google / google/zerocopy

Require opting in to repr-less types?

Open
#358 10 comments 0 reactions 0 assignees View on GitHub
compatibility-breaking
Dominant language
Rust
Stars
2.6k
Forks
179
Avg merge
1d 19h
Merged PRs (30d)
29

Description

Some of our derives support types without reprs because they're not required for soundness. This can be useful if you don't care about layout stability (and perhaps you care about allowing the compiler to make layout optimizations), but it's a big footgun: it makes it easy to accidentally write code which depends upon type layout without realizing it.

Perhaps we should require users who wish to not use reprs to opt-in to this behavior; something like:

```rust
#[derive(FromZeroes, FromBytes)]
#[allow(zerocopy::missing_repr)] // Is this legal? Maybe we need the syntax below instead.
struct Foo;

#[derive(FromZeroes, FromBytes)]
#[zerocopy(allow(missing_repr))]
struct Bar;
```

This would be a semver-breaking change, but a minor one, and our error message could suggest the `allow` to steer users in the right direction.

Note one important subtlety: On its own, this isn't sufficient: if a struct contains another type with a non-stable representation, then even if the outer struct is, e.g., `repr(C)`, it isn't sufficient to guarantee the stability of the outer type's layout.

It seems unlikely, but perhaps we could also have zerocopy-derive emit a warning that users can `allow` using rustc's built-in machinery. According to [this documentation](https://docs.rs/proc-macro-error/1.0.4/proc_macro_error/index.html#limitations), warnings are not currently supported except on nightly, so this may be a non-starter.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.