google/zerocopy

`transmute_mut!` documents looser requirements than what is implemented

kupiakos opened this issue · 2 comments

transmute_mut! documents the requirements that:

  • T: Sized + IntoBytes
  • U: Sized + FromBytes
  • align_of::<T>() >= align_of::<U>()

However, this is less strict that what is actually required:

  • T: FromBytes + IntoBytes + NoCell
  • U: FromBytes + IntoBytes + NoCell
  • size_of::<T>() == size_of::<U>()
  • align_of::<T>() >= align_of::<U>()

The size and NoCell requirements are also similarly missing from transmute_ref!.

Good catch! We'll block releasing 0.8 on this.

This was completed in #1050 and #1058. We now use the following pseudocode to document the bounds of our transmute macros:

const fn transmute<Src, Dst>(src: Src) -> Dst
where
    Src: IntoBytes,
    Dst: FromBytes,
    size_of::<Src>() == size_of::<Dst>();

const fn transmute_ref<'src, 'dst, Src, Dst>(src: &'src Src) -> &'dst Dst
where
    'src: 'dst,
    Src: IntoBytes + NoCell,
    Dst: FromBytes + NoCell,
    size_of::<Src>() == size_of::<Dst>(),
    align_of::<Src>() >= align_of::<Dst>();

const fn transmute_mut<'src, 'dst, Src, Dst>(src: &'src mut Src) -> &'dst mut Dst
where
    'src: 'dst,
    Src: FromBytes + IntoBytes + NoCell,
    Dst: FromBytes + IntoBytes + NoCell,
    size_of::<Src>() == size_of::<Dst>(),
    align_of::<Src>() >= align_of::<Dst>();