily be layered over, as you've said) and more unknown ones. In particular: there are a lot of ~universally used libraries with ludicrously complex C APIs that undergo significant own/borrow semantic changes between releases. Things like OpenSSL. These libraries will need to carry these annotations upstream for correctness and up-datedness reasons.
thradams 3y ago
currently cake uses existing msvc and gcc headers. These headers does not have any owner qualifiers. The temporary solution, is the re-declare the malloc etc when compiling with cake and not complain withe the function signature difference only by owner qualifiers. if this ownership were standard then gcc and mscv headers would have the qualifiers there enabled or not , but they would be there.

JonChesterfield 3y ago

Compilers cheat when working with known libraries - they don't need annotations on known functions, much like they don't need the specific implementation of them to know the semantics. This occasionally goes wrong when the compiler assumes any function with a given name must be that function from libc, e.g. the programmer writes a function called `sin`, there's a risk of it being mistaken for the libm function.

woodruffw 3y ago
Right. It's less known libraries I'm worried about (libc can easily be layered over, as you've said) and more unknown ones. In particular: there are a lot of ~universally used libraries with ludicrously complex C APIs that undergo significant own/borrow semantic changes between releases. Things like OpenSSL. These libraries will need to carry these annotations upstream for correctness and up-datedness reasons.

thradams 3y ago

currently cake uses existing msvc and gcc headers. These headers does not have any owner qualifiers. The temporary solution, is the re-declare the malloc etc when compiling with cake and not complain withe the function signature difference only by owner qualifiers. if this ownership were standard then gcc and mscv headers would have the qualifiers there enabled or not , but they would be there.