[rust-dev] Integer overflow, round -2147483648

Benjamin Striegel ben.striegel at gmail.com
Mon Jun 23 19:52:11 PDT 2014


> the fact is that everyone is an optimist when it comes to integer
overflow bugs.  People just do not think they're going to get bitten.

I agree, and I don't think anyone else here is going to try to argue that
this doesn't cause real bugs. As so often seems to be the case, language
design amounts to deciding which unfortunate tradeoffs you are willing to
live with.


On Mon, Jun 23, 2014 at 8:16 PM, John Regehr <regehr at cs.utah.edu> wrote:

> I do think Rust should exposed either `checked { }` or operators for
>> checked arithmetic along with an opt-in lint to deny the unchecked
>> operators. You can opt-out of a lint for a function/impl/module after
>> opting into it at a higher scope.
>>
>> I'm just making it clear that doing this by default would make Rust
>> slower than Java by default, and I think that would kill off interest in
>> the language. I know I wouldn't be interested anymore.
>>
>
> Sure, I think there are a lot of reasonable options here, and I agree that
> speed and predictability are super important for Rust.
>
> One thing I personally think is very important (not for 1.0, but
> eventually) is to make it possible -- no need for this to be mandatory --
> to get overflow checking for the default integer type.  I'm happy to use a
> special compiler flag or whatever to get this.  The only controversial
> thing this requires from the core language is a way for me to tell the
> compiler which integers (a tiny subset, typically) should have wrapping
> behavior.
>
> I realize that safe integers are available and that operator overloading
> goes a lot ways towards making these palatable, but the fact is that
> everyone is an optimist when it comes to integer overflow bugs.  People
> just do not think they're going to get bitten.
>
> Finally, I'll note that certain optimizations such as array bounds check
> removal and some loop optimziations actually get better then integers
> cannot wrap.  Clearly we would not expect, in general, for these benefits
> to make up for the costs of overflow checking.
>
>
> John
> _______________________________________________
> Rust-dev mailing list
> Rust-dev at mozilla.org
> https://mail.mozilla.org/listinfo/rust-dev
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.mozilla.org/pipermail/rust-dev/attachments/20140623/1ad8a378/attachment.html>


More information about the Rust-dev mailing list