Unsafe Rust is not C

Jack O'Connor explains the differences between unsafe Rust and C, focusing on pointer aliasing rules and undefined behavior.

Unsafe Rust is like C in some ways, but there are tricky rules that unsafe Rust has to follow that don't exist in C. C also has some tricky rules of its own. This is a talk about some of these differences, particularly when it comes to pointer aliasing. Contents: 00:00 introduction 02:24 a familiar example 06:05 sprinkling unsafe doesn't help 06:58 raw pointers 09:50 a "false positive" 13:47 mutable aliasing is UB 15:55 confirming UB with Miri 16:59 comparing assembly 22:46 a pathological example 26:53 strict aliasing in C 30:16 overlapping in C 35:50 aliasing and overlapping in unsafe Rust 36:58 Why do compilers do this to us? 45:04 outro Slides: - a familiar example: godbolt.org/z/vss7Wb585 - sprinkling unsafe doesn't help: godbolt.org/z/T55Tx8KEn - raw pointers: godbolt.org/z/dzo6Pan5q - a "false positive": godbolt.org/z/jjTGPE1fK - mutable aliasing is UB: godbolt.org/z/T78MxzE9G (updated, see errata below) - confirming UB with Miri: play.rust-lang.org/?version=stable&mode=debug&edition=2021&g… - comparing assembly: godbolt.org/z/rzv7Taof6 - a pathological example: play.rust-lang.org/?version=stable&mode=debug&edition=2021&g… - strict aliasing in C: godbolt.org/z/7qWdfG5MG - overlapping in C: godbolt.org/z/f73Ejjnbj - permissive aliasing in Rust: godbolt.org/z/oh8q663sn - overlapping in Rust: godbolt.org/z/bcheT4KoM - Why do compilers do this to us? godbolt.org/z/shTTcv69h Errata: - The godbolt example at 13:47 ("mutable aliasing is UB" above) stops working if you update the compiler version to 1.75.0 or newer. As of Rust 1.82.0, to get the wrong answer in release mode as intended, you need to add #[inline(never)] above foo. I've updated the godbolt link with this change. Thanks to Francisco Garrido de Figueiredo for catching this one. - At 16:16 I said that Miri "inserts extra checks into your code", but that's not actually how Miri works. (Though it is how ASan and UBSan work.) Instead, Miri directly interprets the "mid-level intermediate representation" of your program, which is produced by the compiler. Thanks to Tyler Bloom for catching this one. - At 26:53 I show an example of breaking the "strict aliasing" rule in C, and that example does indeed produce undefined behavior today. But as of just last month, a proposal called "Improved Rules for Tag Compatibility" (N3003) has been adopted into C23 that will make this particular example legal. More egregious violations of this rule, like casting an int pointer to a float pointer, will continue to be UB. Thanks to Michael Grunder for pointing this out. (Update: Actually this particular example might never become legal, because the struct "tags" aren't the same? It's not clear to me.) - At 32:08 I claimed that some pointer casts were allowed, but that's probably incorrect. It might still be true that compilers reason a