Joseph Ferano
69f5d8a05a
A program that wants to load its data once and keep it could not say so. Every move-only global was refused where it was declared, on an argument about the dead set being per function: two functions each freeing the same global would be a double free nothing could see. The argument was sound and the conclusion was too strong. It assumed a global has an owner. It does not. Reading a move-only global is now always a borrow. Nothing may take ownership of one, so nothing may free one, and with no owner to hand over there is no double free left to catch. This is not a general ownership model for globals and is not meant to grow into one: it is sound precisely because the lifetime question that model would exist to answer has a constant answer here, the process's. The refusal lands at the read, which is where a move would have been recorded for a local -- passing the global to something that owns its parameter, binding it to a local, returning it and freeing it all reach the same place, and each is told to borrow instead, or to clone if it really wants something of its own. Such a global is mutable where it stands. push, put, reserve and set already take their target through the borrow path, so a global (Vec u8) is filled and grown in place, and the aliasing that raises is the one every Vec has: spec-memory.md's explicit Zig/Odin contract, where a push that reallocates invalidates a slice taken before it and the dev build's generation word traps on the stale one. Globals get no borrow rule locals do not have, because the hazard is not new and the trap lives on the Vec rather than on the binding. What a move-only global may not do is carry a computed initialiser. A global's initialiser is a link-time constant -- there is no init-at-startup path in the LLVM backend by design, and the x86 backend that has one deliberately leaves it out of a reload module, because re-running an initialiser wipes the live state reloading exists to preserve. So the global starts zeroed, which for a Vec is an empty Vec and therefore a value rather than a placeholder, and the load is an ordinary assignment in whichever function loads it. That is also what makes the data survive: nothing runs between one entry to main and the next, so a re-entered main finds the global as it left it. A defconst cannot be one at all, since a constant is not an assignable place and nothing could ever load it; both refusals name the (defvar g (Vec u8)) that works. The reload fixture gains a global Vec in the host and another that arrives at run time, because that is where declaring instead of defining has teeth: a module that defined the host's Vec would take a zeroed header of its own and strand the block the process is still using, which a re-zeroed i64 cannot demonstrate.
31 lines
1.2 KiB
Plaintext
31 lines
1.2 KiB
Plaintext
;;;; v3 introduces names the host was never built with: a defvar [extra] and a
|
|
;;;; defn [added]. There is no symbol in the running process to bind either to
|
|
;;;; and ELF cannot grow one, so both are keyed by string through
|
|
;;;; runtime/flan_dev.c and resolved once when the module is installed.
|
|
;;;;
|
|
;;;; [bump] is redefined in the same module, which is the point of the unit
|
|
;;;; being a list of forms rather than one function: C-c C-k on a file that
|
|
;;;; adds a var and uses it has to work in one load, or the intermediate state
|
|
;;;; is a module referring to storage that does not exist yet.
|
|
(defvar counter i64)
|
|
(defvar extra i64)
|
|
;;; And a run-time-new one of move-only type: no symbol to bind to, so it goes
|
|
;;; through the by-name registry like [extra], with its declared initial value
|
|
;;; travelling along as a constant. A zeroed Vec is an empty Vec, so that
|
|
;;; constant is a zeroinitializer and the allocation the registry makes is a
|
|
;;; usable Vec rather than a placeholder.
|
|
(defvar fresh (Vec u8))
|
|
|
|
(defn helper [x i64] i64 (* x 2))
|
|
|
|
(defn added [] i64
|
|
(set extra (+ extra 7))
|
|
extra)
|
|
|
|
(defn bump [] i64
|
|
(println "v3")
|
|
(set counter (+ counter (added)))
|
|
(helper counter))
|
|
|
|
(defn outer [] i64 (bump))
|