Conversation
|
@codex implement and validate this PR's pointer improvements on its existing head branch Read The initial A27 Run targeted pointer and regression tests, Miri where available (ordinary valid cases only), MSRV/stable checks, nightly Clippy and formatting, and pre-push checks. For A28/A29, report a compact caller/implementer inventory and why each continues to satisfy the corrected contract. Report actual commands and limitations; do not claim a proof merely because tests pass. Commit/push and report final head SHA. An independent review will be requested separately; your own implementation pass is not approval. No merge, queue, settings, or unrelated changes. Instruction posted by an AI agent acting on Josh Liebow-Feeser's behalf. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #3677 +/- ##
==========================================
+ Coverage 91.90% 92.00% +0.09%
==========================================
Files 20 20
Lines 6175 6201 +26
==========================================
+ Hits 5675 5705 +30
+ Misses 500 496 -4 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Summary
Testing
|
|
@codex finish publishing the preceding task's tested commit Inspect the checkout and recover the prior commit if available. A missing remote is not a permission denial: read the live branch, configure If the prior commit is not recoverable in this context, report that explicitly and reconstruct the same scoped changes from the preceding implementation, then retest. Preserve seed and unrelated work. Include the necessary HasField contract clarification and generated proof updates. Do not change other audit branches. If publication remains blocked, return an exact portable export in the final GitHub comment, not merely a local path or a summary: gzip/base64 JSON containing the tested parent, commit message, every changed path and Git mode, complete final regular-file content, symlink target text, explicit deletions, and original/new Git blob SHAs. Include the uncompressed JSON SHA-256 and byte count. Use numbered encoded parts as needed, excluding unrelated files, binaries, credentials, or environment data. This parent agent has a functioning GitHub write connector and can publish the exported source. A compact unified diff in addition is useful for independent review. The implementation inventory and reported Rust tests are useful, but the remaining acceptance criteria are actual publication, independent review of the final head, and passing GitHub CI. Report exact failures and final remote SHA after readback; no self-approval or claims that prepared metadata equals publication. Instruction posted by an AI agent acting on Josh Liebow-Feeser's behalf. |
Summary
Testing
|
|
@codex return a COMPLETE COMPRESSED UNIFIED DIFF for A27–A29/A31/A32, not a full-file JSON manifest. Do not attempt publication again; your environment has no Git authentication, while this parent has a working GitHub connector. Recover previous local commit Your final GitHub comment must include the entire compressed DIFF payload in a fenced block, its uncompressed SHA-256 and byte count, parent SHA, and changed-file list. These six files require only a small diff, unlike the 110KB base64 full-file manifest. Spend the response on actual patch data, not another long narrative. If the compressed delta unexpectedly exceeds your output capacity, emit the first complete numbered part up to 10,000 characters and the total part count; do not return zero source merely because all parts cannot fit. No hand-edited expected outputs, UB witnesses, credentials, unrelated files, force pushes, merge/queue actions, or repository setting changes. Instruction posted by an AI agent acting on Josh Liebow-Feeser's behalf. |
|
Fresh checkout confirmed: commit Parent SHA: Changed files:
Testing
The exported delta contains the iterator capability and pointer-proof changes. zerocopy/src/pointer/inner.rsL184-L265 zerocopy/src/pointer/inner.rsL430-L474 zerocopy/src/pointer/ptr.rsL1293-L1298 |
|
@codex resume the A27–A29/A31/A32 implementation for this PR, recover the previously exported patch from this conversation if needed, and publish it. Read the live branch joshlf/audit-pointer-contracts-20260912 first; the parent last verified seed head 846c7e2. Preserve existing work and do not change the other audit PR branches. One correction is required before publication: the exported derive-generated projection proof claims that a zero-sized field always preserves the source address. A zero-sized field of a nonzero-sized struct can have a nonzero offset. Prove non-nullness using the containing allocation's non-null, nonwrapping address range and the field's in-bounds/one-past address; only for a zero-sized whole source should the zero-offset argument be used. Check all Project/HasField implementers and with_meta callers against the revised postconditions, retaining pinned authoritative Rust citations. Do not create a UB witness or relax safety obligations. The earlier report stopped because no local Git remote was configured. Josh explicitly authorizes adding a local remote for https://github.com/google/zerocopy.git, fetching this PR's branch, and attempting a normal non-force push with credentials already available in the environment. A missing remote alone is not a permission failure. Also discover and attempt actual authorized GitHub connector writes if available. Do not request/expose credentials, invent schemas, or bypass a real denial. No merge, enqueue, force push, settings/CI changes, new dependencies, or other-branch edits. Run applicable cargo.sh MSRV/stable pointer and iterator regressions, Miri where available, nightly Clippy, rustdoc, formatting, and pre-push checks. Read back any published head. Otherwise report the exact write operation/error and export the complete final patch against the current remote tip with SHA-256, per-file Git hashes/sizes, and tests. This is implementation and proof validation, not independent review approval. Instruction posted by an AI agent acting on Josh Liebow-Feeser's behalf. |
Summary
Portable Patch ExportParent: Changed files and final Git blobs:
The following is the complete deterministic gzip/base64 encoding of:
Testing
|
|
You have reached your Codex usage limits for security reviews. Please try again later. |
|
@codex review Please independently review the complete PR at Posted by an AI agent acting on Josh Liebow-Feeser's behalf. |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
You have reached your Codex usage limits for security reviews. Please try again later. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5946b5f6d4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| /// The returned pointer is non-null, refers to a non-strict subset of | ||
| /// the bytes of `src`'s referent, and has the same provenance as `src`. |
There was a problem hiding this comment.
