Skip to content

Update RawVec proof #489

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Sep 10, 2025
Merged

Update RawVec proof #489

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 3 additions & 26 deletions verifast-proofs/alloc/raw_vec/mod.rs/original/raw_vec.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -155,7 +155,7 @@ impl RawVecInner<Global> {
}

// Tiny Vecs are dumb. Skip to:
// - 8 if the element size is 1, because any heap allocators is likely
// - 8 if the element size is 1, because any heap allocator is likely
// to round up a request of less than 8 bytes to at least 8 bytes.
// - 4 if elements are moderate-sized (<= 1 KiB).
// - 1 otherwise, to avoid wasting too much space for very short Vecs.
Expand Down Expand Up @@ -468,10 +468,6 @@ impl<A: Allocator> RawVecInner<A> {
return Ok(Self::new_in(alloc, elem_layout.alignment()));
}

if let Err(err) = alloc_guard(layout.size()) {
return Err(err);
}

let result = match init {
AllocInit::Uninitialized => alloc.allocate(layout),
#[cfg(not(no_global_oom_handling))]
Expand Down Expand Up @@ -662,7 +658,7 @@ impl<A: Allocator> RawVecInner<A> {
let new_layout = layout_array(cap, elem_layout)?;

let ptr = finish_grow(new_layout, self.current_memory(elem_layout), &mut self.alloc)?;
// SAFETY: finish_grow would have resulted in a capacity overflow if we tried to allocate more than `isize::MAX` items
// SAFETY: layout_array would have resulted in a capacity overflow if we tried to allocate more than `isize::MAX` items

unsafe { self.set_ptr_and_cap(ptr, cap) };
Ok(())
Expand All @@ -684,7 +680,7 @@ impl<A: Allocator> RawVecInner<A> {
let new_layout = layout_array(cap, elem_layout)?;

let ptr = finish_grow(new_layout, self.current_memory(elem_layout), &mut self.alloc)?;
// SAFETY: finish_grow would have resulted in a capacity overflow if we tried to allocate more than `isize::MAX` items
// SAFETY: layout_array would have resulted in a capacity overflow if we tried to allocate more than `isize::MAX` items
unsafe {
self.set_ptr_and_cap(ptr, cap);
}
Expand Down Expand Up @@ -771,8 +767,6 @@ fn finish_grow<A>(
where
A: Allocator,
{
alloc_guard(new_layout.size())?;

let memory = if let Some((ptr, old_layout)) = current_memory {
debug_assert_eq!(old_layout.align(), new_layout.align());
unsafe {
Expand All @@ -799,23 +793,6 @@ fn handle_error(e: TryReserveError) -> ! {
}
}

// We need to guarantee the following:
// * We don't ever allocate `> isize::MAX` byte-size objects.
// * We don't overflow `usize::MAX` and actually allocate too little.
//
// On 64-bit we just need to check for overflow since trying to allocate
// `> isize::MAX` bytes will surely fail. On 32-bit and 16-bit we need to add
// an extra guard for this in case we're running on a platform which can use
// all 4GB in user-space, e.g., PAE or x32.
#[inline]
fn alloc_guard(alloc_size: usize) -> Result<(), TryReserveError> {
if usize::BITS < 64 && alloc_size > isize::MAX as usize {
Err(CapacityOverflow.into())
} else {
Ok(())
}
}

#[inline]
fn layout_array(cap: usize, elem_layout: Layout) -> Result<Layout, TryReserveError> {
elem_layout.repeat(cap).map(|(layout, _pad)| layout).map_err(|_| CapacityOverflow.into())
Expand Down
36 changes: 2 additions & 34 deletions verifast-proofs/alloc/raw_vec/mod.rs/verified/raw_vec.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1134,11 +1134,6 @@ impl<A: Allocator> RawVecInner<A> {
return Ok(r);
}

if let Err(err) = alloc_guard(layout.size()) {
//@ std::alloc::Allocator_to_own(alloc);
return Err(err);
}

let result = match init {
AllocInit::Uninitialized => {
let r;
Expand Down Expand Up @@ -1638,7 +1633,7 @@ impl<A: Allocator> RawVecInner<A> {
core::ops::FromResidual::from_residual(residual)
}
core::ops::ControlFlow::Continue(ptr) => {
// SAFETY: finish_grow would have resulted in a capacity overflow if we tried to allocate more than `isize::MAX` items
// SAFETY: layout_array would have resulted in a capacity overflow if we tried to allocate more than `isize::MAX` items
unsafe {
self.set_ptr_and_cap(ptr, cap);
//@ let self1 = *self;
Expand Down Expand Up @@ -1737,7 +1732,7 @@ impl<A: Allocator> RawVecInner<A> {
core::ops::FromResidual::from_residual(residual)
}
core::ops::ControlFlow::Continue(ptr) => {
// SAFETY: finish_grow would have resulted in a capacity overflow if we tried to allocate more than `isize::MAX` items
// SAFETY: layout_array would have resulted in a capacity overflow if we tried to allocate more than `isize::MAX` items
unsafe {
//@ assert Layout::size_(new_layout) == Layout::size_(elem_layout) * cap;
//@ mul_mono_l(1, Layout::size_(elem_layout), cap);
Expand Down Expand Up @@ -2086,33 +2081,6 @@ fn handle_error(e: TryReserveError) -> !
}
}

