From 90f8e367c2a92edc506752d8689b6ea8acad8c2f Mon Sep 17 00:00:00 2001 From: Ralf Jung Date: Sat, 9 Jan 2016 15:42:03 +0100 Subject: [PATCH 1/1] add link to the rustonomicon example --- personal/_posts/2016-01-09-the-scope-of-unsafe.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/personal/_posts/2016-01-09-the-scope-of-unsafe.md b/personal/_posts/2016-01-09-the-scope-of-unsafe.md index 6c69d09..0bbdcfb 100644 --- a/personal/_posts/2016-01-09-the-scope-of-unsafe.md +++ b/personal/_posts/2016-01-09-the-scope-of-unsafe.md @@ -35,7 +35,7 @@ Roughly speaking, `ptr` points to the heap-allocated block of memory holding the It is very easy to add a function to `Vec` that contains no `unsafe` code, and still breaks the safety of the data structure: {% highlight rust %} impl Vec { - fn evil(&mut self) { + pub fn evil(&mut self) { self.len += 2; } } @@ -59,7 +59,7 @@ More precisely speaking, `ptr` points to an array of type `T` and size `cap`, of The function `evil` above violates this invariant, while all the functions actually provided by `Vec` (including the ones that are implemented unsafely) preserve the invariant. That's why `evil` is the bad guy. (The name kind of gave it away, didn't it?) -This may seem obvious in hindsight, but I think it is actually fairly subtle. +This may seem obvious in hindsight (and it is also [discussed in the Rustonomicon](https://doc.rust-lang.org/nightly/nomicon/working-with-unsafe.html)), but I think it is actually fairly subtle. There used to be claims on the interwebs that "if a Rust program crashes, the bug must be in some `unsafe` block". (And there probably still are.) Even academic researchers working on Rust got this wrong, arguing that in order to detect bugs in data structures like `Vec` it suffices to check functions involving unsafe code. That's why I think it's worth dedicating an entire blog post to this point. @@ -82,7 +82,7 @@ pub struct MyType { We will define only one function for this type: {% highlight rust %} impl MyType { - fn evil(&mut self) { + pub fn evil(&mut self) { self.len += 2; } } -- 2.30.2