Title: Theory / Unimportant / CS / Programming / Rust / Unsafe
On every note of this deck, unless a note says otherwise:
Context: Rust

Instruction: #![forbid(unsafe_code)]
Page: https://www.chromium.org/issue-tracking/release-block-guidelines/
Effect: Fail compilation if there is unsafe code
Language: Rust

Instruction: unsafe fun_declaration
Page: https://www.chromium.org/issue-tracking/release-block-guidelines/
Meaning: users of the function must check that function's documentation to ensure they are using it in a way that maintains the contracts the function requires
Language: Rust
Similar to: Same as fun_declaration

Instruction: unsafe trait_declaration
Page: https://www.chromium.org/issue-tracking/release-block-guidelines/
Meaning: implementors of the trait must check the trait documentation to ensure their implementation maintains the contracts the trait requires.
Language: Rust
Similar to: trait_declaration

Instruction: unsafe block
Page: https://www.chromium.org/issue-tracking/release-block-guidelines/
Meaning: all unsafe actions performed within are verified to uphold the contracts of those operations.
Language: Rust
Similar to: block

Question: Can safe rust trust unsafe rust
Answer: yes
Page: https://www.chromium.org/issue-tracking/release-block-guidelines/

Question: Can unsafe rust trust safe rust
Answer: no
Page: https://www.chromium.org/issue-tracking/release-block-guidelines/

Name: The soundness proprety
Definition: Safe Rust can't cause undefined behavior
Page: https://www.chromium.org/issue-tracking/release-block-guidelines/
Example: if the order is not consistent, behavior is still defined
Applied to: ordered set

Question: Examples of unsafe function
Answer: c function
Page: https://doc.rust-lang.org/nomicon/what-unsafe-does.html
Context: Rust
Answer2: rust functions marked unsafe
Answer3: compiler intrinsics
Answer4: raw allocator

Question: What can be done only in unsafe rust
Answer: Dereference raw pointers
Page: https://doc.rust-lang.org/nomicon/what-unsafe-does.html
Context: Rust
Answer2: Implement unsafe traits
Answer3: Call unsafe functions (including C functions, compiler intrinsics, and the raw allocator)
Answer4: Mutate statics
Answer5: Access fields of unions

Question: What can cause undefined behavior
Answer: Dereferencing (using the * operator on) dangling or unaligned pointers (see below)
Page: https://doc.rust-lang.org/nomicon/what-unsafe-does.html
Context: Rust
Answer2: Breaking the pointer aliasing rules
Answer3: Calling a function with the wrong call ABI or unwinding from a function with the wrong unwind ABI.
Answer4: Causing a data race
Answer5: Executing code compiled with target features that the current thread of execution does not support
Answer6: Producing invalid values

Question: todo
Answer: valid values for many types
Page: https://doc.rust-lang.org/nomicon/what-unsafe-does.html
Context: Rust

Name: Producing a value
Definition: a value is assigned, passed to a function/primitive operation or returned from a function/primitive operation.
Page: https://doc.rust-lang.org/nomicon/what-unsafe-does.html

Name: A dangling pointer
Definition: a null pointer
Page: https://doc.rust-lang.org/nomicon/what-unsafe-does.html
Definition2: not all of the bytes it points to are part of the same allocation
Conjdef: Either

Question: Is deadlock considered safe?
Answer: yes
Page: https://doc.rust-lang.org/nomicon/what-unsafe-does.html
Context: Rust

Question: Is race condition considered safe?
Answer: yes
Page: https://doc.rust-lang.org/nomicon/what-unsafe-does.html
Context: Rust

Question: Is leak memory considered safe?
Answer: yes
Page: https://doc.rust-lang.org/nomicon/what-unsafe-does.html
Context: Rust

Question: Is fail to call destructor considered safe?
Answer: yes
Page: https://doc.rust-lang.org/nomicon/what-unsafe-does.html
Context: Rust

Question: Is overflow integer considered safe?
Answer: yes
Page: https://doc.rust-lang.org/nomicon/what-unsafe-does.html
Context: Rust

Question: Is abort the program considered safe?
Answer: yes
Page: https://doc.rust-lang.org/nomicon/what-unsafe-does.html
Context: Rust

Question: Is delete the production database considered safe?
Answer: yes
Page: https://doc.rust-lang.org/nomicon/what-unsafe-does.html
Context: Rust

Question: Is dereferencing dangling pointer considered safe?
Answer: no
Page: https://doc.rust-lang.org/nomicon/what-unsafe-does.html
Context: Rust

Question: Is dereferencing unaligned pointer considered safe?
Answer: no
Page: https://doc.rust-lang.org/nomicon/what-unsafe-does.html
Context: Rust

