4 ms·

>because unsafety can be inherent in the design I agree in principle, and I have strong feelings based on my experience that this is the case, but I think it w

>because unsafety can be inherent in the design I agree in principle, and I have strong feelings based on my experience that this is the case, but I think it would be illustrative to have some hard examples in mind. Does anyone know any simple cases to ground this discussion in?

nuancebydefault 2y ago
Suppose it is a dll that has exported functions returning or accepting unsafe strings. No way to make it safe without changing the API.
- tatref 2y ago
  In Rust, there is no unsafe String, only blocks of code can be unsafe, no?
  - whytevuhuni 2y ago
    They likely mean a char* pointer to a null-terminated string, or a char* pointer and a length, as is usual for C. If Rust was forced to expose such an API (to be on par with C's old API), it would have to use `*const u8` in its signature. Converting that to something that can be used in Rust is unsafe. Even once converted to &[u8], it now has to deal with non-UTF8 inputs throughout its whole codebase, which is a lot more inconvenient. A lot of methods, like .split_ascii_whitespace, are missing on &[u8]. A lot of libraries won't take anything but a &str. Or they might be tempted to convert such an input to a String, in which case the semantics will differ (it will now panic on non-UTF8 inputs).
colejohnson66 2y ago
Maybe a JIT? Especially one that can poke back into the runtime (like dotnet).
- LPisGood 2y ago
  I know Unity game engine uses some transpiler called IL2CPP that manages to preserve some of the safety features of C# but still gets the speed of CPP, so one direction is definitely possible
  - neonsunset 2y ago
    Oh, it's mainly for platform compatibility. IL2CPP performance is really problematic since it still carries many issues of Mono, even if transpiled to C++: https://meetemq.com/2023/09/18/is-net-8-performant-enough/ https://meetemq.com/2023/09/18/is-net-8-performant-enough/ (don't look at just the starting graph - make sure to scroll down to notes where RyuJITs code competes with other fast entries or even outperforms them). Perhaps what you were looking for is NativeAOT? Either way C ports really well to C# since it supports a large subset of it "as is" and then some with generics and other features originating from C# itself.

nuancebydefault 2y ago

Suppose it is a dll that has exported functions returning or accepting unsafe strings. No way to make it safe without changing the API.

tatref 2y ago
In Rust, there is no unsafe String, only blocks of code can be unsafe, no?
- whytevuhuni 2y ago
  They likely mean a char* pointer to a null-terminated string, or a char* pointer and a length, as is usual for C. If Rust was forced to expose such an API (to be on par with C's old API), it would have to use `*const u8` in its signature. Converting that to something that can be used in Rust is unsafe. Even once converted to &[u8], it now has to deal with non-UTF8 inputs throughout its whole codebase, which is a lot more inconvenient. A lot of methods, like .split_ascii_whitespace, are missing on &[u8]. A lot of libraries won't take anything but a &str. Or they might be tempted to convert such an input to a String, in which case the semantics will differ (it will now panic on non-UTF8 inputs).

colejohnson66 2y ago

Maybe a JIT? Especially one that can poke back into the runtime (like dotnet).

LPisGood 2y ago
I know Unity game engine uses some transpiler called IL2CPP that manages to preserve some of the safety features of C# but still gets the speed of CPP, so one direction is definitely possible
- neonsunset 2y ago
  Oh, it's mainly for platform compatibility. IL2CPP performance is really problematic since it still carries many issues of Mono, even if transpiled to C++: https://meetemq.com/2023/09/18/is-net-8-performant-enough/ https://meetemq.com/2023/09/18/is-net-8-performant-enough/ (don't look at just the starting graph - make sure to scroll down to notes where RyuJITs code competes with other fast entries or even outperforms them). Perhaps what you were looking for is NativeAOT? Either way C ports really well to C# since it supports a large subset of it "as is" and then some with generics and other features originating from C# itself.