Add contracts for all functions in `Alignment` #136578

tautschnig · 2025-02-05T12:24:55Z

Uses the contracts syntax introduced in #128045.

rustbot · 2025-02-05T12:25:04Z

Thanks for the pull request, and welcome! The Rust team is excited to review your changes, and you should hear from @tgross35 (or someone else) some time within the next two weeks.

Please see the contribution instructions for more information. Namely, in order to ensure the minimum review times lag, PR authors and assigned reviewers should ensure that the review label (S-waiting-on-review and S-waiting-on-author) stays updated, invoking these commands when appropriate:

@rustbot author: the review is finished, PR author should check the comments and take action accordingly
@rustbot review: the author is ready for a review, this PR will be queued again in the reviewer's queue

library/core/src/ptr/alignment.rs

jieyouxu · 2025-02-05T12:34:32Z

You could also tag contracts-related PRs with F-contracts in the future via

@rustbot label: +F-contracts

in a comment / PR description.

tgross35 · 2025-02-05T12:57:33Z

Could you say some more about the motivation? This feature was merged only a number of hours ago, that seems soon to start using in std. Even once it is more stable, what should and shouldn't get contracts is probably something that needs to get discussed.

@rust-lang/libs any thoughts here?

jieyouxu · 2025-02-05T13:00:46Z

Yeah, this was only approved as a lang experiment on the lang/compiler side, no idea what the situation is libs side (which certainly should be discussed).

cc @pnkfelix @nikomatsakis @celinval (lang liason and ppl who were implementing this feature compiler side)

Noratrieb · 2025-02-05T13:14:06Z

I'll libs nominate this for discussion (this should only be discussed after the contracts people mentioned above have replied).

celinval · 2025-02-05T20:34:45Z

Totally worth discussion, and it would be great to get some feedback on the features that are needed to meet the libs team bar. I am especially curious to see how you think contracts and ub_checks will interact.

Noratrieb · 2025-02-05T21:37:17Z

It would be useful to know what your plan/intention is with adding contracts here. Is it just to try them out or is annotating the standard library with contracts for downstream consumers part of the goal of contracts?

tautschnig · 2025-02-05T21:37:47Z

Could you say some more about the motivation? This feature was merged only a number of hours ago, that seems soon to start using in std. Even once it is more stable, what should and shouldn't get contracts is probably something that needs to get discussed.

As far as the motivation is concerned: we're working towards https://rust-lang.github.io/rust-project-goals/2025h1/std-contracts.html, and I created this (draft) PR with the hope to initiate discussion while knowing there is a lot more work to be done on our end.

As I am new contributor: is there other information that I can provide or another forum that I should use rather than this PR?

tautschnig · 2025-02-05T21:42:07Z

It would be useful to know what your plan/intention is with adding contracts here. Is it just to try them out or is annotating the standard library with contracts for downstream consumers part of the goal of contracts?

Our current goal is https://rust-lang.github.io/rust-project-goals/2025h1/std-contracts.html, though we are in early stages and it indeed is about trying out what works best. Eventually we want to enable verification of downstream consumers, but a lot more work will be required before we get there.

tgross35 · 2025-02-05T22:17:04Z

As far as the motivation is concerned: we're working towards https://rust-lang.github.io/rust-project-goals/2025h1/std-contracts.html, and I created this (draft) PR with the hope to initiate discussion while knowing there is a lot more work to be done on our end.

As I am new contributor: is there other information that I can provide or another forum that I should use rather than this PR?

Are there any docs on how contracts work as they exist today? Ignoring the stability question, we need something to refer to about how to use these properly, e.g. in https://doc.rust-lang.org/nightly/unstable-book/. Also, how are contracts that get merged into r-l/rust being verified?

The linked page is somewhat vague about what this means for std. I think we could also use a policy page in the library dev guide (https://std-dev-guide.rust-lang.org) giving guidelines for their use, based on the outcome of any discussion that happens.