Question: Is data race considered safe?
Answer: no
Page: https://doc.rust-lang.org/nomicon/what-unsafe-does.html
Context: Rust

Question: Is Calling a function with the wrong call  considered safe?
Answer: no
Page: https://doc.rust-lang.org/nomicon/what-unsafe-does.html
Context: Rust

Question: Is unwinding from a function with the wrong unwind ABI. considered safe?
Answer: no
Page: https://doc.rust-lang.org/nomicon/what-unsafe-does.html
Context: Rust

Question: Is executing code compiled with target features that the current thread of execution does not support considered safe?
Answer: no
Page: https://doc.rust-lang.org/nomicon/what-unsafe-does.html
Context: Rust

Question: Is producing invalid values considered safe?
Answer: no
Page: https://doc.rust-lang.org/nomicon/what-unsafe-does.html
Context: Rust

Name: A sound implementation
Definition: An implementation that can't cause undefined behavior
Page: https://doc.rust-lang.org/nomicon/working-with-unsafe.html

Name: The alignment of t
Definition: A value n such that objects of type t must be stored at adresses which are multiples of n
Page: https://doc.rust-lang.org/nomicon/working-with-unsafe.html
Variables: t a type
Typ: Power of 2

Question: Relationship between size and alignment
Answer: Size of t is a multiple of alignment of t
Page: https://doc.rust-lang.org/nomicon/working-with-unsafe.html
Variables: t a type
Context: Rust

Question: What is the alignment of a struct
Answer: The maximal alignment of its component
Page: https://doc.rust-lang.org/nomicon/working-with-unsafe.html
Variables: t a type
Context: Rust

Name: Dynamically sized types
Definition: type without a statically known size or alignment
Page: https://doc.rust-lang.org/nomicon/working-with-unsafe.html
Variables: t a type
Example: trait objects: dyn MyTrait
Example2: slices [T], str, and others
Abbreviation: DST

Name: A vtable
Definition: A set of informations stating how to use an implementation of a trait
Page: https://doc.rust-lang.org/nomicon/exotic-sizes.html

Name: A zero-sized type
Definition: A type that occupy no space
Page: https://doc.rust-lang.org/nomicon/exotic-sizes.html
Example: Empty struct
Example2: empty tuple
Abbreviation: ZST
Example3: array of size 0

Question: Example of use of zero-sized type
Answer: Set<key> = Map<Key, ()> don't take extra space for values
Page: https://doc.rust-lang.org/nomicon/exotic-sizes.html
Context: Rust

Question: Example of danger of zero-sized type in unsafe rust
Answer: offset is a no-op
Page: https://doc.rust-lang.org/nomicon/exotic-sizes.html
Context: Rust
Answer2: allocators require a non-zero size

Name: An empty type
Definition: A type that can not be instantiated
Page: https://doc.rust-lang.org/nomicon/exotic-sizes.html
Example: An enum with no variant
Example2: Void

Question: Examples of use of empty type
Answer: Result<T, Void> is isomorphic to T. Useful when a function return a Result but error is impossible
Page: https://doc.rust-lang.org/nomicon/exotic-sizes.html
Context: Rust

Instruction: [repr(C)]
type_declaration
Page: https://doc.rust-lang.org/nomicon/exotic-sizes.html
Meaning: type_declaration, implemented as it would in C
Language: Rust
Intuition: For interfacing with C programs

Instruction: [repr(transparent)]
type_declaration
Page: https://doc.rust-lang.org/nomicon/exotic-sizes.html
Meaning: type_declaration is implement as its content, with no extra cost
Language: Rust
Assuming: the type declared as a single field of non-zero size

Name: A fieldless enum
Definition: An enum such that none of the variants have a field
Page: https://doc.rust-lang.org/nomicon/other-reprs.html
Assuming: the type declared as a single field of non-zero size

Instruction: [repr(packed)]
Page: https://doc.rust-lang.org/nomicon/other-reprs.html
Effect: Don't add padding to align values.
Language: Rust
Name: A fieldless enum
Intuition: Never use it unless you know exactly how compiler work on non-aligned values

Instruction: [repr(align(n))]
type_decl
Page: https://doc.rust-lang.org/nomicon/other-reprs.html
Effect: Force the alignment of type_decl to be a multiple of n
Language: Rust
Name: A fieldless enum

Name: Aliasing variables/pointers
Definition: variables/pointers referring to overlapping regions of memory
Page: https://doc.rust-lang.org/nomicon/aliasing.html

