FromZeros boxed slice method supports slice DSTs

Change methods that allocate to return a new error, `AllocError`, on
allocation failure rather than panicking or aborting.

Makes progress on #29

src/error.rs

@@ -570,6 +570,20 @@ impl<Src, Dst: ?Sized + TryFromBytes> TryReadError<Src, Dst> {
  }
 }
 
+/// The error type of a failed allocation.
+///
+/// This type is intended to be deprecated in favor of the standard library's
+/// [`AllocError`] type once it is stabilized. When that happens, this type will
+/// be replaced by a type alias to the standard library type. We do not intend
+/// to treat this as a breaking change; users who wish to avoid breakage should
+/// avoid writing code which assumes that this is *not* such an alias. For
+/// example, implementing the same trait for both types will result in an impl
+/// conflict once this type is an alias.
+///
+/// [`AllocError`]: https://doc.rust-lang.org/alloc/alloc/struct.AllocError.html
+#[derive(Copy, Clone, PartialEq, Eq, Debug)]
+pub struct AllocError;
+
 #[cfg(test)]
 mod tests {
  use super::*;

src/impls.rs

@@ -1020,7 +1020,7 @@ mod tests {
  impl<T: FromBytes> TryFromBytesTestable for T {
  fn with_passing_test_cases<F: Fn(Box<Self>)>(f: F) {
  // Test with a zeroed value.
- f(Self::new_box_zeroed());
+ f(Self::new_box_zeroed().unwrap());
 
  let ffs = {
  let mut t = Self::new_zeroed();

src/lib.rs

@@ -2113,14 +2113,15 @@ pub unsafe trait FromZeros: TryFromBytes {
  /// Note that `Box<Self>` can be converted to `Arc<Self>` and other
  /// container types without reallocation.
  ///
- /// # Panics
+ /// # Errors
  ///
- /// Panics if allocation of `size_of::<Self>()` bytes fails.
+ /// Returns an error on allocation failure. Allocation failure is guaranteed
+ /// never to cause a panic or an abort.
  #[must_use = "has no side effects (other than allocation)"]
  #[cfg(any(feature = "alloc", test))]
  #[cfg_attr(doc_cfg, doc(cfg(feature = "alloc")))]
  #[inline]
- fn new_box_zeroed() -> Box<Self>
+ fn new_box_zeroed() -> Result<Box<Self>, AllocError>
  where
  Self: Sized,
  {
@@ -2146,22 +2147,18 @@ pub unsafe trait FromZeros: TryFromBytes {
  // [2] Per https://doc.rust-lang.org/std/ptr/struct.NonNull.html#method.dangling:
  //
  // Creates a new `NonNull` that is dangling, but well-aligned.
- unsafe {
- return Box::from_raw(NonNull::dangling().as_ptr());
- }
+ return Ok(unsafe { Box::from_raw(NonNull::dangling().as_ptr()) });
  }
 
  // TODO(#429): Add a "SAFETY" comment and remove this `allow`.
  #[allow(clippy::undocumented_unsafe_blocks)]
  let ptr = unsafe { alloc::alloc::alloc_zeroed(layout).cast::<Self>() };
  if ptr.is_null() {
- alloc::alloc::handle_alloc_error(layout);
+ return Err(AllocError);
  }
  // TODO(#429): Add a "SAFETY" comment and remove this `allow`.
  #[allow(clippy::undocumented_unsafe_blocks)]
- unsafe {
- Box::from_raw(ptr)
- }
+ Ok(unsafe { Box::from_raw(ptr) })
  }
 
  /// Creates a `Box<[Self]>` (a boxed slice) from zeroed bytes.
@@ -2181,22 +2178,24 @@ pub unsafe trait FromZeros: TryFromBytes {
  /// actual information, but its `len()` property will report the correct
  /// value.
  ///
- /// # Panics
+ /// # Errors
  ///
- /// * Panics if `size_of::<Self>() * len` overflows.
- /// * Panics if allocation of `size_of::<Self>() * len` bytes fails.
+ /// Returns an error on allocation failure. Allocation failure is
+ /// guaranteed never to cause a panic or an abort.
  #[must_use = "has no side effects (other than allocation)"]
  #[cfg(feature = "alloc")]
  #[cfg_attr(doc_cfg, doc(cfg(feature = "alloc")))]
  #[inline]
- fn new_box_slice_zeroed(len: usize) -> Box<[Self]>
+ fn new_box_zeroed_with_elems(count: usize) -> Result<Box<Self>, AllocError>
  where
- Self: Sized,
+ Self: KnownLayout<PointerMetadata = usize>,
  {
- let size = mem::size_of::<Self>()
- .checked_mul(len)
- .expect("mem::size_of::<Self>() * len overflows `usize`");
- let align = mem::align_of::<Self>();
+ let size = match count.size_for_metadata(Self::LAYOUT) {
+ Some(size) => size,
+ None => return Err(AllocError),
+ };
+
+ let align = Self::LAYOUT.align.get();
  // On stable Rust versions <= 1.64.0, `Layout::from_size_align` has a
  // bug in which sufficiently-large allocations (those which, when
  // rounded up to the alignment, overflow `isize`) are not rejected,
@@ -2205,32 +2204,73 @@ pub unsafe trait FromZeros: TryFromBytes {
  // TODO(#67): Once our MSRV is > 1.64.0, remove this assertion.
  #[allow(clippy::as_conversions)]
  let max_alloc = (isize::MAX as usize).saturating_sub(align);
- assert!(size <= max_alloc);
+ if size > max_alloc {
+ return Err(AllocError);
+ }
+
  // TODO(https://github.com/rust-lang/rust/issues/55724): Use
  // `Layout::repeat` once it's stabilized.
- let layout =
- Layout::from_size_align(size, align).expect("total allocation size overflows `isize`");
+ let layout = Layout::from_size_align(size, align).or(Err(AllocError))?;
 
