Aaron Turon! Mozilla Research

Transcription

1 Aaron Turon Mozilla Research

2 C/C++ ML/Haskell Rust Safe systems programming

3 Why Mozilla? Browsers need control. Browsers need safety. Servo: Next-generation browser built in Rust.

4 C++ What is control? void example() { vector<string> vector; auto& elem = vector[0];

5 C++ What is control? void example() { vector<string> vector; auto& elem = vector[0]; Stack and inline layout. vector data length capacity [0] [] [n] string Stack Heap

6 C++ What is control? void example() { vector<string> vector; auto& elem = vector[0]; Stack and inline layout. vector data length capacity [0] [] [n] string H e Stack Heap

7 C++ What is control? void example() { vector<string> vector; auto& elem = vector[0]; Stack and inline layout. vector data length capacity [0] [] [n] string Stack Heap

8 C++ What is control? void example() { vector<string> vector; auto& elem = vector[0]; Stack and inline layout. Lightweight references vector data length capacity elem [0] [] [n] string Stack Heap

9 C++ What is control? void example() { vector<string> vector; auto& elem = vector[0]; Stack and inline layout. Lightweight references Deterministic destruction vector data length capacity elem [0] [] [n] string Stack Heap

10 Zero-cost abstraction Ability to define abstractions that optimize away to nothing.

11 Zero-cost abstraction Ability to define abstractions that optimize away to nothing. vector data cap. length [0] data cap. [] H e [] Java

12 Zero-cost abstraction Ability to define abstractions that optimize away to nothing. vector data cap. length [0] data cap. [] H e Not just memory layout: - Static dispatch [] - Template expansion - Java

13 Zero-cost abstraction safe Ability to define abstractions that optimize away to nothing. vector data cap. length [0] data cap. [] H e Not just memory layout: - Static dispatch [] - Template expansion - Java

14 C++ What is safety? void example() { vector<string> vector; auto& elem = vector[0]; vector.push_back(some_string); cout << elem; vector data length capacity elem [0]

15 C++ What is safety? void example() { vector<string> vector; auto& elem = vector[0]; vector.push_back(some_string); cout << elem; vector data length capacity elem [0]

16 C++ What is safety? void example() { vector<string> vector; auto& elem = vector[0]; vector.push_back(some_string); cout << elem; [0] [1] vector data length capacity elem [0]

17 C++ What is safety? void example() { vector<string> vector; auto& elem = vector[0]; vector.push_back(some_string); cout << elem; [0] [1] vector data length capacity elem [0]

18 C++ What is safety? void example() { vector<string> vector; auto& elem = vector[0]; vector.push_back(some_string); cout << elem; [0] [1] vector data length capacity elem [0] Dangling pointer: pointer to freed memory.

19 C++ What is safety? void example() { vector<string> vector; auto& elem = vector[0]; vector.push_back(some_string); cout << elem; [0] [1] vector data length capacity elem [0] Dangling pointer: pointer to freed memory.

20 C++ What is safety? void example() { vector<string> vector; auto& elem = vector[0]; vector.push_back(some_string); cout << elem; [0] [1] vector data length capacity elem [0]

21 C++ What is safety? void example() { vector<string> vector; auto& elem = vector[0]; vector.push_back(some_string); cout << elem; [0] [1] vector data length capacity elem [0] Aliasing: more than one pointer to same memory.

22 C++ What is safety? void example() { vector<string> vector; auto& elem = vector[0]; vector.push_back(some_string); cout << elem; Mutating the vector freed old contents. [0] [1] vector data length capacity elem [0] Aliasing: more than one pointer to same memory.

23 What about GC?

24 What about GC? No control. Requires a runtime.

25 What about GC? No control. Requires a runtime. Insufficient to prevent related problems: iterator invalidation, data races.

