C.CodeCompared.To/Roc

There is no #include and no header, because echo! is not declared anywhere in this file — it comes from the platform this program is compiled against. Ok({}) is the return value, where {} is the empty record, and it is what return 0 is doing.

The practical difference is that the list is closed at compile time. A C program can call system() from anywhere a header is included, and whether that is allowed is a question for the sandbox it eventually runs in; a Roc application compiled against a platform with no process control has no name for one.

Because the status is a return value rather than a global action, there is no exit() to call from four frames down and no atexit handler to register against it. Whatever the program has open is released on the way out, in the order the compiler worked out while compiling.

The count : I64 line is a type annotation on its own line above the definition, rather than a declaration specifier before the name. Writing it is optional, but it pins down which number type this is — and as the Numbers section shows, that decides what gets printed.

That one absence is what takes the whole familiar list with it: no dangling pointer, no double free, no use-after-free, no aliasing question, no null dereference. The rest of this section and the next two are that sentence worked out in detail.

The C version has to declare quotient and remainder uninitialized and trust that divide writes both. If it writes only one, the other is read as whatever was on the stack, and -Wall will not always catch it.

In C the same information is smuggled back as a pointer that happens to be zero, so the type says "address of a character" while the value says "nothing". Every caller has to remember the convention, and the one that forgets crashes at a place that has nothing to do with the mistake.

The C column is not a bug — it is the intended behavior of arrays and pointers, and it is also why restrict exists, why strict aliasing is a rule the optimizer relies on, and why passing a buffer to a function you did not write requires reading its documentation carefully.

Pointer arithmetic is what makes C's loop fast and what makes an off-by-one in it a memory-safety bug rather than a wrong answer. Handing the walk to the collection removes both — and removes the choice about how to walk it, which the What C Still Has section comes back to.

The costs are real and worth naming: a little arithmetic on every copy, and no way to free a reference cycle. Roc gets away without a cycle collector because nothing in the language can build a cycle — a value can only refer to values that already existed when it was constructed.

This is the answer to the obvious objection that immutability must cost a copy, and it holds because the value is immutable: the compiler can prove nobody else is looking at that list. It is exactly the proof an optimizer cannot make about a C array whose address has been passed to a function in another translation unit.

The C column shows the workaround rather than the bug, because the bug will not compile cleanly: returning text directly is a dangling pointer, and the static buffer is the usual repair — which is not reentrant and not thread-safe, and is why strtok and asctime have the reputations they do.

Every non-trivial C library has to answer this question in prose — does the caller free it, is it static storage, must it be freed with a matching function from the same library — and every caller has to read the answer. The commonest memory bugs in C are not exotic; they are two people disagreeing about that sentence.

In C the two are separate, and the gap between them is undefined behavior that usually prints a plausible number. The C column above is written the careful way, which is the point — the careless way compiles just as happily.

C gives you two different wrong answers instead: unsigned arithmetic wraps silently, which is defined and almost never what was meant, and signed overflow is undefined, which lets the optimizer delete the bounds check written just after it. Aborting is a worse outcome than the right answer and a much better one than a plausible wrong number.

That is a real loss as well as a real safety gain — bit-level reinterpretation is how you write a fast inverse square root, a tagged pointer or a serializer, and none of them can be written here. What C Still Has picks this up.

C's unsequenced-modification rules are a genuine hazard precisely because the offending expressions look reasonable and compile with at most a -Wsequence-point warning from -Wall — and two compilers, or two optimization levels, can disagree about what they mean.

In C the check is yours to remember, and forgetting it is undefined behavior that the optimizer is entitled to assume cannot occur and to reason backwards from. In Roc, forgetting it with // is a defined abort naming what happened, and div_try makes forgetting it impossible.

The sizeof division in the C column works only where the array's declaration is visible. Pass it to a function and it decays to a pointer, the length is gone, and it has to be handed over separately — which is why every C function taking a buffer also takes a count, and why the two can disagree.

The C column has to write the bound itself and keep it correct as the array changes, and the version without the if compiles identically — it reads adjacent memory, which is a security bug on a good day and a mysterious wrong answer on a bad one.

The second parameter in the C version is the bug surface. Nothing connects it to the first, so passing the wrong count compiles cleanly, and a caller who later shortens the array has to remember to change the number at every call site.

The realloc dance in the C column is the correct form of it, and most of its length is the failure path: assigning the result straight back to numbers leaks the original when it returns NULL, which is a mistake common enough to have its own static-analysis check.

