4 ms·
Can someone tell me how this language is supposed to be any degree of 'safe' when things like this compile (without warning, on Nightly rustc) and "panic"? Rust
by ue_ 10y ago
Can someone tell me how this language is supposed to be any degree of 'safe' when things like this compile (without warning, on Nightly rustc) and "panic"? Rust is about as safe as C.
fn main() {
let a = 4;
let v = [0,1,2,3];
println!("{}", v[a]);
}
result:
rustc 1.15.0-nightly (71c06a56a 2016-12-18)
thread 'main' panicked at 'index out of bounds: the len is 4 but the index is 4', <anon>:4
note: Run with `RUST_BACKTRACE=1` for a backtrace.
- dbaupp 10y agoBeing safer isn't all or nothing. Even if a getting a guaranteed panic on array out of bounds was nearly as unsafe as the undefined behaviour of C in that case (it isn't, at all), Rust still mitigates many of C's other most dangerous problems.
- steveklabnik 10y agoA panic can not lead to memory unsafety, unlike the same code in C.
- snakeanus 10y ago> unlike the same code in C. What makes you think so? I am aware of multiple implementations that add bounds checking. There is nothing in the standard that forces it to be unsafe.
- szemet 10y agoDoes the standard force it to be safe? If not, then the parent comment is true: "the same code in C ... can lead to memory unsafety"
- deleted 10y ago[deleted]
- steveklabnik 10y agoI have never worked with one or come across it, only libraries that can add it through a different syntax. Do you have some references, or projects that require using it? I didn't think such a thing was standards-compliant but I'm also not an expert on the standard.
- snakeanus 10y agoHave you never worked with or come across gcc or clang? Sounds quite a bit surprising to be honest. What implementation are you using? I use the following safety arguments in gcc 6.2.1: -fsanitize=undefined -fsanitize=address -fno-omit-frame-pointer -D_FORTIFY_SOURCE=1 I am also aware of https://staff.aist.go.jp/y.oiwa/FailSafeC/index-en.html https://staff.aist.go.jp/y.oiwa/FailSafeC/index-en.html, http://www.seclab.cs.sunysb.edu/mscc/ http://www.seclab.cs.sunysb.edu/mscc/, http://compcert.inria.fr/compcert-C.html http://compcert.inria.fr/compcert-C.html and http://pages.cs.wisc.edu/~austin/scc.html http://pages.cs.wisc.edu/~austin/scc.html
- steveklabnik 10y agoAh, you're counting sanitizers here. I mean the core language itself. gcc, without those flags, will happily compile and run that C code without any complaints at all. (I have 4.8 locally, it does not understand the "undefined" one, but the address one seems to infinite loop? which is very strange.) That doesn't mean that I think static analysis tooling is bad, or invalid or something! (I forgot about CompCert, but I've never run across any of the other ones in the wild.)
- pjmlp 10y agoSanitizers aren't part of ANSI C. Besides, gcc and clang are just two of many C compilers. https://en.wikipedia.org/wiki/List_of_compilers#C_compilers https://en.wikipedia.org/wiki/List_of_compilers#C_compilers
- snakeanus 10y ago> Sanitizers aren't part of ANSI C. Nobody claimed that they were. I only mentioned that there are C implementations that protect against these kinds of things in the runtime and that the standard does not force the implementation to not do any checks. > Besides, gcc and clang are just two of many C compilers. The reason that I mentioned them was because they are two most popular ones.
- timdierks 10y agoWhat would you have it do? Solving the general dataflow problem so you identify out-of-bounds array accesses at compile-time is impossible (equivalent to the halting problem), so would it really be worth investing in identifying in finding them in simpler cases, particularly since simple cases are much less likely to make it to deployment anyway? And if you don't find the problem before runtime, what's a better strategy than panicking here?
- masklinn 10y ago> What would you have it do? I believe dependent types would yield a compile-time error. I also believe dependently typed languages are an active research area, even ignoring the usability perspective.
- progval 10y agoUse v.get(a). v[a] is equivalent to v.get(a).unwrap(a), and unwrap() may panic.
- C4K3 10y agoNote, I get warning: this expression will panic at run-time when compiling it, but that's besides the point. Panicking is exactly what makes it memory safe, it doesn't access any out of bounds memory. Write an equivalent program in C, and nothing will error, but instead will output something like 140733019311920. Which of those is preferable?
- ue_ 10y agoWhat code did you use to make it print that error? I only get that error if I access the array directly with a subscript (i.e using the constant 4 instead of 4 stored in the variable 'a').
- steveklabnik 10y agoYes, the warning is very limited at the moment.