Skip to content

Commit 282f2d0

Browse files
committed
Revert "make changes compatible with #141224"
This reverts commit aa975c6. "Allocations" in line 116 in library/core/src/ptr/mod.rs was kept, however, because it was added as part of this commit series in 5a52202#diff-c175d4e27676febf62c061d31cf9756d256b46e2e44cc6b3177d4ff75e932567R116-R118
1 parent e3181e0 commit 282f2d0

File tree

1 file changed

+33
-35
lines changed

1 file changed

+33
-35
lines changed

library/core/src/ptr/mod.rs

Lines changed: 33 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -19,10 +19,10 @@
1919
//! pointer. The following points are only concerned with non-zero-sized accesses.
2020
//! * A [null] pointer is *never* valid.
2121
//! * For a pointer to be valid, it is necessary, but not always sufficient, that the pointer be
22-
//! *dereferenceable*. The [provenance] of the pointer is used to determine which [allocation]
23-
//! it is derived from; a pointer is dereferenceable if the memory range of the given size
24-
//! starting at the pointer is entirely contained within the bounds of that allocation. Note
25-
//! that in Rust, every (stack-allocated) variable is considered a separate allocation.
22+
//! *dereferenceable*. The [provenance] of the pointer is used to determine which [allocated
23+
//! object] it is derived from; a pointer is dereferenceable if the memory range of the given size
24+
//! starting at the pointer is entirely contained within the bounds of that allocated object. Note
25+
//! that in Rust, every (stack-allocated) variable is considered a separate allocated object.
2626
//! * All accesses performed by functions in this module are *non-atomic* in the sense
2727
//! of [atomic operations] used to synchronize between threads. This means it is
2828
//! undefined behavior to perform two concurrent accesses to the same location from different
@@ -31,7 +31,7 @@
3131
//! be used for inter-thread synchronization, regardless of whether it is acting on
3232
//! Rust memory or not.
3333
//! * The result of casting a reference to a pointer is valid for as long as the
34-
//! underlying allocation is live and no reference (just raw pointers) is used to
34+
//! underlying object is live and no reference (just raw pointers) is used to
3535
//! access the same memory. That is, reference and pointer accesses cannot be
3636
//! interleaved.
3737
//!
@@ -96,30 +96,28 @@
9696
//!
9797
//! [valid value]: ../../reference/behavior-considered-undefined.html#invalid-values
9898
//!
99-
//! ## Allocation
99+
//! ## Allocated object
100100
//!
101-
//! <a id="allocated-object"></a> <!-- keep old URLs working -->
102-
//!
103-
//! An *allocation* is a subset of program memory which is addressable
101+
//! An *allocated object* is a subset of program memory which is addressable
104102
//! from Rust, and within which pointer arithmetic is possible. Examples of
105-
//! allocations include heap allocations, stack-allocated variables,
103+
//! allocated objects include heap allocations, stack-allocated variables,
106104
//! statics, and consts. The safety preconditions of some Rust operations -
107105
//! such as `offset` and field projections (`expr.field`) - are defined in
108-
//! terms of the allocations on which they operate.
106+
//! terms of the allocated objects on which they operate.
109107
//!
110-
//! An allocation has a base address, a size, and a set of memory
111-
//! addresses. It is possible for an allocation to have zero size, but
112-
//! such an allocation will still have a base address. The base address
113-
//! of an allocation is not necessarily unique. While it is currently the
114-
//! case that an allocation always has a set of memory addresses which is
108+
//! An allocated object has a base address, a size, and a set of memory
109+
//! addresses. It is possible for an allocated object to have zero size, but
110+
//! such an allocated object will still have a base address. The base address
111+
//! of an allocated object is not necessarily unique. While it is currently the
112+
//! case that an allocated object always has a set of memory addresses which is
115113
//! fully contiguous (i.e., has no "holes"), there is no guarantee that this
116114
//! will not change in the future.
117115
//!
118-
//! Allocations must behave like "normal" memory: in particular, reads must not
119-
//! have side-effects, and writes must become visible to other threads using the
120-
//! usual synchronization primitives.
116+
//! Allocations must behave like "normal" memory: in particular, reads must not have
117+
//! side-effects, and writes must become visible to other threads using the usual synchronization
118+
//! primitives.
121119
//!
122-
//! For any allocation with `base` address, `size`, and a set of
120+
//! For any allocated object with `base` address, `size`, and a set of
123121
//! `addresses`, the following are guaranteed:
124122
//! - For all addresses `a` in `addresses`, `a` is in the range `base .. (base +
125123
//! size)` (note that this requires `a < base + size`, not `a <= base + size`)
@@ -129,11 +127,11 @@
129127
//! - `size <= isize::MAX`
130128
//!
131129
//! As a consequence of these guarantees, given any address `a` within the set
132-
//! of addresses of an allocation:
130+
//! of addresses of an allocated object:
133131
//! - It is guaranteed that `a - base` does not overflow `isize`
134132
//! - It is guaranteed that `a - base` is non-negative
135133
//! - It is guaranteed that, given `o = a - base` (i.e., the offset of `a` within
136-
//! the allocation), `base + o` will not wrap around the address space (in
134+
//! the allocated object), `base + o` will not wrap around the address space (in
137135
//! other words, will not overflow `usize`)
138136
//!
139137
//! [`null()`]: null
@@ -145,8 +143,8 @@
145143
//! and the freed memory gets reallocated before your read/write (in fact this is the
146144
//! worst-case scenario, UAFs would be much less concerning if this didn't happen!).
147145
//! As another example, consider that [`wrapping_offset`] is documented to "remember"
