What's the deal with unsafe Rust?
summary
Explains why unsafe Rust exists, shows Mini Rust spec as an executable operational semantics and the MIRI interpreter as a tester, and demonstrates a real UB: reading an uninitialized i8 leads optimizations to break an assertion (Heisenbug). Gives the concrete pattern used (mutex implemented with unsafe plus a safe API), reports MIRI ran on 30,000 crates with ~70% passing, ~3% exhibiting UB and ~20% hitting unsupported FFI operations.
AI-written summary · about
chapters (24)
- 0:00Introduction
- 1:05Rust’s inspiration
- 2:08Ownership and borrowing
- 4:37Safe versus unsafe Rust
- 7:45Mutexes require unsafe
- 13:44Unsafe in Rust’s ecosystem
- 14:49Dangers of unsafe Rust
- 17:16Heisenbugs in unsafe
- 18:39Undefined behavior
- 21:53Uninitialized memory
- 24:48Formalizing unsafe Rust
- 27:16Mini Rust semantics
- 30:45Mini Rust syntax
- 34:16Mini Rust interpreter
- 36:25Memory model in Mini Rust
- 38:55Encoding values in Mini Rust
- 41:03MIRI detects UB
- 44:36MIRI limitations
- 46:43MIRI team contributions
- 48:07Balancing safety and control
- 51:36Formal semantics tools
- 53:00Translating Rust to Mini Rust
- 55:06MIRI guardrails
- 57:11Q&A
related talks
25mMiri: Practical Undefined Behavior Detection for Rust
15mHow Do Programmers Use Unsafe Rust?
30mEnsuring Rust Safety: Strategies for Managing Unsafe Rust
44mUnsafe Rust
27mMiniRust: A Core Language for Specifying Rust
34mMiniRust: A core language for specifying Rust
45mBuilding Safe and Secure Systems in Rust
58mRust for The Curious C++ Developers