Selective Ownership: Combining Object and Type Hierarchies for Flexible Sharing

Most ownership systems enforce a tree topology on a program’s heap. The tree topology facilitates many aspects of programming such as thread synchronization, memory management, and program verification. Ownership-based verification techniques leverage the tree topology of an ownership system (and hence the fact that there exists a single owner) to restore sound modular reasoning about invariants over owned objects. However, these techniques in general restrict sharing by limiting modifying access to an owned object to the object’s owner and to other objects in that owner’s ownership tree. In this paper, we introduce selective ownership, a less rigid form of ownership. The key idea is to structure the heap in two ways, by defining an order on a program’s type declarations and by imposing ownership on selected objects. The order on type declarations results in a stratified program heap but permits shared, modifying access to instances further “down” in the heap topology. By superimposing object ownership on selected objects in the heap, programmers can carve out partial sub-trees in the heap topology where the objects are owned. We show how selective ownership enables the modular verification of invariants over heap topologies that subsume shared, modifiable sub-structures. Selective ownership has been elaborated for our programming language Rumer, a programming language with first-class relationships, which naturally give rise to an ordering on type declarations.