Skip to content

Commit dfb910a

Browse files
committed
Add clarifying docs on pointer read write invariants
Signed-off-by: Alex Saveau <saveau.alexandre@gmail.com>
1 parent 4827cee commit dfb910a

File tree

1 file changed

+11
-1
lines changed

1 file changed

+11
-1
lines changed

library/core/src/ptr/mod.rs

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,8 @@
3535
//! be used for inter-thread synchronization.
3636
//! * The result of casting a reference to a pointer is valid for as long as the
3737
//! underlying object is live and no reference (just raw pointers) is used to
38-
//! access the same memory.
38+
//! access the same memory. That is, reference and pointer accesses cannot be
39+
//! interleaved—they must follow stacked borrows.
3940
//!
4041
//! These axioms, along with careful use of [`offset`] for pointer arithmetic,
4142
//! are enough to correctly implement many useful things in unsafe code. Stronger guarantees
@@ -64,6 +65,15 @@
6465
//! separate allocated object), heap allocations (each allocation created by the global allocator is
6566
//! a separate allocated object), and `static` variables.
6667
//!
68+
//! ## A note on read vs. write invariants
69+
//!
70+
//! Both the pointer and the pointee's invariants must be satisfied when reading from a pointer,
71+
//! but only the pointer's invariants must be satisfied when writing. It is not considered UB to write
72+
//! data that violates a type's invariants so long as the type's invariants are satisfied by the time
73+
//! it is read, either through the raw pointer or the reference it originated from. This means a type
74+
//! may freely transition between valid and invalid states when being written to by raw pointers.
75+
//! Thus, when discussing safety, it may be useful to separately assert the validity of the pointer vs.
76+
//! the validity of the data it points to.
6777
//!
6878
//! # Strict Provenance
6979
//!

0 commit comments

Comments
 (0)