C's convention costs an O(n) walk per call and, more importantly, makes a string with a zero byte in it unrepresentable. It is also where the classic overruns come from: a buffer whose NUL got overwritten has no end, and every function that walks it keeps going.

snprintf is the safe member of a family whose other members are not, and even it truncates silently when the buffer is short — the return value says how much it wanted to write, and almost nobody checks it.

printf has no way to know the types of its arguments, so the agreement between %d and what follows is checked only when the format is a literal the compiler can see. Pass a format string through a variable and the check is gone, which is the whole format-string vulnerability class.

strtok is the sharpest illustration of C's string model: it modifies the input, it keeps its position in a static variable so two loops cannot interleave and no two threads can use it at once, and the pieces it returns point into the buffer you gave it.

The conversion is explicit in both directions, which is the difference worth noticing: in C a string and its bytes are the same object, so code that means to handle text and code that means to handle bytes are written identically and only differ in what the author was thinking.

Because the alias names a shape rather than a type, any record with an x and a y of the right types already is a Point. There is no struct keyword at the use site and no typedef to avoid writing one.

This row is where C and Roc agree more than the rest of the page suggests. A C struct is a value: assigning it copies, passing it to a function copies, and returning it copies. It is only when its address is taken that C's behavior diverges from what this page describes.

For a C programmer this is the most uncomfortable absence on the page, and rightly — parsing a wire format, mapping a hardware register or matching a file header all need exactly this control. What C Still Has returns to it.

C has no structural equality at all, so the choice is a field-by-field comparison you maintain by hand — which quietly stops being right when a field is added — or memcmp, which also compares the padding bytes and can report two identical structs as different.

This is the row that best repays a C programmer's attention. The C version is three declarations for one idea, and the connection between the tag and the union is maintained entirely by the programmer — set kind to KIND_TEXT and write number, and show prints an integer as a pointer.

The C function needs its final return because an enum is an integer type: any value that fits is legal, so no switch over one can ever be exhaustive. -Wswitch catches a forgotten named constant, but it is a warning, and the unreachable fallback stays.

That overlap is what C's union actually is, and type punning through one is used constantly — for bit manipulation, for network headers, for variant records. None of it is expressible here, and the next section is the honest accounting of that.

Empty is a case of the type rather than a null pointer, so the recursion terminates on a value the compiler knows about instead of on a check the author remembered. The C version allocates nothing here only because the tree is three known nodes; a real one needs malloc and a matching walk to free it.

C's enum is a set of integer constants with a type name loosely attached, which is why color + 1 compiles, why any integer fits in an enum Color, and why the switch in the previous section needed its unreachable fallback.

The case is spelled Fine rather than Ok only to keep it clear of the Ok that Try uses — nothing stops you reusing the name, since tags are not registered anywhere, but a reader of the page would have to look twice.

C has no way to express that. An enum is closed at its declaration, and the only open alternative is an integer, which is open to everything including values that are not levels at all. Choosing openness per function has no C counterpart.

Convention is to annotate top-level functions anyway, for the same reason a C header is useful — so a reader can see the shape without reading the body. The difference is that the annotation cannot drift out of step with the definition, the way a prototype in a header can.

C's declarator syntax follows the shape of a use of the thing rather than its type, which is why int (*f(int))(char) has to be unwound from the identifier outwards, and why cdecl exists as a program.

C's usual arithmetic conversions are convenient and are also where a surprising number of bugs live: comparing a signed int with an unsigned size_t converts the int, so a negative length becomes an enormous positive one and the bounds check passes.

That is the difference from void*, which also accepts any type but forgets it — the cast on the way out is a promise the compiler cannot check, and getting it wrong reads the right bytes as the wrong type.

This is stdint.h as the only option rather than as the careful option, and it removes the format-specifier problem with it — printing an I64 is to_str, not a choice between %ld, %lld and PRId64.

C decides from the operand types, so total / count silently truncates when both happen to be int — a bug that survives review because the source looks like the fractional division the author meant. Roc's / on two I64 values truncates the same way. What protects a Roc programmer more often is the default: a number literal with no annotation is a Dec, so 7 / 2 written with bare literals is 3.5.

Where C spells these with operators, Roc spells them as methods named for what they do, so a bit-twiddling expression reads as a chain of calls rather than a line of punctuation.

The C column is the correct use of strtol, and its length is the point: atoi is shorter and reports no errors at all, returning 0 for "abc", which is why it survives in code that has never been given bad input.

C has the same idea twice — the statement for effects and ?: for values — which is why the ternary gets nested into unreadable chains when a third case appears. A Roc if / else if / else chain is the ordinary spelling and stays readable.

Fallthrough is C's default because a switch is a computed jump into a block of statements rather than a selection between alternatives. -Wimplicit-fallthrough and the fallthrough attribute exist to make the deliberate cases distinguishable from the forgotten ones.

The $ is part of the name and is written at every use, so mutation is visible wherever it happens rather than only at the declaration. Most code that would be a loop in C is a fold here, and this row is the version that stays closest to the C shape.

The goto cleanup ladder is good C — it is how the Linux kernel handles multi-step acquisition — and it is entirely bookkeeping. Adding a third allocation means a third label, in the right place, releasing the right subset, and getting that wrong is a leak nothing will report.

