Make `Copy` unsafe to implement for ADTs with `unsafe` fields by jswrenn · Pull Request #134008 · rust-lang/rust

@rustbot rustbot added S-waiting-on-review

Status: Awaiting review from the assignee but also interested parties.

T-compiler

Relevant to the compiler team, which will review and decide on the PR/issue.

labels

Dec 7, 2024

compiler-errors

compiler-errors

@rustbot rustbot added S-waiting-on-author

Status: This is awaiting some action (such as code changes or more information) from the author.

and removed S-waiting-on-review

Status: Awaiting review from the assignee but also interested parties.

labels

Dec 7, 2024

jswrenn

@jswrenn

As a rule, the application of `unsafe` to a declaration requires that use-sites
of that declaration also require `unsafe`. For example, a field declared
`unsafe` may only be read in the lexical context of an `unsafe` block.

For nearly all safe traits, the safety obligations of fields are explicitly
discharged when they are mentioned in method definitions. For example,
idiomatically implementing `Clone` (a safe trait) for a type with unsafe fields
will require `unsafe` to clone those fields.

Prior to this commit, `Copy` violated this rule. The trait is marked safe, and
although it has no explicit methods, its implementation permits reads of `Self`.

This commit resolves this by making `Copy` conditionally safe to implement. It
remains safe to implement for ADTs without unsafe fields, but unsafe to
implement for ADTs with unsafe fields.

Tracking: rust-lang#132922

@rustbot rustbot added S-waiting-on-review

Status: Awaiting review from the assignee but also interested parties.

and removed S-waiting-on-author

Status: This is awaiting some action (such as code changes or more information) from the author.

labels

Dec 8, 2024

compiler-errors

@bors bors added S-waiting-on-bors

Status: Waiting on bors to run and complete tests. Bors will change the label on completion.

and removed S-waiting-on-review

Status: Awaiting review from the assignee but also interested parties.

labels

Dec 9, 2024

fmease added a commit to fmease/rust that referenced this pull request

Dec 9, 2024
…iler-errors

Make `Copy` unsafe to implement for ADTs with `unsafe` fields

As a rule, the application of `unsafe` to a declaration requires that use-sites of that declaration also entail `unsafe`. For example, a field declared `unsafe` may only be read in the lexical context of an `unsafe` block.

For nearly all safe traits, the safety obligations of fields are explicitly discharged when they are mentioned in method definitions. For example, idiomatically implementing `Clone` (a safe trait) for a type with unsafe fields will require `unsafe` to clone those fields.

Prior to this commit, `Copy` violated this rule. The trait is marked safe, and although it has no explicit methods, its implementation permits reads of `Self`.

This commit resolves this by making `Copy` conditionally safe to implement. It remains safe to implement for ADTs without unsafe fields, but unsafe to implement for ADTs with unsafe fields.

Tracking: rust-lang#132922

r? `@compiler-errors`

bors added a commit to rust-lang-ci/rust that referenced this pull request

Dec 10, 2024
Rollup of 9 pull requests

Successful merges:

 - rust-lang#133967 ([AIX] Pass -bnoipath when adding rust upstream dynamic crates)
 - rust-lang#133970 ([AIX] Replace sa_sigaction with sa_union.__su_sigaction for AIX)
 - rust-lang#133980 ([AIX] Remove option "-n" from AIX "ln" command)
 - rust-lang#134008 (Make `Copy` unsafe to implement for ADTs with `unsafe` fields)
 - rust-lang#134017 (Don't use `AsyncFnOnce::CallOnceFuture` bounds for signature deduction)
 - rust-lang#134023 (handle cygwin environment in `install::sanitize_sh`)
 - rust-lang#134041 (Use SourceMap to load debugger visualizer files)
 - rust-lang#134065 (Move `write_graphviz_results`)
 - rust-lang#134070 (Some asm! diagnostic adjustments and a papercut fix)

r? `@ghost`
`@rustbot` modify labels: rollup

fmease added a commit to fmease/rust that referenced this pull request

Dec 10, 2024
…iler-errors

Make `Copy` unsafe to implement for ADTs with `unsafe` fields

As a rule, the application of `unsafe` to a declaration requires that use-sites of that declaration also entail `unsafe`. For example, a field declared `unsafe` may only be read in the lexical context of an `unsafe` block.

For nearly all safe traits, the safety obligations of fields are explicitly discharged when they are mentioned in method definitions. For example, idiomatically implementing `Clone` (a safe trait) for a type with unsafe fields will require `unsafe` to clone those fields.

Prior to this commit, `Copy` violated this rule. The trait is marked safe, and although it has no explicit methods, its implementation permits reads of `Self`.

This commit resolves this by making `Copy` conditionally safe to implement. It remains safe to implement for ADTs without unsafe fields, but unsafe to implement for ADTs with unsafe fields.

