Rewriting Bun in Rust | Lobsters

To add more context around lifetime errors and TigerBeetle’s particular style guide:

Many projects opt to answer these kinds of questions through a style guide. TigerBeetle’s TigerStyle is an example in Zig and Google’s 31,000 word C++ style guide is another. The challenge with style guides is enforcement.

TigerStyle is a bit more than just a style guide. The key rule for this discussion, uplifted straight from of NASA, is static memory allocation: all memory is allocated in the startup phase, and there’s absolutely zero allocs afterwrads . This plus crash only design means that we never call free.

This rule is self-enforcing and compositional, in Zig. There’s no global memory allocator, so the code after startup simply hasn’t the API to allocate. You can’t circumvent this by accident. Of course, if the programmer is byzantine, they can stuff allocator in the global, or just directly mmap and unmap pages of memory, but, at our scale, we don’t have problems with that. This is a similar in kind (not degree) to Rust, where untrusted code generally can circumvent safety guarantees, even without literally spelling unsafe.

And, naturally, never freeing goes a long way towards solving many memory errors by construction. Empirically, they just haven’t been a problem for TigerBeetle. It’s hard to untangle contribution of static allocation in particular from everything else we are doing, but it would make sense for it to play a leading role.

(As a footnote, we aren’t actually do static allocation to avoid memory errors, we use it as a linter to check that every quantity has a known logical static limit, the main property we care about)