How Our Rust-to-Zig Rewrite Is Going

(rtfeldman.com)

176 points | by jorangreef 5 hours ago

18 comments

  • steveklabnik 1 hour ago
    I think this is a fine post. But one comment:

    > remember that for compilers which emit machine code, like roc and rustc, doing memory-unsafe things is a big part of the job

    I don't really think that this is true, in the way that it's written.

    I think that for the hot binary patching / code reloading features, yes, that is going to need unsafe. But for regular old "producing an executable" compilation? Emitting machine code isn't the part that requires unsafe. The language's runtime is a more likely site to find unsafe.

    • rtfeldman 35 minutes ago
      > I think that for the hot binary patching / code reloading features, yes, that is going to need unsafe. But for regular old "producing an executable" compilation? Emitting machine code isn't the part that requires unsafe. The language's runtime is a more likely site to find unsafe.

      Agreed! Emitting machine code is not unsafe, since it's just writing bytes down - it's only once you execute that machine code that there's potentially unsafety. The reason I said "a big part of the job" is that in practice a lot of compilers both emit machine code and execute it - but you're totally right that it's not a requirement that a compiler do both.

      In addition to the examples you gave (hot binary patching/code reloading, language runtime, etc.), others would be things like evaluating userspace code at compile time (e.g. const fn in Rust, or in Roc any expression that could be hoisted to the top level), running tests and inspecting their output to decide what to display to the user, etc.

      Those are the types of things I had in mind when I wrote that.

      • steveklabnik 22 minutes ago
        I am disappointed you're downvoted, Richard. This is a fine reply, and I hope you know that a minor quibble with a single line in the post doesn't mean that I think it's a bad one overall. (EDIT: a few minutes later, the parent comment is no longer grey.)

        I also think it's a good thing that you wrote the post in general, when I saw it pop up I was like "oh, of course, this post should exist!" I'm surprised I didn't think about it earlier.

        > evaluating userspace code at compile time

        Usually this would be done via an interpreter, so I'm not sure that it really requires unsafe either. If you are literally executing machine code, sure, but const fn in Rust and constexpr in C++ and many other languages do not do that, as it causes a number of problems (for example, cross-compilation).

        • rtfeldman 8 minutes ago
          Also a good point! TIL that Rust and C++ use interpreters for const, although of course that wouldn't work for running tests. Then again, in the specific case of Rust I believe rustc only compiles the tests and then something else like Cargo executes them. Of course, as I noted elsewhere, if rustc emits machine code and then cargo immediately executes it, there's the same opportunity for end user memory being corrupted (due to miscompilation) as if rustc and cargo shared a code base.

          By the way, I thought your question was totally reasonable - my first thought reading it was "Oh yeah I wasn't trying to say that writing bytes is unsafe, I definitely should have worded that differently."

    • pjmlp 1 minute ago
      Many people try to twist the fact memory safe languages have unsafe code blocks to make the pivot that why bother.

      It is like someone arguing that since they always bump the head somehow while wearing seatbelts, then they are only a nuisance and should not be used.

    • EPWN3D 56 minutes ago
      Yeah that is definitely 1000% wrong. A compiler can do its job with totally abstract data structures. If anything would need to do unsafe stuff in memory, it would probably be a linker.
      • steveklabnik 25 minutes ago
        > probably be a linker

        I don't think that's any different either. The core job of linking isn't particularly unsafe.

        (Unless, similarly, you're doing the hot reloading stuff)

        • AlotOfReading 15 minutes ago
          I've noticed that people equate "low level stuff" with unsafe, regardless of whether it's contextually justified.
          • steveklabnik 4 minutes ago
            I think it's an understandable prior. Historically, "low level stuff" was near-exclusively (see my comment below about OCaml...) written in unsafe languages. Even if that wasn't always literally required, it sometimes was, and so thinking this is the case was a reasonable thing to think.

            It is only relatively recently that we have gained more realistic options in these spaces, and so not fully understanding the implications, or preferring the historically normal choices, is understandable.

    • Aurornis 58 minutes ago
      That line confused me, too. What parts of their compiler require memory-unsafe operations to produce machine code?
      • skybrian 26 minutes ago
        They are saying that running the compiled code is memory-unsafe when there is a compiler bug, and that’s what developers do next. The memory corruption happens in a different process.

