Skip to content

Commit 17ddacd

Browse files
RalfJungRalfJung
committed
strict provenance: rename addr → bare_addr
1 parent 3793e5b commit 17ddacd

File tree

58 files changed

+222
-204
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

58 files changed

+222
-204
lines changed

Diff for: ‎compiler/rustc_arena/src/lib.rs

+8-8
Original file line numberDiff line numberDiff line change
@@ -172,7 +172,7 @@ impl<T> TypedArena<T> {
172172
fn can_allocate(&self, additional: usize) -> bool {
173173
// FIXME: this should *likely* use `offset_from`, but more
174174
// investigation is needed (including running tests in miri).
175-
let available_bytes = self.end.get().addr() - self.ptr.get().addr();
175+
let available_bytes = self.end.get().bare_addr() - self.ptr.get().bare_addr();
176176
let additional_bytes = additional.checked_mul(mem::size_of::<T>()).unwrap();
177177
available_bytes >= additional_bytes
178178
}
@@ -245,7 +245,7 @@ impl<T> TypedArena<T> {
245245
if mem::needs_drop::<T>() {
246246
// FIXME: this should *likely* use `offset_from`, but more
247247
// investigation is needed (including running tests in miri).
248-
let used_bytes = self.ptr.get().addr() - last_chunk.start().addr();
248+
let used_bytes = self.ptr.get().bare_addr() - last_chunk.start().bare_addr();
249249
last_chunk.entries = used_bytes / mem::size_of::<T>();
250250
}
251251

@@ -271,9 +271,9 @@ impl<T> TypedArena<T> {
271271
// chunks.
272272
fn clear_last_chunk(&self, last_chunk: &mut ArenaChunk<T>) {
273273
// Determine how much was filled.
274-
let start = last_chunk.start().addr();
274+
let start = last_chunk.start().bare_addr();
275275
// We obtain the value of the pointer to the first uninitialized element.
276-
let end = self.ptr.get().addr();
276+
let end = self.ptr.get().bare_addr();
277277
// We then calculate the number of elements to be dropped in the last chunk,
278278
// which is the filled area's length.
279279
let diff = if mem::size_of::<T>() == 0 {
@@ -396,11 +396,11 @@ impl DroplessArena {
396396
self.start.set(chunk.start());
397397

398398
// Align the end to DROPLESS_ALIGNMENT.
399-
let end = align_down(chunk.end().addr(), DROPLESS_ALIGNMENT);
399+
let end = align_down(chunk.end().bare_addr(), DROPLESS_ALIGNMENT);
400400

401401
// Make sure we don't go past `start`. This should not happen since the allocation
402402
// should be at least DROPLESS_ALIGNMENT - 1 bytes.
403-
debug_assert!(chunk.start().addr() <= end);
403+
debug_assert!(chunk.start().bare_addr() <= end);
404404

405405
self.end.set(chunk.end().with_addr(end));
406406

@@ -415,9 +415,9 @@ impl DroplessArena {
415415
// This loop executes once or twice: if allocation fails the first
416416
// time, the `grow` ensures it will succeed the second time.
417417
loop {
418-
let start = self.start.get().addr();
418+
let start = self.start.get().bare_addr();
419419
let old_end = self.end.get();
420-
let end = old_end.addr();
420+
let end = old_end.bare_addr();
421421

422422
// Align allocated bytes so that `self.end` stays aligned to
423423
// DROPLESS_ALIGNMENT.

