Hacker News Reader

Comment by mustache_kimono | Hacker News Reader

> but rustc-1.63.0 still compiles this program that panics at runtime.

An index OOB error? Here, it's important to remember the Rust panic is still memory safe. Perhaps you should read the article, or read up on what undefined behavior is?[0] Here, the Rust behavior is very well defined. It will either abort or unwind.[1]

If you prefer different behavior, there is the get method on slices.[2]

[0]: https://en.wikipedia.org/wiki/Undefined_behavior [1]: https://doc.rust-lang.org/reference/panic.html [2]: https://doc.rust-lang.org/std/primitive.slice.html#method.ge...

View on HN

This subthread is about claims of STATIC checking of memory safety. A panic is not static checking. Perhaps you should read what you respond to.

A panic is memory-safe, so static checking of memory safety holds. Perhaps you should understand your own claims.

I'll henceforth refer to the process of using vector.at(0) instead of vector[0] in C++ as "providing memory safety by static analysis".

Static analysis has a specific meaning, and rote insertion of bounds checking isn't it.

Memory safety has a specific meaning, and panic isn’t it.

C++ can have UB, compilable non-unsafe Rust can’t, that’s what static analysis of memory safety is.

Main point here is you don’t know (and refuse to learn) new knowledge.

If the only way of triggering spatial memory unsafety in C++ was vector[i] and that operation was defined to always interrupt execution, then yes, C++ would be considered memory safe. But that is not the case.

The equivalent of vector[i] in Rust is Vex::get_unchecked, which is marked as unsafe, not the default that people reach for normally.

We are, however, talking in this subthread about the compiler inserting bounds checks and (incorrectly) calling the process "static checking".

I refuted that point by pointing out that the same process, if done manually in C++, would not be considered "static analysis that provides memory safety for array access".

Statically asserting at compile time that all memory access are either in-bounds, or will result in a controlled unwind or exit of the process, guarantees there are no memory safety violations.

We understand you're saying it's not possible in the general case to assert that all memory accesses are in bounds. Instead of that, if you ensure all memory accesses are either in bounds or that they at least do not violate memory safety, you've achieved the requirement of "memory safety", regardless of runtime inputs.

> This subthread is about claims of STATIC checking of memory safety. A panic is not static checking. Perhaps you should read what you respond to.

Oh, I read it.

Rust, and for that matter, the person to whom you are replying, above, never claimed that Rust could statically check array bounds. You created that straw-man. Yes, Rust does use static analysis, as one important method to achieve memory safety, but Rust doesn't require static analysis in every instance for it to be Rust's big step function, or for Rust to achieve memory safety.

Yes, certain elements of memory safety can only be achieved at runtime. Fine? But using static analysis to achieve certain elements of memory safety at compile time is obviously better where possible, rather than only at runtime, such as re: Java or Fil-C?

Reply on news.ycombinator.com