Trait TryTransmuteFromPtr 

pub unsafe trait TryTransmuteFromPtr<Src: ?Sized, A: Aliasing, SV: Validity, DV: Validity, C: CastExact<Src, Self>, R> { }

Transmutations which are sound to attempt, conditional on validating the bit validity of the destination type.

If a Ptr transmutation is TryTransmuteFromPtr, then it is sound to perform that transmutation so long as some additional mechanism is used to validate that the referent is bit-valid for the destination type. That validation mechanism could be a type bound (such as TransmuteFrom) or a runtime validity check.

Safety

Post-conditions

Given Dst: TryTransmuteFromPtr<Src, A, SV, DV, C, _>, callers may assume the following:

Given src: Ptr<'a, Src, (A, _, SV)>, if the referent of src is DV-valid for Dst, then it is sound to transmute src into dst: Ptr<'a, Dst, (A, Unaligned, DV)> using C.

Pre-conditions

Given src: Ptr<Src, (A, _, SV)> and dst: Ptr<Dst, (A, Unaligned, DV)>, Dst: TryTransmuteFromPtr<Src, A, SV, DV, C, _> is sound if all of the following hold:

• Forwards transmutation: Either of the following hold:
  • So long as dst is active, no mutation of dst’s referent is allowed except via dst itself
  • The set of DV-valid referents of dst is a superset of the set of SV-valid referents of src (NOTE: this condition effectively bans shrinking or overwriting transmutes, which cannot satisfy this condition)
• Reverse transmutation: Either of the following hold:
  • dst does not permit mutation of its referent
  • The set of DV-valid referents of dst is a subset of the set of SV-valid referents of src (NOTE: this condition effectively bans shrinking or overwriting transmutes, which cannot satisfy this condition)
• No safe code, given access to src and dst, can cause undefined behavior: Any of the following hold:
  • A is Exclusive
  • Src: Immutable and Dst: Immutable
  • It is sound for shared code to operate on a &Src and &Dst which reference the same byte range at the same time

Proof

Given:

• src: Ptr<'a, Src, (A, _, SV)>
• src’s referent is DV-valid for Dst

We are trying to prove that it is sound to perform a cast from src to a dst: Ptr<'a, Dst, (A, Unaligned, DV)> using C. We need to prove that such a cast does not violate any of src’s invariants, and that it satisfies all invariants of the destination Ptr type.

First, by C: CastExact, src’s address is unchanged, so it still satisfies its alignment. Since dst’s alignment is Unaligned, it trivially satisfies its alignment.

Second, aliasing is either Exclusive or Shared:

• If it is Exclusive, then both src and dst satisfy Exclusive aliasing trivially: since src and dst have the same lifetime, src is inaccessible so long as dst is alive, and no other live Ptrs or references may reference the same referent.
• If it is Shared, then either:
  • Src: Immutable and Dst: Immutable, and so neither src nor dst permit interior mutation.
  • It is explicitly sound for safe code to operate on a &Src and a &Dst pointing to the same byte range at the same time.

Third, src’s validity is satisfied. By invariant, src’s referent began as an SV-valid Src. It is guaranteed to remain so, as either of the following hold:

• dst does not permit mutation of its referent.
• The set of DV-valid referents of dst is a subset of the set of SV-valid referents of src. Thus, any value written via dst is guaranteed to be an SV-valid referent of src.

Fourth, dst’s validity is satisfied. It is a given of this proof that the referent is DV-valid for Dst. It is guaranteed to remain so, as either of the following hold:

• So long as dst is active, no mutation of the referent is allowed except via dst itself.
• The set of DV-valid referents of dst is a superset of the set of SV-valid referents of src. Thus, any value written via src is guaranteed to be a DV-valid referent of dst.

Dyn Compatibility

This trait is not dyn compatible.

In older versions of Rust, dyn compatibility was called "object safety".

Implementors

impl<Src, Dst, SV, DV, A, C, R> TryTransmuteFromPtr<Src, A, SV, DV, C, (BecauseMutationCompatible, R)> for Dst

where A: Aliasing, SV: Validity, DV: Validity, Src: TransmuteFrom<Dst, DV, SV> + ?Sized, Dst: MutationCompatible<Src, A, SV, DV, R> + ?Sized, C: CastExact<Src, Dst>,

impl<Src, Dst, SV, DV, C> TryTransmuteFromPtr<Src, Shared, SV, DV, C, BecauseImmutable> for Dst

where SV: Validity, DV: Validity, Src: Immutable + ?Sized, Dst: Immutable + ?Sized, C: CastExact<Src, Dst>,