3 ms·
In Rust mutable references are exclusive. They're statically guaranteed to never alias with any other pointer. However, when you call such function from C, the
by pornel 3y ago
In Rust mutable references are exclusive. They're statically guaranteed to never alias with any other pointer.
However, when you call such function from C, the C compiler has no clue about exclusive references, so obviously it can't enforce their invariants. The C side can provide aliased pointers and break Rust's assumptions. The Rust side assumes it's called correctly, and the C side can't know what is correct.
- woodruffw 3y agoRight, but that's not controversial, is it? If you call into Rust from C, you need to preserve Rust's invariants; Rust can't preserve them for you.
- pornel 3y agoI don't think anybody expects incorrect code to behave correctly, but as usual the issue is about mistakes. The C compiler can't help you preserve Rust's invariants, so when you make wrong assumptions or declare a wrong interface, instead of a compilation error, you can get UB silently creeping in. The FFI-glue language they propose is meant to prevent these types of mistakes.