You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: reference/src/glossary.md
+22-23Lines changed: 22 additions & 23 deletions
Original file line number
Diff line number
Diff line change
@@ -52,15 +52,22 @@ If data immediately pointed to by a `*const T` or `&*const T` is mutated, that's
52
52
*Interior mutability* refers to the ability to perform interior mutation without causing UB.
53
53
All interior mutation in Rust has to happen inside an [`UnsafeCell`](https://doc.rust-lang.org/core/cell/struct.UnsafeCell.html), so all data structures that have interior mutability must (directly or indirectly) use `UnsafeCell` for this purpose.
54
54
55
-
#### Layout
55
+
#### Validity and safety invariant
56
56
57
-
The *layout* of a type defines its size and alignment as well as the offsets of its subobjects (e.g. fields of structs/unions/enum/... or elements of arrays).
58
-
Moreover, the layout of a type records its *function call ABI* (or just *ABI* for short): how the type is passed *by value* across a function boundary.
57
+
The *validity invariant* is an invariant that all data must uphold any time it is accessed or copied in a typed manner.
58
+
This invariant is known to the compiler and exploited by optimizations such as improved enum layout or eliding in-bounds checks.
59
59
60
-
Note: Originally, *layout* and *representation* were treated as synonyms, and Rust language features like the `#[repr]` attribute reflect this.
61
-
In this document, *layout* and *representation* are not synonyms.
60
+
In terms of MIR statements, "accessed or copied" means whenever an assignment statement is executed.
61
+
That statement has a type (LHS and RHS must have the same type), and the data being assigned must be valid at that type.
62
+
Moreover, arguments passed to a function must be valid at the type given in the callee signature, and the return value of a function must be valid at the type given in the caller signature.
63
+
OPEN QUESTION: Are there more cases where data must be valid?
62
64
63
-
#### Safety Invariant
65
+
In terms of code, some data computed by `TERM` is valid at type `T` if and only if the following program does not have UB:
66
+
```rust,ignore
67
+
fn main() { unsafe {
68
+
let t: T = std::mem::transmute(TERM);
69
+
} }
70
+
```
64
71
65
72
The *safety* invariant is an invariant that safe code may assume all data to uphold.
66
73
This invariant is used to justify which operations safe code can perform.
@@ -82,6 +89,14 @@ Moreover, such unsafe code must not return a non-UTF-8 string to the "outside" o
82
89
To summarize: *Data must always be valid, but it only must be safe in safe code.*
83
90
For some more information, see [this blog post](https://www.ralfj.de/blog/2018/08/22/two-kinds-of-invariants.html).
84
91
92
+
#### Layout
93
+
94
+
The *layout* of a type defines its size and alignment as well as the offsets of its subobjects (e.g. fields of structs/unions/enum/... or elements of arrays).
95
+
Moreover, the layout of a type records its *function call ABI* (or just *ABI* for short): how the type is passed *by value* across a function boundary.
96
+
97
+
Note: Originally, *layout* and *representation* were treated as synonyms, and Rust language features like the `#[repr]` attribute reflect this.
98
+
In this document, *layout* and *representation* are not synonyms.
99
+
85
100
#### Niche
86
101
87
102
The *niche* of a type determines invalid bit-patterns that will be used by layout optimizations.
@@ -96,26 +111,10 @@ niches. For example, the "all bits uninitialized" is an invalid bit-pattern for
96
111
`&mut T`, but this bit-pattern cannot be used by layout optimizations, and is not a
97
112
niche.
98
113
99
-
#### Validity Invariant
100
-
101
-
The *validity invariant* is an invariant that all data must uphold any time it is accessed or copied in a typed manner.
102
-
This invariant is known to the compiler and exploited by optimizations such as improved enum layout or eliding in-bounds checks.
103
-
104
-
In terms of MIR statements, "accessed or copied" means whenever an assignment statement is executed.
105
-
That statement has a type (LHS and RHS must have the same type), and the data being assigned must be valid at that type.
106
-
Moreover, arguments passed to a function must be valid at the type given in the callee signature, and the return value of a function must be valid at the type given in the caller signature.
107
-
OPEN QUESTION: Are there more cases where data must be valid?
108
-
109
-
In terms of code, some data computed by `TERM` is valid at type `T` if and only if the following program does not have UB:
0 commit comments