Trait TryTransmuteFromPtr 

pub unsafe trait TryTransmuteFromPtr<Src: ?Sized, A: Aliasing, SV: Validity, DV: Validity, C: CastExact<Src, Self>, R> { }

Transmutations which are sound to attempt, conditional on validating the bit validity of the destination type.

If a Ptr transmutation is TryTransmuteFromPtr, then it is sound to perform that transmutation so long as some additional mechanism is used to validate that the referent is bit-valid for the destination type. That validation mechanism could be a type bound (such as TransmuteFrom) or a runtime validity check.

Safety

Post-conditions

Given Dst: TryTransmuteFromPtr<Src, A, SV, DV, C, _>, callers may assume the following:

Given src: Ptr<'a, Src, (A, _, SV)>, if the referent of src is DV-valid for Dst, then it is sound to transmute src into dst: Ptr<'a, Dst, (A, Unaligned, DV)> using C.

Pre-conditions

Given src: Ptr<Src, (A, _, SV)> and dst: Ptr<Dst, (A, Unaligned, DV)>, Dst: TryTransmuteFromPtr<Src, A, SV, DV, C, _> is sound if all of the following hold:

• Forwards transmutation: Either of the following hold:
  • So long as dst is active, no mutation of dst’s referent is allowed except via dst itself
  • The set of DV-valid referents of dst is a superset of the set of SV-valid referents of src (NOTE: this condition effectively bans shrinking or overwriting transmutes, which cannot satisfy this condition)
• Reverse transmutation: Either of the following hold:
  • dst does not permit mutation of its referent
  • The set of DV-valid referents of dst is a subset of the set of SV-valid referents of src (NOTE: this condition effectively bans shrinking or overwriting transmutes, which cannot satisfy this condition)
• No safe code, given access to src and dst, can cause undefined behavior: Any of the following hold:
  • A is Exclusive
  • Src: Immutable and Dst: Immutable
  • It is sound for shared code to operate on a &Src and &Dst which reference the same byte range at the same time

Proof

Given:

• src: Ptr<'a, Src, (A, _, SV)>
• src’s referent is DV-valid for Dst

We are trying to prove that it is sound to perform a cast from src to a dst: Ptr<'a, Dst, (A, Unaligned, DV)> using C. We need to prove that such a cast does not violate any of src’s invariants, and that it satisfies all invariants of the destination Ptr type.

First, by C: CastExact, src’s address is unchanged, so it still satisfies its alignment. Since dst’s alignment is Unaligned, it trivially satisfies its alignment.

Second, aliasing is either Exclusive or Shared:

• If it is Exclusive, then both src and dst satisfy Exclusive aliasing trivially: since src and dst have the same lifetime, src is inaccessible so long as dst is alive, and no other live Ptrs or references may reference the same referent.
• If it is Shared, then either:
  • Src: Immutable and Dst: Immutable, and so neither src nor dst permit interior mutation.
  • It is explicitly sound for safe code to operate on a &Src and a &Dst pointing to the same byte range at the same time.

Third, src’s validity is satisfied. By invariant, src’s referent began as an SV-valid Src. It is guaranteed to remain so, as either of the following hold:

• dst does not permit mutation of its referent.
• The set of DV-valid referents of dst is a subset of the set of SV-valid referents of src. Thus, any value written via dst is guaranteed to be an SV-valid referent of src.

Fourth, dst’s validity is satisfied. It is a given of this proof that the referent is DV-valid for Dst. It is guaranteed to remain so, as either of the following hold:

• So long as dst is active, no mutation of the referent is allowed except via dst itself.
• The set of DV-valid referents of dst is a superset of the set of SV-valid referents of src. Thus, any value written via src is guaranteed to be a DV-valid referent of dst.

Dyn Compatibility

This trait is not dyn compatible.

In older versions of Rust, dyn compatibility was called "object safety", so this trait is not object safe.

Implementors

impl<Src, Dst, SV, DV, A, C, R> TryTransmuteFromPtr<Src, A, SV, DV, C, (BecauseMutationCompatible, R)> for Dst

where A: Aliasing, SV: Validity, DV: Validity, Src: TransmuteFrom<Dst, DV, SV> + ?Sized, Dst: MutationCompatible<Src, A, SV, DV, R> + ?Sized, C: CastExact<Src, Dst>,

impl<Src, Dst, SV, DV, C> TryTransmuteFromPtr<Src, Shared, SV, DV, C, BecauseImmutable> for Dst

where SV: Validity, DV: Validity, Src: Immutable + ?Sized, Dst: Immutable + ?Sized, C: CastExact<Src, Dst>,