3 ms·

> Do you think that macros should treat unsafe blocks in their body as a compiler error? No. Exported macros (as opposed to private ones) are only sound if the

> Do you think that macros should treat unsafe blocks in their body as a compiler error? No. Exported macros (as opposed to private ones) are only sound if they do not allow safe Rust to introduce undefined behavior. Whether these macros use "unsafe" internally or not is irrelevant. For example, `pin_mut!` uses unsafe internally, but it does not allow safe Rust calling it to introduce UB. A macro that allows safe Rust to introduce undefined behavior is unsound. An example of such an unsound macro would be `offset_of!`. --- That is, I do not differentiate Rust abstractions when it comes to soundness. Whether its a function, a trait method, a macro, or a function pointer, it does not matter. If an abstraction its safe to use it shall not introduce UB. If it does, it is an unsound abstraction.

steveklabnik 6y ago
> Exported macros (as opposed to private ones) are only sound if they do not allow safe Rust to introduce undefined behavior. There is no debate about this. You didn't really answer my question. I'm also not really gonna continue this argument.
- fluffything 6y ago
  > There is no debate about this. Of course there is, for example, the offset_of! macro was unsound for a long time: * https://internals.rust-lang.org/t/pre-rfc-add-a-new-offset-of-macro-to-core-mem/9273/10 https://internals.rust-lang.org/t/pre-rfc-add-a-new-offset-o... * https://github.com/rust-lang/unsafe-code-guidelines/issues/158 https://github.com/rust-lang/unsafe-code-guidelines/issues/1... * https://github.com/rust-lang/unsafe-code-guidelines/issues/243 https://github.com/rust-lang/unsafe-code-guidelines/issues/2... * https://github.com/rust-lang/rust-memory-model/issues/35 https://github.com/rust-lang/rust-memory-model/issues/35 > You didn't really answer my question. I literally wrote "No.". To your follow up questions starting with "If so ..." i did not reply, because the assumption these questions were based on (that I would reply to the previous question with "yes") did not hold. To expand on this. Rust does not have "unsafe macros", so all exported macros must be sound. Whether a macro is sound or not is orthogonal to whether the macro itself uses `unsafe` (and your original claim was whether I thought that macros containing unsafe should be rejected by the compiler, to which I replied "No.", `pin_mut!` is an example of a macro that uses `unsafe` and is sound).

steveklabnik 6y ago

> Exported macros (as opposed to private ones) are only sound if they do not allow safe Rust to introduce undefined behavior. There is no debate about this. You didn't really answer my question. I'm also not really gonna continue this argument.

fluffything 6y ago
> There is no debate about this. Of course there is, for example, the offset_of! macro was unsound for a long time: * https://internals.rust-lang.org/t/pre-rfc-add-a-new-offset-of-macro-to-core-mem/9273/10 https://internals.rust-lang.org/t/pre-rfc-add-a-new-offset-o... * https://github.com/rust-lang/unsafe-code-guidelines/issues/158 https://github.com/rust-lang/unsafe-code-guidelines/issues/1... * https://github.com/rust-lang/unsafe-code-guidelines/issues/243 https://github.com/rust-lang/unsafe-code-guidelines/issues/2... * https://github.com/rust-lang/rust-memory-model/issues/35 https://github.com/rust-lang/rust-memory-model/issues/35 > You didn't really answer my question. I literally wrote "No.". To your follow up questions starting with "If so ..." i did not reply, because the assumption these questions were based on (that I would reply to the previous question with "yes") did not hold. To expand on this. Rust does not have "unsafe macros", so all exported macros must be sound. Whether a macro is sound or not is orthogonal to whether the macro itself uses `unsafe` (and your original claim was whether I thought that macros containing unsafe should be rejected by the compiler, to which I replied "No.", `pin_mut!` is an example of a macro that uses `unsafe` and is sound).