26 Rust s Solution Type system enforces ownership and borrowing: 1. All resources have a clear owner. 2. Others can borrow from the owner. 3. Owner cannot free or mutate the resource while it is borrowed. 8

27 Ownership/Borrowing No need for a runtime Memory safety Data-race freedom 9

28 Ownership/Borrowing No need for a runtime Memory safety Data-race freedom C++ 9

29 Ownership/Borrowing No need for a runtime Memory safety Data-race freedom C++ GC 9

30 More to Rust than Safety Explicit control is often correlated with painfully verbose. Rust offers lots of goodies traditionally associated with garbagecollected runtimes: - Closures - Pattern matching - Type inference - Traits

31 Credit where it is due Rust has an active, amazing community.

32 Ownership n. The act, state, or right of possessing something.

33 Ownership (T)

34 Ownership (T)

35 Ownership (T)

36 Ownership (T)

37 Aliasing Mutation Ownership (T)

38 Aliasing Mutation Ownership (T)

39 fn give() { let mut vec = Vec::new(); vec.push(1); vec.push(2); take(vec); fn take(vec: Vec<int>) { // data vec length capacity

40 fn give() { let mut vec = Vec::new(); vec.push(1); vec.push(2); take(vec); fn take(vec: Vec<int>) { // data vec length capacity

41 fn give() { let mut vec = Vec::new(); vec.push(1); vec.push(2); take(vec); fn take(vec: Vec<int>) { // data 1 vec length capacity

42 fn give() { let mut vec = Vec::new(); vec.push(1); vec.push(2); take(vec); fn take(vec: Vec<int>) { // data 1 vec length capacity

43 fn give() { let mut vec = Vec::new(); vec.push(1); vec.push(2); take(vec); fn take(vec: Vec<int>) { // data 1 vec length capacity 2

44 fn give() { let mut vec = Vec::new(); vec.push(1); vec.push(2); take(vec); fn take(vec: Vec<int>) { // data 1 vec length capacity 2

45 fn give() { let mut vec = Vec::new(); vec.push(1); vec.push(2); take(vec); fn take(vec: Vec<int>) { // Take ownership of a Vec<int> data 1 vec length capacity 2

46 fn give() { let mut vec = Vec::new(); vec.push(1); vec.push(2); take(vec); fn take(vec: Vec<int>) { // data 1 vec length capacity 2

47 fn give() { let mut vec = Vec::new(); vec.push(1); vec.push(2); take(vec); fn take(vec: Vec<int>) { // data 1 vec length capacity 2 vec data length capacity

48 fn give() { let mut vec = Vec::new(); vec.push(1); vec.push(2); take(vec); fn take(vec: Vec<int>) { // data 1 vec length capacity 2 vec data length capacity

49 fn give() { let mut vec = Vec::new(); vec.push(1); vec.push(2); take(vec); fn take(vec: Vec<int>) { // data 1 vec length capacity 2 vec data length capacity

50 fn give() { let mut vec = Vec::new(); vec.push(1); vec.push(2); take(vec); fn take(vec: Vec<int>) { // data 1 vec length capacity 2 vec data length capacity

51 fn give() { let mut vec = Vec::new(); vec.push(1); vec.push(2); take(vec); fn take(vec: Vec<int>) { // data vec length capacity

52 fn give() { let mut vec = Vec::new(); vec.push(1); vec.push(2); take(vec); fn take(vec: Vec<int>) { // data vec length capacity

53 Compiler enforces moves fn give() { let mut vec = Vec::new(); vec.push(1); vec.push(2); take(vec); fn take(vec: Vec<int>) { //

54 Compiler enforces moves fn give() { let mut vec = Vec::new(); vec.push(1); vec.push(2); take(vec); fn take(vec: Vec<int>) { //

55 Compiler enforces moves fn give() { let mut vec = Vec::new(); vec.push(1); vec.push(2); take(vec); vec.push(2); fn take(vec: Vec<int>) { //

