Skip to content

Guarantee that it is sound to observe the bytes of None::<P> where P is a pointer type subject to NPO #117591

Closed
#137323
joshlf/rust
#1
Closed
Guarantee that it is sound to observe the bytes of None::<P> where P is a pointer type subject to NPO#117591
#137323
joshlf/rust
#1
Labels
A-docsArea: Documentation for any part of the project, including the compiler, standard library, and toolsT-langRelevant to the language teamT-opsemRelevant to the opsem team

Description

@joshlf
joshlf
opened on Nov 4, 2023

In #115333, we added a guarantee that transmuting from [0u8; N] to Option<P> is sound where P is a pointer type subject to the null pointer optimization (NPO). It would be useful to be able to guarantee the inverse - that if all of the bytes of P are initialized, then all of the bytes of None::<P> (and thus all of the bytes of any Option<P>) are initialized. For example, this would allow zerocopy to support safe transmutation from Option<P> to [u8; N] (google/zerocopy#596).

I'm opening this issue first rather than a PR so there's an opportunity to discuss whether this is something we want, how it would be best to document it, etc.

Activity

  1. rustbot
    added
    needs-triageThis issue may need triage. Remove when done. See docs forge.rust-lang.org/release/issue-triaging
    on Nov 4, 2023
  2. saethlin
    added
    A-docsArea: Documentation for any part of the project, including the compiler, standard library, and tools
    T-opsemRelevant to the opsem team
    T-langRelevant to the language team
    and removed
    needs-triageThis issue may need triage. Remove when done. See docs forge.rust-lang.org/release/issue-triaging
    on Nov 4, 2023

  3. RalfJung commented on Feb 20, 2025

    @RalfJung
    RalfJung
    on Feb 20, 2025
    Member

    Cc @rust-lang/opsem

    For thin pointer this seems perfectly fine, I am just not sure where to best document it.

    I think for wide pointers, this is actually not true today (and seems unlikely to ever be true) -- the discriminant will be stored in one of the two "fields" of the pointer, which means that for None the other field is padding.

  4. joshlf commented on Feb 20, 2025

    @joshlf
    joshlf
    on Feb 20, 2025
    ContributorAuthor

    Sounds good. Put up a PR to guarantee this for thin pointers: #137323

  5. RalfJung commented on Feb 21, 2025

    @RalfJung
    RalfJung
    on Feb 21, 2025
    Member

    In #115333, we added a guarantee that transmuting from [u8; N] to Option<P> is sound where P is a pointer type subject to the null pointer optimization (NPO).

    No that's not what that PR did? It just talks specifically about transmuting [0u8; N], not arbitrary arrays of that type.

    And similarly, looking at what you did in the new PR, it doesn't seem to match the issue description. The PR only guarantees that None::<P> can be transmuted to a u8 array and will yield a bunch of 0u8; it doesn't talk about e.g. transmuting Some(Box::new(i32)). That would be a ptr-to-int transmute so it is anyway tangled up in rust-lang/unsafe-code-guidelines#547.

  6. joshlf commented on Mar 5, 2025

    @joshlf
    joshlf
    on Mar 5, 2025
    ContributorAuthor

    In #115333, we added a guarantee that transmuting from [u8; N] to Option<P> is sound where P is a pointer type subject to the null pointer optimization (NPO).

    No that's not what that PR did? It just talks specifically about transmuting [0u8; N], not arbitrary arrays of that type.

    Good point; updated the issue text.

    And similarly, looking at what you did in the new PR, it doesn't seem to match the issue description. The PR only guarantees that None::<P> can be transmuted to a u8 array and will yield a bunch of 0u8; it doesn't talk about e.g. transmuting Some(Box::new(i32)). That would be a ptr-to-int transmute so it is anyway tangled up in rust-lang/unsafe-code-guidelines#547.

    Yeah, I realized the ptr-to-int issue and decided to stick with the more limited (and hopefully less controversial) None case.

  7. matthiaskrgr
    added a commit that references this issue on May 24, 2025

    Rollup merge of rust-lang#137323 - joshlf:transmute-npo, r=RalfJung

    334d7bd
  8. bors
    closed this as completedin 334d7bdon May 24, 2025
  9. rust-timer
    added a commit that references this issue on May 24, 2025

    Unrolled build for #137323

    3466762
  10. github-actions
    added a commit that references this issue on May 26, 2025

    Rollup merge of rust-lang#137323 - joshlf:transmute-npo, r=RalfJung

    e4f7384
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    A-docsArea: Documentation for any part of the project, including the compiler, standard library, and toolsT-langRelevant to the language teamT-opsemRelevant to the opsem team

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions