4 ms·
Rust also has run-time crash checks in the form of run-time array bounds checks that panic. So let us not pretend that Rust strictly catches everything at compi
by forrestthewoods 6mo ago
Rust also has run-time crash checks in the form of run-time array bounds checks that panic. So let us not pretend that Rust strictly catches everything at compile-time.
It’s true that, assuming all things equal, compile-time checks are better than run-time. I love Rust. But Rust is only practical for a subset of correct programs. Rust is terrible for things like games where Rust simply can not prove at compile-time that usage is correct. And inability to prove correctness does NOT imply incorrectness.
I love Rust. I use it as much as I can. But it’s not the one true solution to all things.
- omcnoe 6mo agoNot trying to be a Rust advocate and I actually don't work in it personally. But Rust provides both checked alternatives to indexed reads/writes (compile time safe returning Option<_>), and an exception recovery mechanism for out-of-bounds unsafe read/write. Fil-C only has one choice which is "crash immediately".
- uecker 6mo agoWhat makes you think that one can not add an explicit bound check in C?
- omcnoe 6mo agoIf you can correctly add all the required explicit bounds checks in C what do you need Fil-C for?
- uecker 6mo agoFor temporal memory safety.
- kimixa 6mo agoSame reason any turing complete language needs any constructs - to help the programmer and identify/block "unsafe" constructs. Programming languages have always been more about what they don't let you do rather than what they do - and where that lies on the spectrum of blocking "Possibly Valid" constructs vs "Possibly Invalid".
- tialaramex 6mo agoIt's trickier than it looks because C has mutable aliases. So, in C our bounds check might itself be a data race! Make sure you cope
- uecker 6mo agoDepending on what you are doing, yes. But the statement I responded to "your only choice is crash" is certainly wrong.
- jstimpfle 6mo agoBounds checks have nothing to do with data races. GP is right, you can add bounds checks. Either using macros or (in C++) with templates and operator overloading.
- tialaramex 6mo agoAlas, in C or C++ you have mutable aliasing, so I'm afraid you do incur a potential data race because your bounds might alias. Be careful out there. Also remember that in C++ you may get a reference in these cases and if you keep that reference rather than using it immediately now you also have a potential TOCTOU race because the reference was only valid when you did the bounds check.
- jstimpfle 6mo agoTrue, but you do incur potential data races _everywhere_. There's no relation to bounds checking specifically.
- tialaramex 6mo agoAh, maybe I should have made the example clearer With mutable aliasing the length might change even though the data you care about did not, and so adding the check means incurring a race which did not previously exist and which certainly the naive C programmer cannot see... We can definitely mitigate this in the type system for most real world scenarios, but you don't mitigate problems you don't know about, so knowing is what's important.
- wakawaka28 6mo ago>And inability to prove correctness does NOT imply incorrectness. And inability to prove incorrectness does NOT imply correctness. I think most Rust users don't understand either, because of the hype.