Live data from Hacker News

Rust and the Future of Systems Programming [video]

hacks.mozilla.org

411–420 of 511 posts

Re: Rust and the Future of Systems Programming [video]

#411
post #49

Earlier quoted context omitted.

Would it make sense to have a cargo/rustc flag to disable unwrap and friends when building for production?

To put this into perspective, this would also necessarily disable expressions of the form `xs[i]` where `xs` is a slice. Why? Because `xs[i]` is equivalent to `*xs.get(i).unwrap()`. In other words, banning unwrap isn't really that productive because an unwrap, when properly used, is an expression of a runtime invariant. The problem is that unwrap can be very easily misused as an error handling strategy in a library,…

Sometimes I do wish I could disable the indexing syntax, though. :P At least in my own code, I find that I naturally reach for iterators rather than doing any manual indexing.

Re: Rust and the Future of Systems Programming [video]

#412
post #311
post #253

Earlier quoted context omitted.

This is something you do often in JavaScript, for example: "You have " + messages + " new messages"

"You have undefined new messages" Glorious!

It's very easy to spot the error here, compared to for example a segfault.

Re: Rust and the Future of Systems Programming [video]

#413

Earlier quoted context omitted.

Linked data structures in Rust get complicated, though. See the "Too many lists" book.[1] Doubly linked lists, or trees with backlinks, are especially difficult. Either you have to use refcounts, or the forward pointer and backward pointer need to be updated as an unsafe unit operation. There might be an elegant way to do this with swapping, but I'm not sure yet. [1] http://cglab.ca/~abeinges/blah/too-many-lists/book…

Right, so you implement them with unsafe. While you can implement doubly linked lists safely with refcounting, you're perfectly free to implement them with unsafe code. This is what unsafe code is for , designing low level abstractions with clean API boundaries. (Also I don't see how this is relevant at all)

Right, so you implement them with unsafe.

If you need unsafe code for basic operations within the language, something is wrong with the language. This isn't about talking to hardware, or an external library. It's pure Rust code.

(Some pointer manipulations can be built from swap as a basic operation. That may work for doubly-linked lists. The other big problem is partially valid arrays, such as vectors with extra space reserved. There's no way to talk about that concept within the language. There could be, but this isn't the place to discuss it.)

Re: Rust and the Future of Systems Programming [video]

#414
post #253

Earlier quoted context omitted.

This is something you do often in JavaScript, for example: "You have " + messages + " new messages"

So, since we're talking about Rust... print!("You have %d new messages", messages) Was that supposed to make me want to abandon all type safety and embrace a GC'd language that runs in a VM?

There are advantages to GC, even Rust has runtime GC. But where is the memory freed ? You don't have to think of that at all in JavaScript. Also when something goes wrong with types in JavaScript the worst case scenario is "2"+2 turns into "22" witch is easy to avoid, compared to a silent overwrite/overflow. Even if the types in JavaScript is very loose, they are much safer.

Re: Rust and the Future of Systems Programming [video]

#415
post #395
post #253

Earlier quoted context omitted.

This is something you do often in JavaScript, for example: "You have " + messages + " new messages"

And in Java, and in any language with operator overloading

operator overloading and meta is very nice, but can add a lot of complexity.

Re: Rust and the Future of Systems Programming [video]

#417

Earlier quoted context omitted.

> The problem is that you still need extra annotations. Namely lifetime annotations Well, the idea is not to have the static analyzer verify typical C++ code. Just some practical subset. So for example I think it's quite practical to write C++ code that uses only "scope" pointers (basically pointers to objects on the stack) and (not-null) refcounting pointers, that intrinsically don't outlive their targets. Lifetimes…

> So wait, what more does Rust's static analyzer give us again? Does it somehow remove the need for refcounting heap objects? Refcounting is rarely needed because most sharing is done via "borrows", which usually work via scope-tied "references" which may point to either the stack or the heap. Implementing and enforcing local scope pointers in C++ via static analysis is not hard. Making it possible to thread borrows…

> Right, but at this point you have a very weird looking subset of C++

It's a little weird looking at first glance, but ultimately it's not really that weird. The main unfamiliar thing is that objects that are going to be the target of a (safe) pointer need to be declared as such. So

    {
        std::string s1;
        auto s1_ptr = &s1;
    }
becomes

    {
        mse::TXScopeObj s2;
        auto s2_ptr = &s2;
    }
s2 acts just like a regular string. It's just wrapped in a (transparent) type that overloads the & (address of) operator so that s2_ptr is a safe pointer. (For example, in this case s2_ptr cannot be retargeted or set to null).

> that can't seamlessly integrate with other libraries,

Sure it can, that's the point. For example:

    {
        std::string s1 = "abc";
        mse::TXScopeObj s2 = "def";
        auto s2_ptr = &s2;
        std::string s3 = s1 + s2; // s2 totally works where an std::string is expected
        s3 += *s2_ptr;
        *s2_ptr = s1; // and vice versa
    }
> and can't be translated to from regular C++ without significant human intervention --

Umm, it could be automated, but you would need a tool that can recognize object declarations. But modern C++ code is mostly safe already. I mean you're supposed to try to avoid pointers in favor of standard containers and iterators. So just replace your "std::vector"s with "mse::mstd::vector"s and your "std::array"s with "mse::mstd::array"s and you're mostly there.

> why not just use Rust?

My impression is that Rust has been evolving a lot. Is the language stable now? Is it time to jump in? Has it vanquished D as the successor to C++? Are we happy with Rust's solution for exceptions?

Even if Rust is the future, and the future is here, I'm still stuck with existing C++ projects. And I'd feel better if they were (at least mostly) memory safe. There must be others in the same boat.

Re: Rust and the Future of Systems Programming [video]

#418
post #136

Earlier quoted context omitted.

I wouldn't hold your breath for C to die though. C sucks at many things, but it's pretty good in embedded, if you're not writing ASM.

Actually, the only real advantage that C has over rust there is the availability of trimmed libcs.

A load more developers as well?

Re: Rust and the Future of Systems Programming [video]

#419

Earlier quoted context omitted.

> OK, so you can't use references. Then, as I said before, your pointer replacements have a runtime performance cost worse than GC write barriers. The library provides three types of pointers - "registered", "scope" and "refcounting". I believe you are referring to the registered pointers, that indeed have significant cost on construction, destruction and assignment. But registered pointers are really mostly intended…

Hmm, a more practical approach might be to mirror the GC languages and only permit (not-null) refcounting pointers as elements of dynamic containers such as vectors. Ensuring that all references don't outlive their targets, thereby eliminating the implicit "this" pointer issue. I think. Is that how Rust does it?

> Is that how Rust does it?

No, safe Rust only has safe references, and that includes "this" ("self" in Rust). Because the lifetimes are part of the type, it does not require the runtime overhead of reference counting.

Re: Rust and the Future of Systems Programming [video]

#420
post #400

Earlier quoted context omitted.

What other programming languages do you know of that have an 'absolutely amazing' GC implementation? Wouldn't you like that answer to be 'lots'? The Java team has worked a lot longer and a lot harder on this problem than pretty much everyone else, and even they hit a wall at 1GB. One that took a dreadfully long time to overcome (so long in fact, that it contributed to me being an ex Java developer)

Java has quite a few very good GCs, some in OpenJDK, some by Oracle, and one by Azul. Quite a few of them don't have a 1GB wall. They will become even better when Java finally gets value types and the GC won't have to work hard to do stuff it doesn't have to (this is why Go has decent GC performance even though its GC isn't very sophisticated). In any event, I don't see how Rust can make the work any easier. Coming u…

s/Oracle/IBM
Post reply on HN