Lint unannotated transmutes

[clarfonthey]

I'm thinking of something where you have to either have:

1. Both types fully annotated
2. It be the only part of a function body, potentially including an unsafe block.

[oli-obk]

related: #715

[ndmitchell]

The first of these rules seems super useful, and I came to request.

The second doesn't seem so useful. Once you have annotated both types, the requirement to put it in its own function is reduced.

[clarfonthey]

My reasoning for the second part is that you should have dedicated functions for these transmutes that are marked as either safe or unsafe depending on the situation, and use those instead of the transmutes directly.

[ndmitchell]

@clarfon I have that for some functions, but not others - sometimes exposing that function would make the invariants I'd like to encode harder. Not that your request is unreasonable, just that I'd want to turn on the first lint, and off the second, so they can be treated independently.

[clarfonthey]

That's very fair, I'd agree with making them separate lints. Curiously, do you have any examples of cases where it makes sense to not have the second?

[ndmitchell]

I have a structure that reads:

struct Foo {
   bar: SomeReferenceContainingType
   baz: SomePointerWrapper<'bar>
}

Where the pointer wrapper baz points into bar, but that is behind a reference. This pattern might even be supported in Polonius: https://nikomatsakis.github.io/rust-belt-rust-2019/#95

For the moment I encode that with:

struct Foo {
   bar: SomeReferenceContainingType
   baz_wrong: SomePointerWrapper<'static>
}

impl Foo {
   fn baz<'x>(&'x self) -> SomePointerWrapper<'x> {
       transmute(&self.baz_wrong)
   }
}

The transumute both pulls out the field and converts it, which is a nice single atomic operation. Whereas casting any arbitrary SomePointerWrapper would be wrong. Also, missing the types on transmute makes you likely to type transmute(self) and get a segfault (which I did!).

[croker89]

Restablecer facebook

[xFrednet]

Hey @croker89, was your comment added on purpose here? :) To me, it's not clear what you mean

[croker89]

I'm thinking of something where you have to either have:

1. Both types fully annotated
2. It be the only part of a function body, potentially including an unsafe block.

[lukaslueg]

missing_transmute_annotations, added in 1.79, resolves this?!