Skip to content

Commit 5a377c4

Browse files
joshlfjoshlf
committed
Generalize SizeEq to SizeFrom, support shrinking
Generalize `SizeEq`, renaming it to `SizeFrom`, and supporting casts which shrink rather than preserve referent size. This requires fairly deep surgery in our transmute taxonomy. We can no longer rely on `SizeFrom::cast_from_raw` preserving referent size, which means that all pointer transmutes must now reason about two types of transmutes: - Size-shrinking transmutes (in which the source value is larger than the destination value) - Overwriting transmutes (in which the source value is larger than the destination value *and* the destination permits mutation). In an overwriting transmute, the resulting value is a concatenation of a valid `T` and the *suffix* of a valid `U`. (Note that size-preserving transmutes can be viewed as a special case of size-shrinking transmutes.) In order to support these semantics, we split `TransmuteFrom` into two traits: `TransmuteFrom` (which supports shriking transmutes) and `TransmuteOverwrite` (which supports overwriting transmutes). While we're here, we simplify the relationship between `TryTransmuteFromPtr`, `MutationCompatible`, and `Read`. In particular, `TryTransmuteFromPtr` now has a single blanket impl which is bounded by `MutationCompatible`, and `MutationCompatible` now directly supports three cases (and no longer delegates to `Read`): - Exclusive reference transmutes in which the destination type may be transmuted into the source type - Shared reference transmutes in which both the source and the destination type are `Immutable` - Shared reference transmutes which permit interior mutation, in which the source and destination types may both be transmuted into one another, and in which the source and destination types support compatible interior mutation Makes progress on #1817 Co-authored-by: Jack Wrenn <[email protected]> gherrit-pr-id: I6c793a9620ad75bdc0d26ab7c7cd1a0c7bef1b8b [WIP] Break TransmuteFrom into Shrink vs Overwrite Also, only implement TryTransmuteFromPtr once in terms of MutationCompatible. gherrit-pr-id: I1e15473bf871e5b53a6c093e6a79f48e6498aa04
1 parent 46e2a46 commit 5a377c4

File tree

14 files changed

+442
-348
lines changed

14 files changed

+442
-348
lines changed

‎src/impls.rs‎

Lines changed: 36 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -105,11 +105,13 @@ assert_unaligned!(bool);
105105
// pattern 0x01.
106106
const _: () = unsafe {
107107
unsafe_impl!(=> TryFromBytes for bool; |byte| {
108-
let byte = byte.transmute::<u8, invariant::Valid, _>();
108+
let mut byte = byte;
109+
let byte = byte.reborrow().into_shared().transmute::<u8, invariant::Valid, _>();
109110
*byte.unaligned_as_ref() < 2
110111
})
111112
};
112-
impl_size_eq!(bool, u8);
113+
114+
impl_size_from!(bool, u8);
113115

114116
// SAFETY:
115117
// - `Immutable`: `char` self-evidently does not contain any `UnsafeCell`s.
@@ -134,13 +136,14 @@ const _: () = unsafe { unsafe_impl!(char: Immutable, FromZeros, IntoBytes) };
134136
// `char`.
135137
const _: () = unsafe {
136138
unsafe_impl!(=> TryFromBytes for char; |c| {
137-
let c = c.transmute::<Unalign<u32>, invariant::Valid, _>();
139+
let mut c = c;
140+
let c = c.reborrow().into_shared().transmute::<Unalign<u32>, invariant::Valid, _>();
138141
let c = c.read_unaligned().into_inner();
139142
char::from_u32(c).is_some()
140143
});
141144
};
142145

143-
impl_size_eq!(char, Unalign<u32>);
146+
impl_size_from!(char, Unalign<u32>);
144147

145148
// SAFETY: Per the Reference [1], `str` has the same layout as `[u8]`.
146149
// - `Immutable`: `[u8]` does not contain any `UnsafeCell`s.
@@ -167,21 +170,22 @@ const _: () = unsafe { unsafe_impl!(str: Immutable, FromZeros, IntoBytes, Unalig
167170
// Returns `Err` if the slice is not UTF-8.
168171
const _: () = unsafe {
169172
unsafe_impl!(=> TryFromBytes for str; |c| {
170-
let c = c.transmute::<[u8], invariant::Valid, _>();
173+
let mut c = c;
174+
let c = c.reborrow().into_shared().transmute::<[u8], invariant::Valid, _>();
171175
let c = c.unaligned_as_ref();
172176
core::str::from_utf8(c).is_ok()
173177
})
174178
};
175179

