make more slice mutable ref getters rustc_no_writable#157816
Conversation
* add #[rustc_no_writable] to slice::get_unchecked_mut * add #[rustc_no_writable] to slice::get_mut * add unchecked_mut miri test
|
cc @rust-lang/miri |
rustbot
added
S-waiting-on-review
|
r? @clarfonthey rustbot has assigned @clarfonthey. Use Why was this reviewer chosen?The reviewer was selected based on:
|
| @@ -185,6 +226,7 @@ const unsafe impl<T> SliceIndex<[T]> for usize { | |||
| } | |||
|
|
|||
| #[inline] | |||
| #[rustc_no_writable] | |||
There was a problem hiding this comment.
It'd be nice if we could just add the attribute to the trait rather than each impl... but I am not sure how to implement that and it is not the usual behavior for such attributes.
There was a problem hiding this comment.
How exactly would that work? Just apply to the abstract method and then assume each implementation should have it applied?
That feels kind of unprecedented, since even attributes like #[inline] don't support that.
There was a problem hiding this comment.
I think it makes sense because of the conceptual alignment between what SliceIndex is for and what the attribute is trying to express.
I think #[track_caller] can work like this, based on what I see in should_inherit_track_caller in the compiler.
There was a problem hiding this comment.
Huh, I had no idea you were able to use #[track_caller] in that way, and it turns out you're right: https://play.rust-lang.org/?version=stable&mode=debug&edition=2024&gist=c726a3e5c00af55c75daaa67bf6533fc
Semantically, it makes sense, just, I had no idea that we had precedent for this.
There was a problem hiding this comment.
After catching up on the semantics of this attribute, at least from my understanding, the presence or absence of this attribute is always safe?
We don't really distinguish unsafe attributes (to my knowledge) for internal attributes, at least at the moment, but I guess the main issue with such a thing is if it would have noticeable effects that the method implementations would have to account for, e.g., such that those implementations would be best marked as unsafe or similar.
I guess this technically doesn't matter in this particular review, just trying to grasp a bit better how this would affect methods like this. I'm not sure if this necessarily changes any compiler semantics besides emitting an LLVM flag, e.g., if a future borrow checker would take this attribute into account.
There was a problem hiding this comment.
The attribute affects whether code has UB, but on its own (i.e. in otherwise safe code) the presence or absence of the attribute can never cause UB. Furthermore, adding the attribute can never introduce UB to a program, but removing the attribute can introduce UB if surrounding unsafe code relied on the presence of the attribute. By default, our codegen backend entirely ignores the attribute; it takes a -Z flag (or Miri) for the attribute to do anything.
This is not meant to be taken into account by a borrow checker, just by LLVM and Miri. For now, it is just an experiment. If the experiment goes well, we could consider a more proper (e.g. type-based) solution.
|
@rustbot blocked (since this is explicitly blocked) |
rustbot
added
S-blocked
5 participants
This makes https://rust.godbolt.org/z/TreEYqfW8 work.
Based on and blocked on #157202
Cc @quiode @JoJoDeveloping