56 Compiler enforces moves fn give() { let mut vec = Vec::new(); vec.push(1); vec.push(2); take(vec); vec.push(2); fn take(vec: Vec<int>) { // Error: vec has been moved

57 Compiler enforces moves fn give() { let mut vec = Vec::new(); vec.push(1); vec.push(2); take(vec); vec.push(2); fn take(vec: Vec<int>) { // Error: vec has been moved

58 Compiler enforces moves fn give() { let mut vec = Vec::new(); vec.push(1); vec.push(2); take(vec); vec.push(2); fn take(vec: Vec<int>) { // Error: vec has been moved Prevents: - use after free - double moves -

59 Borrow v. To receive something with the promise of returning it.

60 Shared borrow (&T)

61 Shared borrow (&T)

62 Shared borrow (&T)

63 Aliasing Mutation Shared borrow (&T)

64 Aliasing Mutation Shared borrow (&T)

65 Mutable borrow (&mut T)

66 Mutable borrow (&mut T)

67 Mutable borrow (&mut T)

68 Mutable borrow (&mut T)

69 Mutable borrow (&mut T)

70 Mutable borrow (&mut T)

71 Mutable borrow (&mut T)

72 Aliasing Mutation Mutable borrow (&mut T)

73 Aliasing Mutation Mutable borrow (&mut T)

74 fn lender() { let mut vec = Vec::new(); vec.push(1); vec.push(2); use(&vec); fn use(vec: &Vec<int>) { //

75 fn lender() { let mut vec = Vec::new(); vec.push(1); vec.push(2); use(&vec); fn use(vec: &Vec<int>) { // data 1 vec length capacity 2

76 fn lender() { let mut vec = Vec::new(); vec.push(1); vec.push(2); use(&vec); fn use(vec: &Vec<int>) { // data 1 vec length capacity 2

77 fn lender() { let mut vec = Vec::new(); vec.push(1); vec.push(2); use(&vec); fn use(vec: &Vec<int>) { // Shared reference to Vec<int> data 1 vec length capacity 2

78 fn lender() { let mut vec = Vec::new(); vec.push(1); vec.push(2); use(&vec); Loan out vec fn use(vec: &Vec<int>) { // Shared reference to Vec<int> data 1 vec length capacity 2

79 fn lender() { let mut vec = Vec::new(); vec.push(1); vec.push(2); use(&vec); Loan out vec fn use(vec: &Vec<int>) { // Shared reference to Vec<int> data 1 vec length capacity 2 vec

80 fn lender() { let mut vec = Vec::new(); vec.push(1); vec.push(2); use(&vec); fn use(vec: &Vec<int>) { // data 1 vec length capacity 2 vec

81 fn lender() { let mut vec = Vec::new(); vec.push(1); vec.push(2); use(&vec); fn use(vec: &Vec<int>) { // data 1 vec length capacity 2 vec

82 fn lender() { let mut vec = Vec::new(); vec.push(1); vec.push(2); use(&vec); fn use(vec: &Vec<int>) { // data 1 vec length capacity 2

83 fn lender() { let mut vec = Vec::new(); vec.push(1); vec.push(2); use(&vec); fn use(vec: &Vec<int>) { // data 1 vec length capacity 2

84 Aliasing Mutation Shared references are immutable: fn use(vec: &Vec<int>) { vec.push(3); vec[1] += 2;

85 Aliasing Mutation Shared references are immutable: fn use(vec: &Vec<int>) { vec.push(3); vec[1] += 2;

86 Aliasing Mutation Shared references are immutable: fn use(vec: &Vec<int>) { vec.push(3); vec[1] += 2;

87 Aliasing Mutation Shared references are immutable: fn use(vec: &Vec<int>) { vec.push(3); vec[1] += 2; Error: cannot mutate shared reference

88 Aliasing Mutation Shared references are immutable: * fn use(vec: &Vec<int>) { vec.push(3); vec[1] += 2; Error: cannot mutate shared reference * Actually: mutation only in controlled circumstances

89 Mutable references fn push_all(from: &Vec<int>, to: &mut Vec<int>) { for elem in from.iter() { to.push(*elem);

90 Mutable references fn push_all(from: &Vec<int>, to: &mut Vec<int>) { for elem in from.iter() { to.push(*elem); mutable reference to Vec<int>

91 Mutable references fn push_all(from: &Vec<int>, to: &mut Vec<int>) { for elem in from.iter() { to.push(*elem); mutable reference to Vec<int> push() is legal

92 Efficient Iteration fn push_all(from: &Vec<int>, to: &mut Vec<int>) { for elem in from.iter() { to.push(*elem); from to 1 2 3

93 Efficient Iteration fn push_all(from: &Vec<int>, to: &mut Vec<int>) { for elem in from.iter() { to.push(*elem); from to 1 2 3

94 Efficient Iteration fn push_all(from: &Vec<int>, to: &mut Vec<int>) { for elem in from.iter() { to.push(*elem); from to elem 1 2 3

95 Efficient Iteration fn push_all(from: &Vec<int>, to: &mut Vec<int>) { for elem in from.iter() { to.push(*elem); from to elem 1 2 3

96 Efficient Iteration fn push_all(from: &Vec<int>, to: &mut Vec<int>) { for elem in from.iter() { to.push(*elem); from to elem

97 Efficient Iteration fn push_all(from: &Vec<int>, to: &mut Vec<int>) { for elem in from.iter() { to.push(*elem); from to elem

98 Efficient Iteration fn push_all(from: &Vec<int>, to: &mut Vec<int>) { for elem in from.iter() { to.push(*elem); from to elem

99 What if from and to are equal? fn push_all(from: &Vec<int>, to: &mut Vec<int>) { for elem in from.iter() { to.push(*elem); from to elem 1 2 3

100 What if from and to are equal? fn push_all(from: &Vec<int>, to: &mut Vec<int>) { for elem in from.iter() { to.push(*elem); 1 from to elem

101 What if from and to are equal? fn push_all(from: &Vec<int>, to: &mut Vec<int>) { for elem in from.iter() { to.push(*elem); 1 from to elem

102 What if from and to are equal? fn push_all(from: &Vec<int>, to: &mut Vec<int>) { for elem in from.iter() { to.push(*elem); dangling pointer 1 from to elem

103 fn push_all(from: &Vec<int>, to: &mut Vec<int>) { fn caller() { let mut vec = ; push_all(&vec, &mut vec);

104 fn push_all(from: &Vec<int>, to: &mut Vec<int>) { fn caller() { let mut vec = ; push_all(&vec, &mut vec); shared reference

105 fn push_all(from: &Vec<int>, to: &mut Vec<int>) { fn caller() { let mut vec = ; push_all(&vec, &mut vec); shared reference Error: cannot have both shared and mutable reference at same time

106 fn push_all(from: &Vec<int>, to: &mut Vec<int>) { fn caller() { let mut vec = ; push_all(&vec, &mut vec); shared reference Error: cannot have both shared and mutable reference at same time

107 fn push_all(from: &Vec<int>, to: &mut Vec<int>) { fn caller() { let mut vec = ; push_all(&vec, &mut vec); shared reference Error: cannot have both shared and mutable reference at same time A &mut T is the only way to access the memory it points at

108 { let mut vec = Vec::new(); for i in range(0, vec.len()) { let elem: &int = &vec[i]; vec.push(); vec.push(); Borrows restrict access to the original path for their duration. & &mut no writes, no moves no access at all

109 { let mut vec = Vec::new(); for i in range(0, vec.len()) { let elem: &int = &vec[i]; vec.push(); vec.push(); Borrows restrict access to the original path for their duration. & &mut no writes, no moves no access at all

