ptr pod impl fix. (#65)

* gate the unsound impl.

* changelog

* update cargo.toml

Cargo.toml

@@ -1,7 +1,7 @@
 [package]
 name = "bytemuck"
 description = "A crate for mucking around with piles of bytes."
-version = "1.6.4-alpha.0"
+version = "1.7.0-alpha.0"
 authors = ["Lokathor <zefria@gmail.com>"]
 repository = "https://github.com/Lokathor/bytemuck"
 readme = "README.md"
@@ -12,20 +12,37 @@ license = "Zlib OR Apache-2.0 OR MIT"
 exclude = ["/pedantic.bat"]
 
 [features]
-# Note: Yeah these names are non-standard, we'll fix it in v2 some day maybe
+# In v2 we'll fix these names to be more "normal".
+derive = ["bytemuck_derive"]
 extern_crate_alloc = []
 extern_crate_std = ["extern_crate_alloc"]
 zeroable_maybe_uninit = []
-derive = ["bytemuck_derive"]
 min_const_generics = []
 
+# Do not use if you can avoid it, because this is unsound.
+unsound_ptr_pod_impl = []
+
 [dependencies]
 # use the upper line for testing against bytemuck_derive changes, if any
 #bytemuck_derive = { version = "1.0.1-alpha.0", path = "derive", optional = true }
 bytemuck_derive = { version = "1", optional = true }
 
 [package.metadata.docs.rs]
-all-features = true
+# Note(Lokathor): Don't use all-feautures or it would use `unsound_ptr_pod_impl` too.
+features = [
+  "derive",
+  "extern_crate_alloc",
+  "extern_crate_std",
+  "zeroable_maybe_uninit",
+  "min_const_generics",
+]
 
 [package.metadata.playground]
-all-features = true
+# Note(Lokathor): Don't use all-feautures or it would use `unsound_ptr_pod_impl` too.
+features = [
+  "derive",
+  "extern_crate_alloc",
+  "extern_crate_std",
+  "zeroable_maybe_uninit",
+  "min_const_generics",
+]

changelog.md

@@ -1,5 +1,32 @@
 # `bytemuck` changelog
 
+## 1.7
+
+* In response to [Unsafe Code Guidelines Issue
+  #286](https://github.com/rust-lang/unsafe-code-guidelines/issues/286), this
+  version of Bytemuck has a ***Soundness-Required Breaking Change***. This is
+  "allowed" under Rust's backwards-compatibility guidelines, but it's still
+  annoying of course so we're trying to keep the damage minimal.
+  * **The Reason:** It turns out that pointer values should not have been `Pod`. More
+    specifically, `ptr as usize` is *not* the same operation as calling
+    `transmute::<_, usize>(ptr)`.
+  * LLVM has yet to fully sort out their story, but until they do, transmuting
+    pointers can cause miscompilations. They may fix things up in the future,
+    but we're not gonna just wait and have broken code in the mean time.
+  * **The Fix:** The breaking change is that the `Pod` impls for `*const T`,
+    `*mut T`, and `Option<NonNull<T>` are now gated behind the
+    `unsound_ptr_pod_impl` feature, which is off by default.
+  * You are *strongly discouraged* from using this feature, but if a dependency
+    of yours doesn't work when you upgrade to 1.7 because it relied on pointer
+    casting, then you might wish to temporarily enable the feature just to get
+    that dependency to build. Enabled features are global across all users of a
+    given semver compatible version, so if you enable the feature in your own
+    crate, your dependency will also end up getting the feature too, and then
+    it'll be able to compile.
+  * Please move away from using this feature as soon as you can. Consider it to
+    *already* be deprecated.
+  * [PR 65](https://github.com/Lokathor/bytemuck/pull/65)
+
 ## 1.6.3
 
 * Small goof with an errant `;`, so [PR 69](https://github.com/Lokathor/bytemuck/pull/69)

src/pod.rs

@@ -58,9 +58,13 @@ unsafe impl Pod for Option<NonZeroU64> {}
 unsafe impl Pod for Option<NonZeroU128> {}
 unsafe impl Pod for Option<NonZeroUsize> {}
 
+#[cfg(feature = "unsound_ptr_pod_impl")]
 unsafe impl<T: 'static> Pod for *mut T {}
+#[cfg(feature = "unsound_ptr_pod_impl")]
 unsafe impl<T: 'static> Pod for *const T {}
+#[cfg(feature = "unsound_ptr_pod_impl")]
 unsafe impl<T: 'static> Pod for Option<NonNull<T>> {}
+
 unsafe impl<T: Pod> Pod for PhantomData<T> {}
 unsafe impl<T: Pod> Pod for ManuallyDrop<T> {}