A C function pointer is just an address, so every callback-taking API in C also takes a void *user_data that gets threaded through and cast back — qsort_r, every GUI toolkit, every event loop. Capture removes that parameter and the cast with it.

The qsort comparator is the shape of every generic C interface: it receives const void *, casts both back by hand, and returns a sign that the caller must encode correctly. Getting the sign backwards compiles and sorts wrongly; returning the tag by the wrong name does not compile.

va_arg is unchecked in both directions: it trusts the count and it trusts the type, so asking for an int when a double was passed reads the wrong bytes. This is the same hole printf lives in, and why its format checking is a special case the compiler knows about rather than a property of the language.

That makes the signature a guarantee rather than a description, which is the thing const gestures at and cannot deliver: a const int * parameter promises only that this function will not write through this pointer, and says nothing about the globals it touches or the file it opens.

The macro works and is checked only after substitution, so an error is reported against expanded text; it also evaluates its arguments twice, which makes LARGEST(i++, j) quietly wrong. The Roc version is type-checked once, at its definition, before any caller exists.

The C version has to be told the element size and hands back an address the caller casts. Pass sizeof(long) for an array of int and it compiles, runs and reads the wrong memory — which is why the generic C containers people actually use are macros that generate a type-specific version.

Macro-generated code is C's only way to get type-specific generics, and the costs are all in the tooling: the error messages point at the expansion, the debugger steps through one line, and the definition has to be written with backslashes and no way to break for readability.

C's three conventions for this — a sentinel return, a status code with the answer in an out parameter, and errno — all share the same weakness: none of them appears in the type, so the compiler cannot tell a caller who handled the failure from one who did not.

errno requires a protocol — clear it, call, check it before doing anything else — and every step is easy to skip. It is also why a function that fails must document whether it sets errno at all, since many set it only sometimes.

The two columns do the same work, and the C one is four times as long because the checking is written out. That length is why the checks get skipped in practice — and a skipped check in the Roc version is not a risk, because the value cannot be reached without it.

The C column has to recompute the shortfall at the call site, because the error channel is one integer and it is already carrying the error identity. The alternative is another out parameter, which is only written when it fails, so the caller must not read it otherwise.

Both languages keep a way out for the state that was supposed to be impossible, and both make it look unlike ordinary error handling so it is not reached for by habit.

A macro has no type, obeys no scope, evaluates its arguments however many times the body mentions them, and reports its errors against text the programmer never wrote. The defensive parentheses in the C column are there because omitting them makes DOUBLED(1 + 1) return 3.

A C header is textual inclusion, which is why it needs a guard against being pasted twice, why a change to one triggers a rebuild of everything that includes it, and why the declaration and the definition can disagree without the compiler noticing — they are in different translation units.

That is the real cost of #ifdef: the branch that is switched off is not compiled, so it is not checked, and a rename three months ago may already have broken it. Anyone who has enabled a rarely-used build flag and watched it fail to compile has met this.

For a protocol parser, a file header or a memory-mapped device register this is a genuine loss, and it is not one a library can fix — the control has to come from the language. C keeps it, and the two columns here print the same answer by entirely different means.

Arena and pool allocation are how C programs get both speed and predictable release, and they are the reason a game engine or a compiler is written this way. Zig makes the allocator an explicit parameter to address the same need; Roc takes the decision away, and that is a real trade rather than a simplification.

That is the structural answer to "could Roc replace C here", and for a bootloader or a device driver it is no. It also means the two languages are not really competing for the same job: a Roc platform is exactly the kind of program C is still the right tool for.

C's ABI is the interface every language on the machine agrees on, and being that interface is a large part of why C is still everywhere. Roc reaches it one layer down rather than directly, which is a deliberate boundary and not an oversight.

C89 code still compiles, everywhere, unchanged. That stability is worth a great deal on its own, and it is the fairest thing to weigh against everything the rest of this page argues — a language is not only its design.

This surprises nearly everyone, and it surprises quietly — the program is correct and the arithmetic is exact, but 6 prints as 6.0. Any example whose printed form matters should say which number type it means.

The error for getting this wrong names self-reference rather than mutation, which reads oddly until you see why: total = total + number is a new definition of total whose body mentions total.

The error names a type, [Maybe, True, ..], that appears nowhere in the source, which is what makes this worth knowing before it happens. C's bool from stdbool.h is a different kind of trap — it is an integer, so !flag prints 1 rather than a word.

C's char is the same idea with worse edges: its signedness is implementation-defined, so char c = 0xFF may be −1 or 255 depending on the platform, which is why ctype.h functions take an int and must be passed an unsigned char.

The strictness earns its keep by comparison: printf takes whatever it is given and interprets it according to a format string it cannot check in general, so the same mistake there is a wrong number on a good day and a crash reading an invalid address on a bad one.