Replace unstable strict_provenance feature with crate

**Description**
 - Remove `strict_provenance` and replace with usage of `sptr` crate,
   which is by the same person who authored the strict provenance
   change.
 - Add miri testing section with flags that should enable testing of
   strict provenance.
 - Also fix `perfcnt` and `criterion-perf-events` accidentally being
   added to regular dependencies. Moved those back to dev-dependencies.

**Motivation**
Partial progress towards #20.

Ideally we'd just use the strict_provenance APIs in the standard lib,
but those are still unstable (probably will be for some time).

**Testing Done**
 - `cargo build --all-targets`
 - `cargo test`
 - `cargo miri test`
 - `cargo clippy`

Cargo.toml

@@ -4,6 +4,9 @@ version = "0.1.0"
 edition = "2021"
 license = "MIT OR Apache-2.0"
 
+[dependencies]
+sptr = "0.3.2"
+
 [dependencies.tinyvec]
 version = "1.6.0"
 features = ["std", "rustc_1_57"]
@@ -14,7 +17,7 @@ criterion = { version = "0.3.5", features = ["html_reports"] }
 dhat = "0.3.0"
 rustc-hash = "1.1.0"
 
-[target.'cfg(target_arch = "x86")'.dependencies]
+[target.'cfg(target_arch = "x86")'.dev-dependencies]
 criterion-perf-events = "0.1.4"
 perfcnt = "0.7.2"
 

README.md

@@ -4,6 +4,18 @@
 
 - [Documentation for the `main` branch](https://declanvk.github.io/blart/)
 
+## Testing
+
+### Miri
+
+Currently we're using some specific crates (`sptr` and in the future back to `core::ptr::*`) to ensure that we're compatible with [Strict Provenance][sp-issue]. The following `MIRIFLAGS` setup should enable checking to make sure that we're compatible.
+
+```bash
+MIRIFLAGS="-Zmiri-strict-provenance -Zmiri-symbolic-alignment-check" cargo miri test
+```
+
+I think this is useful because we're doing some pointer times with our tagged pointers implementation, mutating the contents of the pointer to store bits of data.
+
 ## Fuzzing
 
 To run the fuzzer I use the command:
@@ -58,3 +70,5 @@ at your option.
 Unless you explicitly state otherwise, any contribution intentionally submitted
 for inclusion in the work by you, as defined in the Apache-2.0 license, shall be
 dual licensed as above, without any additional terms or conditions.
+
+[sp-issue]: https://github.com/rust-lang/rust/issues/95228

src/lib.rs

@@ -1,5 +1,6 @@
 // TODO(#20): Use rust stable distribution, remove usage of nightly features
-#![feature(slice_ptr_get, strict_provenance, hasher_prefixfree_extras)]
+#![feature(slice_ptr_get, hasher_prefixfree_extras)]
+#![allow(unstable_name_collisions)]
 #![deny(
     missing_docs,
     clippy::missing_safety_doc,

src/nodes/representation/iterators.rs

@@ -1,3 +1,5 @@
+use sptr::Strict;
+
 use super::*;
 use std::{
     iter::FusedIterator,

src/nodes/representation/tests.rs

@@ -1,3 +1,5 @@
+use sptr::Strict;
+
 use super::*;
 use std::mem;
 

src/tagged_pointer.rs

@@ -8,14 +8,23 @@
 //! pointed-to type, so that it can store several bits of information. For a
 //! type with alignment `A`, the number of available bits is `log_2(A)`.
 