176-
impl_size_eq!(str, [u8]);
180+
impl_size_from!(str, [u8]);
177181

178182
macro_rules! unsafe_impl_try_from_bytes_for_nonzero {
179183
($($nonzero:ident[$prim:ty]),*) => {
180184
$(
181185
unsafe_impl!(=> TryFromBytes for $nonzero; |n| {
182-
impl_size_eq!($nonzero, Unalign<$prim>);
183-
184-
let n = n.transmute::<Unalign<$prim>, invariant::Valid, _>();
186+
impl_size_from!($nonzero, Unalign<$prim>);
187+
let mut n = n;
188+
let n = n.reborrow().into_shared().transmute::<Unalign<$prim>, invariant::Valid, _>();
185189
$nonzero::new(n.read_unaligned().into_inner()).is_some()
186190
});
187191
)*
@@ -396,53 +400,59 @@ mod atomics {
396400
($($($tyvar:ident)? => $atomic:ty [$prim:ty]),*) => {{
397401
crate::util::macros::__unsafe();
398402

399-
use core::cell::UnsafeCell;
400-
use crate::pointer::{PtrInner, SizeEq, TransmuteFrom, invariant::Valid};
403+
use core::{cell::UnsafeCell};
404+
use crate::pointer::{TransmuteFrom, PtrInner, SizeFrom, invariant::Valid};
401405

402406
$(
403407
// SAFETY: The caller promised that `$atomic` and `$prim` have
404-
// the same size and bit validity.
408+
// the same size and bit validity. As a result of size equality,
409+
// both impls of `SizeFrom::cast_from_raw` preserve referent
410+
// size exactly.
405411
unsafe impl<$($tyvar)?> TransmuteFrom<$atomic, Valid, Valid> for $prim {}
406412
// SAFETY: The caller promised that `$atomic` and `$prim` have
407-
// the same size and bit validity.
413+
// the same size and bit validity. As a result of size equality,
414+
// both impls of `SizeFrom::cast_from_raw` preserve referent
415+
// size exactly.
408416
unsafe impl<$($tyvar)?> TransmuteFrom<$prim, Valid, Valid> for $atomic {}
409417

410-
// SAFETY: The caller promised that `$atomic` and `$prim` have
411-
// the same size.
412-
unsafe impl<$($tyvar)?> SizeEq<$atomic> for $prim {
418+
// SAFETY: See inline safety comment.
419+
unsafe impl<$($tyvar)?> SizeFrom<$atomic> for $prim {
413420
#[inline]
414421
fn cast_from_raw(a: PtrInner<'_, $atomic>) -> PtrInner<'_, $prim> {
415-
// SAFETY: The caller promised that `$atomic` and
416-
// `$prim` have the same size. Thus, this cast preserves
422+
// SAFETY: The caller promised that `$atomic` and `$prim`
423+
// have the same size. Thus, this cast preserves
417424
// address, referent size, and provenance.
418425
unsafe { cast!(a) }
419426
}
420427
}
421428
// SAFETY: See previous safety comment.
422-
unsafe impl<$($tyvar)?> SizeEq<$prim> for $atomic {
429+
unsafe impl<$($tyvar)?> SizeFrom<$prim> for $atomic {
423430
#[inline]
424431
fn cast_from_raw(p: PtrInner<'_, $prim>) -> PtrInner<'_, $atomic> {
425432
// SAFETY: See previous safety comment.
426433
unsafe { cast!(p) }
427434
}
428435
}
429-
// SAFETY: The caller promised that `$atomic` and `$prim` have
430-
// the same size. `UnsafeCell<T>` has the same size as `T` [1].
436+
437+
// SAFETY: The caller promised that `$atomic` and `$prim`
438+
// have the same size. `UnsafeCell<T>` has the same size as
439+
// `T` [1]. Thus, this cast preserves address, referent
440+
// size, and provenance.
431441
//
432442
// [1] Per https://doc.rust-lang.org/1.85.0/std/cell/struct.UnsafeCell.html#memory-layout:
433443
//
434444
// `UnsafeCell<T>` has the same in-memory representation as
435445
// its inner type `T`. A consequence of this guarantee is that
436446
// it is possible to convert between `T` and `UnsafeCell<T>`.
437-
unsafe impl<$($tyvar)?> SizeEq<$atomic> for UnsafeCell<$prim> {
447+
unsafe impl<$($tyvar)?> SizeFrom<$atomic> for UnsafeCell<$prim> {
438448
#[inline]
439449
fn cast_from_raw(a: PtrInner<'_, $atomic>) -> PtrInner<'_, UnsafeCell<$prim>> {
440450
// SAFETY: See previous safety comment.
441451
unsafe { cast!(a) }
442452
}
443453
}
444454
// SAFETY: See previous safety comment.
445-
unsafe impl<$($tyvar)?> SizeEq<UnsafeCell<$prim>> for $atomic {
455+
unsafe impl<$($tyvar)?> SizeFrom<UnsafeCell<$prim>> for $atomic {
446456
#[inline]
447457
fn cast_from_raw(p: PtrInner<'_, UnsafeCell<$prim>>) -> PtrInner<'_, $atomic> {
448458
// SAFETY: See previous safety comment.
@@ -452,7 +462,9 @@ mod atomics {
452462

