Skip to content

Commit 987ef4c

Browse files
committed
move assert_unsafe_preconditions to its own file
These macros and functions are not intrinsics, after all.
1 parent d6eb0f5 commit 987ef4c

File tree

17 files changed

+184
-177
lines changed

17 files changed

+184
-177
lines changed

compiler/rustc_codegen_cranelift/src/base.rs

+1-1
Original file line numberDiff line numberDiff line change
@@ -780,7 +780,7 @@ fn codegen_stmt<'tcx>(
780780
NullOp::OffsetOf(fields) => {
781781
layout.offset_of_subfield(fx, fields.iter()).bytes()
782782
}
783-
NullOp::UbCheck(_) => {
783+
NullOp::UbChecks => {
784784
let val = fx.tcx.sess.opts.debug_assertions;
785785
let val = CValue::by_val(
786786
fx.bcx.ins().iconst(types::I8, i64::try_from(val).unwrap()),

library/core/src/char/convert.rs

+1-1
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,9 @@ use crate::char::TryFromCharError;
44
use crate::convert::TryFrom;
55
use crate::error::Error;
66
use crate::fmt;
7-
use crate::intrinsics::assert_unsafe_precondition;
87
use crate::mem::transmute;
98
use crate::str::FromStr;
9+
use crate::ub_checks::assert_unsafe_precondition;
1010

1111
/// Converts a `u32` to a `char`. See [`char::from_u32`].
1212
#[must_use]

library/core/src/hint.rs

+3-2
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44
//! Hints may be compile time or runtime.
55
66
use crate::intrinsics;
7+
use crate::ub_checks;
78

89
/// Informs the compiler that the site which is calling this function is not
910
/// reachable, possibly enabling further optimizations.
@@ -98,7 +99,7 @@ use crate::intrinsics;
9899
#[rustc_const_stable(feature = "const_unreachable_unchecked", since = "1.57.0")]
99100
#[cfg_attr(miri, track_caller)] // even without panics, this helps for Miri backtraces
100101
pub const unsafe fn unreachable_unchecked() -> ! {
101-
intrinsics::assert_unsafe_precondition!(
102+
ub_checks::assert_unsafe_precondition!(
102103
check_language_ub,
103104
"hint::unreachable_unchecked must never be reached",
104105
() => false
@@ -148,7 +149,7 @@ pub const unsafe fn unreachable_unchecked() -> ! {
148149
pub const unsafe fn assert_unchecked(cond: bool) {
149150
// SAFETY: The caller promised `cond` is true.
150151
unsafe {
151-
intrinsics::assert_unsafe_precondition!(
152+
ub_checks::assert_unsafe_precondition!(
152153
check_language_ub,
153154
"hint::assert_unchecked must never be called when the condition is false",
154155
(cond: bool = cond) => cond,

library/core/src/intrinsics.rs

+10-135
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,7 @@ use crate::marker::DiscriminantKind;
6767
use crate::marker::Tuple;
6868
use crate::mem::align_of;
6969
use crate::ptr;
70+
use crate::ub_checks;
7071

7172
pub mod mir;
7273
pub mod simd;
@@ -2755,132 +2756,6 @@ pub unsafe fn vtable_align(_ptr: *const ()) -> usize {
27552756
// (`transmute` also falls into this category, but it cannot be wrapped due to the
27562757
// check that `T` and `U` have the same size.)
27572758

