5 ms·

There was a HN discussion ~4 months ago that touched on some of this: "Unsafe Zig Is Safer Than Unsafe Rust" https://news.ycombinator.com/item?id=16226235 http

• Yoric 8y ago
  > "Unsafe Zig Is Safer Than Unsafe Rust" Yes, I've seen that blog post. Definitely a useful analysis, but it doesn't strike me as a fundamental difference, i.e. adding this check (as a warning) to rustc doesn't look too hard and wouldn't break existing code. Also, as pointed out in the title, that's code explicitly marked as `unsafe` in Rust, so it might not be an entirely fair comparison :) > "Containers should provide some way to not panic on failed allocations" https://github.com/rust-lang/rust/issues/29802 https://github.com/rust-lang/rust/issues/29802 Definitely a problem, but it's not what people usually call "memory safety". The problem you mention is that of "fallible allocation". A typical definition of "memory safety" is that you can never get a memory access error. Rust's behavior is indeed to panic in case of failed allocation, letting the developers catch the error at higher level. Barring any bug in rustc, that behavior is memory-safe. Now, this behavior is quite opinionated and it turns out that it doesn't match all applications, so handling failed allocations is indeed being "bolted on as an afterthought". Just not memory safety :) (especially since it's pretty hard to get a memory access error in Rust without deactivating safety checks, and it doesn't seem to be nearly as difficult in the current version of Zig)
  • whyever 8y ago
    Just to clarify, allocation is entirely implemented in the Rust standard library, not the language/compiler.
  • espeed 8y ago
    > i.e. adding this check (as a warning) to rustc doesn't look too hard and wouldn't break existing code. One point of distinction: Zig does not have compile-time warnings, only errors. Simplicity by design. Either it will complie or it won't. Removing the uncertainty here means less greyarea, no space for edgecases in between.
    • Yoric 8y ago
      I realize that this should be an error rather than a warning. But one of the policies of Rust since 1.0 is to not break existing code, so any mechanism that detects error that were not previously detected must make it a warning, rather than an error, otherwise some existing applications and libraries would stop compiling overnight. I generally find this a sane policy, but YMMV.
      • espeed 8y ago
        OT FYI: I just looked at your profile and noticed we have something in common. Your HND matches my DOB ~> 224