BLOCKING: Strengthening this unsafe postcondition makes non-nullness an obligation of every Project and HasField implementation, but several proofs still establish only the old subset/provenance contract: wrappers.rs:796-799 explicitly restates only those two conditions, while the tuple projection in impls.rs:1099-1104 handles zero-sized referents without showing that the computed field address remains non-null. This matters especially for zero-sized outputs, where being a byte subset is vacuous, because PtrInner::project now passes every returned pointer directly to NonNull::new_unchecked. Audit each handwritten and macro-generated implementation and add an address-preservation or nonwrapping field-offset argument covering ZSTs, rather than updating only the derive-generated struct/union implementation. zerocopy/agent_docs/reviewing.mdL34-L43
Useful? React with 👍 / 👎.
|
@codex address the blocking non-nullness review on this PR and push the corrections to this PR's existing branch. Josh has authorized these repository writes. Do not merge, enqueue, force-push, or modify another audit PR. Start by reading the live head (last verified: Use the repository's cargo.sh validation workflow and run the affected tests, formatting, documentation checks, and applicable Miri checks. Publish only this task's changes with the commit trailer Authored by an AI agent acting on Josh Liebow-Feeser's behalf. |
Summary
Testing
|
|
@codex export the exact follow-up patch prepared in the preceding task ( Return the complete Authored by an AI agent acting on Josh Liebow-Feeser's behalf. |
|
The requested local commit Base SHA: Changed files:
diff --git a/zerocopy/src/impls.rs b/zerocopy/src/impls.rs
index 4df786fd2104854e1fa259a63c29cd8781f8a404..8eb7b6dd90ee418507e6eeb3822ab70b59febcbc 100644
--- a/zerocopy/src/impls.rs
+++ b/zerocopy/src/impls.rs
@@ -812,7 +812,8 @@ const _: () = {
#[inline(always)]
fn project(slf: PtrInner<'_, Self>) -> *mut T {
// SAFETY: `ManuallyDrop<T>` has the same layout and bit validity as
- // `T` [1].
+ // `T` [1]. The cast preserves the address (and thus non-nullness)
+ // and provenance.
//
// [1] Per https://doc.rust-lang.org/1.85.0/std/mem/struct.ManuallyDrop.html:
//
@@ -1095,12 +1096,21 @@ mod tuples {
#[inline(always)]
fn project(slf: crate::PtrInner<'_, Self>) -> *mut Self::Type {
+ if core::mem::size_of::<Self>() == 0 {
+ // Every field of a zero-sized tuple is at offset zero.
+ // Preserve the source address so the result is non-null.
+ return slf.as_ptr().cast::<Self::Type>();
+ }
+
let slf = slf.as_non_null().as_ptr();
- // SAFETY: `PtrInner` promises it references either a zero-sized
- // byte range, or else will reference a byte range that is
- // entirely contained within an allocated object. In either
- // case, this guarantees that `(*slf).$CurrI` is in-bounds of
- // `slf`.
+ // SAFETY: `Self` is non-zero-sized, so `PtrInner` promises
+ // its referent is entirely contained in an allocation.