-use std::{fmt, mem::align_of, num::NonZeroUsize, ptr::NonNull};
+use std::{fmt, mem::align_of, ptr::NonNull};
+
+use sptr::Strict;
 
 /// A non-null pointer type which carries several bits of metadata.
 #[repr(transparent)]
 pub struct TaggedPointer<P>(NonNull<P>);
 
 impl<P> TaggedPointer<P> {
     /// The ABI-required minimum alignment of the `P` type.
+    ///
+    /// The maximum alignment of a rust type is 2^29 according to the
+    /// [reference][align-reference]. On 32-bit and 64-bit platforms that means
+    /// that it is impossible for the POINTER_MASK to be zero, there must be at
+    /// least 3 bit present.
+    ///
+    /// [align-reference]: https://doc.rust-lang.org/reference/type-layout.html#the-alignment-modifiers
     pub const ALIGNMENT: usize = align_of::<P>();
     /// A mask for data-carrying bits of the pointer.
     pub const DATA_MASK: usize = !Self::POINTER_MASK;
@@ -63,12 +72,12 @@ impl<P> TaggedPointer<P> {
         // assumes that null is always a zero value.
         let unchecked_ptr = unsafe { NonNull::new_unchecked(pointer) };
 
-        let ptr_addr = unchecked_ptr.addr();
+        let ptr_addr = unchecked_ptr.as_ptr().addr();
 
         // Double-check that there are no existing bits stored in the data-carrying
         // positions
         assert_eq!(
-            ptr_addr.get() & Self::DATA_MASK,
+            ptr_addr & Self::DATA_MASK,
             0,
             "this pointer was not aligned"
         );
@@ -98,18 +107,14 @@ impl<P> TaggedPointer<P> {
     /// This pointer is guaranteed to be non-null.
     pub fn to_ptr(self) -> *mut P {
         self.0
-            .map_addr(|ptr_addr| {
-                // SAFETY: The result is guaranteed to be non-zero because this tagged pointer
-                // was created with the same non-zero value.
-                unsafe { NonZeroUsize::new_unchecked(ptr_addr.get() & Self::POINTER_MASK) }
-            })
             .as_ptr()
+            .map_addr(|ptr_addr| ptr_addr & Self::POINTER_MASK)
     }
 
     /// Consume this tagged pointer and produce the data it carries.
     pub fn to_data(self) -> usize {
-        let ptr_addr = self.0.addr();
-        ptr_addr.get() & Self::DATA_MASK
+        let ptr_addr = self.0.as_ptr().addr();
+        ptr_addr & Self::DATA_MASK
     }
 
     /// Update the data this tagged pointer carries to a new value.
@@ -125,15 +130,18 @@ impl<P> TaggedPointer<P> {
         );
         let data = data & Self::DATA_MASK;
 
-        self.0 = self.0.map_addr(|ptr_addr| {
-            let new_addr = (ptr_addr.get() & Self::POINTER_MASK) | data;
-
-            // clear the data bits and then write the new data
-            // SAFETY: This value will always be non-zero because the upper bits (from
-            // POINTER_MASK) will always be non-zero. This a property of the type and its
-            // construction.
-            unsafe { NonZeroUsize::new_unchecked(new_addr) }
+        let ptr_with_new_data = self.0.as_ptr().map_addr(|ptr_addr| {
+            (ptr_addr & Self::POINTER_MASK) | data
         });
+
+        // The `ptr_with_new_data` is guaranteed to be non-null because it's pointer
+        // address was derived from a non-null pointer using operations that would not
+        // have zeroed out the address.
+        //
+        // The bit-and operation combining the original pointer address (non-null)
+        // combined with the POINTER_MASK would not have produced a zero value because
+        // the POINTER_MASK value must have the high bits set.
+        self.0 = unsafe { NonNull::new_unchecked(ptr_with_new_data) };
     }
 
     /// Casts to a [`TaggedPointer`] of another type.
@@ -423,7 +431,7 @@ mod tests {
             0b11111111_11111111_11111111_11111111_11111111_11111111_11111111_11111000usize
         );
 
-        // Something weird about the representation of u128 on x86 vs aarch64 platforms: 
+        // Something weird about the representation of u128 on x86 vs aarch64 platforms:
         // https://github.com/rust-lang/rust/issues/54341
         if cfg!(target_arch = "x86") {
             assert_eq!(TaggedPointer::<u128>::ALIGNMENT, 8);