Diff for: ‎compiler/rustc_codegen_ssa/src/mono_item.rs

+1-1
Original file line numberDiff line numberDiff line change
@@ -138,7 +138,7 @@ impl<'a, 'tcx: 'a> MonoItemExt<'a, 'tcx> for MonoItem<'tcx> {
138138
fn to_raw_string(&self) -> String {
139139
match *self {
140140
MonoItem::Fn(instance) => {
141-
format!("Fn({:?}, {})", instance.def, instance.args.as_ptr().addr())
141+
format!("Fn({:?}, {})", instance.def, instance.args.as_ptr().bare_addr())
142142
}
143143
MonoItem::Static(id) => format!("Static({id:?})"),
144144
MonoItem::GlobalAsm(id) => format!("GlobalAsm({id:?})"),

Diff for: ‎compiler/rustc_data_structures/src/tagged_ptr/copy.rs

+1-1
Original file line numberDiff line numberDiff line change
@@ -104,7 +104,7 @@ where
104104
#[inline]
105105
pub fn tag(&self) -> T {
106106
// Unpack the tag, according to the `self.packed` encoding scheme
107-
let tag = self.packed.addr().get() >> Self::TAG_BIT_SHIFT;
107+
let tag = self.packed.bare_addr().get() >> Self::TAG_BIT_SHIFT;
108108

109109
// Safety:
110110
// The shift retrieves the original value from `T::into_usize`,

Diff for: ‎compiler/rustc_hir_typeck/messages.ftl

+2-2
Original file line numberDiff line numberDiff line change
@@ -90,8 +90,8 @@ hir_typeck_lossy_provenance_int2ptr =
9090
9191
hir_typeck_lossy_provenance_ptr2int =
9292
under strict provenance it is considered bad style to cast pointer `{$expr_ty}` to integer `{$cast_ty}`
93-
.suggestion = use `.addr()` to obtain the address of a pointer
94-
.help = if you can't comply with strict provenance and need to expose the pointer provenance you can use `.expose_addr()` instead
93+
.suggestion = use `.bare_addr()` to obtain the address of a pointer without its provenance -- but note that this cannot be cast back to a pointer later; you need to use `with_addr` instead
94+
.help = if you need to cast the address back to a pointer later, use `.expose_addr()` instead
9595
9696
hir_typeck_method_call_on_unknown_raw_pointee =
9797
cannot call a method on a raw pointer with an unknown pointee type

Diff for: ‎compiler/rustc_hir_typeck/src/errors.rs

+4-4
Original file line numberDiff line numberDiff line change
@@ -256,28 +256,28 @@ pub enum LossyProvenancePtr2IntSuggestion<'tcx> {
256256
NeedsParensCast {
257257
#[suggestion_part(code = "(")]
258258
expr_span: Span,
259-
#[suggestion_part(code = ").addr() as {cast_ty}")]
259+
#[suggestion_part(code = ").bare_addr() as {cast_ty}")]
260260
cast_span: Span,
261261
cast_ty: Ty<'tcx>,
262262
},
263263
#[multipart_suggestion(hir_typeck_suggestion, applicability = "maybe-incorrect")]
264264
NeedsParens {
265265
#[suggestion_part(code = "(")]
266266
expr_span: Span,
267-
#[suggestion_part(code = ").addr()")]
267+
#[suggestion_part(code = ").bare_addr()")]
268268
cast_span: Span,
269269
},
270270
#[suggestion(
271271
hir_typeck_suggestion,
272-
code = ".addr() as {cast_ty}",
272+
code = ".bare_addr() as {cast_ty}",
273273
applicability = "maybe-incorrect"
274274
)]
275275
NeedsCast {
276276
#[primary_span]
277277
cast_span: Span,
278278
cast_ty: Ty<'tcx>,
279279
},
280-
#[suggestion(hir_typeck_suggestion, code = ".addr()", applicability = "maybe-incorrect")]
280+
#[suggestion(hir_typeck_suggestion, code = ".bare_addr()", applicability = "maybe-incorrect")]
281281
Other {
282282
#[primary_span]
283283
cast_span: Span,

