A CIL Tutorial - Department of Computer Science - ETH Zürich

CHAPTER 8. DEPENDANT TYPE QUALIFIERS 69
$ ciltutcc --enable-tut8 -o tut8 test/tut8.c
which completes successfully, but when we run it:
$ ./tut8
test/tut8.c:40 Bad color coercion: (50,50,50) > (10,10,10)
a runtime type-check assertion fails at the call to bar, as expected.
8.3 Exercises
1. The visitor does not check casts, though this is another obvious place to check color compatibility.
Add code to the visitor for checking casts, but change the static and runtime
type-checks so that only a warning is emitted if colors for a cast are not compatible. (If the
programmer is adding an explicit cast, maybe they know what they're doing.)
2. In Chapter 7 we recursively descended into types, checking color compatibility at all levels.
Extend this code to do similar checking.
3. When a variable is the target of an assignment, then all types that reference it are changed.
The new types must be included in the corresponding old types. In order to capture all cases
in which an assignment may change a type, we must place restrictions on the expressions
that may appear in types. What are these restrictions? Modify this code to enforce those
restrictions, and to place appropriate runtime checks when an assignment may change a type
(i.e. inclusion checks for the types pre- and post-assignment).
4. Create an optimization visitor or dataow analysis that removes checks that we can be sure
will always succeed.
8.4 Further Reading
Deputy [2] is an extension to C's type-system that adds dependent type-qualiers that track the
length of memory buers. In performing type-checking, the compiler adds runtime checks to the
program whenever pointer arithmetic is performed (or any variable mentioned in a type-qualier
may be modied), since doing so may alter a type.
Shoal [1] is also an extension to C's type-system that adds dependent type-qualiers that allow
the compiler to track membership of an object in a pointer-based data-structure. In particular, the
type of an external pointer into a data-structure may be qualied by a pointer to a distinguished
member of the data-structure (i.e. the root of a tree). This has the result that the number of
external pointers into a data-structure can be tracked simply by counting the number of pointers
qualied by pointers to the distinguished member. In Shoal this is used to check the safety of
converting pointer data-structures from thread-private to thread-shared and back again.