V: Don't disallow mut primitive arguments; invalidation

Created on 25 Jul 2019 · 6Comments · Source: vlang/v

In #1131 and in the upcoming changelog for 0.1.17, passing a mutable argument of primitive type is no longer allowed.

Iterator invalidation (not related to custom/generic iterators) is a memory safety issue:

fn set_elem(mut arr []int, i int){
  arr[i] = 5
  *arr = [] // unexpected by caller
}
mut a := [1, 2] // original data
for i, _ in a {
  set_elem(mut a, i)
}

Whilst a is being iterated with for, the original data will be freed (e.g. if using reference counting) when the *arr = [] call means the original data is apparently no longer referenced.

This can be fixed by adding a reference count increment while the for loop is active. But it doesn't solve the problem of the caller not realising that arr is reassigned to.
Instead, the compiler should allow:

fn set_int(mut e int) {
  e = 5 // or whatever
}
mut a := [1, 2] // original data
for i, _ in a {
  set_int(mut a[i])
}

This is much easier to reason about for the caller, and can prevent memory safety issues (in unsafe code at least).

Discussion Type System

Source

ntrel

All 6 comments

This also highlights a problem I raised a while ago in the forum: does mut apply to the variable (the reference) or the value. Now it seems to sometimes apply to both, other times just the variable. In C/C++ we have int * and const int * and int const * and const int const * and they mean different things.

In the example above, why is arr mutable at all? It is only arr[x] we want mutable. The intent is that the elements of the array are mutable, perhaps fun set_elem(arr mut []int, i int)