Rust
Summary - Unsafe Rust
Combine unsafe and raw pointers to build split_in_two.
Unsafe Rust summary
unsafe allows five extra operations: dereferencing raw pointers, calling an unsafe fn, accessing a static mut, implementing an unsafe trait and reading a union. The borrow checker stays on. Rules: keep unsafe small, justify every block with // SAFETY:, document the contract of unsafe fns with # Safety and offer a safe interface to the outside. Use cargo miri test for verification.
Safe abstraction: split_at_mut
The standard library's split_at_mut is a safe abstraction built with unsafe. Let's write the same:
use std::slice;
fn ikiye_bol(v: &mut [i32], orta: usize) -> (&mut [i32], &mut [i32]) {
let n = v.len();
assert!(orta <= n);
let p = v.as_mut_ptr();
// SAFETY: [0, orta) and [orta, n) are disjoint and within v's bounds.
unsafe {
(
slice::from_raw_parts_mut(p, orta),
slice::from_raw_parts_mut(p.add(orta), n - orta),
)
}
}
The assert! guarantees the contract at runtime; that's why the function is safe.
Exercise Your own split_at_mut
Write the ikiye_bol function above. For let mut v = [1, 2, 3, 4, 5];, get the two pieces with ikiye_bol(&mut v, 2), set the first element of the first piece to 10 and the first element of the second to 30, then print v.
Show example solution
use std::slice;
fn ikiye_bol(v: &mut [i32], orta: usize) -> (&mut [i32], &mut [i32]) {
let n = v.len();
assert!(orta <= n);
let p = v.as_mut_ptr();
// SAFETY: [0, orta) ve [orta, n) ayrık ve v'nin sınırları içinde.
unsafe {
(
slice::from_raw_parts_mut(p, orta),
slice::from_raw_parts_mut(p.add(orta), n - orta),
)
}
}
fn main() {
let mut v = [1, 2, 3, 4, 5];
let (a, b) = ikiye_bol(&mut v, 2);
a[0] = 10;
b[0] = 30;
println!("{:?}", v);
}
Test yourself
-
Why can't <code>split_at_mut</code> be written in safe code?
- &mut can't be returned
- It can be
- The compiler can't prove that two &mut pieces taken from the same slice don't overlap
- Slices can't be split
Show answer
The compiler can't prove that two &mut pieces taken from the same slice don't overlap — What's obvious to a human (the two pieces are disjoint) can't be proven by the compiler; here unsafe asks us to supply the proof.
-
Slice from raw parts
slice::____(p.add(orta), n - orta)
Show answer
slice::from_raw_parts_mut(p.add(orta), n - orta)
-
Group summary
- unsafe { }
- Five extra operations
- *const / *mut
- Raw pointer
- extern "C"
- FFI
- assert! + unsafe
- Safe abstraction
Next lesson: extern block