        In this respect, effectively all the compiler should be treated sort of like an unsafe region because it requires extra care to avoid memory corruption bugs.

        • Aurornis 22 minutes ago
          That's not what it says at all. The section we're talking about is for the compiler and emitting machine code

          > we ended up with about 1,200 uses of unsafe

          > remember that for compilers which emit machine code, like roc and rustc, doing memory-unsafe things is a big part of the job

          • skybrian 8 minutes ago
            The article is a bit confusing because they also write:

            > Regardless of which process had the bug—the compiler or compiled program—in both cases the processor only did the bad thing because the compiler told it to. And in both cases the fix is the same: the compiler's code must change, since that code was what caused the memory corruption.

            But yeah, I wonder what those 1,200 unsafe uses actually did?

    • orlp 40 minutes ago
      I think if you interpret it charitably it means that any bug in the emitted machine code is already a likely memory-unsafe miscompilation if it is ran.

      The compiler itself might be perfectly "memory safe" but the generated binary fundamentally is always at risk (besides WebAssembly I suppose).

      I'm fully aware of the separation of compiler and binary, and being able to compile untrusted code safely is nice, but a perfectly safe compiler that generates vulnerable binaries isn't that much better.

      • steveklabnik 27 minutes ago
        I do think that is a good point, it's just not what the line actually says. But that's why I wasn't saying "zomg this is WRONG!!!!" but instead, trying to point out that there are subtleties here. For people who aren't as deep in the weeds in this subject, I think the details matter. But again, as I said, I like the post, this is just one thing.

        I am also probably in a more pedantic mindset because, well, I'm writing a compiler in Rust, and the words as written do not resonate with me at all.

        > a perfectly safe compiler that generates vulnerable binaries isn't that much better.

        I do think it's much better. Eliminating classes of bugs in one component is a good thing, even if it's not every component. This is a core lesson of Rust! unsafe still exists, but going from "I don't know what is unsafe" to "only this part is unsafe" is a major improvement.

      • demosthanos 21 minutes ago
        In context that's clearly not what he's saying, the next sentence is this:

        > Zig has more features than Rust for making memory-unsafe code work correctly, and that was the area where we wanted the most help.

        Zig definitely does not have more features for successfully emitting memory-unsafe machine code than Rust does. I can emit memory-unsafe machine code from typescript if I really want to and nothing at all in the language will get in my way. So the sentence quoted above must refer to the idea that the compiler itself needs to be unsafe, which Steve is right is simply untrue.

      • Aurornis 20 minutes ago
        The section this came from was talking specifically about usages of `unsafe` in the compiler code.

        It's not about the memory safety of the resulting binary.

    • narnarpapadaddy 23 minutes ago
      I agree that it’s not inherent to emitting machine code but I do think it reflects a different set of priorities.

      In extremely high performance code you use different data structures and algorithms and change your approach to memory allocation. TigerBeetle famously does all memory allocation once on startup.

      Roc is attempting to make a similar set of trade-offs in their compiler as Zig, so it makes sense that the author finds many shared patterns.

      • steveklabnik 19 minutes ago
        I do think it reflects different priorities, but one of those differences is that from my perspective, safety and performance are not inherently at odds. Yes, sometimes it is needed, but not as much as some people seem to think. Sometimes, it also means writing code in ways that communicate things to the compiler that you may not think of if you're not used to thinking in this manner.

        A lot of the ways in which the zig compiler works doesn't use pointers, it uses indices. This stuff is easier to write as safe code, not less easy.

        > Roc is attempting to make a similar set of trade-offs in their compiler as Zig, so it makes sense that the author finds many shared patterns.

        I do think that that makes sense, but it also doesn't mean that they have to. I am doing a compiler project that takes a lot of inspiration from Zig (as my language currently inherits some major things from Zig, and I also care a lot about compiler performance) and it's written in Rust, and does not use much unsafe code (outside of the usual suspects of FFI in the runtime, etc).

    • paulddraper 1 hour ago
      Agreed, that’s disturbingly incorrect.

      If anything, compilers are perfect models of trees and well formed programs.

  • stymaar 2 minutes ago
    Irrespective to the technical merits of both language, moving from a stable language to a pre-1.0 one that just lost his most popular open source project is a wild move.
  • landr0id 1 hour ago
    >ReleaseSafe catches use-after-free errors through runtime checks which panic if the program tries to use freed memory.

    I don't know Zig so maybe they know something I don't, but I have seen no evidence that it catches any type of use-after-free including double-free?

    While writing a blog post (below) I went through the documentation to figure out the possible runtime memory safety checks Zig can insert. The term "use-after-free" or "UaF" never occurs on that documentation page. Searching for "safety-checked" doesn't yield any related hits either.

    Unless maybe they're using the DebugAllocator in release builds? Even that does not reliably surface UaF.

    https://landaire.net/memory-safety-by-default-is-non-negotia...

    • veber-alex 33 minutes ago
      I believe you are correct.

      I think ReleaseSafe just adds bound checking and panics on unreachable code.

      I don't think Zig offers any temporal memory safety.

      • flohofwoe 28 minutes ago
        The DebugAllocator catches use-after-free (at least on page-level), but at the cost of never recycling memory addresses (e.g. it eats through the virtual address space).

        https://ziglang.org/documentation/master/std/#src/std/heap/d...

        For higher level code, "generation-counted index handles" might be the better solution to provide temporal runtime memory safety, not part of Zig the stdlib though.

        Or even better: never use dynamic memory allocation and make all lifetimes 'static' :)

        • landr0id 2 minutes ago
          >The DebugAllocator catches use-after-free (at least on page-level)

          To clarify, is that to say that you have to use the `std.heap.page_allocator` as its backing allocator?

  • arthurbrown 1 hour ago
    Interesting that OCaml was flexible and expressive enough to be used as a prototype testbed but not chosen as the implementation language, especially given the maturity of both. I would be surprised if Zigs incremental builds could be meaningfully faster than dune's.

    Cross compilation is great, but not mentioned in the "why Zig" section. Is memory control that crucial for a compiler?

    Rust itself was originally written in OCaml, same with WASM. I'm curious about what milestone gets reached where the maintainers collectively decide to transition away.

    • steveklabnik 1 hour ago
      Rust moved away from OCaml when it decided to be re-written in Rust. The post alludes to this as being a usual time for a wholesale re-write, and I'd agree.
      • arthurbrown 22 minutes ago
        I appreciate the insight, and on closer reading the post clearly states that realistically only Zig and Rust were ever considered anyway.

        Since you're here, could you comment on the approach Rust took in their rewrite? Was it more of a straight translation like Go did when they self hosted -- similar to the recent Bun transliteration? Or were there architectural changes made along the way like this article describes with Roc?

        • steveklabnik 14 minutes ago
          The Rust re-write happened before I got involved. If pcwalton is around and sees this comment, maybe he can provide a more first-class account.

          > Was it more of a straight translation like Go did when they self hosted -- similar to the recent Bun transliteration? Or were there architectural changes made along the way like this article describes with Roc?

          From what I remember, it was a whole-sale re-write from scratch, not a transliteration. While Rust took a lot of inspiration from OCaml, especially in those days, it was different enough that I'm not sure that a more direct transliteration would have been particularly possible, though again, see above, I wasn't there, so I don't know for sure.

    • grayrest 1 hour ago
      One of the primary goals for the Roc project is compiler speed. I presume OCaml is out of the running because it's not a systems language.
      • steveklabnik 13 minutes ago
        OCaml has often historically been considered a language that's been appropriate to write systems tooling like compilers, runtimes, and unikernels in, even though GC'd languages were/are not often considered for such projects.
      • satvikpendem 1 hour ago
        OCaml compiler is incredibly fast. I wonder how it'd fare with Jane Street's extensions for the borrow checker etc in OxCaml, if it's good enough for their HFT I'm sure it's good enough for a new language.
        • djha-skin 28 minutes ago
          I suspect this "not a systems language" alludes only to OCaml's rather steeper learning curve and until-recently difficulty with multiple threads. I am sure it could roll just fine as a single-threaded compiler language written by a small team, which indeed, it was.
        • antonvs 43 minutes ago
          I wrote a toy Scheme implementation in OCaml by using the Camplp4 preprocessor. In benchmarks, it was faster than Gambit Scheme, which compiles through C.
  • maybebug 13 minutes ago
    Nitpicking ahead:

    I am not sure, but there might be a bug in their pattern matching example.

