Re:Rust Performance Pitfalls
by Anderkent on Thursday June 08, 2017 @12:38PM
(#14515314)
'break your code in surprising ways' is super vague. Saying 'may cause out of bounds memory access/writes should the input not be valid UTF-8' explicitly is probably more scary.
[ Parent
| on HN ]
Re:Rust Performance Pitfalls
by steveklabnik on Thursday June 08, 2017 @12:51PM
(#14515398)
The nature of undefined behavior is in fact super vague; it's not actually possible to say what will happen.
While technically true, a specific example helps the reader conceptualize what level of danger that means, when they don't already have a concrete understanding like you do. Recall that the breadth of experience for rust's userbase is much larger than e.g. C.
Re:Rust Performance Pitfalls
by steveklabnik on Thursday June 08, 2017 @02:24PM
(#14516027)
Oh yeah, I mean, I'm not saying I disagree with adding detail, I can just see the impulse to not, since anything you say may or may not be true.
me talking about rust's userbase
steveklabnik's profile: "Rust core team"
I'm guessing you know that a lot better than I do lol.
Re:Rust Performance Pitfalls
by steveklabnik on Thursday June 08, 2017 @02:54PM
(#14516250)
It's all good! You're absolutely right, and it's easy to forget when you're inside a bubble.
Re:Rust Performance Pitfalls
by TickleSteve on Thursday June 08, 2017 @03:48PM
(#14516676)
> breadth of experience for rust's userbase is much larger than e.g. C
Really? I think you mean the opposite here.
Re:Rust Performance Pitfalls
by steveklabnik on Thursday June 08, 2017 @03:54PM
(#14516725)
I read this as saying "not depth", that is, C programmers will have a deep understanding here, but since Rust is drawing in a lot of new blood, they on average will not.
Just say the worst thing that can happen, out of bounds access probably qualifies. :-)
"Could potentially emit code to rm -rf /"
That's the kind of vagueness that should sound like a warning to anyone considering that approach.
The nature of warnings means that any time you make assumptions about those that might need the warnings having enough knowledge to correctly assess an ambiguity, you've likely just failed a portion of the people the warning was meant to help.
The correct response when warning people of potential problems is never "oh, they should be able to figure out whether this applies to their case".
Right. The correct answer here is to convert external data into UTF-8 once and keep it that way. You're probably not going to become compute-bound, even if you're just reading in text and writing it out again. The UTF-8 check is linear time.
Re:Rust Performance Pitfalls
by burntsushi on Thursday June 08, 2017 @01:57PM
(#14515848)
Most of the Rust programs I write are compute bound, and finding ways to avoid the separate UTF-8 validation step are critical to their performance.
That's because you write string search programs. Do those even need to run in UTF-8 space, as opposed to pure byte strings?
If you are reading text and writing it out you generally do not want to convert to utf8 as it is potentially lossy. Think of unix filters.
To me "your code breaks in surprising ways" means something more like "the user sees gibberish/wrong results" and not "your program segfaults". Segfaulting is not actually a surprising result to me - I have seen it over and over on out of bounds access.
A buffer overflow doesn't necessarily cause a segfault - that's the problem! A guaranteed segfault would be a completely valid and safe way to handle a buffer overflow. But segfaults only happen when your program tries to access memory it does not own. It is improbable that an overflowing buffer is straight at a page boundary, doubly so if the buffer is allocated on the stack. Instead, you get gibberish output, an invalid and unexpected program state, no effect at all (except once in a blue moon) or in the worst case a code injection vulnerability. That is, undefined behavior.
Yes, the overflow either segfaults your program, or doesn't. It's not undefined. Computers don't perform random operations. Just say "it will produce buffer overflow" - that is absolutely a defined operation: the CPU will execute a load from an address that hasn't been defined at that place in code and will either contain leftover data, or refer to an unmapped page, triggering a segfault. This isn't quantum mechanics where the underlying physical reality is inherently undefined until you measure it (caveat: as far as we know, at least), this is just insufficient knowledge of hidden variables. I understand that the compiler might emit instructions under various assumptions, which is what we mean by "undefined behaviour" when those assumptions don't hold, but once there's actual machine code running on the actual CPU, everything is absolutely perfectly defined.
All the solutions and problems in computing stem from the fact that we're programming completely deterministic Turing machines that do exactly what they're told.
Re:Rust Performance Pitfalls
by Dylan16807 on Friday June 09, 2017 @06:09AM
(#14520354)
That's a very narrow view of the problem. There are so many moving parts in a program that overwriting an arbitrary chunk of stack is effectively random. Do you object to the term "random number generator" too?
Just saying "or doesn't" is not a useful description. The vast majority of horrible broken behaviors fit inside of that bucket, where it doesn't segfault but then goes on to do the wrong thing at an unexpected place.
And because we're using an optimizing compiler, you can't give a simple description like "overflows a buffer". When the compiler assumes your code is correct, it might output instructions that behave in 'impossible' ways when fed invalid data. For example an if/else that takes neither branch, or both branches, or code that verifies a number has a certain value yet outputs a completely different value. You can only make assertions about what a particular compile will do, and that's obsolete information immediately.
As soon as you use more than one clock domain it's no longer completely deterministic.