Contracts and harnesses for dangling, from_raw_parts, slice_from_raw_parts, to_raw_parts in NonNull
#127
+125
−0
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…/danielhumanmod/verify-rust-std into olivia/pointer_creation_and_init
zhassan-aws
reviewed
Nov 11, 2024
| #[kani::proof_for_contract(NonNull::from_raw_parts)] | ||
| pub fn non_null_check_from_raw_parts() { | ||
|
|
||
| const arr_len: usize = 100; |
There was a problem hiding this comment.
The names of consts should be upper case (see https://doc.rust-lang.org/1.0.0/style/style/naming/README.html).
| #[kani::proof_for_contract(NonNull::slice_from_raw_parts)] | ||
| #[kani::unwind(11)] | ||
| pub fn non_null_check_slice_from_raw_parts() { | ||
| const arr_len: usize = 10; |
| #[stable(feature = "nonnull_slice_from_raw_parts", since = "1.70.0")] | ||
| #[rustc_const_stable(feature = "const_slice_from_raw_parts_mut", since = "1.83.0")] | ||
| #[must_use] | ||
| #[inline] | ||
| #[requires(data.pointer.is_aligned() | ||
| && len as isize * core::mem::size_of::<T>() as isize <= isize::MAX |
There was a problem hiding this comment.
Isn't this subsumed by the next conjunct?
| && len as isize * core::mem::size_of::<T>() as isize <= isize::MAX | ||
| && (len as isize).checked_mul(core::mem::size_of::<T>() as isize).is_some() | ||
| && (data.pointer as isize).checked_add(len as isize * core::mem::size_of::<T>() as isize).is_some() // adding len must not “wrap around” the address space | ||
| && unsafe { kani::mem::same_allocation(data.pointer, data.pointer.add(len)) })] |
There was a problem hiding this comment.
Another safety requirement is that data must be valid for reads. This can be specified using can_dereference.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Towards #53
Contracts and harnesses for
dangling,from_raw_parts,slice_from_raw_parts,to_raw_partsin NonNullDiscussion
NonNull::slice_from_raw_parts: requested new Kani API to compare byte by byteNonNull::to_raw_parts: unstable vtable comparison 'Eq'Verification Result
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 and MIT licenses.