fix(unsafe): use unchecked_add in may_overflow to accurately model UB - #3275
Conversation
|
Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA). View this failed invocation of the CLA check for more information. For the most up to date status, view the checks section at the bottom of the pull request. |
fw-immunant
left a comment
There was a problem hiding this comment.
LGTM, this corrects the factual error and explains the situation clearly. Thanks!
I think we should merge this as a conservative correctness fix, but it's worth noting that there is another open PR (#3244) addressing the same issue in a different way (by changing to an unrelated example with a safety contract around indexing). But that PR is not yet ready to merge and is a more substantial alteration to the curriculum, so I'd rather merge this now and later decide whether #3244 should merge at all and if so in what form.
Summary
Updates the
may_overflowexample in the Unsafe Deep Dive chapter to usei32::unchecked_addinstead of standard+.Background
In standard Rust, integer overflow (
a + i32::MAX) is not undefined behavior: it panics with overflow checks enabled (debug mode) and performs two's-complement wrapping in release mode.Using
unchecked_add:unsafefunction signature and block.The speaker notes have been updated accordingly to clarify the distinction between safe Rust arithmetic (which wraps in release mode) and unchecked operations (which produce UB).
Fixes #3122
Relates #3021