    What happens if 'verb' is "GET" and 'path' is "/users/1234/posts/1234/extra_path/and/more/"? Will 'post_id' become "extra_path/and/more/"?

    I tried running it in the sandbox, and it does indeed seem to buggily result in:

    "Post ID: 1234/extra_path/and/more"

    I suspect that the reason it is behaving like it is, is due to how it handles characters in the string literal. The example program exploits that only the slashes present in the string literal pattern are matched, to enable matching on 'page' having slashes. But then in the nested 'match', it forgot to account for any possible extra slashes.

    Nitpicking end.

    I have not read the whole post yet, but the pattern matching not requiring any allocations, seems very nice. The string literal patterns also seem interesting, though I am not completely sold on them, also as per the above possible bug. It seems really clean in some ways, but the specific semantics, I am not fully sure about. Maybe it is excellent, and is so clean and concise that it is overall less bug-prone than alternatives in other programming languages. I do not know.

  • onlyrealcuzzo 2 hours ago
    Zig's incremental builds are DEFINITELY a killer feature. In the short term, I could see why you'd make a switch to get it. But, in the medium term, can we really not expect to see this in Rust in the somewhat near future?

    I want to go fast, but I don't want to go fast just to shoot my foot off.

    If only somehow we could get Rust's safety with all of Zig's features and Go's runtime without GC...

    That's what I'm working on building [=

    • dabinat 41 minutes ago
      This is being worked on: https://rust-lang.github.io/rust-project-goals/2026/roadmap-...

      Most of the goals on this page are targeted for this year.

    • insanitybit 19 minutes ago
      Rust's compile times will get faster long before Zig gets safer.
    • Hinrik 1 hour ago
      Layperson here: what is special about Go's runtime, aside from the GC?
      • djha-skin 26 minutes ago
        Chief design goals were radically easy concurrency and speed of compilation.
      • onlyrealcuzzo 1 hour ago
        It's literally the most sophisticated scheduling engine in the world.

        In practice, Go can typically outperform Rust in throughput (using more memory), despite having a mountain of disadvantages against it in theory.

        That's how good the Go scheduler/runtime is.

        • jcgl 1 hour ago
          This is the first I've heard anyone claim higher throughput for Go than Rust. Any articles you'd point to to learn more?
          • insanitybit 14 minutes ago
            I think one of the few performance benefits with a GC is that you can defer allocations. You can do that in Rust too though.
        • insanitybit 14 minutes ago
          I think this is interesting and warrants explanation. There are cases where a GC can be faster (sort of, Arenas get you most of the gains) but "the most sophisticated scheduling engine in the world" should be easy to at least partially support.
        • Aurornis 52 minutes ago
          > n practice, Go can typically outperform Rust in throughput (using more memory), despite having a mountain of disadvantages against it in theory

          This is a huge claim that disagrees with both my real-world experience and everything I've seen from artificial comparisons.

          Every high performance Go system I've worked on has quickly reached the point where we're optimizing memory management and doing things that would have been explicit in a non-GC language like Rust anyway.

          The Go runtime is amazingly optimized, but it comes with overhead over doing the same work directly in a lower level language.

        • jandrewrogers 48 minutes ago
          > It's literally the most sophisticated scheduling engine in the world.

          That seems unlikely regardless of how good it is. This is a domain where state-of-the-art research is not in the public literature. Scheduling is an AI-complete problem.

        • zacmps 34 minutes ago
          What benchmarks are you referring to?

          Rust itself doesn't have a scheduler of course, I assume this is comparing against tokio or one of the other async executors?

      • fnord77 1 hour ago
        Goroutines?
    • dnautics 1 hour ago
      > if only somehow we could get Rust's safety with all of Zig's features

      i periodically throw my unused codex tokens at this:

      https://github.com/ityonemo/clr

    • lioeters 1 hour ago
      Instead of waiting for faster compiler in Rust, how about from the other direction, adding some kind of borrow checker to Zig? That sounds more within reach and practically achievable, possibly even in userland.
      • veber-alex 37 minutes ago
        It's impossible to add a borrow checker to any existing language.

