Nicholas Matsakis! Mozilla Research

Transcription

1 Nicholas Matsakis! Mozilla Research

2 Parallel! Systems programming without the hassle crashes! heisenbugs! fear 2

3 C/C++: efficiency first! destructors memory layout smart pointers monomorphization Research community! affine/ownership types region-based borrowing ML/Haskell: safety first! ADTs and pattern matching type inference no null pointers closures traits (typeclasses) 3

4 High-level coding // sums all the positive values in `v` fn sum_pos(v: &[i32]) -> i32 { let mut sum = 0; for i in v.iter().filter( i **i > 0) { sum += *i; sum Iterators. Closures. 4

5 Assembly code leaq (%rdi,%rsi,4), %rcx xorl %eax, %eax jmp.lbb5_1.lbb5_3: addl %edx, %eax.align 16, 0x90.LBB5_1: cmpq %rdi, %rcx je.lbb5_4 movl (%rdi), %edx addq $4, %rdi testl %edx, %edx jle.lbb5_1 jmp.lbb5_3.lbb5_4: retq 5

6 Higher-level coding fn foo(v: &[i32]) -> i32 { v.iter().filter( i **i > 0).map( i *i).sum() generates the same assembly code. 6

7 Safe fn this_wont_compile(v: &mut Vec<i32>) -> i32 { let mut sum = 0; for &i in v.iter() { sum sum += i; if i > 0 { v.push(0); Might free underlying buffer. error: cannot borrow `*v` as mutable because it is also borrowed as immutable if i > 0 { v.push(0); ^ note: previous borrow of `*v` occurs here; the immutable borrow prevents subsequent moves or mutable borrows of `*v` until the borrow ends for &i in v.iter() { ^ 7

8 Parallel fn parallel_qsort(vec: &mut [int]) { if vec.len() <= 1 { return; let pivot = vec[random(vec.len())]; let mid = vec.partition(vec, pivot); let (less, greater) = vec.split_at_mut(mid); parallel::join( parallel_qsort(less), parallel_qsort(greater) ); Sort left and right in parallel. 8

9 Parallel and safe fn parallel_qsort(vec: &mut [int]) { if vec.len() <= 1 { return; let pivot = vec[random(vec.len())]; let mid = vec.partition(vec, pivot); let (less, greater) = vec.split_at_mut(mid); parallel::join( parallel_qsort(less), Data race. parallel_qsort(less) ); error: closure requires unique access to `less` but it is already borrowed parallel_qsort(less) ^~~~~~~~~~~~~~~~~~~~~~~ 9

10 Multiparadigm functional message-passing imperative mutable shared memory 10

11 Open and welcoming Rust has been open source from the beginning. Open governance model based on public RFCs.!! We have an active, amazing community. 11

12 Whither Safety? 12

13 No, it s a double free! It s a dangling pointer! No, it s a data race! Simultaneous Aliasing and Mutation No, it s iterator invalidation! 13

14 The Big Idea Ownership and borrowing:!! 1. All memory has a clear owner. 2. Others can borrow from the owner. 3. Owner cannot free or mutate the memory while it is borrowed. 14

15 fn main() { let mut v = vec![ ]; let sum = sum(v); println!( {:?, sum); Give the vector to sum() fn sum(v: Vec<i32>) -> i32 { let mut s = 0; for i in 0..v.len() { s += v[i]; s Take ownership of a Vec<i32> Ownership 15

16 Compiler enforces moves fn main() { let mut v = vec![ ]; let sum = sum(v); println!( {:?, sum); v[0] += 1; fn sum(v: Vec<i32>) -> i32 { let mut s = 0; for i in 0..v.len() { s += v[i]; s error: use of moved value: `v` v[0] += 1; ^ note: `v` moved here because it has type `Vec<i32>`, which is non-copyable let sum = sum(v); ^ 16

17 Two birds, one stone Ownership solves: - Memory management - Message passing - Strong encapsulation 17

18 fn main() { let mut v = vec![ ]; let sum = sum(&v); println!( {:?, sum); v[0] += 1; Lend the vector fn sum(v: &Vec<i32>) -> i32 { let mut s = 0; for i in 0..v.len() { s += v[i]; s Take a reference to a Vec<i32> Shared borrow 18

19 fn main() { let mut v = vec![ ]; sum(&mut v); v[0] += 1; Lend the vector mutably fn sum(v: &mut Vec<i32>) { let mut s = 0; for i in 0..v.len() { s += v[i]; v[i] = s; Take a mutable reference to a Vec<i32> Mutable borrow 19

20 fn example() { let mut names = Vec::new(); names.push(..); names.push(..); let name = &names[1]; names.push(..); print(name); Mutating the vector freed old contents. brson pcwalton acrichto data brson names length pcwalton capacity name Sharing: more than Dangling one pointer: pointer to same to freed memory. 20

21 Rust solution Compile-time read-write-lock:!! Creating a shared reference to X read locks X. - Other readers OK. - No writers. - Lock lasts until reference goes out of scope.! Creating a mutable reference to X writes locks X. - No other readers or writers. - Lock lasts until reference goes out of scope. Never have a reader/writer at same time. 21

22 fn example() { let mut names = Vec::new(); names.push( brson ); names.push( pcwalton ); let name = &names[1]; names.push( acrichto ); println!( {:?, name); Error: cannot mutate `names` while borrowed Borrow locks `names` until `name` goes out of scope 22

23 Back to qsort fn parallel_qsort(vec: &mut [int]) { if vec.len() <= 1 { return; let pivot = vec[random(vec.len())]; let mid = vec.partition(vec, pivot); let (less, greater) = vec.split_at_mut(mid); parallel::join( parallel_qsort(less), parallel_qsort(less) mutably ); Creating closure borrows `less` This closure also needs a mutable borrow 23

24 Hack without fear! 24