Skip to content

&{mut} T may (briefly) write garbage #161452

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
nia-e wants to merge 2 commits into
base: main
Choose a base branch
from
Open

&{mut} T may (briefly) write garbage #161452

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ec31520
you can write garbage into &mut
nia-e Aug 21, 2026
6750cff
typo
nia-e Aug 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions library/core/src/primitive_docs.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1665,10 +1665,10 @@ const _: () = ();
/// not violate these invariants. The full requirements are stronger, as the reference generally
/// must point to data that is safe to use as type `T`.
///
/// It is not decided yet whether unsafe code may violate these invariants temporarily on internal
/// data. As a consequence, unsafe code which violates these invariants temporarily on internal data
/// may be unsound or become unsound in future versions of Rust depending on how this question is
/// decided.
/// Unsafe code is allowed to temporarily violate type validity invariants on internal data that
/// cannot be otherwise observed; that is, arbitrary data can be written into the pointed-to bytes
/// of a `&mut T` even if it would constitute an invalid value of `T` or set the discriminant of a
/// wrapping enum to an invalid value, so long as everything is restored before the code returns.
Comment on lines +1668 to +1671

@RalfJung RalfJung Sep 18, 2026 •
edited by rustbot
Loading

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a monster sentence.

Suggested change
/// Unsafe code is allowed to temporarily violate type validity invariants on internal data that
/// cannot be otherwise observed; that is, arbitrary data can be written into the pointed-to bytes
/// of a `&mut T` even if it would constitute an invalid value of `T` or set the discriminant of a
/// wrapping enum to an invalid value, so long as everything is restored before the code returns.
/// Unsafe code is allowed to *temporarily* violate type validity invariants on internal data that
/// cannot be otherwise observed; that is, arbitrary data can be written into the pointed-to bytes
/// of a `&mut T` even if it would constitute an invalid value of `T`, so long as everything is restored
/// before the data might be used at type `T` again (in particular, before control is passed to "outside"
/// code that has access to the data this reference points to).
/// This is allowed even if the temporary value sets the discriminant of a
/// wrapping enum to an invalid value.

Also can you make "pointed-to bytes" link to this?

View changes since the review

@workingjubilee workingjubilee Nov 5, 2026 •
edited by rustbot
Loading

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I assume unwinding with a value in this state is also forbidden? That is part of the FCP at least: rust-lang/unsafe-code-guidelines#621 (comment)

It is not clear to me if unwinding is always considered a form of "returning", so something like Ralf's reword would be useful here for more reasons than just breaking up the sentence.

View changes since the review

///
/// [allocation]: ptr#allocation
#[stable(feature = "rust1", since = "1.0.0")]
Expand Down
Loading