Earlier quoted context omitted.
I know and agree that unsafe Rust is problematic, but that criticism of this is missing the forest for the trees. The original code is just as unsafe. Refactoring from unsafe Rust into safe Rust manually is likely to be easier than directly from C into Rust: one is only trying to deal with one small delta (like changing length/pointer arguments into a slice) rather than also having to deal with syntax changes and too…
> The original code is just as unsafe. But the translated code being unreadable to humans adds a whole new layer of "unsafe".
C2Rust: translate C into Rust code
71–79 of 79 posts
Re: C2Rust: translate C into Rust code
#72Earlier quoted context omitted.
I know and agree that unsafe Rust is problematic, but that criticism of this is missing the forest for the trees. The original code is just as unsafe. Refactoring from unsafe Rust into safe Rust manually is likely to be easier than directly from C into Rust: one is only trying to deal with one small delta (like changing length/pointer arguments into a slice) rather than also having to deal with syntax changes and too…
> The original code is just as unsafe. But the translated code being unreadable to humans adds a whole new layer of "unsafe".
That is to say, I don't think humans should be reading or maintaining this code for more than it takes to refactor to be safe(r). (Whether this is how this sort of tool is used in practice is a different question, and one that definitely needs to be considered.)
Re: C2Rust: translate C into Rust code
#73Earlier quoted context omitted.
I know and agree that unsafe Rust is problematic, but that criticism of this is missing the forest for the trees. The original code is just as unsafe. Refactoring from unsafe Rust into safe Rust manually is likely to be easier than directly from C into Rust: one is only trying to deal with one small delta (like changing length/pointer arguments into a slice) rather than also having to deal with syntax changes and too…
>The original code is just as unsafe. That assumes zero translation errors as well as the original C code not relying on a particular compiler's specific implementation of unspecified behavior.
As for unspecified behaviour... that's true! Again I wonder if clang is a useful component here: I suspect if C code behaves correctly with clang, then the translation to Rust compiled with rustc probably works too, both because the translator uses clang, and because both compilers use LLVM.
The point (in contrast to the usual complaint of Animats) I was trying to convey, but was nitpicked was: a correct translation from fully-specified C to unsafe Rust doesn't add any unsafety. Whether this applies in practice is slightly different, but there's questions about whether pretty much any statement about C code applies in practice: since undefined behaviour is so rife and easy to trigger, many/most programs are outside the specification (fuzzing C programs often results in segfaults---undefined behaviour---and so the program is outside the bounds of C).
Wrapping up, I'll emphasise that the value in this sort of translation is as a stepping stone towards safe Rust, not as a final `unsafe` product.
Re: C2Rust: translate C into Rust code
#74Earlier quoted context omitted.
Is that benefit worth the potential for inaccurate translation? Or is it possible to be 100% certain that the Rust functions identically to the C?
Well if you translate it to safe rust at least the worst that could happen is a design flaw. And you can write oracle tests to catch those.
That's still pretty bad, especially for low-level legacy libraries that aren't supposed to break userspace under any circumstances.
Re: C2Rust: translate C into Rust code
#75I think the next step would be to have a tool that can convert C into safe Rust with a combination of static analysis and framework/program-specific user-written rules to translate specific C framework constructs into Rust equivalents. An eventual goal could be for instance to automatically translate the Linux kernel with the aid of a lot of custom rules to handle its constructs.
I've tried to do that with my translator: https://gitlab.com/citrus-rs/citrus#readme Refactoring C to Rust code is hard . It's not enough to derive bits of information function by function. Often you need to re-architect the whole approach, which is a Sufficiently Smart Compiler problem. Until I've tried it I did not fully realize just how much C uses pointers. Pointer soup is everywhere (and hardly any explicit leng…
Basically one-to-one but with errors in Rust because it's unsafe, and then let the programmers deal with the error codes. That still sounds like a valuable tool since it would take some parts of the boilerplate out of the equation.
Re: C2Rust: translate C into Rust code
#76Earlier quoted context omitted.
The premise here must be that the translator (human) has the original C code. So answering questions like "is this an array" is as simple as reading the C code to determine that. Allocating too much space or getting a subscript error seems preferable to unsafety, and something one can hammer out with oracle testing. Actually, it would be cool if there were generated quickcheck-like oracle testcases alongside this so…
So answering questions like "is this an array" is as simple as reading the C code to determine that. If only. Here's the original function definition: void insertion_sort(int const n, int * const p) "p" is really an array. But C doesn't know that. Rust needs to know. Around 2010, I proposed an extension to C [1] in which you'd write that as void insertion_sort (int const n, int& p[n]) Instead of a pointer, you'd use…
Re: C2Rust: translate C into Rust code
#77Earlier quoted context omitted.
Well if you translate it to safe rust at least the worst that could happen is a design flaw. And you can write oracle tests to catch those.
> the worst that could happen is a design flaw That's still pretty bad, especially for low-level legacy libraries that aren't supposed to break userspace under any circumstances.
Re: C2Rust: translate C into Rust code
#78This either does not work well OR there is no need for rust to exist. Is there a pressing need for rust code that is as unsafe as c?
Re: C2Rust: translate C into Rust code
#79Earlier quoted context omitted.
>The original code is just as unsafe. That assumes zero translation errors as well as the original C code not relying on a particular compiler's specific implementation of unspecified behavior.
Your first point is of course true, but most statements about the behaviour of code needs to have "assuming no bugs" appended to it, so I'm not sure that it's a particularly interesting point. A more precise interpretation might be that the translator is likely to have more bugs than other components in the pipeline (the compilers and linkers etc.), since it is unlikely to be used nearly as much as them; I wonder if…
The approach we've taken so far with C2Rust is to build compiler plugins that instrument C and Rust code so we can dynamically check their behavior when fed the same input.