453463
// SAFETY: The caller promised that `$atomic` and `$prim` have
454464
// the same bit validity. `UnsafeCell<T>` has the same bit
455-
// validity as `T` [1].
465+
// validity as `T` [1]. `UnsafeCell<T>` also has the same size
466+
// as `T` [1], and so both impls of `SizeFrom::cast_from_raw`
467+
// preserve referent size exactly.
456468
//
457469
// [1] Per https://doc.rust-lang.org/1.85.0/std/cell/struct.UnsafeCell.html#memory-layout:
458470
//

‎src/layout.rs‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -612,15 +612,15 @@ pub(crate) use cast_from_raw::cast_from_raw;
612612
mod cast_from_raw {
613613
use crate::{pointer::PtrInner, *};
614614

615-
/// Implements [`<Dst as SizeEq<Src>>::cast_from_raw`][cast_from_raw].
615+
/// Implements [`<Dst as SizeCompat<Src>>::cast_from_raw`][cast_from_raw].
616616
///
617617
/// # PME
618618
///
619619
/// Generates a post-monomorphization error if it is not possible to satisfy
620-
/// the soundness conditions of [`SizeEq::cast_from_raw`][cast_from_raw]
620+
/// the soundness conditions of [`SizeCompat::cast_from_raw`][cast_from_raw]
621621
/// for `Src` and `Dst`.
622622
///
623-
/// [cast_from_raw]: crate::pointer::SizeEq::cast_from_raw
623+
/// [cast_from_raw]: crate::pointer::SizeCompat::cast_from_raw
624624
//
625625
// FIXME(#1817): Support Sized->Unsized and Unsized->Sized casts
626626
pub(crate) fn cast_from_raw<Src, Dst>(src: PtrInner<'_, Src>) -> PtrInner<'_, Dst>

‎src/lib.rs‎

Lines changed: 14 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -381,7 +381,7 @@ use core::{
381381
#[cfg(feature = "std")]
382382
use std::io;
383383

384-
use crate::pointer::invariant::{self, BecauseExclusive};
384+
use crate::pointer::{invariant, BecauseBidirectional};
385385

