Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

elaborate on slice wide pointer metadata #1499

Merged
merged 2 commits into from
Jul 13, 2024
Merged

elaborate on slice wide pointer metadata #1499

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c03759e
elaborate on slice wide pointer metadata
RalfJung May 23, 2024
4f5888f
typo fix and clarifications
RalfJung May 23, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 9 additions & 5 deletions src/behavior-considered-undefined.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,12 +71,16 @@ Please read the [Rustonomicon] before writing unsafe code.
* A `!` (all values are invalid for this type).
* An integer (`i*`/`u*`), floating point value (`f*`), or raw pointer obtained
from [uninitialized memory][undef], or uninitialized memory in a `str`.
* A reference or `Box<T>` that is [dangling], misaligned, or points to an invalid value.
* Invalid metadata in a wide reference, `Box<T>`, or raw pointer:
* `dyn Trait` metadata is invalid if it is not a pointer to a vtable for
`Trait` that matches the actual dynamic trait the pointer or reference points to.
Copy link
Member Author

@RalfJung RalfJung Jun 19, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

"that matches the actual dynamic trait" was clearly nonsense. Also this is now moved to the "points to an invalid value" point since it's not about the metadata, it's about using the metadata to keep going recursively through the reference.

* Slice metadata is invalid if the length is not a valid `usize`
* A reference or `Box<T>` that is [dangling], misaligned, or points to an invalid value
(in case of dynamically sized types, using the actual dynamic type of the
pointee as determined by the metadata).
* Invalid metadata in a wide reference, `Box<T>`, or raw pointer. The requirement
for the metadata is determined by the type of the unsized tail:
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Another piece of clarification, previously we were not very clear on what the metadata requirements are for types like (u32, [u32]): we spoke about "slice metadata" and the fact that this covered all types whose unsized tail is a slice was left implicit. Now it is explicit.

* `dyn Trait` metadata is invalid if it is not a pointer to a vtable for `Trait`.
* Slice (`[T]`) metadata is invalid if the length is not a valid `usize`
(i.e., it must not be read from uninitialized memory).
Furthermore, for wide references and `Box<T>`, slice metadata is invalid
if it makes the total size of the pointed-to value bigger than `isize::MAX`.
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is the only actual change, decided in rust-lang/unsafe-code-guidelines#510.

* Invalid values for a type with a custom definition of invalid values.
In the standard library, this affects [`NonNull<T>`] and [`NonZero*`].

Expand Down