Diff for: ‎compiler/rustc_middle/src/ty/generic_args.rs

+1-1
Original file line numberDiff line numberDiff line change
@@ -149,7 +149,7 @@ impl<'tcx> GenericArg<'tcx> {
149149
// pointers were originally created from `Interned` types in `pack()`,
150150
// and this is just going in the other direction.
151151
unsafe {
152-
match self.ptr.addr().get() & TAG_MASK {
152+
match self.ptr.bare_addr().get() & TAG_MASK {
153153
REGION_TAG => GenericArgKind::Lifetime(ty::Region(Interned::new_unchecked(
154154
ptr.cast::<ty::RegionKind<'tcx>>().as_ref(),
155155
))),

Diff for: ‎compiler/rustc_middle/src/ty/mod.rs

+1-1
Original file line numberDiff line numberDiff line change
@@ -624,7 +624,7 @@ impl<'tcx> Term<'tcx> {
624624
// pointers were originally created from `Interned` types in `pack()`,
625625
// and this is just going in the other direction.
626626
unsafe {
627-
match self.ptr.addr().get() & TAG_MASK {
627+
match self.ptr.bare_addr().get() & TAG_MASK {
628628
TYPE_TAG => TermKind::Ty(Ty(Interned::new_unchecked(
629629
ptr.cast::<WithCachedTypeInfo<ty::TyKind<'tcx>>>().as_ref(),
630630
))),

Diff for: ‎library/alloc/src/rc.rs

+1-1
Original file line numberDiff line numberDiff line change
@@ -2840,7 +2840,7 @@ impl<T, A: Allocator> Weak<T, A> {
28402840
}
28412841

28422842
pub(crate) fn is_dangling<T: ?Sized>(ptr: *const T) -> bool {
2843-
(ptr.cast::<()>()).addr() == usize::MAX
2843+
(ptr.cast::<()>()).bare_addr() == usize::MAX
28442844
}
28452845

28462846
/// Helper type to allow accessing the reference counts without

Diff for: ‎library/alloc/src/vec/into_iter.rs

+1-1
Original file line numberDiff line numberDiff line change
@@ -222,7 +222,7 @@ impl<T, A: Allocator> Iterator for IntoIter<T, A> {
222222
#[inline]
223223
fn size_hint(&self) -> (usize, Option<usize>) {
224224
let exact = if T::IS_ZST {
225-
self.end.addr().wrapping_sub(self.ptr.as_ptr().addr())
225+
self.end.bare_addr().wrapping_sub(self.ptr.as_ptr().bare_addr())
226226
} else {
227227
unsafe { non_null!(self.end, T).sub_ptr(self.ptr) }
228228
};

Diff for: ‎library/core/src/hash/mod.rs

+2-2
Original file line numberDiff line numberDiff line change
@@ -956,7 +956,7 @@ mod impls {
956956
#[inline]
957957
fn hash<H: Hasher>(&self, state: &mut H) {
958958
let (address, metadata) = self.to_raw_parts();
959-
state.write_usize(address.addr());
959+
state.write_usize(address.bare_addr());
960960
metadata.hash(state);
961961
}
962962
}
@@ -966,7 +966,7 @@ mod impls {
966966
#[inline]
967967
fn hash<H: Hasher>(&self, state: &mut H) {
968968
let (address, metadata) = self.to_raw_parts();
969-
state.write_usize(address.addr());
969+
state.write_usize(address.bare_addr());
970970
metadata.hash(state);
971971
}
972972
}

Diff for: ‎library/core/src/intrinsics.rs

+3-3
Original file line numberDiff line numberDiff line change
@@ -1267,7 +1267,7 @@ extern "rust-intrinsic" {
12671267
/// - If the code just wants to store data of arbitrary type in some buffer and needs to pick a
12681268
/// type for that buffer, it can use [`MaybeUninit`][crate::mem::MaybeUninit].
12691269
/// - If the code actually wants to work on the address the pointer points to, it can use `as`
1270-
/// casts or [`ptr.addr()`][pointer::addr].
1270+
/// casts or [`ptr.bare_addr()`][pointer::bare_addr].
12711271
///
12721272
/// Turning a `*mut T` into an `&mut T`:
12731273
///
@@ -2781,8 +2781,8 @@ pub(crate) fn is_valid_allocation_size(size: usize, len: usize) -> bool {
27812781
/// `count * size` do *not* overlap.
27822782
#[inline]
27832783
pub(crate) fn is_nonoverlapping(src: *const (), dst: *const (), size: usize, count: usize) -> bool {
2784-
let src_usize = src.addr();
2785-
let dst_usize = dst.addr();
2784+
let src_usize = src.bare_addr();
2785+
let dst_usize = dst.bare_addr();
27862786
let Some(size) = size.checked_mul(count) else {
27872787
crate::panicking::panic_nounwind(
27882788
"is_nonoverlapping: `size_of::<T>() * count` overflows a usize",