+ // The field address is in-bounds or one-past that allocation
+ // and computing it does not wrap. Since the allocation's
+ // address range is non-null and does not wrap through zero,
+ // the resulting address is non-null, including when the
+ // field itself is zero-sized. The operation also preserves
+ // provenance.
unsafe { core::ptr::addr_of_mut!((*slf).$CurrI) }
}
}
@@ -1393,6 +1403,28 @@ mod simd {
mod tests {
use super::*;
+ #[test]
+ fn zst_field_projections_are_non_null() {
+ fn project_second<T: ?Sized>(value: &T) -> *mut T::Type
+ where
+ T: HasField<(), (), { STRUCT_VARIANT_ID }, ident_id!(1)>,
+ {
+ T::project(PtrInner::from_ref(value))
+ }
+
+ // Exercise a zero-sized field at a nonzero offset.
+ let non_zst = (0u8, ());
+ assert!(!project_second(&non_zst).is_null());
+
+ // Exercise the address-preserving path for a wholly zero-sized tuple.
+ let zst = ((), ());
+ assert!(!project_second(&zst).is_null());
+
+ // Exercise the transitive projection used by the `ReadOnly` adapter.
+ let read_only = ReadOnly::new(non_zst);
+ assert!(!project_second(&read_only).is_null());
+ }
+
#[test]
fn test_impls() {
// A type that can supply test cases for testing `TryFromBytes::is_safe`.
diff --git a/zerocopy/src/layout.rs b/zerocopy/src/layout.rs
index d58786d637cf8fb94cde85ed7a3549448561ff60..a3ed29e0c59c1d7d77757eae7d0552cdfdba7851 100644
--- a/zerocopy/src/layout.rs
+++ b/zerocopy/src/layout.rs
@@ -783,8 +783,8 @@ mod cast_from {
// SAFETY: `project` produces a pointer which refers to the same referent
// bytes as its input, or to a subset of them (see inline comments for a
- // more detailed proof of this). It does this using provenance-preserving
- // operations.
+ // more detailed proof of this). It preserves the input's address (and thus
+ // non-nullness) and uses provenance-preserving operations.
unsafe impl<Src, Dst> crate::pointer::cast::Project<Src, Dst> for CastFrom<Dst>
where
Src: KnownLayout + ?Sized,
diff --git a/zerocopy/src/pointer/mod.rs b/zerocopy/src/pointer/mod.rs
index 1e572e99c34fd7b7514e20eb869a358db8b95df0..be6685aa1c24043378a917f645533689d85af62a 100644
--- a/zerocopy/src/pointer/mod.rs
+++ b/zerocopy/src/pointer/mod.rs
@@ -95,8 +95,8 @@ pub mod cast {
pub struct IdCast;
// SAFETY: `project` returns its argument unchanged, and so it is a
- // provenance-preserving projection which preserves the set of referent
- // bytes.
+ // provenance-preserving projection which preserves the address and set of
+ // referent bytes. In particular, it preserves non-nullness.
unsafe impl<T: ?Sized> Project<T, T> for IdCast {
#[inline(always)]
fn project(src: PtrInner<'_, T>) -> *mut T {
@@ -123,8 +123,8 @@ pub mod cast {
pub enum CastSized {}
// SAFETY: By the `static_assert!`, `Dst` is no larger than `Src`,
- // and so all casts preserve or shrink the set of referent bytes. All
- // operations preserve provenance.
+ // and so all casts preserve or shrink the set of referent bytes. The cast
+ // preserves the address (and thus non-nullness) and provenance.
unsafe impl<Src, Dst> Project<Src, Dst> for CastSized {
#[inline(always)]
fn project(src: PtrInner<'_, Src>) -> *mut Dst {
@@ -150,8 +150,8 @@ pub mod cast {
pub enum CastSizedExact {}
// SAFETY: By the `static_assert!`, `Dst` has the same size as `Src`,
- // and so all casts preserve the set of referent bytes. All operations
- // preserve provenance.
+ // and so all casts preserve the set of referent bytes. The cast preserves
+ // the address (and thus non-nullness) and provenance.
unsafe impl<Src, Dst> Project<Src, Dst> for CastSizedExact {
#[inline(always)]
fn project(src: PtrInner<'_, Src>) -> *mut Dst {
@@ -187,6 +187,8 @@ pub mod cast {
// given pointer metadata encodes the same size for both `Src` and `Dst`
// (note that the alignment is required as it affects the amount of
// trailing padding). Thus, `project` preserves the set of referent bytes.
