Project for porting C to Rust gains Mozilla's backing (InfoWorld) [LWN.net]

Project for porting C to Rust gains Mozilla's backing (InfoWorld)

Posted Nov 2, 2016 12:26 UTC (Wed) by valarauca (guest, #109490)
In reply to: Project for porting C to Rust gains Mozilla's backing (InfoWorld) by vasvir
Parent article: Project for porting C to Rust gains Mozilla's backing (InfoWorld)

In non-debug builds the Rust integer addition mirrors the C integer addition. Overflow/underflow will behave according to the platform specification.

The developer can opt-into checked addition (actually most integer operations can be check) which returns an Option<usize> (usize is being used here as an example, usize in Rust is the same as C's size_t). The Option<usize> is just a tagged union of char, size_t where the char signals if overflow occurred.

Here [1] is a simple playpen link where you can see the various ASM generated the different levels (debug/release).

[1] https://play.rust-lang.org/?gist=2bd93049475dda6e75e345a9...

to post comments

Project for porting C to Rust gains Mozilla's backing (InfoWorld)

Posted Nov 3, 2016 11:38 UTC (Thu) by smurf (subscriber, #17840) [Link] (1 responses)

> Here [1] is a simple playpen link
… which doesn't seem to work:
>> error[E0308]: match arms have incompatible types

Project for porting C to Rust gains Mozilla's backing (InfoWorld)

Posted Nov 8, 2016 18:40 UTC (Tue) by ms-tg (subscriber, #89231) [Link]

Try this (I just hacked a fix in):
https://play.rust-lang.org/?gist=1da34770cfdbb44dd77bf966...

Using this (a) it compiles and runs as expected (b) you can look at the ASM output as indicated

Project for porting C to Rust gains Mozilla's backing (InfoWorld)

Posted Nov 3, 2016 13:01 UTC (Thu) by kevincox (subscriber, #93938) [Link] (2 responses)

> In non-debug builds the Rust integer addition mirrors the C integer addition. Overflow/underflow will behave according to the platform specification.

This is NOT how integer overflow works in C. In C unsigned integer overflow is undefined. In Rust "release" builds integer overflow is two's-compliment wrapping.

While in many cases the compiler will use the platforms native overflow behavior an optimizing compiler will often make assumptions because it doesn't have to wrap like the native platform.

For example (x + 1 < x) will be optimized to (0) by most compilers. You will also often see compilers promote small integers to machine words which will cause non-wrapping behavior when you are working with integers that will be used as memory offsets (including array indexes)

Project for porting C to Rust gains Mozilla's backing (InfoWorld)

Posted Nov 3, 2016 13:21 UTC (Thu) by TomH (subscriber, #56149) [Link] (1 responses)

I think you've confused yourself - unsigned integer overflow is defined in C (it wraps). It is signed integer overflow that is undefined.

Project for porting C to Rust gains Mozilla's backing (InfoWorld)

Posted Nov 7, 2016 14:14 UTC (Mon) by musicinmybrain (subscriber, #42780) [Link]

…and to be really pedantic about it, the view of the C standard is that all overflow is undefined, and the mandated unsigned integer “wrapping” behavior (arithmetic modulo 2^n) is not a kind of overflow.