148-
//! the allocation that the original pointer points to, even if it is offset far
149-
//! outside the memory range occupied by that allocation.
146+
//! the allocated object that the original pointer points to, even if it is offset far
147+
//! outside the memory range occupied by that allocated object.
150148
//! To rationalize claims like this, pointers need to somehow be *more* than just their addresses:
151149
//! they must have **provenance**.
152150
//!
@@ -166,12 +164,12 @@
166164
//! writes. Note that this can interact with the other components, e.g. a pointer might permit
167165
//! mutation only for a subset of addresses, or only for a subset of its maximal timespan.
168166
//!
169-
//! When an [allocation] is created, it has a unique Original Pointer. For alloc
167+
//! When an [allocated object] is created, it has a unique Original Pointer. For alloc
170168
//! APIs this is literally the pointer the call returns, and for local variables and statics,
171169
//! this is the name of the variable/static. (This is mildly overloading the term "pointer"
172170
//! for the sake of brevity/exposition.)
173171
//!
174-
//! The Original Pointer for an allocation has provenance that constrains the *spatial*
172+
//! The Original Pointer for an allocated object has provenance that constrains the *spatial*
175173
//! permissions of this pointer to the memory range of the allocation, and the *temporal*
176174
//! permissions to the lifetime of the allocation. Provenance is implicitly inherited by all
177175
//! pointers transitively derived from the Original Pointer through operations like [`offset`],
@@ -199,10 +197,10 @@
199197
//! provenance since they access an empty range of memory.
200198
//!
201199
//! * It is undefined behavior to [`offset`] a pointer across a memory range that is not contained
202-
//! in the allocation it is derived from, or to [`offset_from`] two pointers not derived
203-
//! from the same allocation. Provenance is used to say what exactly "derived from" even
200+
//! in the allocated object it is derived from, or to [`offset_from`] two pointers not derived
201+
//! from the same allocated object. Provenance is used to say what exactly "derived from" even
204202
//! means: the lineage of a pointer is traced back to the Original Pointer it descends from, and
205-
//! that identifies the relevant allocation. In particular, it's always UB to offset a
203+
//! that identifies the relevant allocated object. In particular, it's always UB to offset a
206204
//! pointer derived from something that is now deallocated, except if the offset is 0.
207205
//!
208206
//! But it *is* still sound to:
@@ -223,7 +221,7 @@
223221
//! * Compare arbitrary pointers by address. Pointer comparison ignores provenance and addresses
224222
//! *are* just integers, so there is always a coherent answer, even if the pointers are dangling
225223
//! or from different provenances. Note that if you get "lucky" and notice that a pointer at the
226-
//! end of one allocation is the "same" address as the start of another allocation,
224+
//! end of one allocated object is the "same" address as the start of another allocated object,
227225
//! anything you do with that fact is *probably* going to be gibberish. The scope of that
228226
//! gibberish is kept under control by the fact that the two pointers *still* aren't allowed to
229227
//! access the other's allocation (bytes), because they still have different provenance.
@@ -376,7 +374,7 @@
376374
//! integer-to-pointer casts.
377375
//!
378376
//! [aliasing]: ../../nomicon/aliasing.html
379-
//! [allocation]: #allocation
377+
//! [allocated object]: #allocated-object
380378
//! [provenance]: #provenance
381379
//! [book]: ../../book/ch19-01-unsafe-rust.html#dereferencing-a-raw-pointer
382380
//! [ub]: ../../reference/behavior-considered-undefined.html
@@ -1023,7 +1021,7 @@ pub const unsafe fn swap<T>(x: *mut T, y: *mut T) {
10231021
// SAFETY: the caller must guarantee that `x` and `y` are
10241022
// valid for writes and properly aligned. `tmp` cannot be
10251023
// overlapping either `x` or `y` because `tmp` was just allocated
1026-
// on the stack as a separate allocation.
1024+
// on the stack as a separate allocated object.
10271025
unsafe {
10281026
copy_nonoverlapping(x, tmp.as_mut_ptr(), 1);
10291027
copy(y, x, 1); // `x` and `y` may overlap
@@ -1142,7 +1140,7 @@ pub const unsafe fn swap_nonoverlapping<T>(x: *mut T, y: *mut T, count: usize) {
11421140
// Going though a slice here helps codegen know the size fits in `isize`
11431141
let slice = slice_from_raw_parts_mut(x, count);
11441142
// SAFETY: This is all readable from the pointer, meaning it's one
1145-
// allocation, and thus cannot be more than isize::MAX bytes.
1143+
// allocated object, and thus cannot be more than isize::MAX bytes.
11461144
let bytes = unsafe { mem::size_of_val_raw::<[T]>(slice) };
11471145
if let Some(bytes) = NonZero::new(bytes) {
11481146
// SAFETY: These are the same ranges, just expressed in a different
@@ -1295,7 +1293,7 @@ pub const unsafe fn replace<T>(dst: *mut T, src: T) -> T {
12951293
// SAFETY: the caller must guarantee that `dst` is valid to be
12961294
// cast to a mutable reference (valid for writes, aligned, initialized),
12971295
// and cannot overlap `src` since `dst` must point to a distinct
1298-
// allocation.
1296+
// allocated object.
12991297
unsafe {
13001298
ub_checks::assert_unsafe_precondition!(
13011299
check_language_ub,
@@ -1542,7 +1540,7 @@ pub const unsafe fn read_unaligned<T>(src: *const T) -> T {
15421540
let mut tmp = MaybeUninit::<T>::uninit();
15431541
// SAFETY: the caller must guarantee that `src` is valid for reads.
15441542
// `src` cannot overlap `tmp` because `tmp` was just allocated on
1545-
// the stack as a separate allocation.
1543+
// the stack as a separate allocated object.
15461544
//
15471545
// Also, since we just wrote a valid value into `tmp`, it is guaranteed
15481546
// to be properly initialized.

0 commit comments

Comments
 (0)