Bringing this up on the libs zulip would be a good idea to get the ball rolling https://rust-lang.zulipchat.com/#narrow/channel/219381-t-libs.

library/core/src/ptr/alignment.rs

@@ -43,6 +43,8 @@ impl Alignment {
    #[unstable(feature = "ptr_alignment_type", issue = "102070")]
    #[inline]
    #[must_use]
+    #[cfg_attr(not(bootstrap), contracts::requires(mem::align_of::<T>().is_power_of_two()))]


Amanieu · 2025-02-12T17:44:06Z

We discussed this in the libs meeting today. We're happy to add contracts to the standard library as an experiment, as long as this doesn't get in the way of normal standard library development. Depending on how the contracts feature evolves, we may reconsider our level of support.

library/core/src/ptr/alignment.rs

RalfJung · 2025-04-16T09:58:11Z

What is the difference you are seeing?

bors · 2025-05-13T13:39:10Z

☔ The latest upstream changes (presumably #140887) made this pull request unmergeable. Please resolve the merge conflicts.

Dylan-DPC · 2025-08-15T11:56:35Z

@tautschnig any updates on this? thanks

…quires} See rust-lang#136578 (comment).

rustbot · 2025-08-21T10:22:32Z

The Miri subtree was changed

cc @rust-lang/miri

Some changes occurred to the intrinsics. Make sure the CTFE / Miri interpreter
gets adapted for the changes, if necessary.

cc @rust-lang/miri, @RalfJung, @oli-obk, @lcnr

Uses the experimental contracts syntax..

…quires} See rust-lang#136578 (comment).

Contracts can affect 1) whether we get a constant and 2) which value we are moving.

Updated via `./x.py test mir-opt --bless --stage 1` plus a manual tweak of `tests/mir-opt/gvn_ptr_eq_with_constant.main.GVN.diff`.

Contracts result in function calls that would make the inlining test spuriously fail.

dawidl022 · 2025-08-22T16:41:50Z

tests/codegen-llvm/cross-crate-inlining/auxiliary/leaf.rs

-pub fn leaf_fn() -> String {
-    String::new()
+pub fn leaf_fn() -> bool {
+    Some(0).is_some()


Is this the way we want to handle the test failure? Surely, we don't want contracts to affect the inlining?

Well, I think UB checks already do.

IMO the important case is that trivial getters and setters that literally only do a field access get made cross-crate-inlineable. Also managing to detect functions that optimize to just a load or store is gravy. It's impossible in the general case, because of the limitations of the current compilation model and query system. And it's sometimes undesirable because making a function cross-crate-inlineable increases the amount of code that dependent crates need to compile, which can regress incremental build times.

... Wouldn't hurt to have that sort of explanation in the codebase.

In addition, I think there's a possible future extension to the cross-crate-inlineable analysis that excludes code underneath a UB check or contract check from the cost model.

I believe disabled contracts should have zero runtime penalties, since they serve a different purpose to UB checks or any other form of existing runtime assertion. Their role is more akin to doctests: documentation that can be executed for testing purposes. Additionally contracts are a means to facilitate formal verification.

These are the goals of contracts stated by the draft RFC.

They form precise, machine readable documentation of the expected behaviour of your code.

They can be automatically converted into assert! checks, and then validated using your existing unit, property, fuzz, and integration tests.

They form the specification for formal verification tools. In cases where these tools can prove the absence of bugs, the checks can be elided entirely from the code, giving you safety with no runtime cost. These formally verified checks can even form the basis of assume statements, enabling additional optimization within the compiler (e.g. allowing the compiler to remove bounds checks on accesses that can be formally proven to be safe).

I'm not sure you understood what I was saying, so I'm rephrasing. UB checks currently have an impact on optimizations (that look exactly like the diff we are commenting on) even when they are completely disabled at runtime. In an ideal world, they wouldn't. But the actual consequences here are very minimal in practice, so we haven't yet invested very heavily in making the compiler perfect.

