From 26f2b661e2e16d4eab4901a6c8ea73df3cddce22 Mon Sep 17 00:00:00 2001
From: Ralf Jung <post@ralfj.de>
Date: Sat, 8 Jun 2024 11:26:10 +0200
Subject: [PATCH] size_of_val_raw: for length 0 this is safe to call

---
 library/core/src/alloc/layout.rs              |  2 ++
 library/core/src/mem/mod.rs                   |  8 +++++
 tests/ui/layout/size-of-val-raw-too-big.rs    | 29 +++++++++++++++++++
 .../ui/layout/size-of-val-raw-too-big.stderr  |  4 +++
 4 files changed, 43 insertions(+)
 create mode 100644 tests/ui/layout/size-of-val-raw-too-big.rs
 create mode 100644 tests/ui/layout/size-of-val-raw-too-big.stderr

diff --git a/library/core/src/alloc/layout.rs b/library/core/src/alloc/layout.rs
index 0b92767c93205..e96a41422a2af 100644
--- a/library/core/src/alloc/layout.rs
+++ b/library/core/src/alloc/layout.rs
@@ -183,6 +183,8 @@ impl Layout {
     ///     - a [slice], then the length of the slice tail must be an initialized
     ///       integer, and the size of the *entire value*
     ///       (dynamic tail length + statically sized prefix) must fit in `isize`.
+    ///       For the special case where the dynamic tail length is 0, this function
+    ///       is safe to call.
     ///     - a [trait object], then the vtable part of the pointer must point
     ///       to a valid vtable for the type `T` acquired by an unsizing coercion,
     ///       and the size of the *entire value*
diff --git a/library/core/src/mem/mod.rs b/library/core/src/mem/mod.rs
index 9054ade2d7968..23ece3c57982d 100644
--- a/library/core/src/mem/mod.rs
+++ b/library/core/src/mem/mod.rs
@@ -359,6 +359,12 @@ pub const fn size_of_val<T: ?Sized>(val: &T) -> usize {
 ///     - a [slice], then the length of the slice tail must be an initialized
 ///       integer, and the size of the *entire value*
 ///       (dynamic tail length + statically sized prefix) must fit in `isize`.
+///       For the special case where the dynamic tail length is 0, this function
+///       is safe to call.
+//        NOTE: the reason this is safe is that if an overflow were to occur already with size 0,
+//        then we would stop compilation as even the "statically known" part of the type would
+//        already be too big (or the call may be in dead code and optimized away, but then it
+//        doesn't matter).
 ///     - a [trait object], then the vtable part of the pointer must point
 ///       to a valid vtable acquired by an unsizing coercion, and the size
 ///       of the *entire value* (dynamic tail length + statically sized prefix)
@@ -506,6 +512,8 @@ pub const fn align_of_val<T: ?Sized>(val: &T) -> usize {
 ///     - a [slice], then the length of the slice tail must be an initialized
 ///       integer, and the size of the *entire value*
 ///       (dynamic tail length + statically sized prefix) must fit in `isize`.
+///       For the special case where the dynamic tail length is 0, this function
+///       is safe to call.
 ///     - a [trait object], then the vtable part of the pointer must point
 ///       to a valid vtable acquired by an unsizing coercion, and the size
 ///       of the *entire value* (dynamic tail length + statically sized prefix)
diff --git a/tests/ui/layout/size-of-val-raw-too-big.rs b/tests/ui/layout/size-of-val-raw-too-big.rs
new file mode 100644
index 0000000000000..3ea510d4c1db1
--- /dev/null
+++ b/tests/ui/layout/size-of-val-raw-too-big.rs
@@ -0,0 +1,29 @@
+//@ build-fail
+//@ compile-flags: --target i686-unknown-linux-gnu --crate-type lib
+//@ needs-llvm-components: x86
+//@ error-pattern: too big for the current architecture
+#![feature(no_core, lang_items, intrinsics)]
+#![allow(internal_features)]
+#![no_std]
+#![no_core]
+
+#[lang = "sized"]
+pub trait Sized {}
+#[lang = "copy"]
+pub trait Copy: Sized {}
+
+// 0x7fffffff is fine, but with the padding for the unsized tail it is too big.
+#[repr(C)]
+pub struct Example([u8; 0x7fffffff], [u16]);
+
+extern "rust-intrinsic" {
+    pub fn size_of_val<T: ?Sized>(_: *const T) -> usize;
+}
+
+// We guarantee that with length 0, `size_of_val_raw` (which calls the `size_of_val` intrinsic)
+// is safe to call. The compiler aborts execution if a length of 0 would overflow.
+// So let's construct a case where length 0 just barely overflows, and ensure that
+// does abort execution.
+pub fn check(x: *const Example) {
+    unsafe { size_of_val(x); }
+}
diff --git a/tests/ui/layout/size-of-val-raw-too-big.stderr b/tests/ui/layout/size-of-val-raw-too-big.stderr
new file mode 100644
index 0000000000000..aa9abd644faaf
--- /dev/null
+++ b/tests/ui/layout/size-of-val-raw-too-big.stderr
@@ -0,0 +1,4 @@
+error: values of the type `Example` are too big for the current architecture
+
+error: aborting due to 1 previous error
+