3 ms·

Nope. A language which has semantic requirements and isn't willing to reject programs for which it has been unable to determine whether they meet the requireme

Nope. A language which has semantic requirements and isn't willing to reject programs for which it has been unable to determine whether they meet the requirements, will have these cases by Rice's Theorem. This is why C++ is a complete disaster. C++ specifically does not allow the compiler to reject such programs. You can defuse this like (safe) Rust by just writing conservative checking. You will reject some programs you would like to have successfully compiled, but that's actually OK, programmers who hate it are inspired to improve the checking, that's what Rust's "Non-Lexical Lifetimes" - mentioned by Sean, are about. Even more radically, you can be a Special Purpose language and just only allow a relatively small subset of possible programs, all of which you know are correct, that's why WUFFS gets to emit indexing with no runtime bounds miss checks - it did all the bounds checks at compile time, all source where that wouldn't be possible isn't legal WUFFS code.

mgaunard 2y ago
That is incorrect. A C++ compiler is perfectly allowed to reject any program that contains undefined behaviour. It's just not required to do so.
- leni536 2y ago
  It's allowed to reject programs that will evaluate an undefined operation on every possible execution. This is pretty much impossible, so no compiler even attempts this.
  - mgaunard 2y ago
    It can replace any path with undefined behaviour to one that does std::abort.
    - pjmlp 2y ago
      It can, but in practice no one does it.
      - majoe 2y ago
        When you think about it, that's what -fsanitize=undefined is doing. It detects undefined behaviour at runtime and aborts the program.
        leni536 2y ago
        It detects some, but not all UBs. AFAIK it can't detect UB due to hnsequenced access to the same variable.
        mgaunard 2y ago
        There are different sanitizers that detect different types of UB. Asan, Msan, Tsan and UBSan all detects different ones.
        deleted 2y ago
        [deleted]
    - leni536 2y ago
      Which is very different from diagnosing at compile time.
- tialaramex 2y ago
  That would be easy, the problem is that Rice's Theorem tells us the compiler definitionally cannot be sure whether every possible source code represents a valid program if it has any non-trivial semantic requirements (C++, like Rust, has a whole lot of such requirements). So while "What should we do when we're sure it's not a valid program?" is easy and so it's very silly that some C++ compilers will compile that anyway, it's not enough, you also need to decide "What should we do when we're not sure?" and there the ISO document provides a firm answer, which all the compiler vendors follow - press on anyway, too bad. "Ill-formed - No Diagnostic Required" is how the ISO document describes this situation. The diagnostic isn't required because it's technically impossible to guarantee. You might insist that "Not sure" can't happen. Unfortunately the reason it's called Rice's Theorem is that a guy named Henry Rice got himself a Maths PhD proving this in 1951.
gumby 2y ago
I suppose you can make that assertion by moving the goalposts. But Rice's theorem specifically addresses such behavior: all turing machines are inherently undecidable for all but trivial cases. You can well argue that Rust may be better than C++ in some dimension, just as others can argue that those qualities have an unreasonable or intractable cost (note that about 20% of all crates resort to `unsafe`). But your blanket assertion is not even supported by the reference you made. Also the user is free to tell a C++ compiler to reject programs that use many sorts of undefined behavior, though indeed nobody would claim that any current compiler can identify all such cases. But Rice's theorem says that no Rust compiler could either.
mike_hock 2y ago
Yes, but it seems that we can't satisfy all reasonable real-world use cases this way, or else Rust wouldn't have the "unsafe" escape hatch that's actually used by real code.

mgaunard 2y ago

That is incorrect. A C++ compiler is perfectly allowed to reject any program that contains undefined behaviour. It's just not required to do so.

leni536 2y ago
It's allowed to reject programs that will evaluate an undefined operation on every possible execution. This is pretty much impossible, so no compiler even attempts this.
- mgaunard 2y ago
  It can replace any path with undefined behaviour to one that does std::abort.
  - pjmlp 2y ago
    It can, but in practice no one does it.
    - majoe 2y ago
      When you think about it, that's what -fsanitize=undefined is doing. It detects undefined behaviour at runtime and aborts the program.
      - leni536 2y ago
        It detects some, but not all UBs. AFAIK it can't detect UB due to hnsequenced access to the same variable.
        mgaunard 2y ago
        There are different sanitizers that detect different types of UB. Asan, Msan, Tsan and UBSan all detects different ones.
      - deleted 2y ago
        [deleted]
  - leni536 2y ago
    Which is very different from diagnosing at compile time.
tialaramex 2y ago
That would be easy, the problem is that Rice's Theorem tells us the compiler definitionally cannot be sure whether every possible source code represents a valid program if it has any non-trivial semantic requirements (C++, like Rust, has a whole lot of such requirements). So while "What should we do when we're sure it's not a valid program?" is easy and so it's very silly that some C++ compilers will compile that anyway, it's not enough, you also need to decide "What should we do when we're not sure?" and there the ISO document provides a firm answer, which all the compiler vendors follow - press on anyway, too bad. "Ill-formed - No Diagnostic Required" is how the ISO document describes this situation. The diagnostic isn't required because it's technically impossible to guarantee. You might insist that "Not sure" can't happen. Unfortunately the reason it's called Rice's Theorem is that a guy named Henry Rice got himself a Maths PhD proving this in 1951.

gumby 2y ago

I suppose you can make that assertion by moving the goalposts. But Rice's theorem specifically addresses such behavior: all turing machines are inherently undecidable for all but trivial cases. You can well argue that Rust may be better than C++ in some dimension, just as others can argue that those qualities have an unreasonable or intractable cost (note that about 20% of all crates resort to `unsafe`). But your blanket assertion is not even supported by the reference you made. Also the user is free to tell a C++ compiler to reject programs that use many sorts of undefined behavior, though indeed nobody would claim that any current compiler can identify all such cases. But Rice's theorem says that no Rust compiler could either.

mike_hock 2y ago

Yes, but it seems that we can't satisfy all reasonable real-world use cases this way, or else Rust wouldn't have the "unsafe" escape hatch that's actually used by real code.