For some reason it's not able to constant propagate the None so that contract_check_requires(__postcond, body) expands to just body.

contract_check_requires has signature fn contract_check_requires<C: Fn() -> bool + Copy>(cond: C) so I can't match that up with the code you are posting here. Do you mean contract_check_ensures? But there's no Option argument there either...

But anyway it seems you want contract_check_ensures to be inlined but intrinsics do not get inlined since backends may want to plug in their own implementation. This may need a custom optimization pass. Right now though it's unclear to me why this is an intrinsic in the first place, and your example code doesn't match the actual signatures, so what this needs most is a step back and a plan -- blind experimentation isn't going to get us there.

Yes, sorry, I meant contract_check_ensures (edited my previous comment now). I'm referring to my code in #144438, which @celinval linked to.

Ah... please don't spread the discussion over multiple PRs, that will be impossible to follow.

Probably best to mark this PR here as a draft and suspend it until #144438 is done.

if there was even a slight possibility of runtime penalties.

I think this is an unreasonable criteria, and I tried to explain why by referring to the if T::IS_ZST pattern.

RalfJung · 2025-08-23T08:15:16Z

library/core/src/intrinsics/mod.rs

@@ -2605,6 +2605,7 @@ pub const fn contract_checks() -> bool {
 // doesn't honor `#[allow_internal_unstable]`, so for the const feature gate we use the user-facing
 // `contracts` feature rather than the perma-unstable `contracts_internals`
 #[rustc_const_unstable(feature = "contracts", issue = "128044")]
+#[miri::intrinsic_fallback_is_spec]


It seems that no backend actually overwrites this intrinsic. Why is it an intrinsic in the first place...? (Same for contract_check_ensures.)

rustbot assigned tgross35 Feb 5, 2025

rustbot added S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. T-libs Relevant to the library team, which will review and decide on the PR/issue. labels Feb 5, 2025

This comment has been minimized.

Sign in to view

jieyouxu added the F-contracts `#![feature(contracts)]` label Feb 5, 2025

jieyouxu reviewed Feb 5, 2025

View reviewed changes

library/core/src/ptr/alignment.rs Outdated Show resolved Hide resolved

jieyouxu mentioned this pull request Feb 5, 2025

Tracking Issue for Contracts #128044

Open

9 tasks

Noratrieb added the I-libs-nominated Nominated for discussion during a libs team meeting. label Feb 5, 2025

tautschnig force-pushed the upstream-contracts/alignment branch from d46f868 to 7288286 Compare February 5, 2025 22:06

This comment has been minimized.

Sign in to view

Sky9x reviewed Feb 5, 2025

View reviewed changes

tautschnig force-pushed the upstream-contracts/alignment branch from 7288286 to c180bd0 Compare February 6, 2025 13:23

This comment has been minimized.

Sign in to view

tautschnig mentioned this pull request Feb 7, 2025

ICE when trying to compile code with contracts: No HirId for DefId #136683

Closed

tautschnig force-pushed the upstream-contracts/alignment branch from c180bd0 to 4322394 Compare February 11, 2025 13:46

This comment has been minimized.

Sign in to view

tautschnig mentioned this pull request Feb 12, 2025

Contract cannot be applied to const functions #136925

Closed

Amanieu removed the I-libs-nominated Nominated for discussion during a libs team meeting. label Feb 12, 2025

scottmcm reviewed Feb 12, 2025

View reviewed changes

library/core/src/ptr/alignment.rs Outdated Show resolved Hide resolved

This comment was marked as outdated.

Sign in to view

celinval mentioned this pull request Apr 30, 2025

Instrument the Rust standard library with safety contracts rust-lang/rust-project-goals#126

Open

8 tasks

dawidl022 mentioned this pull request Jul 25, 2025

Guard HIR lowered contracts with contract_checks #144438

Open

dawidl022 mentioned this pull request Aug 10, 2025

Conditionally compile contracts instead of deciding at run-time #145229

Open

tautschnig force-pushed the upstream-contracts/alignment branch from bef04bf to 37e0b32 Compare August 20, 2025 21:05

This comment has been minimized.