Diff for: ‎library/core/src/ptr/const_ptr.rs

+8-8
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ impl<T: ?Sized> *const T {
3535
pub const fn is_null(self) -> bool {
3636
#[inline]
3737
fn runtime_impl(ptr: *const u8) -> bool {
38-
ptr.addr() == 0
38+
ptr.bare_addr() == 0
3939
}
4040

4141
#[inline]
@@ -203,7 +203,7 @@ impl<T: ?Sized> *const T {
203203
#[must_use]
204204
#[inline(always)]
205205
#[unstable(feature = "strict_provenance", issue = "95228")]
206-
pub fn addr(self) -> usize {
206+
pub fn bare_addr(self) -> usize {
207207
// FIXME(strict_provenance_magic): I am magic and should be a compiler intrinsic.
208208
// SAFETY: Pointer-to-integer transmutes are valid (if you are okay with losing the
209209
// provenance).
@@ -223,7 +223,7 @@ impl<T: ?Sized> *const T {
223223
/// Provenance][super#strict-provenance] rules. Supporting
224224
/// [`from_exposed_addr`][] complicates specification and reasoning and may not be supported by
225225
/// tools that help you to stay conformant with the Rust memory model, so it is recommended to
226-
/// use [`addr`][pointer::addr] wherever possible.
226+
/// use [`bare_addr`][pointer::bare_addr] wherever possible.
227227
///
228228
/// On most platforms this will produce a value with the same bytes as the original pointer,
229229
/// because all the bytes are dedicated to describing the address. Platforms which need to store
@@ -264,7 +264,7 @@ impl<T: ?Sized> *const T {
264264
// In the mean-time, this operation is defined to be "as if" it was
265265
// a wrapping_offset, so we can emulate it as such. This should properly
266266
// restore pointer provenance even under today's compiler.
267-
let self_addr = self.addr() as isize;
267+
let self_addr = self.bare_addr() as isize;
268268
let dest_addr = addr as isize;
269269
let offset = dest_addr.wrapping_sub(self_addr);
270270

@@ -282,7 +282,7 @@ impl<T: ?Sized> *const T {
282282
#[inline]
283283
#[unstable(feature = "strict_provenance", issue = "95228")]
284284
pub fn map_addr(self, f: impl FnOnce(usize) -> usize) -> Self {
285-
self.with_addr(f(self.addr()))
285+
self.with_addr(f(self.bare_addr()))
286286
}
287287

288288
/// Decompose a (possibly wide) pointer into its data pointer and metadata components.
@@ -592,7 +592,7 @@ impl<T: ?Sized> *const T {
592592
/// let tagged_ptr = ptr.map_addr(|a| a | 0b10);
593593
///
594594
/// // Get the "tag" back
595-
/// let tag = tagged_ptr.addr() & tag_mask;
595+
/// let tag = tagged_ptr.bare_addr() & tag_mask;
596596
/// assert_eq!(tag, 0b10);
597597
///
598598
/// // Note that `tagged_ptr` is unaligned, it's UB to read from it.
@@ -664,7 +664,7 @@ impl<T: ?Sized> *const T {
664664
/// runtime and may be exploited by optimizations. If you wish to compute the difference between
665665
/// pointers that are not guaranteed to be from the same allocation, use `(self as isize -
666666
/// origin as isize) / mem::size_of::<T>()`.
667-
// FIXME: recommend `addr()` instead of `as usize` once that is stable.
667+
// FIXME: recommend `bare_addr()` instead of `as usize` once that is stable.
668668
///
669669
/// [`add`]: #method.add
670670
/// [allocated object]: crate::ptr#allocated-object
@@ -1611,7 +1611,7 @@ impl<T: ?Sized> *const T {
16111611

