Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Infallible promotion #3027

Merged
merged 8 commits into from
Jan 13, 2021
22 changes: 19 additions & 3 deletions text/0000-infallible-promotion.md
Original file line number Diff line number Diff line change
Expand Up @@ -97,9 +97,25 @@ Inside a function body's block:
it into a static memory location and give the resulting reference a
`'static` lifetime.

Operations that definitely succeed include literals of any kind, constructors (struct/enum/union/tuple), struct/tuple field accesses, `+`/`-`/`*`.
(Checked arithmetic is not a problem: an addition in debug mode is compiled to a `CheckedAdd` MIR operation that never fails, which returns an `(<int>, bool)`, and is followed by a check of said `bool` to possibly raise a panic. We only ever promote the `CheckedAdd`, so evaluation of the promoted will never fail, even if the operation overflows.)
Operations that might fail include `/`/`%`, `panic!` (including the assertion that follows `Checked*` arithmetic to ensure that no overflow happened), array/slice indexing, any unsafe operation, and `const fn` calls (as they might do any of the above).
Operations that definitely succeed include:
- literals of any kind
- constructors (struct/enum/union/tuple)
- struct/tuple field accesses
- arithmetic that does not involve division: `+`/`-`/`*`
RalfJung marked this conversation as resolved.
Show resolved Hide resolved

Note that arithmetic overflow is not a problem: an addition in debug mode is compiled to a `CheckedAdd` MIR operation that never fails, which returns an `(<int>, bool)`, and is followed by a check of said `bool` to possibly raise a panic. We only ever promote the `CheckedAdd`, so evaluation of the promoted will never fail, even if the operation overflows. For example, `&(1 + u32::MAX)` turns into something like:
RalfJung marked this conversation as resolved.
Show resolved Hide resolved
```rust
const C: (u32, bool) = CheckedAdd(1, u32::MAX); // evaluates to (1, true).
assert!(C.1 == false);
&C.0
RalfJung marked this conversation as resolved.
Show resolved Hide resolved
```

Operations that might fail include:
- `/`/`%`
- `panic!` (including the assertion that follows `Checked*` arithmetic to ensure that no overflow happened)
- array/slice indexing
- any unsafe operation
- `const fn` calls (as they might do any of the above)

RalfJung marked this conversation as resolved.
Show resolved Hide resolved
# Reference-level explanation
[reference-level-explanation]: #reference-level-explanation
Expand Down