In Go, pointers (mostly) don't go with slices in practice

https://utcc.utoronto.ca/~cks/space/blog/programming/GoSlicesVsPointers

by deafcalculus • 5 years ago

146 95 5 years ago

utcc.utoronto.ca

friendzis3• 5 years ago

Problems with memory addressing are bound to happen with asynchronous memory manipulation: threads in C/C++ or concurrent GC in go. The biggest issue here is that memory manipulation happens behind the scenes and the runtime does not offer effective tools to synchronise memory state manipulations.

masklinn11• 5 years ago

That’s not really the issue here. The issue is that slices are mutation proxies to the backing array, so in a concurrent context you’re sharing mutable state with all that implies. And worse because of the behaviour of append that sharing is not systematic, so it can look like there’s no mutable state sharing… until you append on a slice with leftover capacity and now there is.

The GC only operates on “dead” allocations (afaik it remains non-moving) so it’s not a concern for now.

Animats• 5 years ago

Well, of course slices work that way. Think about what happens if you have a reference to a slice in an array and you shrank the array to 0. You've just created a dangling pointer.

In Go, you get a stable version of the old data, and the garbage collector tracks that you still have a reference to it. This is safe, but confuses some people.

In Rust, the borrow checker won't let you modify the array while you have a reference to a slice of it. So you can't do this at all.

In C++, you get a mention on the Department of Homeland Security's US-CERT site.

friendzis3• 5 years ago

This is safe, but confuses some people.

Rust has created a weird perception that memory safety equals safety. Language is a tool and it should work with me: it is extremely important that my understanding of what the program should do aligns with what it actually does.

The way you describe go's behavior is "takes snapshot of the underlying data", which usually means "deep copy container". Taking a pointer/reference usually means quite an opposite. So it is "safe" in a sense that the pointer points to valid data, but is "incorrect" in a sense that it does wrong thing without warning.

Sure, one could argue that value-returning modification functions are a giveaway of invalidated data. But this is not C, go has reference counting and instead of "forcing" underlying array to maintain the same address it just keeps original pointer pointing to dereferenceable, but wrong data.

tsimionescu2• 5 years ago

The problem here is identical to the problem of pointers to array elements in C after a 'realloc', except that Go at least guarantees that you're not going to modify some other object's memory.

Of course, since append neither guarantees nor prevents a copy, the semantics of modifying a value through a pointer to a slice element after an append are unspecified, so it is not a useful construct.

foldr• 5 years ago

The way you describe go's behavior is "takes snapshot of the underlying data", which usually means "deep copy container".

There’s no need for Go to copy anything in the circumstance the OP described. It just doesn’t shrink the underlying array.

heleninboodler• 5 years ago

The way you describe go's behavior is "takes snapshot of the underlying data", which usually means "deep copy container"

No, there is no mention of a "snapshot". You get a reference to the current backing array, which may or may not continue being used by the slice (depending on reallocations). You're pointing to the live slice backing array, and the values in it may change if someone else is manipulating the slice, up to the point where the slice backing array must be reallocated, at which point you'll continue pointing to the old backing array and be keeping it from getting GC'd.

Zababa2• 5 years ago

Rust has created a weird perception that memory safety equals safety.

I think it's a bit more than that. They're also riding on the static typing trend that's happening right now, so type-safety is also part of the equation. From the website:

A language empowering everyone to build reliable and efficient software.
Reliability: Rust’s rich type system and ownership model guarantee memory-safety and thread-safety — enabling you to eliminate many classes of bugs at compile-time.

That means that people like me that still have a hard time with C and C++ can build efficient software using the same workflow as I'm used to in my usual "web languages" (Python and JS mostly).

feffe• 5 years ago

This is how I think about Go slices (may help other understand them).

A slice itself is just a window into a backing array of fixed size. The slice carries three data members. The pointer to the backing array and its remaining capacity and the length of the slice data.

Typically slices are passed around by value but you can take their address and modify a "shared" slice.

The built-in append() returns a new slice by value.

What happens is simply that when appending data to a slice and there is no room in the backing array, a new backing array is allocated that the returned slice points into. The old "input" slice to append is still intact and if some code has access to it, it will look at data stored in the old backing array.

I've constructed similar utility types in C and find them quite convenient. It's very convenient to have the distinction between the backing memory (array) and a slice viewing a portion of it instead of just a dynamic array.

sly0103• 5 years ago

it does wrong thing without warning

It's not without warning, it's a well documented behavior.

Just think of slices as "immutable", "pass-by-value" data structures (with a relatively efficient implementation) and everything falls into place.