110 { let mut vec = Vec::new(); for i in range(0, vec.len()) { let elem: &int = &vec[i]; vec.push(); vec.push(); Borrows restrict access to the original path for their duration. & &mut no writes, no moves no access at all

111 { let mut vec = Vec::new(); for i in range(0, vec.len()) { let elem: &int = &vec[i]; vec.push(); vec.push(); Error: vec[i] is borrowed, cannot mutate Borrows restrict access to the original path for their duration. & &mut no writes, no moves no access at all

112 { let mut vec = Vec::new(); for i in range(0, vec.len()) { let elem: &int = &vec[i]; vec.push(); vec.push(); Error: vec[i] is borrowed, cannot mutate OK. loan expired. Borrows restrict access to the original path for their duration. & &mut no writes, no moves no access at all

113 Concurrency n. several computations executing simultaneously, and potentially interacting with each other

114 Data race Two unsynchronized threads accessing same data where at least one writes.

115 Data race Two unsynchronized threads accessing same data where at least one writes.

116 Aliasing Mutation No ordering Data race

117 Sound familiar? Aliasing Mutation No ordering Data race

118 Actors forbid aliasing Rust forbid both from occurring simultaneously Functional forbid mutation

119 Messaging (ownership)

120 Messaging (ownership)

121 Messaging (ownership)

122 Messaging (ownership)

123 Messaging (ownership)

124 fn parent() { let (tx, rx) = channel(); spawn(move {); let m = rx.recv();

125 fn parent() { let (tx, rx) = channel(); spawn(move {); let m = rx.recv(); rx tx

126 fn parent() { let (tx, rx) = channel(); spawn(move {); let m = rx.recv(); rx tx

127 fn parent() { let (tx, rx) = channel(); spawn(move {); let m = rx.recv(); rx tx

128 fn parent() { let (tx, rx) = channel(); spawn(move {); let m = rx.recv(); move { let m = Vec::new(); tx.send(m); rx tx

129 fn parent() { let (tx, rx) = channel(); spawn(move {); let m = rx.recv(); move { let m = Vec::new(); tx.send(m); rx tx

130 fn parent() { let (tx, rx) = channel(); spawn(move {); let m = rx.recv(); move { let m = Vec::new(); tx.send(m); rx tx tx

131 fn parent() { let (tx, rx) = channel(); spawn(move {); let m = rx.recv(); move { let m = Vec::new(); tx.send(m); rx tx tx

132 fn parent() { let (tx, rx) = channel(); spawn(move {); let m = rx.recv(); move { let m = Vec::new(); tx.send(m); rx tx tx data length m capacity

133 fn parent() { let (tx, rx) = channel(); spawn(move {); let m = rx.recv(); move { let m = Vec::new(); tx.send(m); rx tx tx data length m capacity

134 fn parent() { let (tx, rx) = channel(); spawn(move {); let m = rx.recv(); move { let m = Vec::new(); tx.send(m); rx tx tx data data length length capacity m capacity

135 fn parent() { let (tx, rx) = channel(); spawn(move {); let m = rx.recv(); move { let m = Vec::new(); tx.send(m); rx tx tx data data length length capacity m capacity

136 fn parent() { let (tx, rx) = channel(); spawn(move {); let m = rx.recv(); move { let m = Vec::new(); tx.send(m); rx tx data length capacity tx data length capacity m

137 Shared read-only access (ownership, borrowing)

138 Arc<Vec<int>> ref_count data length [0] [1] capacity

139 Arc<Vec<int>> (ARC = Atomic Reference Count) ref_count data length [0] [1] capacity

140 Arc<Vec<int>> (ARC = Atomic Reference Count) ref_count data length [0] [1] capacity Vec<int>

141 Arc<Vec<int>> (ARC = Atomic Reference Count) ref_count data length [0] [1] capacity Owned, so no aliases. Vec<int>

142 Arc<Vec<int>> (ARC = Atomic Reference Count) ref_count data length [0] [1] capacity Owned, so no aliases. Vec<int> &Vec<int>

143 Arc<Vec<int>> (ARC = Atomic Reference Count) ref_count data length [0] [1] capacity Owned, so no aliases. Vec<int> &Vec<int> Shared reference, so Vec<int> is immutable.