16121612
#[inline]
16131613
fn runtime_impl(ptr: *const (), align: usize) -> bool {
1614-
ptr.addr() & (align - 1) == 0
1614+
ptr.bare_addr() & (align - 1) == 0
16151615
}
16161616

16171617
#[inline]

Diff for: ‎library/core/src/ptr/mod.rs

+5-5
Original file line numberDiff line numberDiff line change
@@ -202,7 +202,7 @@
202202
//! we provide the [`map_addr`][] method.
203203
//!
204204
//! To help make it clear that code is "following" Strict Provenance semantics, we also provide an
205-
//! [`addr`][] method which promises that the returned address is not part of a
205+
//! [`bare_addr`][] method which promises that the returned address is not part of a
206206
//! pointer-usize-pointer roundtrip. In the future we may provide a lint for pointer<->integer
207207
//! casts to help you audit if your code conforms to strict provenance.
208208
//!
@@ -239,7 +239,7 @@
239239
//! let tagged = ptr.map_addr(|addr| addr | HAS_DATA);
240240
//!
241241
//! // Check the flag:
242-
//! if tagged.addr() & HAS_DATA != 0 {
242+
//! if tagged.bare_addr() & HAS_DATA != 0 {
243243
//! // Untag and read the pointer
244244
//! let data = *tagged.map_addr(|addr| addr & FLAG_MASK);
245245
//! assert_eq!(data, 17);
@@ -294,7 +294,7 @@
294294
//! particular platform, and it's an open question as to how to specify this (if at all).
295295
//! Notably, [CHERI][] relies on a compression scheme that can't handle a
296296
//! pointer getting offset "too far" out of bounds. If this happens, the address
297-
//! returned by `addr` will be the value you expect, but the provenance will get invalidated
297+
//! returned by `bare_addr` will be the value you expect, but the provenance will get invalidated
298298
//! and using it to read/write will fault. The details of this are architecture-specific
299299
//! and based on alignment, but the buffer on either side of the pointer's range is pretty
300300
//! generous (think kilobytes, not bytes).
@@ -342,7 +342,7 @@
342342
//!
343343
//! Exposed Provenance is provided by the [`expose_addr`] and [`from_exposed_addr`] methods, which
344344
//! are meant to replace `as` casts between pointers and integers. [`expose_addr`] is a lot like
345-
//! [`addr`], but additionally adds the provenance of the pointer to a global list of 'exposed'
345+
//! [`bare_addr`], but additionally adds the provenance of the pointer to a global list of 'exposed'
346346
//! provenances. (This list is purely conceptual, it exists for the purpose of specifying Rust but
347347
//! is not materialized in actual executions, except in tools like [Miri].) [`from_exposed_addr`]
348348
//! can be used to construct a pointer with one of these previously 'exposed' provenances.
@@ -372,7 +372,7 @@
372372
//! [`wrapping_offset`]: pointer::wrapping_offset
373373
//! [`with_addr`]: pointer::with_addr
374374
//! [`map_addr`]: pointer::map_addr
375-
//! [`addr`]: pointer::addr
375+
//! [`bare_addr`]: pointer::bare_addr
376376
//! [`ptr::dangling`]: core::ptr::dangling
377377
//! [`expose_addr`]: pointer::expose_addr
378378
//! [`from_exposed_addr`]: from_exposed_addr

