NonNull<T> doesn't guarantee ABI compatibility with *mut T

[jacobsa]

View all comments

std::num::NonZero<T> guarantees that it is ABI compatible with T for all non-zero values. As far as I can tell:

• There is no such guarantee for std::ptr::NonNull.

• …but it actually does hold in practice, given the repr(transparent) implementation.

Is the fact that this isn't guaranteed just an oversight, or is it on purpose?

[theemathas]

cc @RalfJung

[RalfJung]

Yeah we should probably document something along those lines.

[traviscross]

This is already guaranteed. See:

https://doc.rust-lang.org/nightly/std/primitive.fn.html#abi-compatibility

• *const T, *mut T, &T, &mut T, Box<T> (specifically, only Box<T, Global>), and NonNull<T> are all ABI-compatible with each other for all T. They are also ABI-compatible with each other for different T if they have the same metadata type (<T as Pointee>::Metadata). However, see the [Control Flow Integrity][cfi-docs] docs for caveats.

[jacobsa]

Nice, thanks for citing. Perhaps it would make sense to stick a call-out to that in the NonNull docs? I'm not sure how I'm supposed to find it otherwise; most types guarantee this in their own docs.

[asquared31415]

Those docs are also only for rust-to-rust abi compatibility, not necessarily layout compatibility. There should be a section on the NonNull docs about this.

[traviscross]

We don't currently make the necessary layout guarantees. There's ongoing work on adding these for pointer types. See:

• Document layout equivalences for pointer types reference#2291
• Document transmutability of pointer types reference#2292

I'll consider adding NonNull<T> to those proposals.