Question: What optimization can be done when it is known there is no aliasing
Answer: keeping values in registers by proving no pointers access the value's memory
Page: https://doc.rust-lang.org/nomicon/aliasing.html
Context: Rust
Answer2: eliminating reads by proving some memory hasn't been written to since last we read it
Answer3: eliminating writes by proving some memory is never read before the next write to it
Answer4: moving or reordering reads and writes by proving they don't depend on each other

Question: When is a borrow alive
Answer: between its creation and its last use
Page: https://doc.rust-lang.org/nomicon/lifetimes.html
Context: Rust

Name: Trait bounds that use implicitly "for all lifetime 'a"
Definition: Higher-Rank Trait Bounds
Page: https://doc.rust-lang.org/nomicon/hrtb.html
Abbreviation: HRTBs

Name: The variance of F
Definition: how the subtyping of the inputs of F affects the subtyping of its outputs.
Page: https://doc.rust-lang.org/nomicon/subtyping.html
Variables: F<T>

Name: A covariant type
Definition: A type such that F<sub> is a subtype of F<super> for sub a subtype of super
Page: https://doc.rust-lang.org/nomicon/subtyping.html
Example: &'a T is covariant in 'a and T
Example2: fn(T) -> U is covariant in U
Example3: Box<T> is covariant in T

Name: A contravariant type
Definition: A type such that F<super> is a subtype of F<sub> for sub a subtype of super
Page: https://doc.rust-lang.org/nomicon/subtyping.html
Example: fn(T) -> U is contravariant in T

Name: An invariant type
Definition: A type such that F<super> and F<sub>, for sub a subtype of super, are not sub/super type of each other
Page: https://doc.rust-lang.org/nomicon/subtyping.html
Example: &'a mut T is invariant in T

Question: What is the variance of a field of a tuple
Answer: the variance of the type of the field
Page: https://doc.rust-lang.org/nomicon/subtyping.html
Context: Rust

Question: For a generic type to soundly implement drop,
Answer: its generics arguments must strictly outlive it.
Page: https://doc.rust-lang.org/nomicon/dropck.html
Context: Rust
Name: sound generic drop

Typ: marker::PhantomData<T>
Meaning: Zero-size type ensuring T is covariant when used in a struct
Page: https://doc.rust-lang.org/nomicon/phantom-data.html
Context: Rust

Question: What coercions are done for dot operator
Answer: first, test whether no coercion is acceptable
Page: https://doc.rust-lang.org/nomicon/coercions.html
Answer2: trie to converse the value to reference or mutable reference
Answer3: try to dereference the value using Deref<>
Answer4: If the type has a size (e.g. array) try to ignore the size

Instruction: expr as t
Page: https://doc.rust-lang.org/nomicon/casts.html
Returns: expr, considered of type t
Name: true cast

Name: An unitialized variable
Definition: which has been declared
Page: https://doc.rust-lang.org/nomicon/casts.html
Definition2: whose value was moved out of it
Conjdef: A variable, not given a value since

Name: Drop flag
Definition: A flag that indicates whether the value must be dropped at the end of the block
Page: https://doc.rust-lang.org/nomicon/drop-flags.html
Intuition: Required when it can't be statically determined whether a value is initialized or not at the end of a block

Name: Static drop semantics
Definition: Semantic that allow to determine whether, at the end of a block, a value must be dropped, must not be dropped, or must be determined at runtime
Page: https://doc.rust-lang.org/nomicon/drop-flags.html

Typ: MaybeUninit<T>
Meaning: A value of type T, potentially not initialized. Drop do nothing
Page: https://doc.rust-lang.org/nomicon/unchecked-uninit.html
Context: Rust

Name: Ownership based resource management
Definition: to acquire a resource, you create an object that manages it. To release the resource, you simply destroy the object, and it cleans up the resource for you.
Page: https://doc.rust-lang.org/nomicon/obrm.html
Name2: Resource acquisition is initialization
Abbreviation: OBRM
Abbreviation2: RAII

Typ: Copy
Meaning: Trait of data such that, when elements are assigned to another variable, they remain initialized
Page: https://doc.rust-lang.org/nomicon/obrm.html
Context: Rust

Name: Leak amplification
Definition: When a leak cause other leak
Page: https://doc.rust-lang.org/nomicon/leaking.html

Instruction: mem::forget(foo)
Page: https://doc.rust-lang.org/nomicon/leaking.html
Effect: Consider foo unitiliazed, but don't drop its value
Context: Rust

Question: What rust do in case of error
Answer: If something might reasonably be absent, Option is used.
Page: https://doc.rust-lang.org/nomicon/unwinding.html
Context: Rust
Answer2: If something goes wrong and can reasonably be handled, Result is used.
Answer3: If something goes wrong and cannot reasonably be handled, the thread panics.
Answer4: If something catastrophic happens, the program aborts.

