Stream: t-lang/wg-unsafe-code-guidelines

Topic: provenance through integers?


RalfJ (Aug 06 2019 at 08:00, on Zulip):

See https://github.com/rust-lang/rust/pull/63297#pullrequestreview-271172547 : I thought there was pretty much consensus that our integers do not have provenance, hence I wrote a note along those lines some time ago and it is in the wrapping_offset docs these days. Was I moving too quick?

gnzlbg (Aug 06 2019 at 09:31, on Zulip):

Was I moving too quick?

IIUC from the LLVM bug, LLVM does not support this yet, and it still miscompiles programs.

gnzlbg (Aug 06 2019 at 09:32, on Zulip):

Although it appears that the intent is to support this at some point

gnzlbg (Aug 06 2019 at 09:34, on Zulip):

There are some safe Rust programs that get "miscompiled" due to this, but I am not sure whether these are miscompilations or not

rkruppe (Aug 06 2019 at 11:21, on Zulip):

I also don't think anyone wants integers to carry pointer provenance in Rust, but given that there hasn't been a formal decision (e.g., by T-lang) and there are reasonable concerns about whether LLVM supports/will support that, we should probably be conservative in libstd docs, just as we are w.r.t. things like uninitialized integers.

RalfJ (Aug 06 2019 at 16:00, on Zulip):

but what else would we tell people that ask for cross-object arithmetic? "not possible"? I fear if we do that, they'll use wrapping_offset as that's just so much easier to use.

gnzlbg (Aug 06 2019 at 23:27, on Zulip):

not possible"?

Due to the current bugs, can we tell them that it is possible?

gnzlbg (Aug 06 2019 at 23:28, on Zulip):

I don't want integers to carry provenance, but I don't think there is a reliable way to do this in Rust (or C or C++) today

RalfJ (Aug 07 2019 at 08:06, on Zulip):

I am not disagreeing. I am just saying I think the alternative is that people will do it anyway, and will notice it seems to work -- and they'll not e as conservative as they should be so even if the LLVM devs fix their stuff one day, this code will still be wrong.

rkruppe (Aug 07 2019 at 09:24, on Zulip):

It's an ungreat situation. Perhaps we can document the ptrtoint way as "not decided, may still be UB, but if anything will ever work it'll be this"

RalfJ (Aug 08 2019 at 08:13, on Zulip):

"ungreat", heh ;)

RalfJ (Aug 08 2019 at 08:13, on Zulip):

do you want to give a shot at updating the docs that way?

rkruppe (Aug 08 2019 at 08:21, on Zulip):

I don't think it'll be high priority enough for me to get to it soon-ish

RalfJ (Aug 08 2019 at 08:22, on Zulip):

fair.

Last update: Nov 20 2019 at 12:45UTC