Fix from raw parts - #25277
Open
yilin0518 wants to merge 1 commit into
Open
Conversation
yilin0518
force-pushed
the
fix_from_raw_parts
branch
from
August 3, 2026 11:46
dcc101c to
57a2a6d
Compare
yilin0518
force-pushed
the
fix_from_raw_parts
branch
from
August 3, 2026 11:59
57a2a6d to
a898242
Compare
beicause
approved these changes
Aug 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Objective
AlignedVec::from_raw_parts's safety documentation has a contract gap: whencapacity == 0, it only saidptr"need only be aligned" and never requiredalignitself to be a non-zero power of two. This means a caller can construct anAlignedVecthat satisfies the documented contract literally (e.g.align = 3,capacity = 0), yet later trigger undefined behavior through purely safe method calls (e.g.push), because internal methods likelayout()unconditionally build aLayoutviaLayout::from_size_align_unchecked(self.cap, self.align), which requiresalignto be a non-zero power of two regardless ofcapacity.The old docs were also imprecise about:
alignindependent of allocationptrmust satisfy whencapacity == 0Solution
Rewrote the
# Safetysection offrom_raw_partsto state the invariants unconditionally and precisely:alignmust be a non-zero power of two, and less thanisize::MAX— regardless ofcapacity, sincealignis used to build aLayouteven when the vector currently has zero capacity.capacity, rounded up to the nearest multiple ofalign, must not overflowisize.capacity != 0,ptrmust have been allocated with aLayoutusing this exactalignand asizeofcapacity(merging the two previously-separate, overlapping clauses about matching align/size on dealloc).capacity == 0,ptrneed not point to allocated memory, but must still satisfyptr.as_ptr() as usize % align == 0(replacing the ambiguous "need only be aligned").No functional code changed — this is a documentation-only fix to close the public unsafe contract gap.
Testing
cargo doc -p bevy_platform --no-depspasses, and the existing doctest onfrom_raw_partsstill passes.I use the command
cargo +nightly-x86_64-pc-windows-gnu miri runto test the above code, and it trigger the unsafe precondition(s) violation: