Check Pin guarantees at runtime

[Aaron1011]

Miri should be able to check that the guarantees of Pin are upheld at runtime. AFAICT, all of the requirements for Pin::new_unchecked and for pin projections boil down to the same thing: ensuring that the pinned memory is never deallocated/invalidated until after Drop is called.

This should be fairly straightforward to implement - we can add a pinned flag to AllocExtra, and add special handling for the Pin type. Fortunately, Pin is a lang item, so this won't require hard-coding a path.

[RalfJung]

I disagree with the statement that this is possible or even straightforward. The pin guarantees are not guarantees of the language, they are guarantees of a library. Miri will detect UB caused by violating Pin guarantees, but operationally, it is not possible to detect violations of the pinning API.

[RalfJung]

@Aaron1011 could you describe what concretely you think Miri could do operationally to help detect pinning violations?

[bjorn3]

Maybe add an intrinsic to mark memory as pinned, which is called in the Pin constructor, and then check that a move doesnt have pinned memory as source?

[RalfJung]

"move" is a type system concept, it is not an operation in Miri. Something like memcpy is, but that can happen even for pinned stuff. E.g., in a pinned generator there might be an i32 field that gets copied around.

[RalfJung]

Closing this as (a) Miri is meant to be an implementation of the Rust Abstract Machine spec, and that spec does not know about Pin, and (b) I am not sure what it even is that we could be checking here.