Mutating them in any way is actually a special case that you do only for performance reason (i.e. you can pre-allocate and fill if you know the size ahead of time) but - as always - you try to keep those abstracted away and to the minimum.

hsn9152• 5 years ago

Go tells you very explicitly how it resizes slices by forcing you to write this:

    slice = append(slice, item)

By merely typing this all the time when you add elements, you intuitively understand that appending can potentially re-allocate the slice data in a totally different location, so any pointers you have taken before the resize are not guaranteed to be pointing to items in the new slice; just the old slice.

37ef_ced3• 5 years ago

In Go, a []int ("slice of int") is just a C struct like this, passed by value:

  struct intSlice {
      int* addr;
      int len;
      int cap;
  };

The memory at addr is not owned by the slice. All the slice operations are simply notation for manipulating the struct. Go's garbage collection makes the whole thing work well.

This can be confusing if you're used to C++'s std::vector (which owns the memory) or Python's slices. Go's slices are a shallow pointer/length system exactly like is used in C all the time. For example:

  void sort(int* addr, int len);

becomes

  func sort(a []int)

A Go slice is just a formalization of C's pointer/length idiom, with terse notation for manipulation.

benibela2• 5 years ago

In Pascal, there are no slices

No slices, no problems

If you need to work with a part of a string, you can make two ordinary integer variables for offset and length

jayar95• 5 years ago

Cool

skybrian2• 5 years ago

It would be more accurate to say that pointers don’t work with append() or any other way of growing an array, since they all depend on reallocating it sometimes.

Incidentally, this is equally true of creating additional pointers or slices pointing into an growable array. They aren’t safe after the next append(). If you grow an array then you need to refer to its elements using array indices.

But if you have a fixed-length array, or between appends, you can use both pointers and slices to point to parts of it, and it will work fine,

This all works the same as C if you think of a slice as a glorified pointer. If you’re thinking of a slice as a JavaScript array then you’ll have trouble.

masklinn11• 5 years ago

If you’re thinking of a slice as a JavaScript array then you’ll have trouble.

The problem of Go is that it has you uses slices as that as well as actual slices, there is no vector type. So the confusion is very much understandable and to be expected.

xiaq• 5 years ago

The author seems confused. The following is simply not true:

    When you take a pointer to a slice, you get a pointer to the current version of this tuple of information for the slice. This pointer may or may not refer to a slice that anyone else is using; for instance:

    ps := &s
    s = append(s, 50)

    At this point, '*ps' may or may not be the same thing as 's', and so it might or might not have the new '50' element at the end.

No, *ps will always be the same as s, because ps is a pointer so it carries no information other than the address of s.

The author seems to have failed to distinguish the operation of copying a fat pointer (which opens the possibility of divergence) and the operation of the taking the address of a fat pointer (which involves no copying, so divergence is not possible - where would the divergent version be stored?).

See this code snippet: https://play.golang.org/p/tdb-O8a6hDN

Thorrez5• 5 years ago

Yep, that immediately stood out to me too.

s is a local variable (or global, doesn't matter). ps simply points to that local variable. You can modify the local variable all day long and ps will still point to it, not some old version of it.

watt2• 5 years ago

the line `s = append(s, 50)` redefines what "s" actually is. And after this line `ps` points to some previous version of what "s" used to be.

flippinburgers• 5 years ago

This is why passing a pointer to a slice as a function parameter is required if you want to avoid subtle bugs in functions that alter the length of the contents of slices.

To be clear the author is incorrect.

Thorrez5• 5 years ago

Honestly, this is a strange and peculiar situation, although Go programmers have acclimatized to it. To programmers from other languages, such as C or C++, the concept of pointers to dynamically extensible arrays seems like a perfectly decent idea that surely should exist and work in Go. Well, it exists, and it "works" in the sense that it yields results and doesn't crash your program, but it doesn't "work" in the sense of doing what you'd actually want.

I think it works in the same way as a pointer to std::span in C++. (Or pointer to std::string_view with the exception that std::string_view doesn't allow modification of the elements.)

I guess the difference is that std::span doesn't let you append to the backing array through the std::span directly. So with C++ you have to write more code which makes it clearer what's happening.

edflsafoiewq• 5 years ago

C++ has std::vector, which is one level of abstraction above a slice; you push to a vector, and maybe the backing slice changes, but it's still the same vector.

Go is unusual in not having a equivalent of vector.

pjmlp2• 5 years ago

Not really, if reallocation takes place.

So if you got a pointer to a vector element, it now points to garbage.

Thorrez5• 5 years ago

Yes, std::vector and slice are different. My point is that a slice is similar to std::span.

With both slice and std::span, = does a shallow copy of just 2 or 3 pointers.

With std::vector = does a deep copy of every element, you have 2 distinct backing arrays.

Go forces you to use copy() and append() and rely on the garbage collector to make a slice fill the roll of std::vector. IMO it leads to some confusing code.

barsonme• 5 years ago

Outside of a few very specific situations, if you’re working with a pointer to a slice or string you’re doing something very wrong. Slices are “fat” pointers.