144 Thread safety checking fn send<t: Send>(&self, t: T) Only sendable types

145 Thread safety checking fn send<t: Send>(&self, t: T) Only sendable types Arc<Vec<int>>: Send Rc<Vec<int>> : Send

146 Locked mutable access (ownership, borrowing)

147 fn sync_inc(mutex: &Mutex<int>) { let mut data = mutex.lock(); *data += 1;

148 fn sync_inc(mutex: &Mutex<int>) { let mut data = mutex.lock(); *data += 1;

149 fn sync_inc(mutex: &Mutex<int>) { let mut data = mutex.lock(); *data += 1; Destructor releases lock

150 fn sync_inc(mutex: &Mutex<int>) { let mut data = mutex.lock(); *data += 1; Destructor releases lock Yields a mutable reference to data

151 fn sync_inc(mutex: &Mutex<int>) { let mut data = mutex.lock(); *data += 1; Destructor releases lock Yields a mutable reference to data Destructor runs here, releasing lock

152 Parallel adj. occurring or existing at the same time

153 fn qsort(vec: &mut [int]) { if vec.len() <= 1 { return; let pivot = vec[random(vec.len())]; let mid = vec.partition(vec, pivot); let (less, greater) = vec.split_at_mut(mid); qsort(less); qsort(greater); [0] [1] [2] [3] [] [n]

154 fn qsort(vec: &mut [int]) { if vec.len() <= 1 { return; let pivot = vec[random(vec.len())]; let mid = vec.partition(vec, pivot); let (less, greater) = vec.split_at_mut(mid); qsort(less); qsort(greater); let vec: &mut [int] = ; [0] [1] [2] [3] [] [n]

155 fn qsort(vec: &mut [int]) { if vec.len() <= 1 { return; let pivot = vec[random(vec.len())]; let mid = vec.partition(vec, pivot); let (less, greater) = vec.split_at_mut(mid); qsort(less); qsort(greater); let vec: &mut [int] = ; [0] [1] [2] [3] [] [n]

156 fn qsort(vec: &mut [int]) { if vec.len() <= 1 { return; let pivot = vec[random(vec.len())]; let mid = vec.partition(vec, pivot); let (less, greater) = vec.split_at_mut(mid); qsort(less); qsort(greater); let vec: &mut [int] = ; [0] [1] [2] [3] [] [n]

157 fn qsort(vec: &mut [int]) { if vec.len() <= 1 { return; let pivot = vec[random(vec.len())]; let mid = vec.partition(vec, pivot); let (less, greater) = vec.split_at_mut(mid); qsort(less); qsort(greater); let vec: &mut [int] = ; [0] [1] [2] [3] [] [n]

158 fn qsort(vec: &mut [int]) { if vec.len() <= 1 { return; let pivot = vec[random(vec.len())]; let mid = vec.partition(vec, pivot); let (less, greater) = vec.split_at_mut(mid); qsort(less); qsort(greater); let vec: &mut [int] = ; [0] [1] [2] [3] [] [n] less greater

159 fn qsort(vec: &mut [int]) { if vec.len() <= 1 { return; let pivot = vec[random(vec.len())]; let mid = vec.partition(vec, pivot); let (less, greater) = vec.split_at_mut(mid); qsort(less); qsort(greater); let vec: &mut [int] = ; [0] [1] [2] [3] [] [n] less greater

