21–30 of 105 posts
Earlier quoted context omitted.
To put a point on this question: should an unsafe language (or language subset) be as safe as possible, or as unsafe (i.e. powerful) as possible?
Unsafe Rust is a superset, not a subset, incidentally.
Take off every zig... for great justice!
Earlier quoted context omitted.
> The major difficulty here is that in general, unsafe pieces of code cannot be safely composed, even if the unsafe pieces of code are individually safe. This allows you to bypass runtime safety checks without unsafe code just by composing "safe" modules that internally use unsafe code in their implementation. This comment suggests you don't have much domain knowledge about how `unsafe` in Rust works, so I'm surprise…
Correct me if I’m wrong but I thing GP was stating that composing two “unsafe” blocks together (both of which are manually verified to work well) might interfere with each other when run simultaneously.
Earlier quoted context omitted.
Unsafe Rust is a superset, not a subset, incidentally.
It seems to me that "unsafe" Rust is a subset of Rust as a whole. Unless the Rust language does not support unsafe code at all?
Sure. When people say "Rust" they usually mean "safe Rust". But if we consider "Rust" as a whole, "Safe Rust", and "Unsafe Rust", then:
Rust is Unsafe Rust
Safe Rust is a subset of Unsafe Rust (and therefore Rust).
Earlier quoted context omitted.
Unsafe Rust is a superset, not a subset, incidentally.
It seems to me that "unsafe" Rust is a subset of Rust as a whole. Unless the Rust language does not support unsafe code at all?
Earlier quoted context omitted.
> The major difficulty here is that in general, unsafe pieces of code cannot be safely composed, even if the unsafe pieces of code are individually safe. This allows you to bypass runtime safety checks without unsafe code just by composing "safe" modules that internally use unsafe code in their implementation. This comment suggests you don't have much domain knowledge about how `unsafe` in Rust works, so I'm surprise…
Correct me if I’m wrong but I thing GP was stating that composing two “unsafe” blocks together (both of which are manually verified to work well) might interfere with each other when run simultaneously.
If there is any way in which a function containing an `unsafe` block may be used unsafely (specifically, violating memory-safety), then that function must also be marked as unsafe.
Rust is a language that offers you lots of compile time checks, and an escape hatch called unsafe that says “trust the programmer here.” Yes, it is possible—and easy—to make mistakes in the place where you have asked to be trusted, not checked. We have a big pedagogical task ahead of us in teaching safe practices for unsafe Rust, and defensive coding practices in unsafe Rust. We should also think of if we can improve…
Rust's approach to "unsafe" is to let the programmer do whatever they want. Having to use this for UNIX-type API calls is kind of lame. I once proposed extending C to allow talking about array sizes.[1] You'd define "read" as int read(int fd, char &buf[len], size_t len); The compiler now knows that "buf" is an array with length "len", and can check calls for "buf" being the right size. The generated code for the call…
That would be a very useful, and relatively unobstrusive, extension to C. I've always liked the idea of a C "strict mode". I wish the political problems weren't so hard.
I'd like to see a C equivalent of this, just for comparisons sake to zig
#include
#include
typedef struct {
int32_t a;
int32_t b;
} Foo;
int main(void)
{
uint8_t array[1024];
memset(array, 1, sizeof(array));
Foo *foo = (Foo*)(&array[0]);
foo->a += 1;
}
It appears that the array is aligned with the minimum ABI requirement 16 by default? May be a note of this in the standard, can't recall of the top of my head.
%array = alloca [1024 x i8], align 16
...
%6 = load i32, i32* %5, align 4
...
store i32 %7, i32* %5, align 4
#include
#include
#include
typedef struct {
int32_t a;
int32_t b;
} Foo;
int main(void)
{
uint8_t alignas(alignof(Foo)) array[1024];
memset(array, 1, sizeof(array));
Foo *foo = (Foo*)(&array[0]);
foo->a += 1;
}
%array = alloca [1024 x i8], align 4
...
%6 = load i32, i32* %5, align 4
...
store i32 %7, i32* %5, align 4I'd like to see a C equivalent of this, just for comparisons sake to zig