Question: What to do if a computation may not have result
Answer: Use option
Page: https://doc.rust-lang.org/nomicon/unwinding.html
Context: Rust

Question: What to do if a computation goes wrong in a way that can not be reasonably be handled
Answer: The thread should panic
Page: https://doc.rust-lang.org/nomicon/unwinding.html
Context: Rust

Question: What to do if something catastrophic occurs in a computation
Answer: The thread should panic
Page: https://doc.rust-lang.org/nomicon/unwinding.html
Context: Rust

Name: Panic
Definition: The stack unwind. At each level, all data call their destructors
Page: https://doc.rust-lang.org/nomicon/unwinding.html

Name: Unwinding
Definition: Catching a panic
Page: https://doc.rust-lang.org/nomicon/unwinding.html

Name: Minimal exception safety
Definition: be exception safe to the point of not violating memory safety
Page: https://doc.rust-lang.org/nomicon/unwinding.html

Name: Maximal exception safety
Definition: be exception safe to the point of your program doing the right thing.
Page: https://doc.rust-lang.org/nomicon/unwinding.html

Question: How to deal with user-provided code in container that require unsafe usage
Answer: Either use all user provider code first, so that if it panic, nothing unsafe occured
Page: https://doc.rust-lang.org/nomicon/exception-safety.html
Context: Rust
Answer2: use a data structure whose Drop will repair the current structure and ensure it remains in a valid state when leaving the unsafe part

Name: Poisoning
Definition: Ensuring that if a panic is observed, all future usage of a value is impossible
Page: https://doc.rust-lang.org/nomicon/poisoning.html

Name: A data race
Definition: two or more threads concurrently accessing a location of memory
Page: https://doc.rust-lang.org/nomicon/races.html
Definition2: one or more of them is a write
Definition3: one or more of them is unsynchronized

Instruction: #![feature(negative_impls)]
Page: https://doc.rust-lang.org/nomicon/races.html
Effect: Allow to cancel implicit implementation
Context: Rust

Instruction: impl !trait for Type
Page: https://doc.rust-lang.org/nomicon/races.html
Effect: Don't derive Trait for Type
Context: Rust
Assuming: #![feature(negative_impls)]

Question: Which memory model Rust use for atomics
Answer: C++11
Page: https://doc.rust-lang.org/nomicon/races.html
Context: Rust

Question: A sequentially consistent instruction
Answer: An instruction that is both acquire and release
Page: https://doc.rust-lang.org/nomicon/races.html
Context: Rust

Question: An acquire instruction
Answer: An instruction i such that no instructions that occurs after i can be reordered to be executed before
Page: https://doc.rust-lang.org/nomicon/races.html
Context: Rust

Question: A release instruction
Answer: An instruction i such that no instructions that occurs before i can be reordered to be executed after
Page: https://doc.rust-lang.org/nomicon/races.html
Context: Rust

Question: A  relaxed instruction
Answer: An atomic instruction that can be freely reordered
Page: https://doc.rust-lang.org/nomicon/races.html
Context: Rust

Name: Foreign Function Interface
Page: https://doc.rust-lang.org/nomicon/ffi.html
Abbreviation: FFI

Instruction: #[link(name = "library")]
extern {
  fn_decl_1
  ...
  fn_decl_n
}
Page: https://doc.rust-lang.org/nomicon/ffi.html
Effect: Indicates that functions as declared in fn_decl_i can be used, with declared type, and will be linked from foreign library "library"
Context: Rust
Name: Foreign Function Interface

Instruction: #[no_mangle]
fun_decl
Page: https://doc.rust-lang.org/nomicon/ffi.html
Effect: Ensure that the declared name in fun_decl is not mangled
Context: Rust
Intuition: Useful when interfacing with non rust code that expect a particular name

Instruction: publ extern "C" fn_declaration
Page: https://doc.rust-lang.org/nomicon/ffi.html
Effect: same as fn_declaration, and can be called from C code
Context: Rust

Instruction: #[no_std]
Page: https://doc.rust-lang.org/nomicon/beneath-std.html
Effect: Indicate the file can't use any std library
Context: Rust

Instruction: #[panic_handler]
fn panic(info: &PanicInfo) -> ! {
  foo
}
Page: https://doc.rust-lang.org/nomicon/beneath-std.html
Effect: Indicate that in case of panic, the execution should do foo
Context: Rust
Assuming: #![no_std]

Typ: enum Foo {
  Empty,
  NonEmpty(NonNullableType)
}
Implementation: nullptr represents Empty
nonNullableTypeValue represents an entry of type NonEmpty
Name: Null-pointer optimization (NPO)