To programmers from other languages, such as C or C++, the concept of pointers to dynamically extensible arrays seems like a perfectly decent idea

Write Go in Go, don’t write C in Go. (Which applies to every language, tbh.)

vanderZwan• 5 years ago

I get the confusion (to people unfamiliar with pointers) about pointers to elements in reference types, but why would anyone want pointers to reference types? They're basically pointers with extra features

simiones6• 5 years ago

There are no such things as "reference types" in Go, though slices do have the extremely odd behavior that they can take the value `nil`, similarly to interfaces and unlike any other non-pointer type in Go.

Pointers to "fat pointer" types are sometimes needed, just like you sometimes need pointers-to-pointers.

Joker_vD2• 5 years ago

What about maps? Non-nil maps sure seem like they're "reference types", look at [0].

[0] https://play.golang.org/p/xtY_ASExQzR

masklinn11• 5 years ago

Go doesn’t have reference types, and slices certainly do not behave like them: because the slice is composed of the pointer, length, and capacity (on the stack) if you want to modify a slice on behalf of a caller you absolutely must get a pointer to a slice, unless your mutations consist solely of setting existing indices.

Go’s map is (AFAIK) a pointer to the hmap stucture where everything happens, so it does behave like a reference type (all updates in the callee will be visible to the caller) but even then it can be useful to have a pointer to one so you can reset it without mutating it in-place. While that can be a bit weirder, it is also much safer. Especially given Go’s maps are not thread-safe (and in fact not memory-safe under concurrent updates).

ratorx• 5 years ago

Isn’t passing in pointers to slices considered an anti-pattern? I thought the go way would be to take the slice as argument by value and return possibly a different slice, like append does. I don’t think I’ve seen any (idiomatic) code that took slices by pointer.

kubb• 5 years ago

Considering the confusion of the author, it seems like not all junior programmers can understand Go, which makes me wonder: is it simple enough?

One pitfall is when getting a slice by value in a function. You cannot be sure that someone is not going to pass you a slice into a buffer that they themselves use, so you have to be careful when appending - someone might be using that buffer and you’ll be writing over it.

gobookdev• 5 years ago

No it's not, it can be even simpler, but it's a great start and evolution

kansface• 5 years ago

I don't feel its a matter of complexity per se, more like bad UX. We could imagine exposing why this doesn't work to end users instead oh hiding behind a leaky abstraction.

masklinn11• 5 years ago

which makes me wonder: is it simple enough?

Obviously not given Go was never simple in the first place. Go was built to be easy — for a certain value of easy.

Simple tools are often not easy, and simple programming languages are definitely not easy: they tend to be built out of a small set of very powerful concepts which are directly exposed to the language user, said language user has close to the power of the language designer in building abstractions. Lisps, and Smalltalks and Forths are simple, which means they are mind-bending and not only can you build what you want out of them (hello turing equivalence) you can build how you want.

And of course the simplest of languages (the turing tarpits) are barely usable at all.

kortex• 5 years ago

Continuing that thought along the line of "Simple made easy," I think ease has a simplicity all its own.

A simple language, e.g. C or lisp, simple in that their grammar is simple, are definitely less easy for the programmer, than say Go. But C is not simple as an experience, since it forces the dev to mentally complect so many concepts in order to get things done: macros, memory management, etc. Lisp is complex in a different way: metaprogamming, DSLs, and deep abstractions are the norm. So simplicity/complexity tends to be something of a whack-a-mole. It's a lower bound, much like the uncertainty principle; you can always add complexity.

Go makes a lot of choices that try to really optimize the user_complexity * language_complexity product.

skybrian2• 5 years ago

There are conventions that help, but they could be made explicit:

- If you don't know where a slice came from (such as getting it passed as an argument), treat it as read-only. Any exceptions should be documented.

- If you're going to mutate a slice, make it a private member of a struct and don't give out direct access to it.

sly0103• 5 years ago

Go-s behavior is the ONLY sensible one in _any_ language that supports pointers. This is a faster and safe(er) way. You simply cannot modify (move or reallocate) a data-structure that has pointers pointing to it without invalidating all pointers. Not in C++, not in any language with pointers (that I know if). This is not "strange and peculiar". What's "strange and peculiar" is that the author thinks that doing this in C++ is a "perfectly decent idea". In fact it's a huge no no and more often than not will crash.

Edit: we would both learn something if you offered a counter example instead of downvoted.

Diggsey• 5 years ago

It's clearly not the "only sensible one" given that no other language works the way Go does here.

In C++ this is UB, which is bad, but in keeping with the rest of the language.

In Rust, the compiler will not allow you to do any operation that would re-allocate the backing store whilst there are outstanding references into it.