Tracking: rust-lang#132922

r? ``@compiler-errors``

This was referenced

Dec 10, 2024

bors added a commit to rust-lang-ci/rust that referenced this pull request

Dec 10, 2024
Rollup of 11 pull requests

Successful merges:

 - rust-lang#133478 (jsondocck: Parse, don't validate commands.)
 - rust-lang#133967 ([AIX] Pass -bnoipath when adding rust upstream dynamic crates)
 - rust-lang#133970 ([AIX] Replace sa_sigaction with sa_union.__su_sigaction for AIX)
 - rust-lang#133980 ([AIX] Remove option "-n" from AIX "ln" command)
 - rust-lang#134008 (Make `Copy` unsafe to implement for ADTs with `unsafe` fields)
 - rust-lang#134017 (Don't use `AsyncFnOnce::CallOnceFuture` bounds for signature deduction)
 - rust-lang#134023 (handle cygwin environment in `install::sanitize_sh`)
 - rust-lang#134041 (Use SourceMap to load debugger visualizer files)
 - rust-lang#134065 (Move `write_graphviz_results`)
 - rust-lang#134106 (Add compiler-maintainers who requested to be on review rotation)
 - rust-lang#134123 (bootstrap: Forward cargo JSON output to stdout, not stderr)

Failed merges:

 - rust-lang#134120 (Remove Felix from ping groups and review rotation)

r? `@ghost`
`@rustbot` modify labels: rollup

rust-timer added a commit to rust-lang-ci/rust that referenced this pull request

Dec 10, 2024
Rollup merge of rust-lang#134008 - jswrenn:unsafe-fields-copy, r=compiler-errors

Make `Copy` unsafe to implement for ADTs with `unsafe` fields

As a rule, the application of `unsafe` to a declaration requires that use-sites of that declaration also entail `unsafe`. For example, a field declared `unsafe` may only be read in the lexical context of an `unsafe` block.

For nearly all safe traits, the safety obligations of fields are explicitly discharged when they are mentioned in method definitions. For example, idiomatically implementing `Clone` (a safe trait) for a type with unsafe fields will require `unsafe` to clone those fields.

Prior to this commit, `Copy` violated this rule. The trait is marked safe, and although it has no explicit methods, its implementation permits reads of `Self`.

This commit resolves this by making `Copy` conditionally safe to implement. It remains safe to implement for ADTs without unsafe fields, but unsafe to implement for ADTs with unsafe fields.

Tracking: rust-lang#132922

r? ```@compiler-errors```

flip1995 pushed a commit to flip1995/rust that referenced this pull request

Dec 15, 2024
…iler-errors

Make `Copy` unsafe to implement for ADTs with `unsafe` fields

As a rule, the application of `unsafe` to a declaration requires that use-sites of that declaration also entail `unsafe`. For example, a field declared `unsafe` may only be read in the lexical context of an `unsafe` block.

For nearly all safe traits, the safety obligations of fields are explicitly discharged when they are mentioned in method definitions. For example, idiomatically implementing `Clone` (a safe trait) for a type with unsafe fields will require `unsafe` to clone those fields.

Prior to this commit, `Copy` violated this rule. The trait is marked safe, and although it has no explicit methods, its implementation permits reads of `Self`.

This commit resolves this by making `Copy` conditionally safe to implement. It remains safe to implement for ADTs without unsafe fields, but unsafe to implement for ADTs with unsafe fields.

Tracking: rust-lang#132922

r? ```@compiler-errors```

flip1995 pushed a commit to flip1995/rust that referenced this pull request

Dec 15, 2024
Rollup of 11 pull requests

Successful merges:

 - rust-lang#133478 (jsondocck: Parse, don't validate commands.)
 - rust-lang#133967 ([AIX] Pass -bnoipath when adding rust upstream dynamic crates)
 - rust-lang#133970 ([AIX] Replace sa_sigaction with sa_union.__su_sigaction for AIX)
 - rust-lang#133980 ([AIX] Remove option "-n" from AIX "ln" command)
 - rust-lang#134008 (Make `Copy` unsafe to implement for ADTs with `unsafe` fields)
 - rust-lang#134017 (Don't use `AsyncFnOnce::CallOnceFuture` bounds for signature deduction)
 - rust-lang#134023 (handle cygwin environment in `install::sanitize_sh`)
 - rust-lang#134041 (Use SourceMap to load debugger visualizer files)
 - rust-lang#134065 (Move `write_graphviz_results`)
 - rust-lang#134106 (Add compiler-maintainers who requested to be on review rotation)
 - rust-lang#134123 (bootstrap: Forward cargo JSON output to stdout, not stderr)

Failed merges:

 - rust-lang#134120 (Remove Felix from ping groups and review rotation)

r? `@ghost`
`@rustbot` modify labels: rollup

bors pushed a commit to rust-lang-ci/rust that referenced this pull request

Jan 5, 2025
…iler-errors

Make `Copy` unsafe to implement for ADTs with `unsafe` fields

As a rule, the application of `unsafe` to a declaration requires that use-sites of that declaration also entail `unsafe`. For example, a field declared `unsafe` may only be read in the lexical context of an `unsafe` block.

For nearly all safe traits, the safety obligations of fields are explicitly discharged when they are mentioned in method definitions. For example, idiomatically implementing `Clone` (a safe trait) for a type with unsafe fields will require `unsafe` to clone those fields.

Prior to this commit, `Copy` violated this rule. The trait is marked safe, and although it has no explicit methods, its implementation permits reads of `Self`.

This commit resolves this by making `Copy` conditionally safe to implement. It remains safe to implement for ADTs without unsafe fields, but unsafe to implement for ADTs with unsafe fields.

Tracking: rust-lang#132922

r? ```@compiler-errors```

@TimNN TimNN mentioned this pull request

Mar 30, 2025