3 ms·
It doesn't provide any additional safety by itself, but it does provide a good starting point. Once you've Corroded your existing C code, you can then replace t
by ameliaquining 9y ago
It doesn't provide any additional safety by itself, but it does provide a good starting point. Once you've Corroded your existing C code, you can then replace the unsafe Rust abstractions (like raw pointers) with equivalent safe ones (like references), one at a time. This way the manual part of the conversion doesn't have to be done all at once.
- danenania 9y agoIs there anything that prevents this conversion of raw pointers to references from being automatable as well?
- steveklabnik 9y agoIf C was able to encode Rust's semantics around references, you wouldn't need Rust in the first place. You might be able to get it to work sometimes for a very simple subset. I'd be extremely skeptical that it'd be very useful, though.
- dllthomas 9y agoI agree with "sometimes, for a very simple subset" but I think there's a good chance that can still be very useful. A lot of uses just are super simple, and that may be obvious to the computer in cases that aren't obvious to the human. If we can remove the need for the human to reason about those, that can be a big help.
- ameliaquining 9y agoRice's theorem. That's an overly glib answer. The fully general form of this problem is undecidable, but it would be theoretically possible to build a "reverse borrow checker" that analyzes a Rust program, detects raw pointers that are provably used exclusively in ways compatible with Rust's lifetime semantics, and converts them to references. But it would probably be a fairly major project requiring lots of specialized knowledge, because lifetime semantics are complicated. Nobody has attempted it yet as far as I know, although the author of Corrode has expressed interest.