3 ms·
It sounds like this boils down to one thing: C and Rust have different aliasing rules, with Rust's being much more restrictive. You can't assume programming in
by kelnos 2y ago
It sounds like this boils down to one thing: C and Rust have different aliasing rules, with Rust's being much more restrictive.
You can't assume programming in unsafe Rust is like programming in C. Unsafe doesn't mean "do whatever you want"; it means you get to do things that the compiler won't check for you, but it's your responsibility to ensure you're still maintaining Rust's invariants.
So yes, unsafe Rust is harder than C. I think that's fine, though. Most people will be able to get by without writing any unsafe Rust, and those who still need to use it will end up writing very little of it. And tools like MIRI exist to help increase your confidence that your unsafe Rust is correct.
- jsheard 2y ago> C and Rust have different aliasing rules, with Rust's being much more restrictive. Rust is more restrictive by default, but C's restrict keyword lets you opt-in to strict aliasing semantics in exchange for unlocking compiler optimizations that would otherwise be unsound, so it's not like you're free from having to think about aliasing in high performance C code.
- kelnos 2y agoAgreed, but in practice defaults do matter, and it's pretty rare that I see a C code base that actually makes use of 'restrict' etc. It's nice to see it sprinkled liberally throughout glibc's headers, but that's the exception, not the rule.
- physicsguy 2y agoIt’s in pretty much every simulation code base I’ve worked on (both academic + industry)
- steveklabnik 2y agoIt's not so much "more restrictive" as it is "just plain different." You have behaviors for all four quadrants: there's stuff that's okay in Rust and not okay in C, stuff that's okay in both, stuff that's not okay in both, and stuff that's not okay in Rust and is okay in C.
- bloppe 2y agoVery curious to know an example of what's ok in Rust but not in C
- whytevuhuni 2y agoOf the things you can do: Integer overflow (wrapping in Rust, undefined behavior in C), indexing out of bounds (panic in Rust, UB in C), unwinding stack frames (runs destructors in Rust, UB in C) Of the things you can try to do, but will be prevented: use-after-free, double-free, using uninitialized variables, null references, modifying constants, data races
- steveklabnik 2y agoThe most straightforward one is that Rust doesn't have strict aliasing.