Sign in to view

tautschnig added a commit to tautschnig/verify-rust-std that referenced this pull request Aug 21, 2025

Add #[miri::intrinsic_fallback_is_spec] to contract_check_{ensures,re…

8432f09

…quires} See rust-lang#136578 (comment).

tautschnig force-pushed the upstream-contracts/alignment branch 2 times, most recently from bad50a8 to 3402194 Compare August 21, 2025 10:20

tautschnig added a commit to tautschnig/verify-rust-std that referenced this pull request Aug 21, 2025

Add #[miri::intrinsic_fallback_is_spec] to contract_check_{ensures,re…

8569a2a

…quires} See rust-lang#136578 (comment).

tautschnig marked this pull request as ready for review August 21, 2025 10:22

rustbot added S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. and removed S-waiting-on-author Status: This is awaiting some action (such as code changes or more information) from the author. labels Aug 21, 2025

This comment has been minimized.

Sign in to view

tautschnig added 6 commits August 21, 2025 10:23

Add contracts for all functions in Alignment

85c9f58

Uses the experimental contracts syntax..

Add #[miri::intrinsic_fallback_is_spec] to contract_check_{ensures,re…

6f71cb1

…quires} See rust-lang#136578 (comment).

Adjust tests as affected by contracts

1025874

Contracts can affect 1) whether we get a constant and 2) which value we are moving.

Update expected MIR in tests

f4a8289

Updated via `./x.py test mir-opt --bless --stage 1` plus a manual tweak of `tests/mir-opt/gvn_ptr_eq_with_constant.main.GVN.diff`.

Use Option instead of String to make inling test pass

1e82a9b

Contracts result in function calls that would make the inlining test spuriously fail.

Contracts affect execution time

23fefad

tautschnig force-pushed the upstream-contracts/alignment branch from 3402194 to 23fefad Compare August 21, 2025 10:24

dawidl022 reviewed Aug 22, 2025

View reviewed changes

RalfJung reviewed Aug 23, 2025

View reviewed changes

RalfJung added S-blocked Status: Blocked on something else such as an RFC or other implementation work. and removed S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. labels Aug 23, 2025

Add contracts for all functions in Alignment #136578

Are you sure you want to change the base?

Add contracts for all functions in Alignment #136578

Conversation

tautschnig commented Feb 5, 2025

Uh oh!

rustbot commented Feb 5, 2025

Uh oh!

This comment has been minimized.

Uh oh!

jieyouxu commented Feb 5, 2025

Uh oh!

tgross35 commented Feb 5, 2025

Uh oh!

jieyouxu commented Feb 5, 2025

Uh oh!

Noratrieb commented Feb 5, 2025

Uh oh!

celinval commented Feb 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Noratrieb commented Feb 5, 2025

Uh oh!

tautschnig commented Feb 5, 2025

Uh oh!

tautschnig commented Feb 5, 2025

Uh oh!

This comment has been minimized.

tgross35 commented Feb 5, 2025

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment has been minimized.

This comment has been minimized.

Amanieu commented Feb 12, 2025

Uh oh!

Uh oh!

This comment was marked as outdated.

RalfJung commented Apr 16, 2025

Uh oh!

This comment was marked as outdated.

bors commented May 13, 2025

Uh oh!

Dylan-DPC commented Aug 15, 2025

Uh oh!

This comment has been minimized.

rustbot commented Aug 21, 2025

Uh oh!

This comment has been minimized.

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

RalfJung Aug 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dawidl022 Aug 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Add contracts for all functions in `Alignment` #136578

Add contracts for all functions in `Alignment` #136578

celinval commented Feb 5, 2025 •

edited

Loading

RalfJung Aug 23, 2025 •

edited

Loading

dawidl022 Aug 23, 2025 •

edited

Loading