v147 · Security · Safety Comparison

Safety Comparison

Memory safety properties of C++ versus Rust for XML parsing — the bug classes eliminated by the Rust parser, and how the new implementation integrates with Chrome without changing the web API.

C++ vs Rust memory safety

C++ XML parser (pre-Chrome 147)

Manual memory management
Use-after-free possible if parsing state is mishandled
Buffer overflows in string operations
Integer overflows in size calculations
Dangling pointer from entity expansion
Bugs require CVE patches and browser updates

Rust XML parser (Chrome 147+)

Ownership system — memory managed at compile time
Use-after-free impossible — borrow checker enforces it
Bounds checking enforced — slice accesses are safe
Integer overflow detectable — checked arithmetic in debug
No null/dangling pointer dereferencing
Entire bug class eliminated without runtime overhead

eliminated bug classes

Bug type	C++ parser	Rust parser (Chrome 147+)
Use-after-free	Possible — manual free	Eliminated — borrow checker
Heap buffer overflow	Possible — raw pointer arithmetic	Eliminated — slice bounds checked
Double free	Possible — manual delete	Eliminated — ownership system
Null pointer dereference	Possible — raw pointers	Eliminated — Option<T> forces null checks
Data race (multithreaded parsing)	Possible — shared mutable state	Eliminated — Send/Sync traits enforced
Logic errors	Still possible	Still possible — Rust doesn't prevent logic bugs

integration architecture

// Chrome integrates Rust via a C FFI boundary:
// C++ Blink calls → Rust XML parser → returns C++ DOM nodes

// The web-facing API is unchanged:
const parser = new DOMParser();
// ↕ Blink C++ API layer (unchanged)
// ↕ C FFI boundary
// ↕ Rust xml_parser::parse(bytes) → XmlNode tree
// ↕ C FFI boundary
// ↕ Blink converts XmlNode → Document DOM
const doc = parser.parseFromString(xml, 'application/xml');

// No changes needed in web code.
// Performance is equivalent to C++ — no GC pauses,
// Rust compiles to native code.

scenario focus

Select a scenario to focus its rendered example and summary.

implementation reference

Need the exact API surface, compatibility boundaries, errors, lifecycle, and source links? Read the matching gendn reference ↗