386386
#[cfg(any(feature = "alloc", test, kani))]
387387
extern crate alloc;
@@ -1840,7 +1840,7 @@ pub unsafe trait TryFromBytes {
18401840
Self: KnownLayout + IntoBytes,
18411841
{
18421842
static_assert_dst_is_not_zst!(Self);
1843-
match Ptr::from_mut(bytes).try_cast_into_no_leftover::<Self, BecauseExclusive>(None) {
1843+
match Ptr::from_mut(bytes).try_cast_into_no_leftover(None) {
18441844
Ok(source) => {
18451845
// This call may panic. If that happens, it doesn't cause any soundness
18461846
// issues, as we have not generated any invalid state which we need to
@@ -1852,9 +1852,7 @@ pub unsafe trait TryFromBytes {
18521852
// condition will not happen.
18531853
match source.try_into_valid() {
18541854
Ok(source) => Ok(source.as_mut()),
1855-
Err(e) => {
1856-
Err(e.map_src(|src| src.as_bytes::<BecauseExclusive>().as_mut()).into())
1857-
}
1855+
Err(e) => Err(e.map_src(|src| src.as_bytes().as_mut()).into()),
18581856
}
18591857
}
18601858
Err(e) => Err(e.map_src(Ptr::as_mut).into()),
@@ -2421,8 +2419,7 @@ pub unsafe trait TryFromBytes {
24212419
where
24222420
Self: KnownLayout<PointerMetadata = usize> + IntoBytes,
24232421
{
2424-
match Ptr::from_mut(source).try_cast_into_no_leftover::<Self, BecauseExclusive>(Some(count))
2425-
{
2422+
match Ptr::from_mut(source).try_cast_into_no_leftover(Some(count)) {
24262423
Ok(source) => {
24272424
// This call may panic. If that happens, it doesn't cause any soundness
24282425
// issues, as we have not generated any invalid state which we need to
@@ -2434,9 +2431,7 @@ pub unsafe trait TryFromBytes {
24342431
// condition will not happen.
24352432
match source.try_into_valid() {
24362433
Ok(source) => Ok(source.as_mut()),
2437-
Err(e) => {
2438-
Err(e.map_src(|src| src.as_bytes::<BecauseExclusive>().as_mut()).into())
2439-
}
2434+
Err(e) => Err(e.map_src(|src| src.as_bytes().as_mut()).into()),
24402435
}
24412436
}
24422437
Err(e) => Err(e.map_src(Ptr::as_mut).into()),
@@ -2844,7 +2839,7 @@ fn try_mut_from_prefix_suffix<T: IntoBytes + TryFromBytes + KnownLayout + ?Sized
28442839
cast_type: CastType,
28452840
meta: Option<T::PointerMetadata>,
28462841
) -> Result<(&mut T, &mut [u8]), TryCastError<&mut [u8], T>> {
2847-
match Ptr::from_mut(candidate).try_cast_into::<T, BecauseExclusive>(cast_type, meta) {
2842+
match Ptr::from_mut(candidate).try_cast_into(cast_type, meta) {
28482843
Ok((candidate, prefix_suffix)) => {
28492844
// This call may panic. If that happens, it doesn't cause any soundness
28502845
// issues, as we have not generated any invalid state which we need to
@@ -2856,7 +2851,7 @@ fn try_mut_from_prefix_suffix<T: IntoBytes + TryFromBytes + KnownLayout + ?Sized
28562851
// condition will not happen.
28572852
match candidate.try_into_valid() {
28582853
Ok(valid) => Ok((valid.as_mut(), prefix_suffix.as_mut())),
2859-
Err(e) => Err(e.map_src(|src| src.as_bytes::<BecauseExclusive>().as_mut()).into()),
2854+
Err(e) => Err(e.map_src(|src| src.as_bytes().as_mut()).into()),
28602855
}
28612856
}
28622857
Err(e) => Err(e.map_src(Ptr::as_mut).into()),
@@ -3835,8 +3830,8 @@ pub unsafe trait FromBytes: FromZeros {
38353830
Self: IntoBytes + KnownLayout,
38363831
{
38373832
static_assert_dst_is_not_zst!(Self);
3838-
match Ptr::from_mut(source).try_cast_into_no_leftover::<_, BecauseExclusive>(None) {
3839-
Ok(ptr) => Ok(ptr.recall_validity::<_, (_, (_, _))>().as_mut()),
3833+
match Ptr::from_mut(source).try_cast_into_no_leftover(None) {
3834+
Ok(ptr) => Ok(ptr.recall_validity::<_, BecauseBidirectional>().as_mut()),
38403835
Err(err) => Err(err.map_src(|src| src.as_mut())),
38413836
}
38423837
}
@@ -4304,11 +4299,9 @@ pub unsafe trait FromBytes: FromZeros {
43044299
Self: IntoBytes + KnownLayout<PointerMetadata = usize> + Immutable,
43054300
{
43064301
let source = Ptr::from_mut(source);
4307-
let maybe_slf = source.try_cast_into_no_leftover::<_, BecauseImmutable>(Some(count));
4302+
let maybe_slf = source.try_cast_into_no_leftover(Some(count));
43084303
match maybe_slf {
4309-
Ok(slf) => Ok(slf
4310-
.recall_validity::<_, (_, (_, (BecauseExclusive, BecauseExclusive)))>()
4311-
.as_mut()),
4304+
Ok(slf) => Ok(slf.recall_validity::<_, BecauseBidirectional>().as_mut()),
43124305
Err(err) => Err(err.map_src(|s| s.as_mut())),
43134306
}
43144307
}
@@ -4665,7 +4658,7 @@ pub unsafe trait FromBytes: FromZeros {
46654658
// cannot be violated even though `buf` may have more permissive bit
46664659
// validity than `ptr`.
46674660
let ptr = unsafe { ptr.assume_validity::<invariant::Initialized>() };
4668-
let ptr = ptr.as_bytes::<BecauseExclusive>();
4661+
let ptr = ptr.as_bytes();
46694662
src.read_exact(ptr.as_mut())?;
46704663
// SAFETY: `buf` entirely consists of initialized bytes, and `Self` is
46714664
// `FromBytes`.
@@ -4784,9 +4777,9 @@ fn mut_from_prefix_suffix<T: FromBytes + IntoBytes + KnownLayout + ?Sized>(
47844777
cast_type: CastType,
47854778
) -> Result<(&mut T, &mut [u8]), CastError<&mut [u8], T>> {
47864779
let (slf, prefix_suffix) = Ptr::from_mut(source)
4787-
.try_cast_into::<_, BecauseExclusive>(cast_type, meta)
4780+
.try_cast_into(cast_type, meta)
47884781
.map_err(|err| err.map_src(|s| s.as_mut()))?;
4789-
Ok((slf.recall_validity::<_, (_, (_, _))>().as_mut(), prefix_suffix.as_mut()))
4782+
Ok((slf.recall_validity::<_, BecauseBidirectional>().as_mut(), prefix_suffix.as_mut()))
47904783
}
47914784

