Tracking Issue for Transmutability Trait: `#[transmutability]`

[jswrenn]

Feature gate: #![feature(transmutability)]

This is a tracking issue for MCP411: Lang Item for Transmutability. The MCP defines an experimental, compiler-implemented trait that can be used to audit whether a particular transmutation (or other form of bit-reinterpretation cast) is safe.

At this time, this feature is NOT on track to stabilization. It has been specified in an MCP, not an RFC, and will likely require an RFC to be tracked for stabilization.

Public API

The public API of this feature (which may have evolved since this issue's last update), is roughly as follows:

pub unsafe trait TransmuteFrom<Src, const ASSUME: Assume = { Assume::NOTHING }>
where
    Src: ?Sized,
{
    unsafe fn transmute(src: Src) -> Self
    where
        Src: Sized,
        Self: Sized,
    {
        ...
    }
}

#[derive(PartialEq, Eq, Clone, Copy, Debug)]
pub struct Assume {
    pub alignment: bool,
    pub lifetimes: bool,
    pub safety: bool,
    pub validity: bool,
}

impl Assume {
    pub const NOTHING: Self =
        Self { alignment: false, lifetimes: false, safety: false, validity: false };

    pub const ALIGNMENT: Self = Self { alignment: true, ..Self::NOTHING };
    pub const LIFETIMES: Self = Self { lifetimes: true, ..Self::NOTHING };
    pub const SAFETY: Self = Self { safety: true, ..Self::NOTHING };
    pub const VALIDITY: Self = Self { validity: true, ..Self::NOTHING };

    pub const fn and(self, other_assumptions: Self) -> Self { ... }
    pub const fn but_not(self, other_assumptions: Self) -> Self { ... }
}

Steps / History

• MCP: Lang Item for Transmutability compiler-team#411
• Implementation:
  • Initial implementation of transmutability trait. #92268
  • safe transmute: use Assume struct to provide analysis options #100726
• RFC: #...
• Final comment period (FCP)¹
• Stabilization PR

Unresolved Questions

Virtually all aspects of this experimental feature are unresolved.

• What can we transmute to and from a union?
• Naming of fields:
  • Safe Transmute: Revise safety analysis #121681 (comment)
• What kind of transmute to model?
• Is the transmute-via-union example fully specified?

• How do we ensure that we can still change rustc layout details without this resulting in things breaking?
  • See https://github.com/rust-lang/rust/pull/155473/changes#diff-03c9016a41f6f6eb195211d7697452d58120fccdfe56511025a478a33ea6f28c for example where changing how repr(Rust) picks niche encodings needed to update transmutability tests.

Footnotes

1. https://std-dev-guide.rust-lang.org/feature-lifecycle/stabilization.html ↩