Comment by the_mitsuhiko | Hacker News Reader

Comment by the_mitsuhiko | Hacker News Reader

Parent Full thread

If a value returned from a function actually moves or not is currently up for Rust to optimize. It's not something you can depend on.

About the refcounts: since the counting is explicit (calls to clone()) they at least in my experience don't really show up. Most of the refcounted objects I deal with bump the refcounts once when some task spawns and decrements it when it ends. I have yet to see refcounts to change in hot code paths.

//EDIT for your edit:

> Edit: Forgot about handles. Ugh. Completely unacceptable when you want to grow your tree data structure and you have to do a realloc and basically copy every node.

Sure, but that's not my point anyways. At any point you can fall down to writing unsafe code and building a safe abstraction on top of it. This is to help developers not run into walls. I don't think that handles are the best thing invented but I don't think "well you can't do that in Rust until we some time in the future" and not provide an alternative is a particularly good suggestion.

But if they do... oh boy, what fun can be had by spamming ooeratins on the same memory location from multiple cores! If this isn't thrilling enough, try doing that with atomic operationsto be extra thread safe. I had some really fun experiences with this in C++. The best one was a factor 100 slowdown by activating compiler optimizations.

Are Rust ref-counts atomic? (I'd assume so).

Atomic ref-counts can actually have a surprising amount of overhead in many multithreaded scenarios, so much so that going back to raw pointers over shared pointers in C++ for some use cases of passing pointers around can provide a huge win.

Arc<T> is atomic, Rc<T> is not.

There is Rc and Arc, the latter being atomic. If you want to pass them between threads, you'll want an Arc, and in fact you will want an Arc<Mutex<Data>> so your data becomes:

  let data = Arc::new(Mutex::new(Data::new()));

And if you want a mutable static global that's accessed across threads, you'll need something like:

  lazy_static! {
    // 0 -> None
    // 1 -> Circles
    // 2 -> Bezier
    static ref DRAW_ON_TOUCH: Arc<Mutex<u32>> = Arc::new(Mutex::new(0));
  }

I love Rust but it is making easy things harder than they need to be.

Hm, this distinction between non-atomic and atomic ref counting sounds like a scat-gun sized footgun waiting to go off when it is least expected. Is there any protection for non-atomic ref counting in a multithreaded environment in Rust?

> Is there any protection for non-atomic ref counting in a multithreaded environment in Rust?

Yes. It errors at compile time (`std::rc::Rc<i32>` cannot be sent between threads safely)

> Is there any protection for non-atomic ref counting in a multithreaded environment in Rust?

Of course. Rust is memory safe. The compiler will prevent you from sharing non-thread-safe reference counted objects between threads.

This is a significant advantage over C++, where the compiler offers no such protection and so the typical solution is just to use atomic reference counting (shared_ptr) everywhere.

So are you claiming that the exact same solution is good in rust and bad in C++?

I'm not the person you are replying to but I would never use a non atomic refcounted smart pointer in C++ because the risks associated with it are just too high. In Rust however the compiler protects me from misuse.

Separately emotionally I feel different about Arc<T> because all the counting is explicit and I see it. Understanding where shared_ptr<T> in C++ counts however can be quite a challenge, even if you consider yourself proficient with C++.

I may be in the minority here, but if you are programming properly, your understanding of the code should always be good enough that this is a non-issue. If you manage to trigger a compiler error like this at all, you are most likely hacking, not developing.

Reference count problems routinely result in vulnerabilities. Google for [cve reference count].

But these vulnerabilities can only happen if reference counting is not automatic, right?

No, because of the way references in C++ work—you can take a reference to the inside of a reference counted object without manipulating the reference count.

They could also happen if you used non-thread-safe reference counting on a thread-safe object. Now this seems to be rare in practice, because non-thread-safe reference counting is unusual. If it became more prevalent, however, I could see it happening.

Should probably but I'm not a good enough developer (yet?) to guarantee that. I rather take the extra safety from the compiler.

Real programmers apparently never make mistakes.

Unofficial slogan of the C apologism task force, apparently.

No. Real developers design their data structures and algorithms carefully. When it is tine to implement them, everything should be laid out clearly enough. There are industries where this kind of process is required and it truely shows in the quality of the results.

If the vast majority of software is not made by real developers (and I think by the definitions you are espousing it is not), then I think one of the definitions is in need to change.

As beneficial to your argument as it would be for that change to be the definition of "software", I don't think that's likely.

I needed to make a distinction in the dedinition I gave. And I stand by it, even if the wording comes across as snarky. There are software engineering methods that are proven to work. They do not involve just diving in and changing the code. But I also think that there are valid reasons to not apply these rigid development practices to certain kinds of projects. For the rest, we might well get mandatory development standards forced on us to

I am well aware of the pressure on developers to get requested feature done quickly. But the vast majority of bugs that get shipped would be easily prevented by more thorough processes. All those projects writing highly reliable software demonstrate this. But the price tag has a few zeroes appended as a result.

There are software engineering methods that are proven to work.

Rust’s type system is arguably one of them.

I was talking about processes, not tools. Rust is just tool. But good software comes from thorough processes.

Good software comes from processes that aren't afraid to adopt tools to automatically enforce those processes in order to guard against human oversight.

Tools come from processes. You need to know what the tool needs to do (the process) before you can write it.

Type systems are applied mathematics. You can’t get more engineering-y than that.

See my reply to the other comment.

Type systems are tools that simply the process of checking that you do not mangle data by applying the wrong instructions to them. They didn't come out of nowhere.

Math is a tool, too, yet applying mathematical methods is one of the defining characteristics of engineering.

> There are industries where this kind of process is required and it truely shows in the quality of the results.

It also shows in the cost of building the software. Most software companies aren't willing to pay the cost of that process. Like it or not, you will almost certainly interact with software written by these companies, either directly or indirectly.

I mean, that's great in theory, but we've been trying the "just design the program better" approach for 40 years and have been failing.

This sort of mistake gets harder and harder to prevent as programs get larger. For example, one programmer might use a non-atomic Rc pointer to hold a string in some random Error value. Later, another programmer might try to parallelize that part of the program, without realizing that sending an Error across a thread boundary is now illegal. Or maybe the same mistake happens in the other order.

Here's Niko Mastakis talking about a case where that happened to him (I think): https://youtu.be/lO1z-7cuRYI?t=4m

I don't trust myself to not make mistakes though even when I have a thorough understanding of what I'm making.

"... trusting the programmer is fundamentally wrong, no matter the programming language"

I'm not pcwalton, but he is correct. The Rust compiler only allows objects that implement the Sync trait to cross thread boundaries. Rc<T> is not Sync, while Arc<T> is. Sync is a marker trait, with impls automatically generated by the compiler for types that are comprised entirely of Sync types, or manually (and unsafely) specified by the author. As a result, Rc<T> cannot be misused from multiple threads without unsafe.

To learn more about this, look here: https://doc.rust-lang.org/beta/nomicon/send-and-sync.html

How is safely accessing a mutable global from multiple threads an easy thing?

Also, the Arc isn't needed in lazy_static: just a mutex is enough for mutability, the sharing (which is what Arc controls) comes from being a static.

And if there's just a single u32 inside, there's no need for a whole mutex, you can just use a zero-overhead AtomicU32. …or you could, if it were stable.

AtomicUsize is stable!

Imagine your example in a singleton pattern scenario. It would be quite a performance hit.

> Are Rust ref-counts atomic? (I'd assume so).

No, not unless the object is actually shared among multiple threads.

Reply on news.ycombinator.com