bjoernager/rust
bjoernager/rust
1
Fork 0
Code Issues Pull requests Activity

slice: Remove some uses of unsafe in first/last chunk methods

Browse source 
Remove unsafe `split_at_unchecked` and `split_at_mut_unchecked`
in some slice `split_first_chunk`/`split_last_chunk` methods.
Replace those calls with the safe `split_at` and `split_at_checked` where
applicable.

Add codegen tests to check for no panics when calculating the last
chunk index using `checked_sub` and `split_at`
This commit is contained in:
okaneco 2025-03-29 14:47:09 -04:00
parent 45b40a7596
commit 59ca7679c7
2 changed files with 57 additions and 59 deletions
Download patch file Download diff file Expand all files Collapse all files

92
library/core/src/slice/mod.rs
View file

@ -382,16 +382,11 @@ impl<T> [T] {
#[stable(feature = "slice_first_last_chunk", since = "1.77.0")]
#[rustc_const_stable(feature = "slice_first_last_chunk", since = "1.77.0")]
pub const fn split_first_chunk<const N: usize>(&self) -> Option<(&[T; N], &[T])> {
if self.len() < N {
None
} else {
// SAFETY: We manually verified the bounds of the split.
let (first, tail) = unsafe { self.split_at_unchecked(N) };
let Some((first, tail)) = self.split_at_checked(N) else { return None };
// SAFETY: We explicitly check for the correct number of elements,
// and do not let the references outlive the slice.
Some((unsafe { &*(first.as_ptr().cast::<[T; N]>()) }, tail))
}
// SAFETY: We explicitly check for the correct number of elements,
// and do not let the references outlive the slice.
Some((unsafe { &*(first.as_ptr().cast::<[T; N]>()) }, tail))
}
/// Returns a mutable array reference to the first `N` items in the slice and the remaining
@ -419,17 +414,12 @@ impl<T> [T] {
pub const fn split_first_chunk_mut<const N: usize>(
&mut self,
) -> Option<(&mut [T; N], &mut [T])> {
if self.len() < N {
None
} else {
// SAFETY: We manually verified the bounds of the split.
let (first, tail) = unsafe { self.split_at_mut_unchecked(N) };
let Some((first, tail)) = self.split_at_mut_checked(N) else { return None };
// SAFETY: We explicitly check for the correct number of elements,
// do not let the reference outlive the slice,
// and enforce exclusive mutability of the chunk by the split.
Some((unsafe { &mut *(first.as_mut_ptr().cast::<[T; N]>()) }, tail))
}
// SAFETY: We explicitly check for the correct number of elements,
// do not let the reference outlive the slice,
// and enforce exclusive mutability of the chunk by the split.
Some((unsafe { &mut *(first.as_mut_ptr().cast::<[T; N]>()) }, tail))
}
/// Returns an array reference to the last `N` items in the slice and the remaining slice.
@ -452,16 +442,12 @@ impl<T> [T] {
#[stable(feature = "slice_first_last_chunk", since = "1.77.0")]
#[rustc_const_stable(feature = "slice_first_last_chunk", since = "1.77.0")]
pub const fn split_last_chunk<const N: usize>(&self) -> Option<(&[T], &[T; N])> {
if self.len() < N {
None
} else {
// SAFETY: We manually verified the bounds of the split.
let (init, last) = unsafe { self.split_at_unchecked(self.len() - N) };
let Some(index) = self.len().checked_sub(N) else { return None };
let (init, last) = self.split_at(index);
// SAFETY: We explicitly check for the correct number of elements,
// and do not let the references outlive the slice.
Some((init, unsafe { &*(last.as_ptr().cast::<[T; N]>()) }))
}
// SAFETY: We explicitly check for the correct number of elements,
// and do not let the references outlive the slice.
Some((init, unsafe { &*(last.as_ptr().cast::<[T; N]>()) }))
}
/// Returns a mutable array reference to the last `N` items in the slice and the remaining
@ -489,17 +475,13 @@ impl<T> [T] {
pub const fn split_last_chunk_mut<const N: usize>(
&mut self,
) -> Option<(&mut [T], &mut [T; N])> {
if self.len() < N {
None
} else {
// SAFETY: We manually verified the bounds of the split.
let (init, last) = unsafe { self.split_at_mut_unchecked(self.len() - N) };
