4 ms·
It's almost as if what one would want is a language where you could shrink unsafe operations to as small a footprint as possible by confining them within a bloc
by pohl 12y ago
It's almost as if what one would want is a language where you could shrink unsafe operations to as small a footprint as possible by confining them within a block with a special keyword, like this:
unsafe { … }
Someone should invent such a thing.
Edit: …yeah, I was being tongue-in-cheek. This is exactly what Rust provides.
http://doc.rust-lang.org/rust.html#unsafety http://doc.rust-lang.org/rust.html#unsafety
"...When a programmer has sufficient conviction that a sequence of potentially unsafe operations is actually safe, they can encapsulate that sequence (taken as a whole) within an unsafe block. The compiler will consider uses of such code safe, in the surrounding context…"
- ygra 12y ago- http://msdn.microsoft.com/library/chfa2zb8.aspx http://msdn.microsoft.com/library/chfa2zb8.aspx - http://doc.rust-lang.org/rust.html#unsafe-blocks http://doc.rust-lang.org/rust.html#unsafe-blocks
- Touche 12y agoIf I call a function that is running unsafe { } inside of it, do I know? Because I really want to know. And I want my function to be marked as unsafe as well (because it is) as well as any function calling my function, etc.
- steveklabnik 12y agoYou don't know, but you can use a compiler flag that will tell you if you are. > I want my function to be marked as unsafe as well (because it is) This misunderstands the nature of `unsafe`. `unsafe` means "I promise that this is actually safe, even thought it can't be inferred." Take, for example, a type which has mutable, shared state, but enforces all access through a mutex[1]. This type presents a safe interface, but the compiler can't know that it's safe, so you have to use `unsafe` internally. 1: http://static.rust-lang.org/doc/master/std/cell/struct.RefCell.html http://static.rust-lang.org/doc/master/std/cell/struct.RefCe...
- kibwen 12y agoThe way that you mark a function as unsafe is to stick a keyword in front of it: unsafe fn foo() { ... } Any function marked as such is then allowed to call other unsafe functions: unsafe fn bar() { foo(); } But there is a way to break the chain, which is to use an `unsafe` block without marking your function as unsafe: fn qux() { unsafe { bar(); } } That said, it's incorrect to think that Rust is any more unsafe than any other language because of this; most languages simply defer this behavior to their FFI. By pulling it into the language itself, Rust is actually safer than e.g. calling C from Python, because Rust can do the low-level fiddling while still retaining at least some of the safety checks of normal Rust code. Even unsafe Rust is safer than C.
- steveklabnik 12y ago> Even unsafe Rust is safer than C. This is an important point. `unsafe` blocks only let you do a few extra operations[1], not anything you want. A lot of safety checks still happen inside of unsafe blocks. 1: http://static.rust-lang.org/doc/master/rust.html#behavior-considered-unsafe http://static.rust-lang.org/doc/master/rust.html#behavior-co...
- kibwen 12y agoWell, no, you can still theoretically do anything you want, you just need to be very, very explicit about it. :)
- dbaupp 12y agoSome things are undefined behaviour[1]... so you really don't want to want to do them (i.e. you can do them inside `unsafe`, but the compiler optimises/reasons assuming they never happen: if they occur at all, you could have an arbitrarily broken program). [1]: http://doc.rust-lang.org/master/rust.html#behavior-considered-unsafe http://doc.rust-lang.org/master/rust.html#behavior-considere...
- kibwen 12y ago
- pcwalton 12y ago> If I call a function that is running unsafe { } inside of it, do I know? Because I really want to know. Pretty much every function is going to be transitively running unsafe code, since the core libraries use it to implement the base primitives.