RUST PATTERNS. Lars Bergstrom Mozilla Research

Size: px

Start display at page:

Download "RUST PATTERNS. Lars Bergstrom Mozilla Research"

Roy Parks
7 years ago
Views:

1 RUST PATTERNS Lars Bergstrom Mozilla Research

2 Goals Cover some techniques commonly used in Rust programming A safe interface that uses unsafe pointers Phantom types

3 Linked list with owned pointers First, quick owned boxes review Allocated globally Have exactly one owner Memory reclaimed and destructor called when no longer accessible

4 Owned pointer example Moved let x = ~3 let y = x println("{", *x); Error

5 Linked list An ordered sequence of nodes Contains a value in each node A pointer from each node to the next one Head Value Next Value Next

6 Simple linked list with header pub struct List<T> { priv list_head: Option<~Node<T>>, pub struct Node<T> { priv next: Option<~Node<T>>, priv value: T,

7 Quiz: why can t it be pub struct List<T> { priv list_head: Option<Node<T>>, Bad pub struct Node<T> { priv next: Option<Node<T>>, priv value: T, Bad

8 Answer: the type has infinite size pub fn foo(_:node<int>) { print("this doesn't work."); $ rustc --test test.rs task '<unnamed>' has overflowed its stack Illegal instruction: 4

9 Doubly linked list In addition to a pointer to the next node, also has a pointer to the previous node Several benefits Can implement a reverse iterator to walk backwards through the data Insert/delete a node in constant time given only a pointer to the node

10 First (wrong) attempt pub struct List<T> { priv list_head: Option<~Node<T>>, priv list_tail: Option<~Node<T>>, pub struct Node<T> { priv next: Option<~Node<T>>, priv prev: Option<~Node<T>>, priv value: T,

11 Where it goes bad fn push_front_node(&mut self, mut new_head: ~Node<T>) { match self.list_head Error { None => { Error self.list_tail = Some(new_head); new_head.prev = None; self.list_head = Some(new_head); Some(ref mut head) => { Error new_head.prev = None; head.prev = Some(new_head); util::swap(head, &mut new_head); head.next = Some(new_head); Error

12 Instead: use unsafe pointers Pattern: providing a safe interface over unsafe pointers Unsafe pointer usage can crash or corrupt memory To be dynamically safe, need the invariant that the if unsafe pointer references data, then that data is still owned

13 Wrapping up the access in Rawlink use std::cast; use std::ptr; struct Rawlink<T> { priv p: *mut T

14 Just like Option<T>, but unsafe /// Like Option::None fn none() -> Rawlink<T> { Rawlink{p: ptr::mut_null() /// Like Option::Some for Rawlink fn some(n: &mut T) -> Rawlink<T> { Rawlink{p: ptr::to_mut_unsafe_ptr(n)

15 New push_front code fn push_front_node(&mut self, mut new_head: OK, ~Node<T>) { match self.list_head { None => { new_head wasn t moved self.list_tail = Rawlink::some(new_head); new_head.prev = Rawlink::none(); self.list_head = Some(new_head); Some(ref mut head) => { new_head.prev = Rawlink::none(); head.prev = Rawlink::some(new_head); util::swap(head, &mut new_head); head.next = Some(new_head); OK, new_head wasn t moved

16 Use by converting to an Option fn resolve_immut(&self) -> Option<&T> { unsafe { self.p.to_option()

17 And then use just like an Option impl<'self, A> DoubleEndedIterator<&'self A> for ListIterator<'self, A> { #[inline] fn next_back(&mut self) -> Option<&'self A> { if self.nelem == 0 { return None; let tmp = self.tail.resolve_immut(); do tmp.as_ref().map prev { self.nelem -= 1; self.tail = prev.prev; &prev.value

18 What happens if fn boom() { let mut x = None; { let z = Rawlink::some(~3); x = z.resolve_immut(); match x { Some(badness) => assert_eq(3, *badness), None => fail("huh...")

19 Boom $ rustc --test test2.rs &&./test2 running 1 test task '<unnamed>' failed at 'assertion failed: `(left == right) && (right == left)` (left: `3`, right:` `)', test2.rs:57 test tests::boom... FAILED

20 Raw pointers Useful if you need to access an object that is already owned by a different object Be careful Create and remove the pointer only when the object is known valid Do not expose the underlying data (or a wrapper) - the Rust type checker can t help you

21 How does Servo use this? Pointers from the AbstractNode back to the Flow in the new incremental layout code Flow tree is owned by the layout task But the DOM nodes need pointers back to their Flows to be able to reuse them in incremental reflow

22 Questions? An example Rawlink type is in: src/compiler/rust/src/stdextra/dlist.rs

23 Part 2: Phantom types Any type whose type parameter is not used pub struct Typename<Unused> { fields not referencing Unused Used to perform compile-time verification of properties, e.g., That a function is only called on the appropriate phantom-typed object That only certain code can access certain methods

24 Why not just priv? pub struct Shared { data: int, priv secret_data: int impl Shared { /// OK for anyone to call pub fn readsomething(&self) -> int { self.data /// Secret data fn readsecret(&self) -> int { self.secret_data fn writesecret(&mut self) { self.secret_data = 3;

25 Pull out the secure methods pub struct Secure; pub struct Shared<T> { data: int, priv secret_data: int impl<t> Shared<T> { pub fn readsomething(&self) -> int{ self.data impl Shared<Secure> { pub fn readsecret(&self) -> int { self.secret_data pub fn writesecret(&mut self) { self.secret_data = 3;

26 Transmute to get access impl<t> Shared<T> { fn change(&self) -> Shared<Secure> { unsafe { cast::transmute(self)

27 Notes Makes it easy to verify correct usage, as you can just look for uses of Secure in the codebase Difficult to prevent malicious coders from circumventing the system by just calling transmute More about enforcing design patterns and behavior than securing an API Zero runtime cost

28 How does Servo use this? /// A phantom type representing the script task's view of this /// node. Script is able to mutate nodes but may not access /// layout data. pub struct ScriptView; /// A phantom type representing the layout task's view of the /// node. Layout is not allowed to mutate nodes but may access /// layout data. pub struct LayoutView; pub struct AbstractNode<View> { priv obj: *mut Box<Node<View>>,

29 Questions? The servo code is in: src/components/script/dom/node.rs

30 Other patterns Downcasting High-performance Trait usage

USING RUST TO BUILD THE NEXT GENERATION WEB BROWSER

USING RUST TO BUILD THE NEXT GENERATION WEB BROWSER Lars Bergstrom Mozilla Research Mike Blumenkrantz Samsung R&D America Why a new web engine? Support new types of applications and new devices All modern