rust-lang · bors · Dec 3, 2019 · Nov 9, 2019 · Nov 9, 2019 · Nov 9, 2019
diff --git a/src/liballoc/rc.rs b/src/liballoc/rc.rs
@@ -897,7 +897,7 @@ impl<T: ?Sized> Rc<T> {
         // reference (see #54908).
         let layout = Layout::new::<RcBox<()>>()
             .extend(value_layout).unwrap().0
-            .pad_to_align().unwrap();
+            .pad_to_align();
 
         // Allocate for the layout.
         let mem = Global.alloc(layout)

diff --git a/src/liballoc/sync.rs b/src/liballoc/sync.rs
@@ -751,7 +751,7 @@ impl<T: ?Sized> Arc<T> {
         // reference (see #54908).
         let layout = Layout::new::<ArcInner<()>>()
             .extend(value_layout).unwrap().0
-            .pad_to_align().unwrap();
+            .pad_to_align();
 
         let mem = Global.alloc(layout)
             .unwrap_or_else(|_| handle_alloc_error(layout));

diff --git a/src/libcore/alloc.rs b/src/libcore/alloc.rs
@@ -213,18 +213,21 @@ impl Layout {
     /// Creates a layout by rounding the size of this layout up to a multiple
     /// of the layout's alignment.
     ///
-    /// Returns `Err` if the padded size would overflow.
-    ///
     /// This is equivalent to adding the result of `padding_needed_for`
     /// to the layout's current size.
     #[unstable(feature = "alloc_layout_extra", issue = "55724")]
     #[inline]
-    pub fn pad_to_align(&self) -> Result<Layout, LayoutErr> {
+    pub fn pad_to_align(&self) -> Layout {
         let pad = self.padding_needed_for(self.align());
-        let new_size = self.size().checked_add(pad)
-            .ok_or(LayoutErr { private: () })?;
+        // This cannot overflow: it is an invariant of Layout that
+        // > `size`, when rounded up to the nearest multiple of `align`,
+        // > must not overflow (i.e., the rounded value must be less than
     /// Constructs a `Layout` from a given `size` and `align`, 
     /// or returns `LayoutErr` if either of the following conditions 
     /// are not met: 
     /// 
     /// * `align` must not be zero, 
     /// 
     /// * `align` must be a power of two, 
     /// 
     /// * `size`, when rounded up to the nearest multiple of `align`, 
     ///    must not overflow (i.e., the rounded value must be less than 
     ///    `usize::MAX`). 
     #[stable(feature = "alloc_layout", since = "1.28.0")] 
     #[inline] 
     pub fn from_size_align(size: usize, align: usize) -> Result<Self, LayoutErr> { 
         if !align.is_power_of_two() { 
             return Err(LayoutErr { private: () }); 
         } 
         // (power-of-two implies align != 0.) 
         // Rounded up size is: 
         //   size_rounded_up = (size + align - 1) & !(align - 1); 
         // 
         // We know from above that align != 0. If adding (align - 1) 
         // does not overflow, then rounding up will be fine. 
         // 
         // Conversely, &-masking with !(align - 1) will subtract off 
         // only low-order-bits. Thus if overflow occurs with the sum, 
         // the &-mask cannot subtract enough to undo that overflow. 
         // 
         // Above implies that checking for summation overflow is both 
         // necessary and sufficient. 
         if size > usize::MAX - (align - 1) { 
             return Err(LayoutErr { private: () }); 
         } 
         unsafe { 
             Ok(Layout::from_size_align_unchecked(size, align)) 
         } 
     } 
     /// Constructs a `Layout` from a given `size` and `align`, 
     /// or returns `LayoutErr` if either of the following conditions 
     /// are not met: 
     /// 
     /// * `align` must not be zero, 
     /// 
     /// * `align` must be a power of two, 
     /// 
     /// * `size`, when rounded up to the nearest multiple of `align`, 
     ///    must not overflow (i.e., the rounded value must be less than 
     ///    `usize::MAX`). 
     #[stable(feature = "alloc_layout", since = "1.28.0")] 
     #[inline] 
     pub fn from_size_align(size: usize, align: usize) -> Result<Self, LayoutErr> { 
         if !align.is_power_of_two() { 
             return Err(LayoutErr { private: () }); 
         } 
  
         // (power-of-two implies align != 0.) 
  
         // Rounded up size is: 
         //   size_rounded_up = (size + align - 1) & !(align - 1); 
         // 
         // We know from above that align != 0. If adding (align - 1) 
         // does not overflow, then rounding up will be fine. 
         // 
         // Conversely, &-masking with !(align - 1) will subtract off 
         // only low-order-bits. Thus if overflow occurs with the sum, 
         // the &-mask cannot subtract enough to undo that overflow. 
         // 
         // Above implies that checking for summation overflow is both 
         // necessary and sufficient. 
         if size > usize::MAX - (align - 1) { 
             return Err(LayoutErr { private: () }); 
         } 
  
         unsafe { 
             Ok(Layout::from_size_align_unchecked(size, align)) 
         } 
     } 
+        // > `usize::MAX`)
+        let new_size = self.size() + pad;
 
-        Layout::from_size_align(new_size, self.align())
+        // SAFETY: This necessarily respectes the from_size_align
+        // prerequisites per the above.
+        unsafe { Layout::from_size_align_unchecked(new_size, self.align()) }
     }
 
     /// Creates a layout describing the record for `n` instances of