Repository navigation
Conversation
Require `impl_for_transmute_from!` to obtain an explicit trusted same-size proof before using reciprocal `TransmuteFrom` bounds as an equal-validity proof. Fixes #3691. Agent-authored-by: AI agent acting on Josh Liebow-Feeser's behalf
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
Extend the internal same-size witness to DST representations and add the existing transparent-wrapper and atomic-pointer layout cases used by `impl_for_transmute_from!`. Agent-authored-by: AI agent acting on Josh Liebow-Feeser's behalf
Restore unrelated punctuation and comment wrapping changed while updating the transmute proof helper.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #3694 +/- ##
=======================================
Coverage 91.90% 91.90%
=======================================
Files 20 20
Lines 6175 6175
=======================================
Hits 5675 5675
Misses 500 500 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Make the new same-size witnesses and transmute-helper safety comments state their exact obligations, premises, and inference steps following the unsafe-Rust proof methodology. Agent-authored-by: AI agent acting on Josh Liebow-Feeser's behalf
Restore two unrelated macro-arm semicolons changed while rewriting safety comments.
Define the same-size witness independently of its consumer and prove each implementation directly from the relevant representation guarantee, without relying on surrounding macro implementations. Agent-authored-by: AI agent acting on Josh Liebow-Feeser's behalf
Restore the verified source blob and remove temporary files introduced while attempting the safety-comment rewrite.
Define the same-size witness independently of its consumer and prove each implementation directly from the relevant representation guarantee, without relying on surrounding macro implementations. Agent-authored-by: AI agent acting on Josh Liebow-Feeser's behalf
Restore the verified macros.rs blob after an over-broad comment-edit attempt.
Define the same-size witness independently of its consumer and prove each implementation directly from the relevant representation guarantee. Agent-authored-by: AI agent acting on Josh Liebow-Feeser's behalf
Restore the verified macros.rs blob after an over-broad comment-edit attempt.
Define the same-size witness as a type-level referent-size invariant and prove every implementation directly from its representation guarantee. Update the consuming macro proof to use that invariant without participating in its proof. Agent-authored-by: AI agent acting on Josh Liebow-Feeser's behalf
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Close the latent soundness hole in
impl_for_transmute_from!by making its missing size premise explicit.SameSizeForTransmute<R>proof trait whose contract is a property of the two types alone:SelfandRhave exactly the same set of possible referent byte lengths. For twoSizedtypes, this reduces to ordinarysize_ofequality.SameSizeForTransmuteimpl prove that contract locally from the relevant representation/size guarantee. These proofs do not depend onimpl_for_transmute_from!,unsafe_impl_for_transparent_wrapper!, or another zerocopy unsafe assertion.SameSizeForTransmutebefore reciprocalTransmuteFrom<_, Safe, Safe>bounds are used. For an arbitrary possible referent size, the marker makes bothTransmuteFromcontracts applicable; the reciprocal bounds then establish equality of the twoSafestate sets at that size.FromZeros,FromBytes,IntoBytes, andTryFromBytes.impl_for_transmute_from!:Wrapping<T>,ManuallyDrop<T>,Cell<T>,UnsafeCell<T>, the integer/bool atomic types, andAtomicPtr<T>.impl_for_transmute_from!#3691 FIXME now that its missing premise is represented directly.This deliberately does not change
SizeEq; that trait still carries no safety guarantee of its own.Fixes #3691.
Authored by an AI agent acting on Josh Liebow-Feeser's behalf.