> With unsafe you get exactly the same kind of semantics as C, if you don't uphold the invariant the unsafe functions expect, you end up with UB exactly like in C.
This is not exactly true. Even in production code, unsafe preconditions check if you violate these rules.
> Safe Rust: memory safe, no undefined behavior possible.
Unsafe Rust: can trigger undefined behavior if preconditions are violated.
So Unsafe Rust from a UB perspective is no different than C/C++. If preconditions are violated, UB can occur, affecting anywhere in the program. Its unclear how the compiler could check anything about preconditions in a block explicitly used to say that the developer is the one upholding the preconditions.
> So Unsafe Rust from a UB perspective is no different than C/C++. If preconditions are violated, UB can occur
Only if you actively disable panics being triggered if unsafe preconditions are triggered. In most code, the program will crash instead. Enabling default panic on up violation in production code was done last year, IIRC.
> Its unclear how the compiler could check anything about preconditions
It can't. This is done at runtime, by default and without manually needed programmer interaction.
These seem to be beta features. But in any case it seems like its just doing some number of asserts to validate some preconditions.
However, even at runtime it can't do anything to say if (excuse the C pseudocode) *(uint32_t*)0x1C00 = 0xFE is a valid memory operations. On some systems, in some cases it might be.
> Yeah, like C code normally would, just in the STD in this case.
Yes, in that manual checks are still needed. My point is unsafe code in rust is nowhere near safe and cannot be considered as safe without extensive analysis, no matter the language features used.
This is not exactly true. Even in production code, unsafe preconditions check if you violate these rules.
Here: https://doc.rust-lang.org/core/macro.assert_unsafe_precondit... And here: https://google.github.io/comprehensive-rust/unsafe-rust/unsa...