-
Notifications
You must be signed in to change notification settings - Fork 121
Override std::ptr::align_offset #2396
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Conversation
Perhaps @karkhaz:
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Is there any potential unsoundness with this change?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I don't think this implementation is sound. The code should panic if the input is not a power of two.
For example, the following code panic in Rust:
use std::mem::align_of;
fn main() {
let x = 10;
let ptr = &x as *const i32;
let _ = ptr.align_offset(5);
}
Requested changes have been implemented.
This hook intercepts calls to `std::ptr::align_offset<T>` as CBMC's memory model has no concept of alignment of allocations, so we would have to non-deterministically choose an alignment of the base pointer, add the pointer's offset to it, and then do the math that is done in `library/core/src/ptr/mod.rs`. Instead, we choose to always return `usize::MAX`, per `align_offset`'s documentation, which states: "It is permissible for the implementation to always return usize::MAX. Only your algorithm’s performance can depend on getting a usable offset here, not its correctness." Fixes: model-checking#2363
This hook intercepts calls to
std::ptr::align_offset<T>
as CBMC's memory model has no concept of alignment of allocations, so we would have to non-deterministically choose an alignment of the base pointer, add the pointer's offset to it, and then do the math that is done inlibrary/core/src/ptr/mod.rs
. Instead, we choose to always return either 0 when the pointer points to the beginning of an object (and, therefore, is necessarily aligned), orusize::MAX
, peralign_offset
's documentation, which states: "It is permissible for the implementation to always return usize::MAX. Only your algorithm’s performance can depend on getting a usable offset here, not its correctness."Fixes: #2363