47924785
/// Analyzes whether a type is [`IntoBytes`].

‎src/pointer/inner.rs‎

Lines changed: 24 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,9 @@ mod _def {
8989
/// Rust allocation, `A`.
9090
/// 1. If `ptr`'s referent is not zero sized, `A` is guaranteed to live
9191
/// for at least `'a`.
92-
pub(crate) const unsafe fn new(ptr: NonNull<T>) -> PtrInner<'a, T> {
92+
#[inline(always)]
93+
#[must_use]
94+
pub const unsafe fn new(ptr: NonNull<T>) -> PtrInner<'a, T> {
9395
// SAFETY: The caller has promised to satisfy all safety invariants
9496
// of `PtrInner`.
9597
Self { ptr, _marker: PhantomData }
@@ -160,6 +162,27 @@ impl<'a, T: ?Sized> PtrInner<'a, T> {
160162
// single allocated object.
161163
unsafe { Self::new(ptr) }
162164
}
165+
166+
#[must_use]
167+
#[inline(always)]
168+
pub fn cast_sized<U>(self) -> PtrInner<'a, U>
169+
where
170+
T: Sized,
171+
{
172+
static_assert!(T, U => size_of::<T>() >= size_of::<U>());
173+
let ptr = self.as_non_null().cast::<U>();
174+
175+
// SAFETY: By the preceding assert, `U` is no larger than `T`. Thus,
176+
// `ptr` addresses a subset of the bytes addressed by `self`.
177+
//
178+
// 0. By invariant on `self`, if `self`'s referent is not zero sized,
179+
// then `self` has valid provenance for its referent, which is
180+
// entirely contained in some Rust allocation, `A`. Thus, the same
181+
// holds of `ptr`.
182+
// 1. By invariant on `self`, if `self`'s referent is not zero sized,
183+
// then `A` is guaranteed to live for at least `'a`.
184+
unsafe { PtrInner::new(ptr) }
185+
}
163186
}
164187

165188
#[allow(clippy::needless_lifetimes)]

‎src/pointer/mod.rs‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ mod transmute;
1818
pub use {inner::PtrInner, transmute::*};
1919
#[doc(hidden)]
2020
pub use {
21-
invariant::{BecauseExclusive, BecauseImmutable, Read},
21+
invariant::{BecauseExclusive, Read},
2222
ptr::Ptr,
2323
};
2424

@@ -30,11 +30,11 @@ pub type Maybe<'a, T, Aliasing = invariant::Shared, Alignment = invariant::Unali
3030
Ptr<'a, T, (Aliasing, Alignment, invariant::Initialized)>;
3131

3232
/// Checks if the referent is zeroed.
33-
pub(crate) fn is_zeroed<T, I>(ptr: Ptr<'_, T, I>) -> bool
33+
pub(crate) fn is_zeroed<T, I>(mut ptr: Ptr<'_, T, I>) -> bool
3434
where
3535
T: crate::Immutable + crate::KnownLayout,
3636
I: invariant::Invariants<Validity = invariant::Initialized>,
3737
I::Aliasing: invariant::Reference,
3838
{
39-
ptr.as_bytes::<BecauseImmutable>().as_ref().iter().all(|&byte| byte == 0)
39+
ptr.reborrow().into_shared().as_bytes().as_ref().iter().all(|&byte| byte == 0)
4040
}

0 commit comments

Comments
 (0)