Skip to content

Commit 50d9d62

Browse files
authored
Strengthen soundness proof for size_of_val_raw (#1574)
Previously, we needed to rely on the fact that the instance of any valid Rust type with 0 elements has a size (in number of bytes) which is not greater than `isize::MAX`. Providing this as a guarantee turned out to be controversial. [1] This was made possible by rust-lang/rust#126152. [1] rust-lang/unsafe-code-guidelines#465 (comment)
1 parent a51d64f commit 50d9d62

File tree

1 file changed

+7
-10
lines changed

1 file changed

+7
-10
lines changed

Diff for: src/macro_util.rs

+7-10
Original file line numberDiff line numberDiff line change
@@ -132,7 +132,8 @@ macro_rules! trailing_field_offset {
132132
let min_size = {
133133
let zero_elems: *const [()] =
134134
$crate::macro_util::core_reexport::ptr::slice_from_raw_parts(
135-
#[allow(clippy::incompatible_msrv)] // Work around https://github.com/rust-lang/rust-clippy/issues/12280
135+
// Work around https://github.com/rust-lang/rust-clippy/issues/12280
136+
#[allow(clippy::incompatible_msrv)]
136137
$crate::macro_util::core_reexport::ptr::NonNull::<()>::dangling()
137138
.as_ptr()
138139
.cast_const(),
@@ -144,16 +145,12 @@ macro_rules! trailing_field_offset {
144145
// - If `$ty` is not a slice DST, this pointer conversion will
145146
// fail due to "mismatched vtable kinds", and compilation will
146147
// fail.
147-
// - If `$ty` is a slice DST, the safety requirement is that "the
148-
// length of the slice tail must be an initialized integer, and
149-
// the size of the entire value (dynamic tail length +
150-
// statically sized prefix) must fit in isize." The length is
151-
// initialized to 0 above, and Rust guarantees that no type's
152-
// minimum size may overflow `isize`. [1]
148+
// - If `$ty` is a slice DST, we have constructed `zero_elems` to
149+
// have zero trailing slice elements. Per the `size_of_val_raw`
150+
// docs, "For the special case where the dynamic tail length is
151+
// 0, this function is safe to call." [1]
153152
//
154-
// [1] TODO(#429),
155-
// TODO(https://github.com/rust-lang/unsafe-code-guidelines/issues/465#issuecomment-1782206516):
156-
// Citation for this?
153+
// [1] https://doc.rust-lang.org/nightly/std/mem/fn.size_of_val_raw.html
157154
unsafe {
158155
#[allow(clippy::as_conversions)]
159156
$crate::macro_util::core_reexport::mem::size_of_val_raw(zero_elems as *const $ty)

0 commit comments

Comments
 (0)