Bun Rust rewrite: "codebase fails basic miri checks, allows for UB in safe rust"

· coding · Source ↗

TLDR

  • Bun’s AI-generated Rust rewrite triggers miri UB errors immediately: a dangling reference in PathString::slice via core::slice::from_raw_parts with no-provenance pointer.

Key Takeaways

  • Miri flags PathString::slice constructing an invalid &[u8] from a dangling pointer – a use-after-free pattern reproducible in a 5-line test.
  • The UB occurs inside an unsafe block within what was presented as a memory-safe Rust rewrite, undermining the core marketing claim.
  • The reproducer: allocate a Box, initialize a PathString referencing it, drop the box, then call .slice() – miri immediately errors.
  • Issue author explicitly attributes the bugs to AI-generated Rust code and calls for hiring a human Rust developer.

Hacker News Comment Review

  • Commenters split on severity: some see these as expected early-stage bugs in a parallel rewrite where the Zig stable branch remains intact, others flag the asymmetry between the high-reach launch announcement and the low-reach correction.
  • A minority argues the UB may be net-neutral if it replicates existing Zig behavior, and the long-term value is a single maintained codebase once bugs are resolved.
  • Reaction to the issue’s tone was mixed: several commenters found the “please don’t vibe code Rust” framing needlessly hostile, diluting an otherwise valid technical report.

Notable Comments

  • @dangerlibrary: flags the reach asymmetry – flashy rewrite announcement spreads wide; bug report corrections do not.

Original | Discuss on HN