|
69 | 69 | //!
|
70 | 70 | //! * It must be "dereferenceable" in the sense defined above.
|
71 | 71 | //!
|
72 |
| -//! * The pointer must point to a valid instance of `T`. |
| 72 | +//! * The pointer must point to a valid value of type `T`. |
73 | 73 | //! This means that the created reference can only refer to
|
74 |
| -//! uninitialized memory through careful use of `MaybeUninit`. |
| 74 | +//! uninitialized memory through careful use of `MaybeUninit`, |
| 75 | +//! or if the uninitialized memory is entirly contained within |
| 76 | +//! padding bytes, since |
| 77 | +//! [padding has the same validity invariant as `MaybeUninit`][ucg-pad]. |
75 | 78 | //!
|
76 | 79 | //! * You must enforce Rust's aliasing rules, since the lifetime of the
|
77 | 80 | //! created reference is arbitrarily chosen,
|
78 | 81 | //! and does not necessarily reflect the actual lifetime of the data.
|
79 | 82 | //! In particular, while this reference exists,
|
80 | 83 | //! the memory the pointer points to must
|
81 | 84 | //! not get accessed (read or written) through any raw pointer,
|
82 |
| -//! except for data inside an `UnsafeCell` |
83 |
| -// ^ previous documentation was somewhat unclear on if modifications through |
84 |
| -// an UnsafeCell are safe even if they would seemingly violate the exclusivity |
85 |
| -// of a mut ref. |
| 85 | +//! except for data inside an `UnsafeCell`. |
| 86 | +//! Note that aliased writes are always UB for mutable references, |
| 87 | +//! even if they only modify `UnsafeCell` data. |
86 | 88 | //!
|
87 | 89 | //! If a pointer follows all of these rules, it is said to be
|
88 | 90 | //! *convertable to a reference*.
|
|
98 | 100 | //! An example of the implications of the above rules is that an expression such
|
99 | 101 | //! as `unsafe { &*(0 as *const u8) }` is Immediate Undefined Behavior.
|
100 | 102 | //!
|
| 103 | +//! [ucgpad]: https://rust-lang.github.io/unsafe-code-guidelines/glossary.html#padding |
| 104 | +//! |
101 | 105 | //! ## Allocated object
|
102 | 106 | //!
|
103 | 107 | //! An *allocated object* is a subset of program memory which is addressable
|
|
0 commit comments