4 ms·

> ... Java and C# were... Do you mean those langauges are memory safe only in their GC implementation, which uses multiple kernel threads? How does this affect

by azth 12y ago

> ... Java and C# were... Do you mean those langauges are memory safe only in their GC implementation, which uses multiple kernel threads? How does this affect user code? Java and C# still allow you to access memory from other threads without locking.

pcwalton 12y ago
I'm using the Saraswat definition of memory safety (though he called it "type safety"), which admits data races but not things like use-after-free. You're right that Rust has a stronger guarantee of data race freedom. But most recent systems programming languages don't even guarantee memory safety in parallel mode.
- pron 12y ago
  The freedoms that allow data races are the very same ones allowing implementing concurrent data structures. To the best of my knowledge, there are no static proof systems (other than model checkers, which aren't really static) that guarantee correctness of concurrent DSs yet allow implementing all (or most) correct ones. You can either sacrifice your guarantees or your use of efficient data structures. Of course, you can always wrap the implementation in some "unsafe" designation, and then declare the whole black box to be correct. Of course, efficient, general-purpose concurrent data structures usually require a GC.
  - necubi 12y ago
    This is true, but also a false dilemma. Rust provides an escape hatch in the form of the `unsafe` keyword. This allows the implementation of efficient data structures, while still providing static safety guarantees to the vast majority of code.
    - pron 12y ago
      Well, GC runtimes also ensure memory safety of those data structures (you can't really implement them too efficiently without a GC anyway) without being unsafe, while Rust provides neither memory nor race safety in these interesting cases. Still, I think Rust design decisions are correct if it wants to fill the C/C++ niche (which I hope it will). That niche is not necessarily meant to provide the best performance (I believe JITs will soon surpass any AOT compiler, and GCs are pretty much a must to support concurrent workloads on many-core servers with huge RAM) but safety and speed in constrained environments or applications where GC/JITs are inappropriate (small RAM/short startup). But even so, there is a need for good concurrent data stuctures. What I'm wondering is whether Rust provides a way to use the type system alongside concurrent data structures (ARCs don't cut it). Is there a way to say "this pointer is managed by a transactional data structure and can be shared freely among threads"?
- qznc 12y ago
  While the current Java memory model is not completely safe, it looks fixable. http://pp.ipd.kit.edu/publication.php?id=lochbihler14toplas http://pp.ipd.kit.edu/publication.php?id=lochbihler14toplas

by azth 12y ago

pcwalton 12y ago

I'm using the Saraswat definition of memory safety (though he called it "type safety"), which admits data races but not things like use-after-free. You're right that Rust has a stronger guarantee of data race freedom. But most recent systems programming languages don't even guarantee memory safety in parallel mode.

pron 12y ago
The freedoms that allow data races are the very same ones allowing implementing concurrent data structures. To the best of my knowledge, there are no static proof systems (other than model checkers, which aren't really static) that guarantee correctness of concurrent DSs yet allow implementing all (or most) correct ones. You can either sacrifice your guarantees or your use of efficient data structures. Of course, you can always wrap the implementation in some "unsafe" designation, and then declare the whole black box to be correct. Of course, efficient, general-purpose concurrent data structures usually require a GC.
- necubi 12y ago
  This is true, but also a false dilemma. Rust provides an escape hatch in the form of the `unsafe` keyword. This allows the implementation of efficient data structures, while still providing static safety guarantees to the vast majority of code.
  - pron 12y ago
    Well, GC runtimes also ensure memory safety of those data structures (you can't really implement them too efficiently without a GC anyway) without being unsafe, while Rust provides neither memory nor race safety in these interesting cases. Still, I think Rust design decisions are correct if it wants to fill the C/C++ niche (which I hope it will). That niche is not necessarily meant to provide the best performance (I believe JITs will soon surpass any AOT compiler, and GCs are pretty much a must to support concurrent workloads on many-core servers with huge RAM) but safety and speed in constrained environments or applications where GC/JITs are inappropriate (small RAM/short startup). But even so, there is a need for good concurrent data stuctures. What I'm wondering is whether Rust provides a way to use the type system alongside concurrent data structures (ARCs don't cut it). Is there a way to say "this pointer is managed by a transactional data structure and can be shared freely among threads"?
qznc 12y ago
While the current Java memory model is not completely safe, it looks fixable. http://pp.ipd.kit.edu/publication.php?id=lochbihler14toplas http://pp.ipd.kit.edu/publication.php?id=lochbihler14toplas