  let ptr = if layout.size() != 0 {
  // TODO(#429): Add a "SAFETY" comment and remove this `allow`.
  #[allow(clippy::undocumented_unsafe_blocks)]
- let ptr = unsafe { alloc::alloc::alloc_zeroed(layout).cast::<Self>() };
- if ptr.is_null() {
- alloc::alloc::handle_alloc_error(layout);
+ let ptr = unsafe { alloc::alloc::alloc_zeroed(layout) };
+ match NonNull::new(ptr) {
+ Some(ptr) => ptr,
+ None => return Err(AllocError),
  }
- ptr
  } else {
+ let align = Self::LAYOUT.align.get();
+ // We use `transmute` instead of an `as` cast since Miri (with
+ // strict provenance enabled) notices and complains that an `as`
+ // cast creates a pointer with no provenance. Miri isn't smart
+ // enough to realize that we're only executing this branch when
+ // we're constructing a zero-sized `Box`, which doesn't require
+ // provenance.
+ //
+ // SAFETY: any initialized bit sequence is a bit-valid `*mut u8`.
+ // All bits of a `usize` are initialized.
+ let dangling = unsafe { mem::transmute::<usize, *mut u8>(align) };
+ // SAFETY: `dangling` is constructed from `Self::LAYOUT.align`,
+ // which is a `NonZeroUsize`, which is guaranteed to be non-zero.
+ //
  // `Box<[T]>` does not allocate when `T` is zero-sized or when `len`
  // is zero, but it does require a non-null dangling pointer for its
  // allocation.
- NonNull::<Self>::dangling().as_ptr()
+ //
+ // TODO(https://github.com/rust-lang/rust/issues/95228): Use
+ // `std::ptr::without_provenance` once it's stable. That may
+ // optimize better. As written, Rust may assume that this consumes
+ // "exposed" provenance, and thus Rust may have to assume that this
+ // may consume provenance from any pointer whose provenance has been
+ // exposed.
+ #[allow(fuzzy_provenance_casts)]
+ unsafe {
+ NonNull::new_unchecked(dangling)
+ }
  };
 
- // TODO(#429): Add a "SAFETY" comment and remove this `allow`.
+ let ptr = Self::raw_from_ptr_len(ptr, count);
+
+ // TODO(#429): Add a "SAFETY" comment and remove this `allow`. Make sure
+ // to include a justification that `ptr.as_ptr()` is validly-aligned in
+ // the ZST case (in which we manually construct a dangling pointer).
  #[allow(clippy::undocumented_unsafe_blocks)]
- unsafe {
- Box::from_raw(slice::from_raw_parts_mut(ptr, len))
- }
+ Ok(unsafe { Box::from_raw(ptr.as_ptr()) })
+ }
+
+ #[deprecated(since = "0.8.0", note = "renamed to `FromZeros::new_box_zeroed_with_elems`")]
+ #[doc(hidden)]
+ #[cfg(feature = "alloc")]
+ #[cfg_attr(doc_cfg, doc(cfg(feature = "alloc")))]
+ #[must_use = "has no side effects (other than allocation)"]
+ #[inline(always)]
+ fn new_box_slice_zeroed(len: usize) -> Result<Box<[Self]>, AllocError>
+ where
+ Self: Sized,
+ {
+ <[Self]>::new_box_zeroed_with_elems(len)
  }
 
  /// Creates a `Vec<Self>` from zeroed bytes.
@@ -2249,19 +2289,19 @@ pub unsafe trait FromZeros: TryFromBytes {
  /// actual information, but its `len()` property will report the correct
  /// value.
  ///
- /// # Panics
+ /// # Errors
  ///
- /// * Panics if `size_of::<Self>() * len` overflows.
- /// * Panics if allocation of `size_of::<Self>() * len` bytes fails.
+ /// Returns an error on allocation failure. Allocation failure is
+ /// guaranteed never to cause a panic or an abort.
  #[must_use = "has no side effects (other than allocation)"]
  #[cfg(feature = "alloc")]
  #[cfg_attr(doc_cfg, doc(cfg(feature = "alloc")))]
  #[inline(always)]
- fn new_vec_zeroed(len: usize) -> Vec<Self>
+ fn new_vec_zeroed(len: usize) -> Result<Vec<Self>, AllocError>
  where
  Self: Sized,
  {
- Self::new_box_slice_zeroed(len).into()
+ <[Self]>::new_box_zeroed_with_elems(len).map(Into::into)
  }
 }
 