// We need to guarantee the following:
// * We don't ever allocate `> isize::MAX` byte-size objects.
// * We don't overflow `usize::MAX` and actually allocate too little.
//
// On 64-bit we just need to check for overflow since trying to allocate
// `> isize::MAX` bytes will surely fail. On 32-bit and 16-bit we need to add
// an extra guard for this in case we're running on a platform which can use
// all 4GB in user-space, e.g., PAE or x32.
#[inline]
fn alloc_guard(alloc_size: usize) -> Result<(), TryReserveError>
//@ req thread_token(currentThread);
/*@
ens thread_token(currentThread) &*&
match result {
Result::Ok(dummy) => true,
Result::Err(err) => <std::collections::TryReserveError>.own(currentThread, err)
};
@*/
//@ safety_proof { assume(false); }
{
if usize::BITS < 64 && alloc_size > isize::MAX as usize { //~allow_dead_code
Err(CapacityOverflow.into()) //~allow_dead_code
} else {
Ok(())
}
}

#[inline]
fn layout_array(cap: usize, elem_layout: Layout) -> Result<Layout, TryReserveError>
//@ req thread_token(currentThread) &*& Layout::size_(elem_layout) % Layout::align_(elem_layout) == 0;
Expand Down
29 changes: 3 additions & 26 deletions verifast-proofs/alloc/raw_vec/mod.rs/with-directives/raw_vec.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -155,7 +155,7 @@ impl RawVecInner<Global> {
}

// Tiny Vecs are dumb. Skip to:
// - 8 if the element size is 1, because any heap allocators is likely
// - 8 if the element size is 1, because any heap allocator is likely
// to round up a request of less than 8 bytes to at least 8 bytes.
// - 4 if elements are moderate-sized (<= 1 KiB).
// - 1 otherwise, to avoid wasting too much space for very short Vecs.
Expand Down Expand Up @@ -468,10 +468,6 @@ impl<A: Allocator> RawVecInner<A> {
return Ok(Self::new_in(alloc, elem_layout.alignment()));
}

if let Err(err) = alloc_guard(layout.size()) {
return Err(err);
}

let result = match init {
AllocInit::Uninitialized => alloc.allocate(layout),
#[cfg(not(no_global_oom_handling))]
Expand Down Expand Up @@ -662,7 +658,7 @@ impl<A: Allocator> RawVecInner<A> {
let new_layout = layout_array(cap, elem_layout)?;

let ptr = finish_grow(new_layout, self.current_memory(elem_layout), &mut self.alloc)?;
// SAFETY: finish_grow would have resulted in a capacity overflow if we tried to allocate more than `isize::MAX` items
// SAFETY: layout_array would have resulted in a capacity overflow if we tried to allocate more than `isize::MAX` items

unsafe { self.set_ptr_and_cap(ptr, cap) };
Ok(())
Expand All @@ -684,7 +680,7 @@ impl<A: Allocator> RawVecInner<A> {
let new_layout = layout_array(cap, elem_layout)?;

let ptr = finish_grow(new_layout, self.current_memory(elem_layout), &mut self.alloc)?;
// SAFETY: finish_grow would have resulted in a capacity overflow if we tried to allocate more than `isize::MAX` items
// SAFETY: layout_array would have resulted in a capacity overflow if we tried to allocate more than `isize::MAX` items
unsafe {
self.set_ptr_and_cap(ptr, cap);
}
Expand Down Expand Up @@ -771,8 +767,6 @@ fn finish_grow<A>(
where
A: Allocator,
{
alloc_guard(new_layout.size())?;

let memory = if let Some((ptr, old_layout)) = current_memory {
debug_assert_eq!(old_layout.align(), new_layout.align());
unsafe {
Expand All @@ -799,23 +793,6 @@ fn handle_error(e: TryReserveError) -> ! {
}
}

// We need to guarantee the following:
// * We don't ever allocate `> isize::MAX` byte-size objects.
// * We don't overflow `usize::MAX` and actually allocate too little.
//
// On 64-bit we just need to check for overflow since trying to allocate
// `> isize::MAX` bytes will surely fail. On 32-bit and 16-bit we need to add
// an extra guard for this in case we're running on a platform which can use
// all 4GB in user-space, e.g., PAE or x32.
#[inline]
fn alloc_guard(alloc_size: usize) -> Result<(), TryReserveError> {
if usize::BITS < 64 && alloc_size > isize::MAX as usize {
Err(CapacityOverflow.into())
} else {
Ok(())
}
}

#[inline]
fn layout_array(cap: usize, elem_layout: Layout) -> Result<Layout, TryReserveError> {
elem_layout.repeat(cap).map(|(layout, _pad)| layout).map_err(|_| CapacityOverflow.into())
Expand Down