GitHub IssueCommentEvent at 2015-01-01 18:16:08
Repository: rust-lang/rust
Actor: Gankro
Payload: {"action":"created","issue":{"url":"https://api.github.com/repos/rust-lang/rust/issues/19733","labels_url":"https://api.github.com/repos/rust-lang/rust/issues/19733/labels{/name}","comments_url":"https://api.github.com/repos/rust-lang/rust/issues/19733/comments","events_url":"https://api.github.com/repos/rust-lang/rust/issues/19733/events","html_url":"https://github.com/rust-lang/rust/issues/19733","id":51703197,"number":19733,"title":"Mutable Pointer Aliasing Rules are Unclear for Unsafe Code","user":{"login":"Gankro","id":1136864,"avatar_url":"https://avatars.githubusercontent.com/u/1136864?v=3","gravatar_id":"","url":"https://api.github.com/users/Gankro","html_url":"https://github.com/Gankro","followers_url":"https://api.github.com/users/Gankro/followers","following_url":"https://api.github.com/users/Gankro/following{/other_user}","gists_url":"https://api.github.com/users/Gankro/gists{/gist_id}","starred_url":"https://api.github.com/users/Gankro/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Gankro/subscriptions","organizations_url":"https://api.github.com/users/Gankro/orgs","repos_url":"https://api.github.com/users/Gankro/repos","events_url":"https://api.github.com/users/Gankro/events{/privacy}","received_events_url":"https://api.github.com/users/Gankro/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/rust-lang/rust/labels/A-docs","name":"A-docs","color":"d7e102"},{"url":"https://api.github.com/repos/rust-lang/rust/labels/P-high","name":"P-high","color":"eb6420"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2014-12-11T15:56:41Z","updated_at":"2015-01-01T18:16:08Z","closed_at":null,"body":"As I rub against the boundaries of unsafe and undefined behaviour more and more It's becoming less \"obvious\" to me what is or isn't allowed. To demonstrate this I've whipped up a few examples of safe and unsafe code that does basically the same thing. Some of them are clearly defined or clearly undefined in my mental model, but I really have no idea at this point.\r\n\r\n`a` is clearly defined, as it uses no unsafe code. We re-loan a mutable reference to a different variable temporarily. At any given point there's clear ownership of the value.\r\n```\r\nfn a() -> u32 {\r\n    // totally safe mutable aliasing\r\n    let a = &mut 1u32;\r\n    {\r\n        let b = &mut *a;\r\n        *b += 1;\r\n    }\r\n    *a += 1;\r\n    *a\r\n}\r\n```\r\n\r\n`b` does the exact same thing, but through a `*mut` instead of an `&mut`. Ownership is still \"clear\" to the compiler, but we mutate through the `*mut`, and then later through the `&mut`. It wouldn't be unreasonable to consider this undefined behaviour. We mutated something \"owned\" by an `&mut` through something other than that `&mut`, and then worked with the value through the `&mut`.\r\n```\r\nfn b() -> u32 {\r\n    // same mutable aliasing, but with a raw ptr\r\n    let a = &mut 1u32;\r\n    unsafe {\r\n        let b = a as *mut _;\r\n        *b += 1;\r\n    }\r\n    *a += 1;\r\n    *a\r\n}\r\n```\r\n`c` does the exact same things as `b`, but explicitly constructs an &'static mut to mutate through unsafely. Here we have created two &mut's to the same value, which in my mental mode is clearly invoking undefined behaviour as I understand it. You cannot have two &mut's to the same value.\r\n```\r\nfn c() -> u32 {\r\n    // same unsafe aliasing, but by explicitly making an &mut from a *mut\r\n    let a = &mut 1u32;\r\n    unsafe {\r\n        let b = &mut *((&mut *a) as *mut _);\r\n        *b += 1;\r\n    }\r\n    *a += 1;\r\n    *a\r\n}\r\n```\r\n`d` is basically the same as `a`, but we've added a box in the way. This adds a rawptr between the `&mut` and the actual data. Semantically the data is still \"owned\" by the `&mut`, but is the `*mut` in-between important or just an implementation detail? Regardless this is all safe, so this must be defined.\r\n```\r\nfn d() -> u32 {\r\n    // totally safe mutable aliasing, but through a box \r\n    // (and therefore a raw ptr)\r\n    let mut a = box 1u32;\r\n    {\r\n        let b = &mut *a;\r\n        *b += 1;\r\n    }\r\n    *a += 1;\r\n    *a\r\n}\r\n```\r\n`e` is the same as `d`, but we've added a `*mut` again. This time we mutate the data inside the box while the box is owned. However the box *is* a `*mut`, so really we've just mutated data behind a rawptr with another rawptr. Now it really matters if the box's representation is defined or not! Critically I believe that the defined-ness of this case effects whether DList is sound or not. It mixes boxes, `*mut`s, and `&mut`s pretty freely. What is or isn't allowed is important.\r\n\r\n```\r\nfn e() -> u32 {\r\n    // same mutable aliasing, but with another raw ptr\r\n    let mut a = box 1u32;\r\n    unsafe {\r\n        let b = (&mut *a) as *mut _;\r\n        *b += 1;\r\n    }\r\n    *a += 1;\r\n    *a\r\n}\r\n```\r\nFinally `f` is a special case of unsafe mutable aliasing. Here we construct a `*mut` to a subfield of a composite structure. Then we capture the whole structure with an `&mut`. We mutate the subfield while the whole struct is owned, but then only use the ownership to mutate a *different* subfield. At no point do we read the \"unsafely\" mutated field. Then we relinquish ownership to the \"parent\" owner which, presumably, must assume that all fields may have been mutated since it loaned the structure out. Is this defined behaviour? I honestly have no clue.\r\n\r\n```\r\nfn f() -> u32 {\r\n    // mutable aliasing with a raw ptr, but on an unaccessed field\r\n    // until ownership is \"returned\" to the parent\r\n    let mut x = (1u32, 10u32);\r\n    let b = (&mut x.1) as *mut _;\r\n    {\r\n        let a = &mut x;\r\n        unsafe {\r\n            *b += 1;\r\n        }\r\n        a.0 += 1;\r\n    }\r\n    x.0 + x.1\r\n}\r\n```"},"comment":{"url":"https://api.github.com/repos/rust-lang/rust/issues/comments/68493603","html_url":"https://github.com/rust-lang/rust/issues/19733#issuecomment-68493603","issue_url":"https://api.github.com/repos/rust-lang/rust/issues/19733","id":68493603,"user":{"login":"Gankro","id":1136864,"avatar_url":"https://avatars.githubusercontent.com/u/1136864?v=3","gravatar_id":"","url":"https://api.github.com/users/Gankro","html_url":"https://github.com/Gankro","followers_url":"https://api.github.com/users/Gankro/followers","following_url":"https://api.github.com/users/Gankro/following{/other_user}","gists_url":"https://api.github.com/users/Gankro/gists{/gist_id}","starred_url":"https://api.github.com/users/Gankro/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Gankro/subscriptions","organizations_url":"https://api.github.com/users/Gankro/orgs","repos_url":"https://api.github.com/users/Gankro/repos","events_url":"https://api.github.com/users/Gankro/events{/privacy}","received_events_url":"https://api.github.com/users/Gankro/received_events","type":"User","site_admin":false},"created_at":"2015-01-01T18:16:08Z","updated_at":"2015-01-01T18:16:08Z","body":"CC @cmr @zwarich "}}