Live data from Hacker News

Rav1e: An experimental AV1 video encoder, designed to be fast and safe

github.com

71–76 of 76 posts

Re: Rav1e: An experimental AV1 video encoder, designed to be fast and safe

#71
post #64

Earlier quoted context omitted.

Pretty much only use-after-free and double-free of that list is truly solved by unique_ptr, which is great, but nothing like what you say: - std::move out of a unique_ptr x and "*x" is a null pointer dereference, - take a reference into a unique_ptr, and it becomes dangling if it is held after the pointer is deallocated, - an T[N] array doesn't get bounds-checked whether or not it is stored in a std::unique_ptr (it i…

Clang does a good number of warnings/errors on unique_ptr, and I'm not sure your first point is actually right - it tends to be pretty hard to use after move. If you want to pay the cost of runtime array checking every time, an impl in operator[] is just a few lines long. Thankfully it is becoming more common to run programs under ASAN in dev mode.

It is trivial to use-after-move. The following compiles completely without warnings with the clang on my system (even with -Wall -Weverything), and segfaults:

  #include 
  
  int main() {
    std::unique_ptr p = std::make_unique(0);
  
    std::unique_ptr q(std::move(p));
  
    return *p;
  }
Maybe you mean it doesn't happen much in practice, which might be true (although, we need to be comparing use-after-move with use-after-free etc., which also don't happen that much, per line-of-code), but is a different point. The fact remains that unique_ptr doesn't solve use-after-move.

> If you want to pay the cost of runtime array checking every time, an impl in operator[] is just a few lines long

This is also a different point, and moving the goal posts.

In any case, which operator[] exactly? AFAIK, neither T[N] nor T* can have a custom operator[] (and getting the bounds of a raw pointer is essentially impossible), and none of the operator[]s of std::array nor std::vector nor std::span do bounds checking (sure, you can use ...::at for the first two, but you have to remember to do that everywhere, going against the default that pretty much every programming language uses).

> Thankfully it is becoming more common to run programs under ASAN in dev mode.

Yes, this is great! However, this is yet another different point, and it is orthogonal to modern C++ and its fancy new features like std::unique_ptr: C++98 code, and even C code benefit from ASan.

Re: Rav1e: An experimental AV1 video encoder, designed to be fast and safe

#72
post #7

Earlier quoted context omitted.

It's probably not quite equivalent but I believe Frederico & al found & fixed a number of issues when they converted librsvg to rust. You may want to check the archives on their blogs (IIRC it's split between Frederico's own and the librsvg one) for more, or specifics. But "safe" rust at least intrinsically protects from use-after-free, double free, dangling pointers, null-pointer dereferences, out-of-bounds accesses…

All of the pointer issues you mentioned have already been solved in C++ by unique_ptr.

unique_ptr helps with one thing and one thing only: memory leaks.

The list you were responding to didn't include memory leaks.

Re: Rav1e: An experimental AV1 video encoder, designed to be fast and safe

#73
post #64

Earlier quoted context omitted.

Pretty much only use-after-free and double-free of that list is truly solved by unique_ptr, which is great, but nothing like what you say: - std::move out of a unique_ptr x and "*x" is a null pointer dereference, - take a reference into a unique_ptr, and it becomes dangling if it is held after the pointer is deallocated, - an T[N] array doesn't get bounds-checked whether or not it is stored in a std::unique_ptr (it i…

Clang does a good number of warnings/errors on unique_ptr, and I'm not sure your first point is actually right - it tends to be pretty hard to use after move. If you want to pay the cost of runtime array checking every time, an impl in operator[] is just a few lines long. Thankfully it is becoming more common to run programs under ASAN in dev mode.

> I'm not sure your first point is actually right - it tends to be pretty hard to use after move.

    std::unique_ptr foo(new int(10));
    
    void bar(int& x);
    
    int main() {
        bar(*foo);
        return 0;
    }
    
    void bar(int& x) {
        foo = std::unique_ptr(new int(20));
        std::cout 
No warnings on any warning level.

Re: Rav1e: An experimental AV1 video encoder, designed to be fast and safe

#74
post #60

Earlier quoted context omitted.

Good, now try to enforce developers to actually use it on their code and all third party libraries they link to. Ah, and not passing it around by address or reference, instead of actually moving ownership. C++17 is a great improvement, but for it to work out in this context, developers need to actually write C++ instead of "C with C++ compiler".

This is a silly argument. When evaluating whether to use a tool, you should consider how /you/ would use the tool, not how someone else does.

Yeah, it kind of works out in the ideal world where one works alone, writing 100% of the source code.

Re: Rav1e: An experimental AV1 video encoder, designed to be fast and safe

#75
post #62

Earlier quoted context omitted.

The fact is that the Linux kernel without the APIs copied from POSIX/UNIX and the userspace copied from UNIX is useless on the server space. Of course we can play semantic games about the use of UNIX word, and GNU/Linux not sharing any code from either BSD or AT&T linage, it doesn't make it any less UNIX. Had Linux not copied UNIX, and provided a playground for UNIX vendors kind of outsource their development costs,…

NT had POSIX subsystem too. What Linux (and NT POSIX to certain degree) allowed, was to move the existing investment in software from hodge-podge of mutually incompatible, but expensive UNIX systems, to somewhere else.

NT isn't a copy of UNIX, just because it had support for the first edition of POSIX, it goes beyond than that.

Starting by wanting to copy Minix, an educational OS that copied UNIX, getting the GNU tools on board (which goal was to copy UNIX), kernel architecture, device drivers subsystems, userland, culture, ....

My old stack of Linux Journal editions at home are pretty clear what the ongoing story was.

If NT was a copy of anything, it was VMS given Dave Cutler's contribution to its design.

Re: Rav1e: An experimental AV1 video encoder, designed to be fast and safe

#76

Earlier quoted context omitted.

While I do believe that rust will prevent many memory safety issues. I think you would probably catch a bunch of safety issues rewriting any code.

I think you would probably catch a bunch of safety issues rewriting any code. As well as introduce new ones.

That's only if you rewrite "from the design" in a fresh repo.

If, on the other hand, you rewrite the code line by line from C to Rust (which Rust is actually quite amenable to!), faithfully translating the semantics of the C code into the Rust code (and thereby having to use lots of unsafe{} blocks) then you can avoid most of the problems—what you'll end up with will essentially be the same as what a hypothetical C-to-Rust transpiler would output.

Importantly, you can also translate the test suite in this same way.

After that step is done, you can just refactor the resulting code, replacing unsafe{} blocks with Rust idioms, and then rerunning the tests (which you can leave un-idiomatized) as regression tests.

Post reply on HN