rust/library
Matthias Krüger 4f4a819fa9
Rollup merge of #97316 - CAD97:bound-misbehavior, r=dtolnay
Put a bound on collection misbehavior

As currently written, when a logic error occurs in a collection's trait parameters, this allows *completely arbitrary* misbehavior, so long as it does not cause undefined behavior in std. However, because the extent of misbehavior is not specified, it is allowed for *any* code in std to start misbehaving in arbitrary ways which are not formally UB; consider the theoretical example of a global which gets set on an observed logic error. Because the misbehavior is only bound by not resulting in UB from safe APIs and the crate-level encapsulation boundary of all of std, this makes writing user unsafe code that utilizes std theoretically impossible, as it now relies on undocumented QOI (quality of implementation) that unrelated parts of std cannot be caused to misbehave by a misuse of std::collections APIs.

In practice, this is a nonconcern, because std has reasonable QOI and an implementation that takes advantage of this freedom is essentially a malicious implementation and only compliant by the most langauage-lawyer reading of the documentation.

To close this hole, we just add a small clause to the existing logic error paragraph that ensures that any misbehavior is limited to the collection which observed the logic error, making it more plausible to prove the soundness of user unsafe code.

This is not meant to be formal; a formal refinement would likely need to mention that values derived from the collection can also misbehave after a logic error is observed, as well as define what it means to "observe" a logic error in the first place. This fix errs on the side of informality in order to close the hole without complicating a normal reading which can assume a reasonable nonmalicious QOI.

See also [discussion on IRLO][1].

[1]: https://internals.rust-lang.org/t/using-std-collections-and-unsafe-anything-can-happen/16640

r? rust-lang/libs-api ```@rustbot``` label +T-libs-api -T-libs

This technically adds a new guarantee to the documentation, though I argue as written it's one already implicitly provided.
2022-05-31 23:11:34 +02:00
..
alloc Rollup merge of #97316 - CAD97:bound-misbehavior, r=dtolnay 2022-05-31 23:11:34 +02:00
backtrace@4e5a3f7292 update libbacktrace 2022-05-20 09:30:26 +02:00
core Auto merge of #97419 - WaffleLapkin:const_from_ptr_range, r=oli-obk 2022-05-31 14:55:33 +00:00
panic_abort Use Rust ABI for __rust_start_panic and _{rdl,rg}_oom 2022-05-14 02:53:59 +01:00
panic_unwind Use Rust ABI for __rust_start_panic and _{rdl,rg}_oom 2022-05-14 02:53:59 +01:00
portable-simd Finish bumping stage0 2022-05-27 07:36:17 -04:00
proc_macro proc_macro: don't pass a client-side function pointer through the server. 2022-05-27 19:29:21 +00:00
profiler_builtins Switch all libraries to the 2021 edition 2021-12-23 19:03:47 +08:00
rtstartup Bump bootstrap compiler to 1.50 beta 2020-12-30 09:27:19 -05:00
rustc-std-workspace-alloc Switch all libraries to the 2021 edition 2021-12-23 19:03:47 +08:00
rustc-std-workspace-core Switch all libraries to the 2021 edition 2021-12-23 19:03:47 +08:00
rustc-std-workspace-std Switch all libraries to the 2021 edition 2021-12-23 19:03:47 +08:00
std Rollup merge of #97316 - CAD97:bound-misbehavior, r=dtolnay 2022-05-31 23:11:34 +02:00
stdarch@28335054b1 Also allow unused macro rules in stdarch 2022-05-10 19:53:22 +02:00
test Auto merge of #95678 - pietroalbini:pa-1.62.0-bootstrap, r=Mark-Simulacrum 2022-04-07 07:34:04 +00:00
unwind Auto merge of #97033 - nbdd0121:unwind3, r=Amanieu 2022-05-19 04:04:40 +00:00