2758-
/// Check that the preconditions of an unsafe function are followed. The check is enabled at
2759-
/// runtime if debug assertions are enabled when the caller is monomorphized. In const-eval/Miri
2760-
/// checks implemented with this macro for language UB are always ignored.
2761-
///
2762-
/// This macro should be called as
2763-
/// `assert_unsafe_precondition!(check_{library,lang}_ub, "message", (ident: type = expr, ident: type = expr) => check_expr)`
2764-
/// where each `expr` will be evaluated and passed in as function argument `ident: type`. Then all
2765-
/// those arguments are passed to a function with the body `check_expr`.
2766-
/// Pick `check_language_ub` when this is guarding a violation of language UB, i.e., immediate UB
2767-
/// according to the Rust Abstract Machine. Pick `check_library_ub` when this is guarding a violation
2768-
/// of a documented library precondition that does not *immediately* lead to language UB.
2769-
///
2770-
/// If `check_library_ub` is used but the check is actually guarding language UB, the check will
2771-
/// slow down const-eval/Miri and we'll get the panic message instead of the interpreter's nice
2772-
/// diagnostic, but our ability to detect UB is unchanged.
2773-
/// But if `check_language_ub` is used when the check is actually for library UB, the check is
2774-
/// omitted in const-eval/Miri and thus if we eventually execute language UB which relies on the
2775-
/// library UB, the backtrace Miri reports may be far removed from original cause.
2776-
///
2777-
/// These checks are behind a condition which is evaluated at codegen time, not expansion time like
2778-
/// [`debug_assert`]. This means that a standard library built with optimizations and debug
2779-
/// assertions disabled will have these checks optimized out of its monomorphizations, but if a
2780-
/// caller of the standard library has debug assertions enabled and monomorphizes an expansion of
2781-
/// this macro, that monomorphization will contain the check.
2782-
///
2783-
/// Since these checks cannot be optimized out in MIR, some care must be taken in both call and
2784-
/// implementation to mitigate their compile-time overhead. Calls to this macro always expand to
2785-
/// this structure:
2786-
/// ```ignore (pseudocode)
2787-
/// if ::core::intrinsics::check_language_ub() {
2788-
/// precondition_check(args)
2789-
/// }
2790-
/// ```
2791-
/// where `precondition_check` is monomorphic with the attributes `#[rustc_nounwind]`, `#[inline]` and
2792-
/// `#[rustc_no_mir_inline]`. This combination of attributes ensures that the actual check logic is
2793-
/// compiled only once and generates a minimal amount of IR because the check cannot be inlined in
2794-
/// MIR, but *can* be inlined and fully optimized by a codegen backend.
2795-
///
2796-
/// Callers should avoid introducing any other `let` bindings or any code outside this macro in
2797-
/// order to call it. Since the precompiled standard library is built with full debuginfo and these
2798-
/// variables cannot be optimized out in MIR, an innocent-looking `let` can produce enough
2799-
/// debuginfo to have a measurable compile-time impact on debug builds.
2800-
#[allow_internal_unstable(ub_checks)] // permit this to be called in stably-const fn
2801-
macro_rules! assert_unsafe_precondition {
2802-
($kind:ident, $message:expr, ($($name:ident:$ty:ty = $arg:expr),*$(,)?) => $e:expr $(,)?) => {
2803-
{
2804-
// This check is inlineable, but not by the MIR inliner.
2805-
// The reason for this is that the MIR inliner is in an exceptionally bad position
2806-
// to think about whether or not to inline this. In MIR, this call is gated behind `debug_assertions`,
2807-
// which will codegen to `false` in release builds. Inlining the check would be wasted work in that case and
2808-
// would be bad for compile times.
2809-
//
2810-
// LLVM on the other hand sees the constant branch, so if it's `false`, it can immediately delete it without
2811-
// inlining the check. If it's `true`, it can inline it and get significantly better performance.
2812-
#[rustc_no_mir_inline]
2813-
#[inline]
2814-
#[rustc_nounwind]
2815-
#[rustc_const_unstable(feature = "ub_checks", issue = "none")]
2816-
const fn precondition_check($($name:$ty),*) {
2817-
if !$e {
2818-
::core::panicking::panic_nounwind(
2819-
concat!("unsafe precondition(s) violated: ", $message)
2820-
);
2821-
}
2822-
}
2823-
2824-
if ::core::intrinsics::$kind() {
2825-
precondition_check($($arg,)*);
2826-
}
2827-
}
2828-
};
2829-
}
2830-
pub(crate) use assert_unsafe_precondition;
2831-
2832-
/// Checks whether `ptr` is properly aligned with respect to
2833-
/// `align_of::<T>()`.
2834-
///
2835-
/// In `const` this is approximate and can fail spuriously. It is primarily intended
2836-
/// for `assert_unsafe_precondition!` with `check_language_ub`, in which case the
2837-
/// check is anyway not executed in `const`.
2838-
#[inline]
2839-
pub(crate) const fn is_aligned_and_not_null(ptr: *const (), align: usize) -> bool {
2840-
!ptr.is_null() && ptr.is_aligned_to(align)
2841-
}
2842-
2843-
#[inline]
2844-
pub(crate) const fn is_valid_allocation_size(size: usize, len: usize) -> bool {
2845-
let max_len = if size == 0 { usize::MAX } else { isize::MAX as usize / size };
2846-
len <= max_len
2847-
}
2848-
2849-
/// Checks whether the regions of memory starting at `src` and `dst` of size
2850-
/// `count * size` do *not* overlap.
2851-
///
2852-
/// Note that in const-eval this function just returns `true` and therefore must
2853-
/// only be used with `assert_unsafe_precondition!`, similar to `is_aligned_and_not_null`.
2854-
#[inline]
2855-
pub(crate) const fn is_nonoverlapping(
2856-
src: *const (),
2857-
dst: *const (),
2858-
size: usize,
2859-
count: usize,
2860-
) -> bool {
2861-
#[inline]
2862-
fn runtime(src: *const (), dst: *const (), size: usize, count: usize) -> bool {
2863-
let src_usize = src.addr();
2864-
let dst_usize = dst.addr();
2865-
let Some(size) = size.checked_mul(count) else {
2866-
crate::panicking::panic_nounwind(
2867-
"is_nonoverlapping: `size_of::<T>() * count` overflows a usize",
2868-
)
2869-
};
2870-
let diff = src_usize.abs_diff(dst_usize);
2871-
// If the absolute distance between the ptrs is at least as big as the size of the buffer,
2872-
// they do not overlap.
2873-
diff >= size
2874-
}
2875-
2876-
#[inline]
2877-
const fn comptime(_: *const (), _: *const (), _: usize, _: usize) -> bool {
2878-
true
2879-
}
2880-
2881-
const_eval_select((src, dst, size, count), comptime, runtime)
2882-
}
2883-
28842759
/// Copies `count * size_of::<T>()` bytes from `src` to `dst`. The source
28852760
/// and destination must *not* overlap.
28862761
///
@@ -2979,7 +2854,7 @@ pub const unsafe fn copy_nonoverlapping<T>(src: *const T, dst: *mut T, count: us
29792854
pub fn copy_nonoverlapping<T>(src: *const T, dst: *mut T, count: usize);
29802855
}
29812856