        The reason Rust has a working borrow checker is because every part of the language from structs, enum, traits, generics and all the way to the syntax itself has been designed to support lifetimes and borrow checking.

        It's is not something you can just tack on to an existing language without fundamentally changing it.

        • dnautics 3 minutes ago
          > It's impossible to add a borrow checker to any existing language.

          Why do you say that. Have you tried and failed? It seems to be possible to add a borrow checker to zig, just as you can add MIRI to rust to get extra safety in unsafe blocks.

        • solatic 27 minutes ago
          I wouldn't say it's impossible, rather un-ergonomic. TypeScript can add type information to ordinary JavaScript code via JSDoc comments; the result can both be executed as ordinary JavaScript as-is and type-checked with TypeScript. But it's a huge pain to try to write (and maintain) everything that way, it was supported as a hack to help migrate legacy codebases. You could probably take a similar "the lifetimes are embedded in comments" approach with other languages, and the result would be similarly un-ergonomic.
          • afdbcreid 16 minutes ago
            That is possible (clang has experimental lifetime annotations support), but that is not enough to guarantee memory safety.

            As a simple example, Zig has no private fields. That makes encapsulating any unsafety impossible.

            • dnautics 1 minute ago
              no. You don't need private fields. All you have to do is analyze the code, harness the compiler to generate a time-dependent data dependency graph, and map allocation/frees/uses, if you can 'color' branches where data are shared you can also track and check to see there isn't an aliasing violation too.

              it is easy to patch the zig compiler to do this (about 50 LOC). The analysis is much much harder to get right.

            • veber-alex 2 minutes ago
              Exactly.

              Every part of the language must support memory safety from first principles.

      • onlyrealcuzzo 1 hour ago
        That's sort of what I'm doing...

        I'm writing a language with Affine Ownership that transpiles to Zig and has a built-in FSM-based Green Fiber runtime.

        Affine Ownership gives you memory safety + fearless concurrency + eliminates the need for Go's GC.

        It's obviously going to slow down compilation - since you need to do Rust's borrow checking, etc. But I can do this incrementally as well...

      • dnautics 1 hour ago
        > how about from the other direction, adding some kind of borrow checker to Zig? That sounds more within reach and practically achievable, possibly even in userland.

        It's doable, and as static analysis. see sibling comment.

        • Ar-Curunir 1 hour ago
          No, it would fundamentally change how Zig works.
          • dnautics 5 minutes ago
            no, it would not. If you do not believe me, you should try out the repo.
  • pjmlp 27 minutes ago
    Quite interesting the hand waving of security issues with Zig, oh well.

    If I want to use allocator debuggers I already have the production ready tools that exist for C and C++ for at least 30 years.

    • afdbcreid 19 minutes ago
      Compilers are not security sensitive, usually. And while UB could theoretically poison the generated code, this isn't a bigger risk than logic bugs.
      • pjmlp 5 minutes ago
        Of course they are, anything can be a gateway to inject backdoors, if security is not taken into account.

        And as mentioned, if what Zig offers is already in Purify, there is hardly any added value over C and C++, without the headaches of a niche language.

  • giancarlostoro 51 minutes ago
    One thing I wish Rust would improve over time is the builds. Its one of the biggest sources of wasted storage space on all my computers, builds a ton of libraries can take tens of gigs, it adds up very quickly. Not sure what the best solution is, one I found is to set the global build folder so dependencies get reused across projects, but imho it should be an OOTB default behavior whatever the real solution should be.
    • epage 2 minutes ago
      We are trading away disk space for faster builds. We could make them faster in some cases by using even more...

      On the other hand, it would be good to garbage collect those caches. We are wrapping up work on a new layout for intermediate build artifacts that will make it easier to GC them.

    • c-hendricks 38 minutes ago
      I always got a kick out of that, coming from a JavaScript background where people constantly harp on the size of node modules.

      My Tauri project, where the backend is much smaller code-wise than the frontend, has 9gb of rust artifacts (node_modules is 550mb for comparison)

      • tredre3 12 minutes ago
        Rust isn't great, and it shouldn't be a surprised since it's designed after npm. However one metric where nodes_modules is still worse for me is the sheer number of small files in it.