@@ -4972,7 +5012,7 @@ mod alloc_support {
 
  #[test]
  fn test_new_box_zeroed() {
- assert_eq!(*u64::new_box_zeroed(), 0);
+ assert_eq!(u64::new_box_zeroed(), Ok(Box::new(0)));
  }
 
  #[test]
@@ -4986,28 +5026,28 @@ mod alloc_support {
  // when running under Miri.
  #[allow(clippy::unit_cmp)]
  {
- assert_eq!(*<()>::new_box_zeroed(), ());
+ assert_eq!(<()>::new_box_zeroed(), Ok(Box::new(())));
  }
  }
 
  #[test]
- fn test_new_box_slice_zeroed() {
- let mut s: Box<[u64]> = u64::new_box_slice_zeroed(3);
+ fn test_new_box_zeroed_with_elems() {
+ let mut s: Box<[u64]> = <[u64]>::new_box_zeroed_with_elems(3).unwrap();
  assert_eq!(s.len(), 3);
  assert_eq!(&*s, &[0, 0, 0]);
  s[1] = 3;
  assert_eq!(&*s, &[0, 3, 0]);
  }
 
  #[test]
- fn test_new_box_slice_zeroed_empty() {
- let s: Box<[u64]> = u64::new_box_slice_zeroed(0);
+ fn test_new_box_zeroed_with_elems_empty() {
+ let s: Box<[u64]> = <[u64]>::new_box_zeroed_with_elems(0).unwrap();
  assert_eq!(s.len(), 0);
  }
 
  #[test]
- fn test_new_box_slice_zeroed_zst() {
- let mut s: Box<[()]> = <()>::new_box_slice_zeroed(3);
+ fn test_new_box_zeroed_with_elems_zst() {
+ let mut s: Box<[()]> = <[()]>::new_box_zeroed_with_elems(3).unwrap();
  assert_eq!(s.len(), 3);
  assert!(s.get(10).is_none());
  // This test exists in order to exercise unsafe code, especially
@@ -5020,22 +5060,20 @@ mod alloc_support {
  }
 
  #[test]
- fn test_new_box_slice_zeroed_zst_empty() {
- let s: Box<[()]> = <()>::new_box_slice_zeroed(0);
+ fn test_new_box_zeroed_with_elems_zst_empty() {
+ let s: Box<[()]> = <[()]>::new_box_zeroed_with_elems(0).unwrap();
  assert_eq!(s.len(), 0);
  }
 
  #[test]
- #[should_panic(expected = "mem::size_of::<Self>() * len overflows `usize`")]
- fn test_new_box_slice_zeroed_panics_mul_overflow() {
- let _ = u16::new_box_slice_zeroed(usize::MAX);
- }
+ fn new_box_zeroed_with_elems_errors() {
+ assert_eq!(<[u16]>::new_box_zeroed_with_elems(usize::MAX), Err(AllocError));
 
- #[test]
- #[should_panic(expected = "assertion failed: size <= max_alloc")]
- fn test_new_box_slice_zeroed_panics_isize_overflow() {
  let max = usize::try_from(isize::MAX).unwrap();
- let _ = u16::new_box_slice_zeroed((max / mem::size_of::<u16>()) + 1);
+ assert_eq!(
+ <[u16]>::new_box_zeroed_with_elems((max / mem::size_of::<u16>()) + 1),
+ Err(AllocError)
+ );
  }
  }
 }
@@ -5525,14 +5563,20 @@ mod tests {
 
  #[cfg(feature = "alloc")]
  {
- assert_eq!(bool::new_box_zeroed(), Box::new(false));
- assert_eq!(char::new_box_zeroed(), Box::new('\0'));
+ assert_eq!(bool::new_box_zeroed(), Ok(Box::new(false)));
+ assert_eq!(char::new_box_zeroed(), Ok(Box::new('\0')));
 
- assert_eq!(bool::new_box_slice_zeroed(3).as_ref(), [false, false, false]);
- assert_eq!(char::new_box_slice_zeroed(3).as_ref(), ['\0', '\0', '\0']);
+ assert_eq!(
+ <[bool]>::new_box_zeroed_with_elems(3).unwrap().as_ref(),
+ [false, false, false]
+ );
+ assert_eq!(
+ <[char]>::new_box_zeroed_with_elems(3).unwrap().as_ref(),
+ ['\0', '\0', '\0']
+ );
 
- assert_eq!(bool::new_vec_zeroed(3).as_ref(), [false, false, false]);
- assert_eq!(char::new_vec_zeroed(3).as_ref(), ['\0', '\0', '\0']);
+ assert_eq!(bool::new_vec_zeroed(3).unwrap().as_ref(), [false, false, false]);
+ assert_eq!(char::new_vec_zeroed(3).unwrap().as_ref(), ['\0', '\0', '\0']);
  }
 
  let mut string = "hello".to_string();