std: Mark mem::forget as a safe function
#25187
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
(rust_highfive has picked a reviewer for you, use r? to override) |
|
r? @aturon I'm specifically curious on suggestions for improvements to the doc-comment on |
alexcrichton
added
the
beta-nominated
| /// The safety of this function implies that when writing `unsafe` code | ||
| /// yourself, you cannot write a primitive that relies on a destructor running | ||
| /// to preserve memory safety. Unsafe code must be resilient to destructors not | ||
| /// running in all circumstances. |
There was a problem hiding this comment.
This is very confusing. We can't rely on destructors? Of course we can, as long as we don't give away the ownership of the value (so no risk of forget or being passed into an Rc owner, for example).
We rely on stack guards in our code, for example here https://github.com/rust-lang/rust/blob/master/src/libstd/io/mod.rs#L72-L78
There was a problem hiding this comment.
I've pushed some minor updates to the wording here, but I will echo @aturon in that explicitly specifying this kind of detail is likely best left to a future RFC with a more focused discussion.
alexcrichton
force-pushed
the
mem-forget-safe
branch
from
e8ea4b4 to
a3aabdf
Compare
alexcrichton
added
the
beta-accepted
| @@ -235,7 +235,6 @@ extern "rust-intrinsic" { | |||
| /// | |||
| /// `forget` is unsafe because the caller is responsible for | |||
| /// ensuring the argument is deallocated already. | |||
|
Might be a breaking change because the calling convention of |
This commit is an implementation of [RFC 1066][rfc] where the conclusion was that leaking a value is a safe operation in Rust code, so updating the signature of this function follows suit. [rfc]: https://github.com/rust-lang/rfcs/blob/master/text/1066-safe-mem-forget.md Closes rust-lang#25186
alexcrichton
force-pushed
the
mem-forget-safe
branch
from
a3aabdf to
dd59b1f
Compare
|
@tbu- strictly speaking this is a breaking change, but due to the current implementation in the compiler it's not a breaking change because taking the function by value (which is when the ABI in the type starts mattering) you get an ICE: use std::mem;
fn main() {
let f = mem::forget::<i32>;
} |
|
@bluss observes back in rust-lang/rfcs#1066 that |
|
@alexcrichton Thanks for updating the text! |
|
@bors r+ p=1 |
|
📌 Commit dd59b1f has been approved by |
|
@bors: p=50 (putting beta-accepted at the top) |
bors
added a commit
that referenced
this pull request
May 8, 2015
This commit is an implementation of [RFC 1066][rfc] where the conclusion was that leaking a value is a safe operation in Rust code, so updating the signature of this function follows suit. [rfc]: https://github.com/rust-lang/rfcs/blob/master/text/1066-safe-mem-forget.md Closes #25186
alexcrichton
removed
the
beta-nominated
|
What's the reason that |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This commit is an implementation of RFC 1066 where the conclusion was
that leaking a value is a safe operation in Rust code, so updating the signature
of this function follows suit.
Closes #25186