280: Fix undefined behavior identified by Miri r=japaric a=jgallagher
Hi! We ran into an exception triggered by new undefined behavior checks inserted into the nightly compiler (https://github.com/rust-lang/rust/pull/92686/files#diff-54110dcedc5a4d976321aa5d2a6767ac0744a3ef1363b75ffc62faf81cf14c30R230-L229). Running `heapless`'s test suite under Miri didn't flag anything at first, but it did once we added `MIRIFLAGS="-Zmiri-tag-raw-pointers"`. All three of the fixes in this PR were identified via
```
MIRIFLAGS="-Zmiri-tag-raw-pointers -Zmiri-ignore-leaks" cargo +nightly miri test -- --skip pool::
```
and the fixes came from copying the implementations from the equivalent methods in `std`. Note that I skipped the `pool::` tests; there is at least one miri failure in them, but it wasn't immediately obvious how to fix it so I skipped it for now. It's probably worth adding the flag above to the CI miri run, but I didn't do that either (since it would immediately cause failures given I didn't fix the problem in `pool`).
The specific output for `pool` is
```
test pool::singleton::tests::sanity ... error: Undefined Behavior: trying to reborrow <untagged> for SharedReadWrite permission at alloc36[0x1], but that tag does not exist in the borrow stack for this location
--> /home/john/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/ptr/non_null.rs:380:18
|
380 | unsafe { &*self.as_ptr() }
| ^^^^^^^^^^^^^^^
| |
| trying to reborrow <untagged> for SharedReadWrite permission at alloc36[0x1], but that tag does not exist in the borrow stack for this location
| this error occurs as part of a reborrow at alloc36[0x1..0x9]
|
= help: this indicates a potential bug in the program: it performed an invalid operation, but the rules it violated are still experimental
= help: see https://github.com/rust-lang/unsafe-code-guidelines/blob/master/wip/stacked-borrows.md for further information
= note: inside `std::ptr::NonNull::<pool::stack::Node<u8>>::as_ref` at /home/john/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/ptr/non_null.rs:380:18
note: inside `pool::stack::Stack::<u8>::push` at src/pool/cas.rs:43:17
--> src/pool/cas.rs:43:17
|
43 | / new_head
44 | | .as_raw()
45 | | .as_ref()
| |_____________________________^
note: inside `pool::Pool::<u8>::grow` at src/pool/mod.rs:390:25
--> src/pool/mod.rs:390:25
|
390 | self.stack.push(p);
| ^^^^^^^^^^^^^^^^^^
note: inside `<pool::singleton::tests::sanity::A as pool::singleton::Pool>::grow` at src/pool/singleton.rs:78:9
--> src/pool/singleton.rs:78:9
|
78 | Self::ptr().grow(memory)
| ^^^^^^^^^^^^^^^^^^^^^^^^
note: inside `pool::singleton::tests::sanity` at src/pool/singleton.rs:362:9
--> src/pool/singleton.rs:362:9
|
362 | A::grow(unsafe { &mut MEMORY });
| ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
note: inside closure at src/pool/singleton.rs:353:5
--> src/pool/singleton.rs:353:5
|
352 | #[test]
| ------- in this procedural macro expansion
353 | / fn sanity() {
354 | | const SZ: usize = 2 * mem::size_of::<Node<u8>>() - 1;
355 | | static mut MEMORY: [u8; SZ] = [0; SZ];
356 | |
... |
373 | | assert_eq!(*A::alloc().unwrap().init(1), 1);
374 | | }
| |_____^
= note: this error originates in the attribute macro `test` (in Nightly builds, run with -Z macro-backtrace for more info)
```
Co-authored-by: John Gallagher <john@oxidecomputer.com>
as it's easier to deal with TSAN false positives in the former API
as surfaced in PR 280 the current supression rules don't handle newer versions of the
scoped_threadpool crate
trying to update the supression rules related to scoped_threadpool in PR #282 revealed that the
supression rules are masking (hiding) real data races:
https://github.com/japaric/heapless/pull/282#issuecomment-1113173358
std:🧵:scope requires less supression rules and does not mask real data races -- for instance,
the data race in the linked issue comment is not masked when using std:🧵:scope
tradeoffs:
- pro: one less dev dependency
- pro: supressions file is simpler
- cons: std:🧵:scope is only available on recent nightlies
Use when building generated code where it's possible to have a zero
length array/vector (e.g. wire-format). See #252
- Added vec::tests::zero_capacity test
- Added sealed::greater_than_eq_0
There already is the Vec::from_slice method that does the same, but
implementing the TryFrom trait makes it easier to write code that works
both with heapless::Vec and std::vec::Vec.
