Document soundness of Integer -> Pointer -> Integer conversions in const contexts.

[onestacked]

see this zulip thread

r? @RalfJung

With this slice Iterator's should be able to be made const once the const Trait reimplementation is done.

[RalfJung]

LGTM. However, I think we need the lang team to bless this. Nominating for their discussion.
Cc @rust-lang/wg-const-eval @rust-lang/lang

[onestacked]

@RalfJung Are there any const operations that can be done on the pointer (between the transmutes) that would make this unsound?
I can't think of any, but maybe it would be good to restrict this in some way for now.

[RalfJung]

No, in const you can never turn an integer value into a pointer value.

[joshtriplett]

@rfcbot merge

@scottmcm has a suggestion/concern he's going to raise, but since we know this needs an FCP I'm going ahead and starting one.

[rfcbot]

Team member @joshtriplett has proposed to merge this. The next step is review by the rest of the tagged team members:

• @joshtriplett
• @nikomatsakis
• @pnkfelix
• @scottmcm
• @tmandry

Concerns:

• concept-vs-method resolved by Document soundness of Integer -> Pointer -> Integer conversions in const contexts. #113510 (comment)

Once a majority of reviewers approve (and at most 2 approvals are outstanding), this will enter its final comment period. If you spot a major issue that hasn't been raised at any point in this process, please speak up!

cc @rust-lang/lang-advisors: FCP proposed for lang, please feel free to register concerns.
See this document for info about what commands tagged team members can give me.

[scottmcm]

Absolutely in favour in the abstract 👍

I do think, though, that we want it to be able to general idea of transmuting, rather than limiting the text to allowing it only via mem::transmute and ptr::invalid. (For example, mem::transmute_copy feels like it ought not to be UB.)

I've proposed some alternative text above to kick of discussion about the best way to phrase such a guarantee.
@rfcbot concern concept-vs-method

@rfcbot reviewed

[scottmcm]

@rfcbot resolve concept-vs-method

Though, other folks, please review the text to ensure it's still something with which you're ok.

[rfcbot]

🔔 This is now entering its final comment period, as per the review above. 🔔

[RalfJung]

Suggested change

	/// Transmuting pointers *to* integers in a `const` context is [undefined behavior][ub],
	/// unless the pointer was originally created by transmuting *from* an integer.
	/// (That includes this function specifically and helpers like [`invalid`][crate::ptr::invalid],
	/// but also semantically-equivalent conversions such as punning through `repr(C)` union fields.)
	/// Transmuting pointers *to* integers in a `const` context is [undefined behavior][ub],
	/// unless the pointer was originally created *from* an integer.
	/// (The pointer can be created from an integer via integer-to-pointer casts, helpers like [`invalid`][crate::ptr::invalid],
	/// this function, or semantically-equivalent conversions such as punning through `repr(C)` union fields.)

We don't want to say that invalid is a transmute. We just want to say that transmute(ptr::invalid(N)): *mut T is allowed, as is transmute(Nusize): *mut T.

[RalfJung]

Wait, does "that includes" refer to "created by" or to "transmuting to"? It must be "created by" as otherwise invalid can't be in the list, but then this doesn't cover union field punning from invalid to an integer.

IMO this section shouldn't talk specifically about that anyway, that should fall out of the general principle that transmute and union field punning are equivalent.

[onestacked]

Maybe I should mention only [invalid][crate::ptr::invalid] explicitly?

Something like:

unless the pointer was originally converted *from* an integer.
(for example with this function or [`invalid`][crate::ptr::invalid])

[RalfJung]

I'm pretty sure we want to allow transmuting 16 as *const u8 back to an integer. There is really no reason not to.

[onestacked]

I would say that is converted from and integer and therefore allowed.
Not sure how to write a concise description that makes it clear all the possibilities for this conversion are allowed.

[RalfJung]

The parenthetical explains what it means to convert from an integer. So then if you think casting is converting from an integer, it should be listed. :)

[onestacked]

Applied @RalfJung's suggestions.

[scottmcm]

(Re-nominated to encourage discussion of the exact text on Tuesday.)

[rfcbot]

The final comment period, with a disposition to merge, as per the review above, is now complete.

As the automated representative of the governance process, I would like to thank the author for their work and everyone else who contributed.

This will be merged soon.

[RalfJung]

Oh, sorry, I didn't realize this was assigned to me...

@bors r+ rollup

[bors]

📌 Commit dc4e026 has been approved by RalfJung

It is now in the queue for this repository.