5 ms·
Amen. I just spent ~1.5 days tracking down a dangling pointer bug in interop code from Rust to C. It's so easy to do when you don't have lifetimes on pointers.
by vvanders 10y ago
Amen.
I just spent ~1.5 days tracking down a dangling pointer bug in interop code from Rust to C. It's so easy to do when you don't have lifetimes on pointers. I'd gotten so comfortable with lifetimes that I'd started taking it for granted.
Yes Rust can be hard to write, but the time and pain we spend of the other side of that equation can be just as important if not more so.
- Manishearth 10y agoFor stylo I've taught bindgen to be able to insert borrows in the binding functions in the presence of certain types, so on the C++ side you define it as FooBorrowed bindingFunc(BarBorrowed b), and on the rust side you get fn bindingFunct(&Bar) -> &Foo, which elides correctly. As a result a lot of the rust-side FFI code is actually 100% safe and the burden of safety has been pushed over completely to the C++ side. It's pretty neat.
- vvanders 10y agoMy problem was that I was taking a: Some([u8; 32]).map(|v| v.as_ptr()).unwrap_or(::std::ptr::null()); Which the map(..) copies by value and immediately goes out of scope so now you have a dangling pointer to the stack(fun!). If it was a reference I'd be totally covered but since pointers drop lifetime semantics that's where I got bit. Love bindgen though, just whitelisting the function I needs generates awesome interop APIs. At the end of the day though unsafe is unsafe.
- Manishearth 10y agoah, yeah, bad idea :) Yep, unsafe is unsafe and needs more scrutiny.