In most other languages (eg. Java, C#, python, etc.), you can't get a pointer/reference to an array index, only a pointer/reference to the item at that index at the time you looked.

Go's decision here is especially weird given that this same thing is seemingly prevented for maps (why the inconsistency?).

Given the three goals of memory-safety, "simplicity" and performance, it's true there are not many other options Go could have chosen, but personally I think Go's interpretation of "simplicity" is incredibly warped: it's a kind of superficial simplicity that leads to programs that are much more complicated to reason about.

dilap• 5 years ago

To programmers from other languages, such as C or C++, the concept of pointers to dynamically extensible arrays seems like a perfectly decent idea that surely should exist and work in Go.

Ah, I would beg to differ!

You should never be taking pointers to a dynamically resizable array, in any language. (Well, caveat, its fine if you do it only for a time period where you know the array won't be growing.) The whole point of a dynamically resizable array is that its addresses can change!

If you did this in C++, you'd get undefined behavior. In Go you get "safe" but probably-not-what-you-wanted behavior. In Rust it simply wouldn't be possible (w/o unsafe), and you'd have to use indices (which is the correct thing to do, in any language).

klodolph4• 5 years ago

Honestly, this is a strange and peculiar situation, although Go programmers have acclimatized to it. To programmers from other languages, such as C or C++, the concept of pointers to dynamically extensible arrays seems like a perfectly decent idea that surely should exist and work in Go. Well, it exists, and it "works" in the sense that it yields results and doesn't crash your program, but it doesn't "work" in the sense of doing what you'd actually want.

In C++, what happens is that the "iterators are invalidated" when you add something to an array. This is CONSTANTLY a source of bugs and frustration for new programmers. In C++, it may yield results or crash your program, and you are never sure quite which will happen. The best you can do (as a senior engineer) is design your software to avoid ever creating this situation in the first place and throw address sanitizer at things to try and catch them when they arise. The difference with Go is that in Go this will never result in a memory error.

Strictly speaking, the situation in Go is way better. I will take "incorrect behavior, but not a memory error" over "memory error" any day of the week.

We may forget what it's like for new programmers, but for those of us who hang out on Discord channels, Stack Overflow, and Reddit giving people help with programming, simple things like iterator invalidation are a major pain point.

"You have a memory error in your program", I say to someone. "Now that you know that you have a memory error, it is probably your highest priority to find and fix this error." And now you start walking someone through the steps of finding and fixing a memory error, which is nontrivial. You'll tell them about Address Sanitizer, GDB, and Valgrind, and you'll wish them luck.

kevincox3• 5 years ago

I agree that it is better than C and C++ but not much better.

C and C++ are "It is very easy to make this mistake which leads to undefined behaviour and a maybe incorrect program."

Go is "It is very easy to make this mistake which leads to a maybe incorrect program."

Yes, better! But the problem is still there. I much prefer the Rust solution where there is no common mistake.

klodolph4• 5 years ago

The catch is that code is hard to translate into Rust.

"I have this code, you see... and it takes a couple mutable references into an array... how do I translate this into Rust?"

There is no one-size-fits-all answer to that question. The code may be correct in C or C++, but the Rust type system may give you one hell of a hard time proving that it is correct to the Rust type system's satisfaction... so you refactor your code completely, or you use integer indexes into arrays rather than references, or you use unsafe code...

I've written some amount of Rust code at this point. About half of the time, when I write a project in Rust, there comes a point at which I'm fighting with the type system. I feel like this should stop happening, at some point.

marcus_holmes• 5 years ago

I love Go, my favourite language. But I've been bitten before by passing slices around and then finding out that they got disassociated and are now pointing at two different backing arrays without telling me.

I kinda know enough now to avoid this, but I have to be careful and remind myself it's a possibility.

I'd love some built-in method to be able to tell whether altering a value in slice A will also alter the value in slice B (i.e. whether A and B are referring to the same backing array). As far as I'm aware there's no easy way of doing this in Go.

Fire-Dragon-DoL• 5 years ago

s = append(s, elem)

I read this immediately as "create a new copy of the original slice with one additional element", so I presumed that was the case. It would actually be shocking the opposite, if I could end up modifying the original one (before the append) with a pointer to the new s, which seems to be the case!

Big gotcha there: treat slices as stateful at all time.

Since it has an assignment operation, it must be creating something new, otherwise it would have been a method of the slice itself

EDIT: I just realized the gotcha is not there at all, Go would consider the first slice to be of N length and the second slice of length N+1. Comparing the two slices would give an error at some point because one is shorter than the other, so the fact that the address changes or not is irrelevant. However I can see this becoming problematic with pointers, which proves the point of the article.

In Go, pointers (mostly) don't go with slices in practice

Related Stories