more explicitly state the basic rules of working with the obtained ra… · model-checking/verify-rust-std@33389b0 (original) (raw)

Original file line number Diff line number Diff line change
@@ -779,6 +779,15 @@ where
779 779 ///
780 780 /// For `r: &T`, `from_ref(r)` is equivalent to `r as *const T`, but is a bit safer since it will
781 781 /// never silently change type or mutability, in particular if the code is refactored.
782 +///
783 +/// The caller must ensure that the pointee outlives the pointer this function returns, or else it
784 +/// will end up pointing to garbage.
785 +///
786 +/// The caller must also ensure that the memory the pointer (non-transitively) points to is never
787 +/// written to (except inside an `UnsafeCell`) using this pointer or any pointer derived from it. If
788 +/// you need to mutate the pointee, use [`from_mut`]`. Specifically, to turn a mutable reference `m:
789 +/// &mut T` into `*const T`, prefer `from_mut(m).cast_const()` to obtain a pointer that can later be
790 +/// used for mutation.
782 791 #[inline(always)]
783 792 #[must_use]
784 793 #[stable(feature = "ptr_from_ref", since = "1.76.0")]
@@ -791,6 +800,9 @@ pub const fn from_ref<T: ?Sized>(r: &T) -> *const T {
791 800
792 801 /// Convert a mutable reference to a raw pointer.
793 802 ///
803 +/// The caller must ensure that the pointee outlives the pointer this function returns, or else it
804 +/// will end up pointing to garbage.
805 +///
794 806 /// For `r: &mut T`, `from_mut(r)` is equivalent to `r as *mut T`, but is a bit safer since it will
795 807 /// never silently change type or mutability, in particular if the code is refactored.
796 808 #[inline(always)]