Skip to content

Commit aed5cf3

Browse files
committed
say some more things about how transmute is UB
1 parent 5d95a36 commit aed5cf3

File tree

1 file changed

+13
-11
lines changed

1 file changed

+13
-11
lines changed

Diff for: library/core/src/intrinsics.rs

+13-11
Original file line numberDiff line numberDiff line change
@@ -1207,30 +1207,32 @@ extern "rust-intrinsic" {
12071207

12081208
/// Reinterprets the bits of a value of one type as another type.
12091209
///
1210-
/// Both types must have the same size. Neither the original, nor the result,
1211-
/// may be an [invalid value](../../nomicon/what-unsafe-does.html).
1210+
/// Both types must have the same size. Compilation will fail if this is not guaranteed.
12121211
///
12131212
/// `transmute` is semantically equivalent to a bitwise move of one type
12141213
/// into another. It copies the bits from the source value into the
12151214
/// destination value, then forgets the original. Note that source and destination
12161215
/// are passed by-value, which means if `T` or `U` contains padding, that padding
12171216
/// might *not* be preserved by `transmute`.
12181217
///
1218+
/// Both the argument and the result must be [valid](../../nomicon/what-unsafe-does.html) at
1219+
/// their given type. Violating this condition leads to [undefined behavior][ub]. The compiler
1220+
/// will generate code *assuming that you, the programmer, ensure that there will never be
1221+
/// undefined behavior*. It is therefore your responsibility to guarantee that every value
1222+
/// passed to `transmute` is valid at both types `T` and `U`. Failing to uphold this condition
1223+
/// may lead to unexpeced and unstable compilation results. This makes `transmute` **incredibly
1224+
/// unsafe**. `transmute` should be the absolute last resort.
1225+
///
1226+
/// Transmuting pointers to integers in a `const` context is [undefined behavior][ub].
1227+
/// Any attempt to use the resulting value for integer operations will abort const-evaluation.
1228+
///
12191229
/// Because `transmute` is a by-value operation, alignment of the *transmuted values
12201230
/// themselves* is not a concern. As with any other function, the compiler already ensures
12211231
/// both `T` and `U` are properly aligned. However, when transmuting values that *point
12221232
/// elsewhere* (such as pointers, references, boxes…), the caller has to ensure proper
12231233
/// alignment of the pointed-to values.
12241234
///
1225-
/// `transmute` is **incredibly** unsafe. There are a vast number of ways to
1226-
/// cause [undefined behavior][ub] with this function. `transmute` should be
1227-
/// the absolute last resort.
1228-
///
1229-
/// Transmuting pointers to integers in a `const` context is [undefined behavior][ub].
1230-
/// Any attempt to use the resulting value for integer operations will abort const-evaluation.
1231-
///
1232-
/// The [nomicon](../../nomicon/transmutes.html) has additional
1233-
/// documentation.
1235+
/// The [nomicon](../../nomicon/transmutes.html) has additional documentation.
12341236
///
12351237
/// [ub]: ../../reference/behavior-considered-undefined.html
12361238
///

0 commit comments

Comments
 (0)