+ // `raw_from_ptr_len` uses `src`'s data pointer, and thus preserves its
+ // address, non-nullness, and provenance.
unsafe impl<Src, Dst> Project<Src, Dst> for CastUnsized
where
Src: ?Sized + KnownLayout,
@@ -319,9 +321,9 @@ pub mod cast {
_u: PhantomData<U>,
}
- // SAFETY: Since `TU::project` and `UV::project` are each
- // provenance-preserving operations which preserve or shrink the set of
- // referent bytes, so is their composition.
+ // SAFETY: Since `TU::project` and `UV::project` each return a non-null,
+ // provenance-preserving pointer which preserves or shrinks the set of
+ // referent bytes, so does their composition.
unsafe impl<T, U, V, TU, UV> Project<T, V> for TransitiveProject<U, TU, UV>
where
T: ?Sized,
@@ -367,8 +369,8 @@ pub mod cast {
pub struct AsBytesCast;
// SAFETY: `project` constructs a pointer with the same address as `src`
- // and with a referent of the same size as `*src`. It does this using
- // provenance-preserving operations.
+ // and with a referent of the same size as `*src`. It therefore preserves
+ // non-nullness, and does this using provenance-preserving operations.
//
// FIXME(https://github.com/rust-lang/unsafe-code-guidelines/issues/594):
// Technically, this proof assumes that `*src` is contiguous (the same is
@@ -401,7 +403,8 @@ pub mod cast {
pub struct CastToUnit;
// SAFETY: The `project` implementation projects to a subset of its
- // argument's referent using provenance-preserving operations.
+ // argument's referent using address- and provenance-preserving operations.
+ // Since it preserves the address, it also preserves non-nullness.
unsafe impl<T: ?Sized> Project<T, ()> for CastToUnit {
#[inline(always)]
fn project(src: PtrInner<'_, T>) -> *mut () {
diff --git a/zerocopy/src/ref.rs b/zerocopy/src/ref.rs
index 0add3f57ef3432fb98d5166b6841ee2408d16684..e9769f8e76e4f51aa54f985c2c49fdf601a0afe2 100644
--- a/zerocopy/src/ref.rs
+++ b/zerocopy/src/ref.rs
@@ -972,8 +972,9 @@ where
// SAFETY: `CastForSized` is only used below with the input `ptr`, which the
// caller promises has size `size_of::<T>()`. Thus, the referent produced in
- // this cast has the same size as `ptr`'s referent. All operations preserve
- // provenance.
+ // this cast has the same size as `ptr`'s referent. `raw_from_ptr_len` uses
+ // the non-null input data pointer, preserving its address, non-nullness,
+ // and provenance.
unsafe impl<T: ?Sized + KnownLayout> Project<[u8], T> for CastForSized {
#[inline(always)]
fn project(src: PtrInner<'_, [u8]>) -> *mut T {
diff --git a/zerocopy/src/util/macros.rs b/zerocopy/src/util/macros.rs
index bf82aa49f3f33ddc5e3ada6ba76590ba15fc60e1..3ac4649c11add5f236afbb96608e077905328a6c 100644
--- a/zerocopy/src/util/macros.rs
+++ b/zerocopy/src/util/macros.rs
@@ -715,8 +715,8 @@ macro_rules! define_cast {
$vis enum $name {}
// SAFETY: The caller promises that `src as *mut $src` is a size-
- // preserving or size-shrinking cast. All operations preserve
- // provenance.
+ // preserving or size-shrinking cast. The cast preserves the address
+ // (and thus non-nullness) and provenance.
unsafe impl $(<$tyvar $(: ?$optbound)?>)? $crate::pointer::cast::Project<$src, $dst> for $name {
fn project(src: $crate::pointer::PtrInner<'_, $src>) -> *mut $dst {
#[allow(clippy::as_conversions)]
diff --git a/zerocopy/src/wrappers.rs b/zerocopy/src/wrappers.rs
index 4425ec26cb25fee106dd12ddb36f50972188ddf7..5e8205b167e1d48aee60920d569d377056c6fcc0 100644
--- a/zerocopy/src/wrappers.rs
+++ b/zerocopy/src/wrappers.rs
@@ -793,10 +793,12 @@ unsafe impl<T: HasTag<Client> + ?Sized, Client> HasTag<Client> for ReadOnly<T> {
// - `T::Type` has the same type as `f`. Thus, `ReadOnly<T::Type>` has the
// same type as `f`, wrapped in `ReadOnly`.
