Compute transmutability from `rustc_target::abi::Layout`
In its first step of computing transmutability, `rustc_transmutability`
constructs a byte-level representation of type layout (`Tree`). Previously, this
representation was computed for ADTs by inspecting the ADT definition and
performing our own layout computations. This process was error-prone, verbose,
and limited our ability to analyze many types (particularly default-repr types).
In this PR, we instead construct `Tree`s from `rustc_target::abi::Layout`s. This
helps ensure that layout optimizations are reflected our analyses, and increases
the kinds of types we can now analyze, including:
- default repr ADTs
- transparent unions
- `UnsafeCell`-containing types
Overall, this PR expands the expressvity of `rustc_transmutability` to be much
closer to the transmutability analysis performed by miri. Future PRs will work
to close the remaining gaps (e.g., support for `Box`, raw pointers, `NonZero*`,
coroutines, etc.).
2024-03-19 09:49:13 -05:00
|
|
|
#![crate_type = "lib"]
|
|
|
|
#![feature(transmutability)]
|
|
|
|
#![allow(dead_code, incomplete_features, non_camel_case_types)]
|
|
|
|
|
|
|
|
use std::cell::UnsafeCell;
|
|
|
|
|
|
|
|
mod assert {
|
2024-08-27 09:05:54 -05:00
|
|
|
use std::mem::{Assume, TransmuteFrom};
|
Compute transmutability from `rustc_target::abi::Layout`
In its first step of computing transmutability, `rustc_transmutability`
constructs a byte-level representation of type layout (`Tree`). Previously, this
representation was computed for ADTs by inspecting the ADT definition and
performing our own layout computations. This process was error-prone, verbose,
and limited our ability to analyze many types (particularly default-repr types).
In this PR, we instead construct `Tree`s from `rustc_target::abi::Layout`s. This
helps ensure that layout optimizations are reflected our analyses, and increases
the kinds of types we can now analyze, including:
- default repr ADTs
- transparent unions
- `UnsafeCell`-containing types
Overall, this PR expands the expressvity of `rustc_transmutability` to be much
closer to the transmutability analysis performed by miri. Future PRs will work
to close the remaining gaps (e.g., support for `Box`, raw pointers, `NonZero*`,
coroutines, etc.).
2024-03-19 09:49:13 -05:00
|
|
|
|
|
|
|
pub fn is_maybe_transmutable<Src, Dst>()
|
|
|
|
where
|
2024-08-27 09:05:54 -05:00
|
|
|
Dst: TransmuteFrom<Src, { Assume::SAFETY }>
|
Compute transmutability from `rustc_target::abi::Layout`
In its first step of computing transmutability, `rustc_transmutability`
constructs a byte-level representation of type layout (`Tree`). Previously, this
representation was computed for ADTs by inspecting the ADT definition and
performing our own layout computations. This process was error-prone, verbose,
and limited our ability to analyze many types (particularly default-repr types).
In this PR, we instead construct `Tree`s from `rustc_target::abi::Layout`s. This
helps ensure that layout optimizations are reflected our analyses, and increases
the kinds of types we can now analyze, including:
- default repr ADTs
- transparent unions
- `UnsafeCell`-containing types
Overall, this PR expands the expressvity of `rustc_transmutability` to be much
closer to the transmutability analysis performed by miri. Future PRs will work
to close the remaining gaps (e.g., support for `Box`, raw pointers, `NonZero*`,
coroutines, etc.).
2024-03-19 09:49:13 -05:00
|
|
|
{}
|
|
|
|
}
|
|
|
|
|
|
|
|
fn value_to_value() {
|
|
|
|
// We accept value-to-value transmutations of `UnsafeCell`-containing types,
|
|
|
|
// because owning a value implies exclusive access.
|
|
|
|
assert::is_maybe_transmutable::<UnsafeCell<u8>, u8>();
|
|
|
|
assert::is_maybe_transmutable::<u8, UnsafeCell<u8>>();
|
|
|
|
assert::is_maybe_transmutable::<UnsafeCell<u8>, UnsafeCell<u8>>();
|
|
|
|
}
|
|
|
|
|
|
|
|
fn ref_to_ref() {
|
|
|
|
// We forbid `UnsafeCell`-containing ref-to-ref transmutations, because the
|
|
|
|
// two types may use different, incompatible synchronization strategies.
|
|
|
|
assert::is_maybe_transmutable::<&'static u8, &'static UnsafeCell<u8>>(); //~ ERROR: cannot be safely transmuted
|
|
|
|
|
|
|
|
assert::is_maybe_transmutable::<&'static UnsafeCell<u8>, &'static UnsafeCell<u8>>(); //~ ERROR: cannot be safely transmuted
|
|
|
|
}
|
|
|
|
|
|
|
|
fn mut_to_mut() {
|
|
|
|
// `UnsafeCell` does't matter for `&mut T` to `&mut U`, since exclusive
|
|
|
|
// borrows can't be used for shared access.
|
|
|
|
assert::is_maybe_transmutable::<&'static mut u8, &'static mut UnsafeCell<u8>>();
|
|
|
|
assert::is_maybe_transmutable::<&'static mut UnsafeCell<u8>, &'static mut u8>();
|
|
|
|
assert::is_maybe_transmutable::<&'static mut UnsafeCell<u8>, &'static mut UnsafeCell<u8>>();
|
|
|
|
}
|
|
|
|
|
|
|
|
fn mut_to_ref() {
|
|
|
|
// We don't care about `UnsafeCell` for transmutations in the form `&mut T
|
|
|
|
// -> &U`, because downgrading a `&mut T` to a `&U` deactivates `&mut T` for
|
|
|
|
// the lifetime of `&U`.
|
|
|
|
assert::is_maybe_transmutable::<&'static mut u8, &'static UnsafeCell<u8>>();
|
|
|
|
assert::is_maybe_transmutable::<&'static mut UnsafeCell<u8>, &'static u8>();
|
|
|
|
assert::is_maybe_transmutable::<&'static mut UnsafeCell<u8>, &'static UnsafeCell<u8>>();
|
|
|
|
}
|