size_of_val_raw: for length 0 this is safe to call · model-checking/verify-rust-std@a7bec56 (original) (raw)

2 files changed

lines changed

Original file line number Diff line number Diff line change
@@ -183,6 +183,8 @@ impl Layout {
183 183 /// - a [slice], then the length of the slice tail must be an initialized
184 184 /// integer, and the size of the *entire value*
185 185 /// (dynamic tail length + statically sized prefix) must fit in `isize`.
186 + /// For the special case where the dynamic tail length is 0, this function
187 + /// is safe to call.
186 188 /// - a [trait object], then the vtable part of the pointer must point
187 189 /// to a valid vtable for the type `T` acquired by an unsizing coercion,
188 190 /// and the size of the *entire value*
Original file line number Diff line number Diff line change
@@ -359,6 +359,12 @@ pub const fn size_of_val<T: ?Sized>(val: &T) -> usize {
359 359 /// - a [slice], then the length of the slice tail must be an initialized
360 360 /// integer, and the size of the *entire value*
361 361 /// (dynamic tail length + statically sized prefix) must fit in `isize`.
362 +/// For the special case where the dynamic tail length is 0, this function
363 +/// is safe to call.
364 +// NOTE: the reason this is safe is that if an overflow were to occur already with size 0,
365 +// then we would stop compilation as even the "statically known" part of the type would
366 +// already be too big (or the call may be in dead code and optimized away, but then it
367 +// doesn't matter).
362 368 /// - a [trait object], then the vtable part of the pointer must point
363 369 /// to a valid vtable acquired by an unsizing coercion, and the size
364 370 /// of the *entire value* (dynamic tail length + statically sized prefix)
@@ -506,6 +512,8 @@ pub const fn align_of_val<T: ?Sized>(val: &T) -> usize {
506 512 /// - a [slice], then the length of the slice tail must be an initialized
507 513 /// integer, and the size of the *entire value*
508 514 /// (dynamic tail length + statically sized prefix) must fit in `isize`.
515 +/// For the special case where the dynamic tail length is 0, this function
516 +/// is safe to call.
509 517 /// - a [trait object], then the vtable part of the pointer must point
510 518 /// to a valid vtable acquired by an unsizing coercion, and the size
511 519 /// of the *entire value* (dynamic tail length + statically sized prefix)