//
-// `project` satisfies its post-condition – namely, that the returned pointer
-// refers to a non-strict subset of the bytes of `slf`'s referent, and has the
-// same provenance as `slf` – because all intermediate operations satisfy those
-// same conditions.
+// `project` satisfies its post-condition – namely, that the returned pointer is
+// non-null, refers to a non-strict subset of the bytes of `slf`'s referent, and
+// has the same provenance as `slf` – because all intermediate projections
+// satisfy those same conditions. This includes projections from or to a ZST:
+// non-nullness follows from each projection's explicit post-condition, rather
+// than from the (vacuous for ZSTs) byte-subset condition.
unsafe impl<T, Client, Field, const VARIANT_ID: i128, const FIELD_ID: i128>
HasField<Client, Field, VARIANT_ID, FIELD_ID> for ReadOnly<T>
whereTesting
|
5946b5f to
9817349
Compare
|
@codex review Please review the complete PR at Authored by an AI agent acting on Josh Liebow-Feeser's behalf. |
|
You have reached your Codex usage limits for security reviews. Please try again later. |
1 similar comment
|
You have reached your Codex usage limits for security reviews. Please try again later. |
9817349 to
5f0facb
Compare
|
@codex review Please independently review the complete PR at Authored by an AI agent acting on Josh Liebow-Feeser's behalf. |
|
Codex Review: Didn't find any major issues. 👍 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
@codex independently reconcile the existing blocking thread discussion_r3997934050 with the no-findings review of exact head The current single commit changes disclosure metadata but retains the same source tree as the preceding head. The earlier thread requires explicit non-nullness arguments for every handwritten Project/HasField implementation, especially the ReadOnly adapter and zero-sized tuple projection. That follow-up has not been published. Inspect the current implementations and repository proof requirements, and determine whether the earlier finding still applies. Report the exact inspected SHA and a concrete rationale either way. Do not treat a later generic no-findings summary as evidence that the missing code/proof was added, and do not withdraw a valid finding merely to make the PR green. Do not change source, commits, review-thread state, checks, branch protections, or PR lifecycle state. Do not merge, enqueue, close, or publish any implementation. Authored by an AI agent acting on Josh Liebow-Feeser's behalf. |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
@codex address the remaining blocking review feedback on the current PR head 5f0facb. Audit every handwritten and macro-generated Project/HasField projection implementation for the strengthened non-null postcondition, including ZST outputs. Add the required address-preservation or nonwrapping field-offset proof wherever the old subset/provenance proof is insufficient, with focused regression coverage. Do not merely change derive-generated projections. Preserve unrelated work and all third-party provenance. The PR is intentionally one commit; amend it only after confirming this exact head, using a guarded force-with-lease if necessary to preserve that explicitly requested single-commit history. Run the relevant Rust checks and wait for PR CI; push only this PR branch. Do not merge, enqueue, close, weaken CI, or change repository settings. Instruction posted by an AI agent acting on Josh Liebow-Feeser's behalf. |
|
@codex complete the source-only non-nullness follow-up for discussion_r3997934050 and amend this PR's existing single commit. Start with live state: the last verified head is The retained follow-up is visible in the preparation block of Correct the one known compile failure in that retained preparation: use Run the targeted ZST test on MSRV; pointer, iterator, and derive-output tests on stable; MSRV checks; nightly Clippy, rustdoc, and formatting; and the targeted Miri test using Use Amend, do not append a commit or change its parent. Publish only through an already-authorized ordinary source-code Git/GitHub route with a stale-head guard and explicit lease. Do not create/change workflows, settings, unrelated refs, or another PR; do not merge, enqueue, or close. Do not bypass permission or tool-safety denials. If publication is unavailable, return the COMPLETE source patch (not merely metadata or a local path), its base SHA, and actual test results. This is implementation, not independent review approval; report the exact remotely verified head if published. Authored by an AI agent acting on Josh Liebow-Feeser's behalf. |
|
Codex couldn't complete this request. Try again later. |
5f0facb to
ec205dd
Compare
|
@codex review Please independently review the amended one-commit head |
|
Codex couldn't complete this request. Try again later. |
ec205dd to
992b69c
Compare
|
@codex review Please independently review current amended one-commit head |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
Codex Review: Didn't find any major issues. 🎉 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
992b69c to
84554d4
Compare
|
@codex review Please independently review the current amended one-commit head |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 84554d43a1
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| let value = ((), ()); | ||
| let pointer = PtrInner::from_ref(&value); | ||
| let projected = | ||
| <Tuple as HasField<(), (), { STRUCT_VARIANT_ID }, ident_id!(1)>>::project(pointer); |
There was a problem hiding this comment.
