4 ms·
"I'm relieved to hear that at least it doesn't pollute beyond module boundaries." This isn't true, it is easy to come up with an example where lack of safety s
by fmstephe 11y ago
"I'm relieved to hear that at least it doesn't pollute beyond module boundaries."
This isn't true, it is easy to come up with an example where lack of safety spreads past module boundaries.
impl Vec<T> {
pub fn evil(&mut self, len: i32, cap: i32) {
self.len = len;
self.cap = cap;
}
}
If we want to know our program is broken now, we need to look across all of the source code to see if evil is called in breaking ways.
The point was that Rust provides abstraction facilities which allow us to contain these invariants. If we are careful.
- ralfj 11y agoThis is not a counter-example to the claim you are citing. If you added this form of `evil` to `Vec`, then since `evil` is within the module, the proof of correctness has to cover `evil`. Doing that proof will fail. So, it is not necessary to look outside of the module to notice that something is wrong. Of course, if `len` were public, that would be a different story. Unsafety doesn't pollute beyond module boundaries if all the extra invariants are about private fields.
- Manishearth 11y ago`len` and `cap` are private fields and can't be accessed outside the module boundary, even by an impl.
- phaylon 11y agoI've been wondering if it would make sense to encapsulate internal fields that are part of the unsafe machinery in a type forcing you to use unsafe blocks, even inside the type impl. [edit: Removed note about UnsafeCell since it's not really like the thing described above] I haven't really played with it though, most of my unsafe use is FFI.
- Manishearth 11y agoYou can, but IMO it's not so necessary. The module boundary thing doesn't cause many issues in practice is straightforward to reason about if you're aware of it. (And if you weren't aware of it you would probably not use `UnsafeField` either, since the compiler can't force you to do that)
- phaylon 11y agoI'm more thinking about the documentation effect of such a wrapper type. Both in the data structure and in the parts of the code that are foced to use unsafe.
- ralfj 11y agoI suggested something kind-of-similar at <https://internals.rust-lang.org/t/pre-rfc-unsafe-types/3073> https://internals.rust-lang.org/t/pre-rfc-unsafe-types/3073>