3 ms·

> but why would they bother with unsafe? Wouldn't they need unsafe in order to interface with the outside world via their libsqlite persona? Which, I think, i

• woodruffw 5y ago
  You can export a C API in safe Rust. You might a small amount of unsafe code at any boundary where the C API takes pointers instead providing them, but that again is the kind of thing that can be safely encapsulated and tested.
  • dathinab 5y ago
    > small amount of unsafe code You can for example have a C API accepting a Option<&mut A> if A is repr(c) and sized. This is possible due to the guarantees &mut A has about it's representation (if A is..) and the guarantees `Option` has about it's representation wrt. non-null values. While such pattern exposes a often fully safe rust C-ABI API it has some drawbacks mainly that C is required to make sure the pointer they pass in is valid (null or aligned, allocated and initialized). You can take this a step further an only accept a `&mut A` BUT that is a bit dangerous as now C calling rust with a null-pointer leads to unsound rust, as rust assumes &mut A is never null. Another gotcha is wrt. owned heap allocated data, as you need to make sure the same alocator is used for allocating and de-allocating it. Again nothing new, but in C you often doge that issue. (E.g. if you allocate, and initialize a *A in C and then pass it to rust as a Box<A> you need to be very careful that you never drop that box in rust). Through Rust is currently getting support for keeping track of non-default/non-global allocators in the standard library, and you could always setup a global/default allocator which defers to libcs malloc/free.