2982-
assert_unsafe_precondition!(
2857+
ub_checks::assert_unsafe_precondition!(
29832858
check_language_ub,
29842859
"ptr::copy_nonoverlapping requires that both pointer arguments are aligned and non-null \
29852860
and the specified memory ranges do not overlap",
@@ -2990,9 +2865,9 @@ pub const unsafe fn copy_nonoverlapping<T>(src: *const T, dst: *mut T, count: us
29902865
align: usize = align_of::<T>(),
29912866
count: usize = count,
29922867
) =>
2993-
is_aligned_and_not_null(src, align)
2994-
&& is_aligned_and_not_null(dst, align)
2995-
&& is_nonoverlapping(src, dst, size, count)
2868+
ub_checks::is_aligned_and_not_null(src, align)
2869+
&& ub_checks::is_aligned_and_not_null(dst, align)
2870+
&& ub_checks::is_nonoverlapping(src, dst, size, count)
29962871
);
29972872

29982873
// SAFETY: the safety contract for `copy_nonoverlapping` must be
@@ -3083,7 +2958,7 @@ pub const unsafe fn copy<T>(src: *const T, dst: *mut T, count: usize) {
30832958

30842959
// SAFETY: the safety contract for `copy` must be upheld by the caller.
30852960
unsafe {
3086-
assert_unsafe_precondition!(
2961+
ub_checks::assert_unsafe_precondition!(
30872962
check_language_ub,
30882963
"ptr::copy_nonoverlapping requires that both pointer arguments are aligned and non-null \
30892964
and the specified memory ranges do not overlap",
@@ -3092,8 +2967,8 @@ pub const unsafe fn copy<T>(src: *const T, dst: *mut T, count: usize) {
30922967
dst: *mut () = dst as *mut (),
30932968
align: usize = align_of::<T>(),
30942969
) =>
3095-
is_aligned_and_not_null(src, align)
3096-
&& is_aligned_and_not_null(dst, align)
2970+
ub_checks::is_aligned_and_not_null(src, align)
2971+
&& ub_checks::is_aligned_and_not_null(dst, align)
30972972
);
30982973
copy(src, dst, count)
30992974
}
@@ -3164,13 +3039,13 @@ pub const unsafe fn write_bytes<T>(dst: *mut T, val: u8, count: usize) {
31643039

