miri

If you found this interesting, you may also be interested to hear about some related projects with similar goals/scopes: Miri[0], Kani[1], and Creusot[2]. There looks to be some significant overlap between Verus, Kani, and Creusot but I've not used any of them so I'll refrain from trying to differentiate them. [0]https://github.com/rust-lang/miri [1]https://github.com/model-checking/kani [2]https://github.com/creusot-rs/creusot

For comparison, in Rust they track down the differences in which flags are ignored in a certain kind of `fcntl` syscall across all the architectures that have this C function, which includes Solaris, Mac OS, the BSDs, Linux, ... This is so that this is correctly handled in Miri, which can then be used to run the test-suite of the OS-specific parts of the standard library, and observe if this uses unsupported features in some way. This ensures that the standard library relies on documented features and not on whatever happens to work right now. See for example this PR comment: https://github.com/rust-lang/miri/pull/4840#discussion_r2836...

> but its code has lots of unsafe. And every instance of unsafe that I could find (except one, in test-only code) was a call to libc with a clarifying comment on why this particular use was safe. That is, all (or at least, all of it that I could find) was wrapping an unsafe API with documented (and usually straightforward and local) invariants that maintain safety, such that the calling code is safe. I'd say that the fact that miri's trophy-shelf[0] has 39 entries and is 7 years old and still regularly updated is a pretty good indicator that memory bugs are sufficiently rare in rust so as to be notable. That is the opposite of "regular" [0]: https://github.com/rust-lang/miri/blame/master/README.md

Coherence in Rust implementation interpreter where C++ designates Store_elem as integration testing in ecosystem. > https://github.com/rust-lang/miri

If you have a codebase that uses unsafe, I highly recommend running your tests through Miri (cargo miri nextest) and seeing what spills out. I ran tests for a codebase at work through Miri a while ago and found a couple of distinct classes of UB: https://github.com/rust-lang/miri/issues/1807#issuecomment-8... These can be summarized as: 1. Converting a reference to the first field of a struct to a pointer of its parents struct type 2. Functions with signature (&self) -> &mut self_inner_field_type 3. Having a mut pointer to the data inside of a Box<T> #1 and #3 were somewhat surprising to me. #2 seems to be common enough that there's even a clippy lint for it. A lot of C and C++ developers understand that undefined behavior is bad, but in practice observe its impact less. From my own experience, Rust's optimizations are pretty aggressive a