4 ms·

EDIT: > While not as formalized as C/C++, Rust's "spec" exists in the reference, nomicon, RFCs and documentation. I believe that there is a desire for a spec,

EDIT: > While not as formalized as C/C++, Rust's "spec" exists in the reference, nomicon, RFCs and documentation. I believe that there is a desire for a spec, but enough resources exist that the community can continue without one with no major negative side-effects (unless you want to re-implement the compiler from scratch, I suppose). Thank you, I was unaware that this is a thing. > This post probably answers a lot of your reply as well: https://jacko.io/safety_and_soundness.html https://jacko.io/safety_and_soundness.html This appears to also rely on "undefined behavior" as a meaningful term.

mmastrac 1y ago
> This appears to also rely on "undefined behavior" as a meaningful term. I assure you it is a meaningful term: https://llvm.org/docs/UndefinedBehavior.html https://llvm.org/docs/UndefinedBehavior.html
- NoTeslaThrow 1y ago
  Ok, but in the context of the language at hand? Presumably the IR has distinct semantics from the language that generates the IR. Does UB just strictly resolve to LLVM UB? That's very reasonable!
  - fc417fc802 1y ago
    No. UB is a term of art here. Consider a hypothetical non-LLVM full reimplementation of the compiler. If it optimizes and there are invalid assumptions then there is likely UB. LLVM isn't involved in that case though.
    - NoTeslaThrow 1y ago
      > If it optimizes and there are invalid assumptions then there is likely UB. It's the distinguishing from bugs that concerns me.
      - lmm 1y ago
        Anything a compiler does with code which is UB is not a bug in the compiler. That's pretty much the definition of UB.
      - fc417fc802 1y ago
        I don't follow. Isn't UB a subset of bugs or alternatively a follow on consequence that causes observable behavior to further deviate?
        NoTeslaThrow 1y ago
        > Isn't UB a subset of bugs No, not at all. UB can still produce correct and expected results for the entire input domain.
        fc417fc802 1y ago
        If I have a bug that only triggers between 9 and 10 am EST on Mondays that is still a bug, no? Now extend that to "rand(1.0) < 0.01". Now extend that to a check using __TIME__ that goes off at compile time instead of runtime (some binaries are buggy, some aren't). Now extend that to UB.
        deleted 1y ago
        [deleted]
        pharrington 1y ago
        "can" is extremely different than "will"!
      - vlovich123 1y ago
        It is a bug - you’ve violated the contract between the language and the compiler. Just like segfault or logic bug, it’s a class of bugs. Why is special though is that in most bugs you just hit an invalid state. In UB you can end up executing code that never existed or not executing code that does exist. Or any number of other things can happen because the compiler applies an optimization assuming a runtime state you promised it would never occur but did. It’s slightly different from being a strict subset because UB is actually exploited to perform optimizations - UB is not allowed so the compiler is able to emit more efficient code is taught to exploit that and the language allows for it (eg the niche optimization the blog describes)
  - vollbrecht 1y ago
    You can find a general overview for the language at hand in "The rust reference"[1]. For a more formal document, you can have a look in to the ferroscene language specification list of undefined behaviour[2] section. From there you can jump to different section, and see legality rules, and undefined behavior sections for each. The ferroscene language spec was recently donated to the rust foundation. [1] https://doc.rust-lang.org/reference/behavior-considered-undefined.html https://doc.rust-lang.org/reference/behavior-considered-unde... [2] https://spec.ferrocene.dev/undefined-behavior.html https://spec.ferrocene.dev/undefined-behavior.html

mmastrac 1y ago

> This appears to also rely on "undefined behavior" as a meaningful term. I assure you it is a meaningful term: https://llvm.org/docs/UndefinedBehavior.html https://llvm.org/docs/UndefinedBehavior.html

NoTeslaThrow 1y ago
Ok, but in the context of the language at hand? Presumably the IR has distinct semantics from the language that generates the IR. Does UB just strictly resolve to LLVM UB? That's very reasonable!
- fc417fc802 1y ago
  No. UB is a term of art here. Consider a hypothetical non-LLVM full reimplementation of the compiler. If it optimizes and there are invalid assumptions then there is likely UB. LLVM isn't involved in that case though.
  - NoTeslaThrow 1y ago
    > If it optimizes and there are invalid assumptions then there is likely UB. It's the distinguishing from bugs that concerns me.
    - lmm 1y ago
      Anything a compiler does with code which is UB is not a bug in the compiler. That's pretty much the definition of UB.
    - fc417fc802 1y ago
      I don't follow. Isn't UB a subset of bugs or alternatively a follow on consequence that causes observable behavior to further deviate?
      - NoTeslaThrow 1y ago
        > Isn't UB a subset of bugs No, not at all. UB can still produce correct and expected results for the entire input domain.
        fc417fc802 1y ago
        If I have a bug that only triggers between 9 and 10 am EST on Mondays that is still a bug, no? Now extend that to "rand(1.0) < 0.01". Now extend that to a check using __TIME__ that goes off at compile time instead of runtime (some binaries are buggy, some aren't). Now extend that to UB.
        deleted 1y ago
        [deleted]
        pharrington 1y ago
        "can" is extremely different than "will"!
    - vlovich123 1y ago
      It is a bug - you’ve violated the contract between the language and the compiler. Just like segfault or logic bug, it’s a class of bugs. Why is special though is that in most bugs you just hit an invalid state. In UB you can end up executing code that never existed or not executing code that does exist. Or any number of other things can happen because the compiler applies an optimization assuming a runtime state you promised it would never occur but did. It’s slightly different from being a strict subset because UB is actually exploited to perform optimizations - UB is not allowed so the compiler is able to emit more efficient code is taught to exploit that and the language allows for it (eg the niche optimization the blog describes)
- vollbrecht 1y ago
  You can find a general overview for the language at hand in "The rust reference"[1]. For a more formal document, you can have a look in to the ferroscene language specification list of undefined behaviour[2] section. From there you can jump to different section, and see legality rules, and undefined behavior sections for each. The ferroscene language spec was recently donated to the rust foundation. [1] https://doc.rust-lang.org/reference/behavior-considered-undefined.html https://doc.rust-lang.org/reference/behavior-considered-unde... [2] https://spec.ferrocene.dev/undefined-behavior.html https://spec.ferrocene.dev/undefined-behavior.html