Memory-safe interoperation between safe and unsafe languages
summary
Describes a practical system that imports C/C++ pointers into Swift as a span safe pointer using counted_by and noescape annotations to encode bounds and lifetime, plus a C extension that enforces bounds with dependent types and wide pointers carrying bound metadata. The compiler inserts bounds checks and uses a constraint elimination pass to remove redundant checks. The extension is open source, in use across millions of lines adopted at Apple with negligible OS-wide performance impact, and is being proposed to the C committee.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 1:07Safe interoperability essentials
- 4:39Safe language boundaries challenges
- 8:17Swift’s safe pointer interoperation
- 10:49Annotations for safety guarantees
- 14:27C extension for bound safety
- 17:20Open research problems
- 19:29Q&A: Compiler optimizations
- 20:55Q&A: C++ memory-safe types
- 22:43Q&A: Swift and Rust interoperability
related talks
01h 26mA Path to Practically Safe C++
17mFat Pointers for Temporal Memory Safety of C
05mThe Safety of Unsafe Swift
01h 30mDangerous Optimizations in C and C++ Programming Languages
39mSafety first
28mDetecting Borrow and Provenance Bugs Across Unsafe Rust [...]
26mMemory Safety Preservation for WebAssembly
45mThe existential threat against C++ and where to go from here