        Having nearly one million files in nodes_modules isn't that unusual. The problem is that on most common file systems the minimum allocation is usually at least 4KB. So even if the actual data is less than 500MB, you end up with 4GB disk space used/wasted.

        • inigyou 2 minutes ago
          I wish ext4 had a feature to mark a file as "atomic" where it would allocate all atomic files in a long run, without room for expansion, and I suppose with very inefficient compaction upon deletion, but without any padding bytes.
  • dev_l1x_be 1 hour ago
    Zig is a pre-1.0 language while Rust is post-1.0. This alone is settles which one to pick for may developers. The library support is probably favours Rust too. Rust build times are much slower than Zig, I get that, but I rarely optimize software for build times.
    • drdexebtjl 31 minutes ago
      Zig is not pre-1.0 because it’s not ready for production (bugs or missing features), it’s pre-1.0 because they want to be able to make breaking language changes.

      Nowadays when you can just point an agent at release notes and have it update everything, I actually prefer not having to wait through rare major releases to get new language features.

      • rwz 13 minutes ago
        > they want to be able to make breaking language changes

        That sounds like it's not ready for production to me.

      • afdbcreid 14 minutes ago
        > Nowadays when you can just point an agent at release notes and have it update everything

        Except that means that not only you lose compiler bugfixes, you also pretty much has no access to the ecosystem. For most production codebases, this is a deal breaker.

  • royal__ 22 minutes ago
    I don't even know what Zig is but I've seen this topic come up so many times on this site that I'm starting to think the people who are actually doing this are unsure themselves whether it's a good idea or not.
  • KoleSeise1277 2 hours ago
    The 35ms incremental rebuild is the part that sold me. I'd be curious to see the same benchmark on ARM once -fincremental gets there.
  • coffeeindex 2 hours ago
    Didn’t know Roc was still being worked on. I think it’s an interesting concept for a language that I personally haven’t seen elsewhere
  • satyambnsal 56 minutes ago
    is this uno reverse for bun post of zig to rust port ?
  • dminik 16 minutes ago
    While I'm a rust enthusiast, I do agree that certain languages lend themselves well to particular domains. So a rewrite from Rust to something better suited is fine by me. In fact, while I do work on a rust project, I would not have and still would not recommend it as the choice for that particular project.

    That being said, I had to do some double takes while reading this.

    > https://rtfeldman.com/rust-to-zig#memory-safety-post-rewrite

    I feel that it's a bit weird to compare a rather well tested 7 (?) year old rust implementation with a brand new not yet released less than a year old Zig implementation. Without that context, this looks like a bad comparison for rust, when it is in fact the complete opposite.

    > https://rtfeldman.com/rust-to-zig#build-times

    The swiftness of the Zig compilere here is insane, and would would very much shift my recommendation of Rust if it got to similar speeds.

    That being said, I do find it funny that currently, the compilation speed is actually worse on Zig than Rust, despite Zig (anonymous commenters at least tbd) claiming the opposite for years.

    How did you eventually discover the 35 ms figure for Roc? Did you have to temporarily update the codebase to 0.17?

    > https://rtfeldman.com/rust-to-zig#memory-control-zero-parse-...

    Nothing negative here. I did play around with implementing a scripting language in this DOD-ish, index-based paradigm and yeah, it is neat.

    I was thinking that it might be possible to do resumable computation across the network like this (in the context of frontend frameworks "resuming" UIs), but ultimately I have no use for this so just the experience itself was enough.

    One note here is that it does tend to break completely if non-pointer-free data is introduced. It seems like it's either all or nothing.

    > https://rtfeldman.com/rust-to-zig#ecosystem-relevance

    This is more of an LLM thing, which is fair, but I find it funny that "LLVM unstable bad" and "Zig unstable whatever".

    Overall though, this was an interesting read. And if the folks contributing to roc like zig then more power to them.

    Last thing, the link here is broken (points to a TODO):

    > Zig's compiler itself is another

  • up2isomorphism 1 hour ago
    I think there will be soon a wave of rewriting rust to language X coming up.
  • nntlol 1 hour ago
    [dead]
  • jdw64 32 minutes ago
    [dead]
  • throwaway613746 1 hour ago
    [dead]