Skip to content

[pointer] Require same-size proof in transmute helper - #3694

Open
joshlf wants to merge 16 commits into
mainfrom
fix-transmute-same-size-proof
Open

joshlf wants to merge 16 commits into
mainfrom
fix-transmute-same-size-proof

Conversation

@joshlf

@joshlf joshlf commented Sep 17, 2026 •

Copy link
Copy Markdown
Member

Close the latent soundness hole in impl_for_transmute_from! by making its missing size premise explicit.

  • Add an internal unsafe SameSizeForTransmute<R> proof trait whose contract is a property of the two types alone: Self and R have exactly the same set of possible referent byte lengths. For two Sized types, this reduces to ordinary size_of equality.
  • Make every SameSizeForTransmute impl prove that contract locally from the relevant representation/size guarantee. These proofs do not depend on impl_for_transmute_from!, unsafe_impl_for_transparent_wrapper!, or another zerocopy unsafe assertion.
  • Require SameSizeForTransmute before reciprocal TransmuteFrom<_, Safe, Safe> bounds are used. For an arbitrary possible referent size, the marker makes both TransmuteFrom contracts applicable; the reciprocal bounds then establish equality of the two Safe state sets at that size.
  • Spell out separately how that result transfers each supported trait: FromZeros, FromBytes, IntoBytes, and TryFromBytes.
  • Provide witnesses for every existing representation family used by impl_for_transmute_from!: Wrapping<T>, ManuallyDrop<T>, Cell<T>, UnsafeCell<T>, the integer/bool atomic types, and AtomicPtr<T>.
  • Remove the [pointer] Require size equality in impl_for_transmute_from! #3691 FIXME now that its missing premise is represented directly.

This deliberately does not change SizeEq; that trait still carries no safety guarantee of its own.

Fixes #3691.

Authored by an AI agent acting on Josh Liebow-Feeser's behalf.

Require `impl_for_transmute_from!` to obtain an explicit trusted same-size proof before using reciprocal `TransmuteFrom` bounds as an equal-validity proof.

Fixes #3691.

Agent-authored-by: AI agent acting on Josh Liebow-Feeser's behalf
@chatgpt-codex-connector

Copy link
Copy Markdown

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

Extend the internal same-size witness to DST representations and add the existing transparent-wrapper and atomic-pointer layout cases used by `impl_for_transmute_from!`.

Agent-authored-by: AI agent acting on Josh Liebow-Feeser's behalf
Restore unrelated punctuation and comment wrapping changed while updating the transmute proof helper.
@codecov-commenter

codecov-commenter commented Sep 17, 2026 •

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.90%. Comparing base (1f5c93a) to head (b24150d).

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #3694   +/-   ##
=======================================
  Coverage   91.90%   91.90%           
=======================================
  Files          20       20           
  Lines        6175     6175           
=======================================
  Hits         5675     5675           
  Misses        500      500           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Make the new same-size witnesses and transmute-helper safety comments state their exact obligations, premises, and inference steps following the unsafe-Rust proof methodology.

Agent-authored-by: AI agent acting on Josh Liebow-Feeser's behalf
Restore two unrelated macro-arm semicolons changed while rewriting safety comments.
Define the same-size witness independently of its consumer and prove each implementation directly from the relevant representation guarantee, without relying on surrounding macro implementations.

Agent-authored-by: AI agent acting on Josh Liebow-Feeser's behalf
Restore the verified source blob and remove temporary files introduced while attempting the safety-comment rewrite.
Define the same-size witness independently of its consumer and prove each implementation directly from the relevant representation guarantee, without relying on surrounding macro implementations.

Agent-authored-by: AI agent acting on Josh Liebow-Feeser's behalf
Restore the verified macros.rs blob after an over-broad comment-edit attempt.
Define the same-size witness independently of its consumer and prove each implementation directly from the relevant representation guarantee.

Agent-authored-by: AI agent acting on Josh Liebow-Feeser's behalf
Restore the verified macros.rs blob after an over-broad comment-edit attempt.
Define the same-size witness as a type-level referent-size invariant and prove every implementation directly from its representation guarantee. Update the consuming macro proof to use that invariant without participating in its proof.

Agent-authored-by: AI agent acting on Josh Liebow-Feeser's behalf

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[pointer] Require size equality in impl_for_transmute_from!

2 participants