31653040
// SAFETY: the safety contract for `write_bytes` must be upheld by the caller.
31663041
unsafe {
3167-
assert_unsafe_precondition!(
3042+
ub_checks::assert_unsafe_precondition!(
31683043
check_language_ub,
31693044
"ptr::write_bytes requires that the destination pointer is aligned and non-null",
31703045
(
31713046
addr: *const () = dst as *const (),
31723047
align: usize = align_of::<T>(),
3173-
) => is_aligned_and_not_null(addr, align)
3048+
) => ub_checks::is_aligned_and_not_null(addr, align)
31743049
);
31753050
write_bytes(dst, val, count)
31763051
}

library/core/src/lib.rs

+1
Original file line numberDiff line numberDiff line change
@@ -367,6 +367,7 @@ pub mod hint;
367367
pub mod intrinsics;
368368
pub mod mem;
369369
pub mod ptr;
370+
mod ub_checks;
370371

371372
/* Core language traits */
372373

library/core/src/num/nonzero.rs

+3-2
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ use crate::ops::{BitOr, BitOrAssign, Div, DivAssign, Neg, Rem, RemAssign};
99
use crate::panic::{RefUnwindSafe, UnwindSafe};
1010
use crate::ptr;
1111
use crate::str::FromStr;
12+
use crate::ub_checks;
1213

1314
use super::from_str_radix;
1415
use super::{IntErrorKind, ParseIntError};
@@ -369,7 +370,7 @@ where
369370
None => {
370371
// SAFETY: The caller guarantees that `n` is non-zero, so this is unreachable.
371372
unsafe {
372-
intrinsics::assert_unsafe_precondition!(
373+
ub_checks::assert_unsafe_precondition!(
373374
check_language_ub,
374375
"NonZero::new_unchecked requires the argument to be non-zero",
375376
() => false,
@@ -409,7 +410,7 @@ where
409410
None => {
410411
// SAFETY: The caller guarantees that `n` references a value that is non-zero, so this is unreachable.
411412
unsafe {
412-
intrinsics::assert_unsafe_precondition!(
413+
ub_checks::assert_unsafe_precondition!(
413414
check_library_ub,
414415
"NonZero::from_mut_unchecked requires the argument to dereference as non-zero",
415416
() => false,

library/core/src/ops/index_range.rs

+3-2
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
1-
use crate::intrinsics::{assert_unsafe_precondition, unchecked_add, unchecked_sub};
1+
use crate::intrinsics::{unchecked_add, unchecked_sub};
22
use crate::iter::{FusedIterator, TrustedLen};
33
use crate::num::NonZero;
4+
use crate::ub_checks;
45

56
/// Like a `Range<usize>`, but with a safety invariant that `start <= end`.
67
///
@@ -19,7 +20,7 @@ impl IndexRange {
1920
/// - `start <= end`
2021
#[inline]
2122
pub const unsafe fn new_unchecked(start: usize, end: usize) -> Self {
22-
assert_unsafe_precondition!(
23+
ub_checks::assert_unsafe_precondition!(
2324
check_library_ub,
2425
"IndexRange::new_unchecked requires `start <= end`",
2526
(start: usize = start, end: usize = end) => start <= end,

library/core/src/ptr/alignment.rs

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
use crate::convert::{TryFrom, TryInto};
2-
#[cfg(debug_assertions)]
3-
use crate::intrinsics::assert_unsafe_precondition;
42
use crate::num::NonZero;
3+
#[cfg(debug_assertions)]
4+
use crate::ub_checks::assert_unsafe_precondition;
55
use crate::{cmp, fmt, hash, mem, num};
66

77
/// A type storing a `usize` which is a power of two, and thus

library/core/src/ptr/const_ptr.rs

+1-1
Original file line numberDiff line numberDiff line change
@@ -818,7 +818,7 @@ impl<T: ?Sized> *const T {
818818
intrinsics::const_eval_select((this, origin), comptime, runtime)
819819
}
820820

821-
assert_unsafe_precondition!(
821+
ub_checks::assert_unsafe_precondition!(
822822
check_language_ub,
823823
"ptr::sub_ptr requires `self >= origin`",
824824
(

0 commit comments

Comments
 (0)