Rust: Unlocking Systems Programming

Aaron Turon

Mozilla Research

InfoQ.com: News & Community Site
• 750,000 unique visitors/month
• Published in 4 languages (English, Chinese, Japanese and Brazilian
Portuguese)
• Post content from our QCon conferences
• News 15-20 / week
• Articles 3-4 / week
• Presentations (videos) 12-15 / week
• Interviews 2-3 / week
• Books 1 / month
Watch the video with slide
synchronization on InfoQ.com!
http://www.infoq.com/presentations
/rust-thread-safety

Purpose of QCon
- to empower software development by facilitating the spread of
knowledge and innovation
Strategy
- practitioner-driven conference designed for YOU: influencers of
change and innovation in your teams
- speakers and topics driving the evolution and innovation
- connecting and catalyzing the influencers and innovators
Highlights
- attended by more than 12,000 delegates since 2007
- held in 9 cities worldwide
Presented at QCon San Francisco
www.qconsf.com

Rust is a systems programming language
that runs blazingly fast, prevents nearly all
segfaults, and guarantees thread safety.

- https://www.rust-lang.org/

Safety
Control
C C++
Go
Java
Haskell
Scala
“Low-level”

Conventional wisdom
The Essence of Rust
Low-level == Unsafe
+ Safe

Why Rust?
- You’re already doing systems programming,  
want safety or expressiveness.

!
- You wish you could do some systems work

- Maybe as an embedded piece in your 
Java, Python, JS, Ruby, …

Why Mozilla?
Browsers need control.
Browsers need safety.
Servo: Next-generation
browser built in Rust.
Rust: New language for

safe systems programming.

What is control?
void example() {
vector<string> vector;
…
auto& elem = vector[0];
…
}
string[0]
…elem
vector
data
length
capacity
[0]
[n]
[…]
…
‘H’
…
‘e’
Stack and inline layout.
Interior references
Deterministic destruction
Stack Heap
C++

Zero-cost abstraction
Ability to deﬁne abstractions that

optimize away to nothing.
vector data
length
cap.
[0]
[…]
data cap.
‘H’
‘e’
[…]
Not just memory layout:

- Static dispatch

- Template expansion

- … Java

What is safety?
void example() {
vector<string> vector;
…
auto& elem = vector[0];
vector.push_back(some_string);
cout << elem;
}
vector
data
length
capacity
[0]
…
[0]
[1]
elem
Aliasing: more than

one pointer to same

memory.
Dangling pointer: pointer

to freed memory.
C++
Mutating the vector

freed old contents.

What about GC?
No control.
Requires a runtime.
Insufﬁcient to prevent related problems:

iterator invalidation, data races, many others.

Ownership & Borrowing
Memory

safety
Data-race

freedom

(and more)
No need for

a runtime
GCC++

… Plus lots of goodies
- Pattern matching

- Traits

- “Smart” pointers

- Metaprogramming

- Package management (think Bundler)
TL;DR: Rust is a modern language

Ownership
!
n. The act, state, or right of possessing something.

Ownership (T)
Aliasing Mutation

vec
data
length
capacity
vec
data
length
capacity
1
2
fn give() {
let mut vec = Vec::new();
vec.push(1);
vec.push(2);
take(vec);
…
}
fn take(vec: Vec<int>) {
// …
}
!
!
!
Take ownership

of aVec<int>

fn give() {
vec.push(1);
vec.push(2);
take(vec);
…
}
vec.push(2);
Compiler enforces moves
fn take(vec: Vec<int>) {
// …
}
!
!
!Error: vec has been moved
Prevents:

- use after free

- double moves

- …

Borrow
!
v. To receive something with the promise of returning it.

Shared borrow (&T)
Aliasing Mutation

Mutable borrow (&mut T)
Aliasing Mutation

fn lender() {
vec.push(1);
vec.push(2);
use(&vec);
…
}
fn use(vec: &Vec<int>) {
// …
}
!
!
!
1
2vec
data
length
capacity
vec
“Shared reference

toVec<int>”
Loan out vec

fn use(vec: &Vec<int>) {
vec.push(3);
vec[1] += 2;
}
Shared references are immutable:
Error: cannot mutate shared reference
* Actually: mutation only in controlled circumstances
*
Aliasing Mutation

fn push_all(from: &Vec<int>, to: &mut Vec<int>) {
for elem in from {
to.push(*elem);
}
}
Mutable references
mutable reference to Vec<int>
push() is legal

1
2
3
from
to
elem
1
…
for elem in from {
to.push(*elem);
}
}
Mutable references

What if from and to are equal?
1
2
3
from
to
elem
1
2
3
…
1
for elem in from {
to.push(*elem);
}
} dangling pointer

fn push_all(from: &Vec<int>, to: &mut Vec<int>) {…}
!
fn caller() {
let mut vec = …;
push_all(&vec, &mut vec);
}
shared reference
Error: cannot have both shared and
mutable reference at same time
A &mut T is the only way to access

the memory it points at

{
…
for i in 0 .. vec.len() {
let elem: &int = &vec[i];
…
vec.push(…);
}
…
vec.push(…);
}
Borrows restrict access to
the original path for their
duration.
Error: vec[i] is borrowed,
cannot mutate
OK. loan expired.
&
&mut
no writes, no moves
no access at all

Concurrency
!
n. several computations executing simultaneously, and
potentially interacting with each other.

Rust’s vision for concurrency
Originally:

!
Now:
only isolated message passing
libraries for many paradigms,

using ownership to avoid footguns,

guaranteeing no data races

Data race
Two unsynchronized threads

accessing same data
where at least one writes.
✎
✎

Aliasing
Mutation
No ordering
Data race
Sound familiar?

No data races =

No accidentally-shared state.

!
All sharing is explicit!
*some_value = 5;
return *some_value == 5; // ALWAYS true

data
length
capacity
data
length
capacity
move || {
let m = Vec::new();
…
tx.send(m);
}
rx
tx
tx
m
fn parent() {
let (tx, rx) = channel();
spawn(move || {…});
let m = rx.recv();
}

Locked mutable access
(ownership, borrowing)
✎
✎

fn sync_inc(mutex: &Mutex<int>) {
let mut data = mutex.lock();
*data += 1;
}
Destructor releases lock
Yields a mutable reference to data
Destructor runs here, releasing lock

Disjoint, scoped access
(borrowing)
✎
✎

fn qsort(vec: &mut [int]) {
if vec.len() <= 1 { return; }
let pivot = vec[random(vec.len())];
let mid = vec.partition(vec, pivot);
let (less, greater) = vec.split_at_mut(mid);
qsort(less);
qsort(greater);
}
[0] [1] [2] [3] […] [n]
let vec: &mut [int] = …;
less greater

fn split_at_mut(&mut self, mid: usize)
-> (&mut [T], & mut [T])

[0] [1] [2] [3] […] [n]
let vec: &mut [int] = …;
less greater
fn parallel_qsort(vec: &mut [int]) {
if vec.len() <= 1 { return; }
let pivot = vec[random(vec.len())];
let mid = vec.partition(vec, pivot);
let (less, greater) = vec.split_at_mut(mid);
parallel::join(
|| parallel_qsort(less),
|| parallel_qsort(greater)
);
}

Arc<Vec<int>>: Send
Rc<Vec<int>> : !Send
fn send<T: Send>(&self, t: T)
Only “sendable” types
Static checking for thread safety

And beyond…
Concurrency is an area of active development.

!
Either already have or have plans for:

- Atomic primitives

- Non-blocking queues

- Concurrent hashtables

- Lightweight thread pools

- Futures

- CILK-style fork-join concurrency

- etc.
Always data-race free

Unsafe
!
adj. not safe; hazardous

Safe abstractions
unsafe {
…
}
Useful for:

Bending mutation/aliasing rules (split_at_mut)

Interfacing with C code
Trust me.
fn something_safe(…) {
!
!
!
!
}
Validates input, etc.
Ownership enables safe abstraction boundaries.

Community
!
n. A feeling of fellowship with others sharing similar goals.

“The Rust community seems to be
populated entirely by human beings.
I have no idea how this was done.”

— Jamie Brandon

It takes a village…
Community focus from the start:

Rust 1.0 had > 1,000 contributors

Welcoming, pragmatic culture

!
Developed “in the open”

Much iteration;

humility is key!

!
Clear leadership

Mix of academic and engineering backgrounds

“Keepers of the vision”

Memory safety

Concurrency

Abstraction

Stability
without
garbage collection

data races

overhead

stagnation
Hack without fear!
Articulating the vision

Watch the video with slide synchronization on
InfoQ.com!
http://www.infoq.com/presentations/rust-
thread-safety

Rust: Unlocking Systems Programming

In this document

More Related Content

What's hot

Viewers also liked

Similar to Rust: Unlocking Systems Programming

More from C4Media

Recently uploaded

Rust: Unlocking Systems Programming