Diff for: ‎library/core/src/ptr/mut_ptr.rs

+8-8
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ impl<T: ?Sized> *mut T {
3535
pub const fn is_null(self) -> bool {
3636
#[inline]
3737
fn runtime_impl(ptr: *mut u8) -> bool {
38-
ptr.addr() == 0
38+
ptr.bare_addr() == 0
3939
}
4040

4141
#[inline]
@@ -211,7 +211,7 @@ impl<T: ?Sized> *mut T {
211211
#[must_use]
212212
#[inline(always)]
213213
#[unstable(feature = "strict_provenance", issue = "95228")]
214-
pub fn addr(self) -> usize {
214+
pub fn bare_addr(self) -> usize {
215215
// FIXME(strict_provenance_magic): I am magic and should be a compiler intrinsic.
216216
// SAFETY: Pointer-to-integer transmutes are valid (if you are okay with losing the
217217
// provenance).
@@ -231,7 +231,7 @@ impl<T: ?Sized> *mut T {
231231
/// Provenance][super#strict-provenance] rules. Supporting
232232
/// [`from_exposed_addr_mut`][] complicates specification and reasoning and may not be supported
233233
/// by tools that help you to stay conformant with the Rust memory model, so it is recommended
234-
/// to use [`addr`][pointer::addr] wherever possible.
234+
/// to use [`bare_addr`][pointer::bare_addr] wherever possible.
235235
///
236236
/// On most platforms this will produce a value with the same bytes as the original pointer,
237237
/// because all the bytes are dedicated to describing the address. Platforms which need to store
@@ -272,7 +272,7 @@ impl<T: ?Sized> *mut T {
272272
// In the mean-time, this operation is defined to be "as if" it was
273273
// a wrapping_offset, so we can emulate it as such. This should properly
274274
// restore pointer provenance even under today's compiler.
275-
let self_addr = self.addr() as isize;
275+
let self_addr = self.bare_addr() as isize;
276276
let dest_addr = addr as isize;
277277
let offset = dest_addr.wrapping_sub(self_addr);
278278

@@ -290,7 +290,7 @@ impl<T: ?Sized> *mut T {
290290
#[inline]
291291
#[unstable(feature = "strict_provenance", issue = "95228")]
292292
pub fn map_addr(self, f: impl FnOnce(usize) -> usize) -> Self {
293-
self.with_addr(f(self.addr()))
293+
self.with_addr(f(self.bare_addr()))
294294
}
295295

296296
/// Decompose a (possibly wide) pointer into its data pointer and metadata components.
@@ -607,7 +607,7 @@ impl<T: ?Sized> *mut T {
607607
/// let tagged_ptr = ptr.map_addr(|a| a | 0b10);
608608
///
609609
/// // Get the "tag" back
610-
/// let tag = tagged_ptr.addr() & tag_mask;
610+
/// let tag = tagged_ptr.bare_addr() & tag_mask;
611611
/// assert_eq!(tag, 0b10);
612612
///
613613
/// // Note that `tagged_ptr` is unaligned, it's UB to read from/write to it.
@@ -839,7 +839,7 @@ impl<T: ?Sized> *mut T {
839839
/// runtime and may be exploited by optimizations. If you wish to compute the difference between
840840
/// pointers that are not guaranteed to be from the same allocation, use `(self as isize -
841841
/// origin as isize) / mem::size_of::<T>()`.
842-
// FIXME: recommend `addr()` instead of `as usize` once that is stable.
842+
// FIXME: recommend `bare_addr()` instead of `as usize` once that is stable.
843843
///
844844
/// [`add`]: #method.add
845845
/// [allocated object]: crate::ptr#allocated-object
@@ -1884,7 +1884,7 @@ impl<T: ?Sized> *mut T {
18841884

18851885
#[inline]
18861886
fn runtime_impl(ptr: *mut (), align: usize) -> bool {
1887-
ptr.addr() & (align - 1) == 0
1887+
ptr.bare_addr() & (align - 1) == 0
18881888
}
18891889

18901890
#[inline]

0 commit comments

Comments
 (0)