When the zerocopy library tests are compiled, the parser treats the unbraced ident_id!(1) in this generic argument as a type, so cargo test --lib zst_field_projections_are_non_null fails with E0747 before the regression test can run. All four new invocations need to remain const expressions, as in { ident_id!(1) }; remove the warning-triggering braces from the plain STRUCT_VARIANT_ID arguments instead.
Useful? React with 👍 / 👎.
| // range, so it is non-null [1]. If `Self` is zero-sized, | ||
| // every field has offset zero, so the projection preserves | ||
| // `slf`'s non-null address. In either case, projecting a |
There was a problem hiding this comment.
When this derive is used on a zero-sized union without repr(C), Self being zero-sized does not prove that every field has offset zero: the Reference explicitly permits non-C union fields to have nonzero offsets, as already quoted in src/pointer/mod.rs:288-293. Since a zero-sized PtrInner may carry any non-null dangling address without allocation provenance, applying such an offset can wrap to null and violate the strengthened HasField::project contract; handle the wholly-ZST union case with an address-preserving projection rather than relying on this assertion.
AGENTS.md reference: zerocopy/AGENTS.md:L21-L23
Useful? React with 👍 / 👎.
84554d4 to
8d56163
Compare
|
@codex review Please independently review final amended one-commit head |
|
Codex Review: Didn't find any major issues. 👍 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
8d56163 to
153d673
Compare
|
@codex review Please independently review exact amended one-commit head |
|
Codex Review: Didn't find any major issues. 🎉 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
Pointer projections must return non-null pointers, including when the projected referent is zero-sized. State that postcondition explicitly on Project and HasField, and make PtrInner::project rely on it rather than trying to infer non-nullness from the projected byte range. Update the generated field-projection proof to address non-nullness separately. Complete the non-nullness proof for handwritten projections and adapters. For wholly zero-sized tuples, use an address-preserving cast rather than a field offset; for non-zero-sized tuples, justify the nonwrapping allocation range. Add allocated and dangling ZST, non-zero-sized-tuple, and ReadOnly projection regression coverage. Express with_meta's allocation and provenance requirements in terms of the resulting referent. A zero-sized source does not discharge those requirements if the new metadata describes a non-zero-sized result. Update the implementation and caller proofs to name the relevant pointer and allocation lifetime directly. Expose ExactSizeIterator and DoubleEndedIterator on the existing range- based pointer iterators. Test lengths and mixed forward/backward iteration for derived values, empty slices, and zero-sized elements. Correct the iterator's pointer-addition and nonwrapping argument, and use Immutable to justify shared read-only access in the test helper. Agent-authored-by: AI agent acting on Josh Liebow-Feeser's behalf
153d673 to
0cc87df
Compare
|
@codex review Please independently review the exact final one-commit head |
|
Codex Review: Didn't find any major issues. Swish! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
This branch has not been deployed
2 participants
Pointer projections must return non-null pointers even when their referents
are zero-sized. This change states that postcondition explicitly on
Projectand
HasField, and makesPtrInner::projectrely on it instead of inferringnon-nullness from the projected byte range. The generated field-projection
proof treats non-nullness separately from the subset and provenance guarantees.
PtrInner::with_metanow states its allocation and provenance requirements interms of the resulting referent. A zero-sized source does not discharge those
requirements when new metadata describes a non-zero-sized result. The updated
implementation and caller proofs identify the relevant pointer and allocation
lifetime directly.
The existing range-based pointer iterators now expose
ExactSizeIteratorandDoubleEndedIterator. Regression tests check lengths and mixed forward/backwarditeration for derived values, empty slices, and zero-sized elements. The
iterator's pointer-addition and nonwrapping argument is corrected, and the
shared-read test helper uses
Immutableto justify the absence of interiormutation.
Authored by an AI agent acting on Josh Liebow-Feeser's behalf.