160 fn parallel_qsort(vec: &mut [int]) { if vec.len() <= 1 { return; let pivot = vec[random(vec.len())]; let mid = vec.partition(vec, pivot); let (less, greater) = vec.split_at_mut(mid); parallel::join( parallel_qsort(less), parallel_qsort(greater) ); let vec: &mut [int] = ; [0] [1] [2] [3] [] [n]

161 fn parallel_qsort(vec: &mut [int]) { if vec.len() <= 1 { return; let pivot = vec[random(vec.len())]; let mid = vec.partition(vec, pivot); let (less, greater) = vec.split_at_mut(mid); parallel::join( parallel_qsort(less), parallel_qsort(greater) ); let vec: &mut [int] = ; [0] [1] [2] [3] [] [n]

162 fn parallel_qsort(vec: &mut [int]) { if vec.len() <= 1 { return; let pivot = vec[random(vec.len())]; let mid = vec.partition(vec, pivot); let (less, greater) = vec.split_at_mut(mid); parallel::join( parallel_qsort(less), parallel_qsort(greater) ); let vec: &mut [int] = ; [0] [1] [2] [3] [] [n] less greater

163 fn parallel_qsort(vec: &mut [int]) { if vec.len() <= 1 { return; let pivot = vec[random(vec.len())]; let mid = vec.partition(vec, pivot); let (less, greater) = vec.split_at_mut(mid); parallel::join( parallel_qsort(less), parallel_qsort(greater) ); let vec: &mut [int] = ; [0] [1] [2] [3] [] [n] less greater

164 fn parallel_qsort(vec: &mut [int]) { if vec.len() <= 1 { return; let pivot = vec[random(vec.len())]; let mid = vec.partition(vec, pivot); let (less, greater) = vec.split_at_mut(mid); parallel::join( parallel_qsort(less), parallel_qsort(greater) ); let vec: &mut [int] = ; [0] [1] [2] [3] [] [n] less greater

165 fn parallel_qsort(vec: &mut [int]) { if vec.len() <= 1 { return; let pivot = vec[random(vec.len())]; let mid = vec.partition(vec, pivot); let (less, greater) = vec.split_at_mut(mid); parallel::join( parallel_qsort(less), parallel_qsort(greater) ); let vec: &mut [int] = ; [0] [1] [2] [3] [] [n] less greater

166 And beyond Concurrency is an area of active development. Either already have or have plans for: - Atomic primitives - Non-blocking queues - Concurrent hashtables - Lightweight thread pools - Futures - CILK-style fork-join concurrency - etc.

167 And beyond Concurrency is an area of active development. Either already have or have plans for: - Atomic primitives - Non-blocking queues - Concurrent hashtables - Lightweight thread pools - Futures - CILK-style fork-join concurrency - etc. Always data-race free

168 Unsafe adj. not safe; hazardous

169 Safe abstractions unsafe { Useful for: Uninitialized memory Interfacing with C code Building parallel abstractions like ARC Ownership/borrowing permit creating safe abstraction boundaries.

170 Safe abstractions unsafe { Trust me. Useful for: Uninitialized memory Interfacing with C code Building parallel abstractions like ARC Ownership/borrowing permit creating safe abstraction boundaries.

171 Safe abstractions fn something_safe() { unsafe { Trust me. Useful for: Uninitialized memory Interfacing with C code Building parallel abstractions like ARC Ownership/borrowing permit creating safe abstraction boundaries.

172 Safe abstractions fn something_safe() { unsafe { Trust me. Validates input, etc. Useful for: Uninitialized memory Interfacing with C code Building parallel abstractions like ARC Ownership/borrowing permit creating safe abstraction boundaries.

173 Status of Rust 1.0 Beta: March 31st 1.0 Final: May 15th - Stable syntax, core type system - Basic standard library - Blossoming ecosystem on crates.io Subsequent releases coming every six weeks.

174 Conclusions Rust combines high-level features with low-level control. Rust gives strong safety guarantees beyond what GC can offer: Deterministic destruction Data race freedom Iterator invalidation