let Some(index) = self.len().checked_sub(N) else { return None };
let (init, last) = self.split_at_mut(index);
// SAFETY: We explicitly check for the correct number of elements,
// do not let the reference outlive the slice,
// and enforce exclusive mutability of the chunk by the split.
Some((init, unsafe { &mut *(last.as_mut_ptr().cast::<[T; N]>()) }))
}
// SAFETY: We explicitly check for the correct number of elements,
// do not let the reference outlive the slice,
// and enforce exclusive mutability of the chunk by the split.
Some((init, unsafe { &mut *(last.as_mut_ptr().cast::<[T; N]>()) }))
}
/// Returns an array reference to the last `N` items in the slice.
@ -522,17 +504,13 @@ impl<T> [T] {
#[stable(feature = "slice_first_last_chunk", since = "1.77.0")]
#[rustc_const_stable(feature = "const_slice_last_chunk", since = "1.80.0")]
pub const fn last_chunk<const N: usize>(&self) -> Option<&[T; N]> {
if self.len() < N {
None
} else {
// SAFETY: We manually verified the bounds of the slice.
// FIXME(const-hack): Without const traits, we need this instead of `get_unchecked`.
let last = unsafe { self.split_at_unchecked(self.len() - N).1 };
// FIXME(const-hack): Without const traits, we need this instead of `get`.
let Some(index) = self.len().checked_sub(N) else { return None };
let (_, last) = self.split_at(index);
// SAFETY: We explicitly check for the correct number of elements,
// and do not let the references outlive the slice.
Some(unsafe { &*(last.as_ptr().cast::<[T; N]>()) })
}
// SAFETY: We explicitly check for the correct number of elements,
// and do not let the references outlive the slice.
Some(unsafe { &*(last.as_ptr().cast::<[T; N]>()) })
}
/// Returns a mutable array reference to the last `N` items in the slice.
@ -556,18 +534,14 @@ impl<T> [T] {
#[stable(feature = "slice_first_last_chunk", since = "1.77.0")]
#[rustc_const_stable(feature = "const_slice_first_last_chunk", since = "1.83.0")]
pub const fn last_chunk_mut<const N: usize>(&mut self) -> Option<&mut [T; N]> {
if self.len() < N {
None
} else {
// SAFETY: We manually verified the bounds of the slice.
// FIXME(const-hack): Without const traits, we need this instead of `get_unchecked`.
let last = unsafe { self.split_at_mut_unchecked(self.len() - N).1 };
// FIXME(const-hack): Without const traits, we need this instead of `get`.
let Some(index) = self.len().checked_sub(N) else { return None };
let (_, last) = self.split_at_mut(index);
// SAFETY: We explicitly check for the correct number of elements,
// do not let the reference outlive the slice,
// and require exclusive access to the entire slice to mutate the chunk.
Some(unsafe { &mut *(last.as_mut_ptr().cast::<[T; N]>()) })
}
// SAFETY: We explicitly check for the correct number of elements,
// do not let the reference outlive the slice,
// and require exclusive access to the entire slice to mutate the chunk.
Some(unsafe { &mut *(last.as_mut_ptr().cast::<[T; N]>()) })
}
/// Returns a reference to an element or subslice depending on the type of

24
tests/codegen/slice-split-at.rs Normal file
View file

@ -0,0 +1,24 @@
//@ compile-flags: -Copt-level=3
#![crate_type = "lib"]
// Check that no panic is generated in `split_at` when calculating the index for
// the tail chunk using `checked_sub`.
//
// Tests written for refactored implementations of:
// `<[T]>::{split_last_chunk, split_last_chunk_mut, last_chunk, last_chunk_mut}`
// CHECK-LABEL: @split_at_last_chunk
#[no_mangle]
pub fn split_at_last_chunk(s: &[u8], chunk_size: usize) -> Option<(&[u8], &[u8])> {
// CHECK-NOT: panic
let Some(index) = s.len().checked_sub(chunk_size) else { return None };
Some(s.split_at(index))
}
// CHECK-LABEL: @split_at_mut_last_chunk
#[no_mangle]
pub fn split_at_mut_last_chunk(s: &mut [u8], chunk_size: usize) -> Option<(&mut [u8], &mut [u8])> {
// CHECK-NOT: panic
let Some(index) = s.len().checked_sub(chunk_size) else { return None };
Some(s.split_at_mut(index))
}