第三届中国 Rust 开发者大会 王俊吉 RustBelt - Rust 的形式化语义模型 Outline Background • RustBelt Project • Rust Types Overview Rust Semantics • Type System • The own Predict • Exclusive Ownership & Mutable Borrow Borrow Examples • Rc Logics • Hoare Logic • Separation Logic Background ERC Project "RustBelt" 2015-2021 Unlike C/C++, Rust is a safe language But, like C/C++, Rust is also an unsafe language There array-index overflow use after free data race array-index overflow ?? ? ... RustBelt Project Background Ralf Jung, et. al. RustBelt: Securing the Foundations of the Rust Programming Language. In POPL 2018:

libfuzzer)：分支覆盖率；用例程序的构造 符号执行(klee, angr)：路径爆炸；求解困难 静态分析(MirChecker, Rudra, SafeDrop)：分析特定问题；假阳性 形式化验证(RustBelt)：无法方便的验证第三方库 其他工具（Miri等）…..... Rust China Conf 2021 – 2022, Online, China API 测试用例合成 出错的API1