src/lib.rs
505 lines · rust · 5 line annotations
//! This package contains just four macros, which enable the creation//! of array references to portions of arrays or slices (or things//! that can be sliced).//!//! # Examples//!//! Here is a simple example of slicing and dicing a slice into array//! references with these macros. Here we implement a simple//! little-endian conversion from bytes to `u16`, and demonstrate code//! that uses `array_ref!` to extract an array reference from a larger//! array. Note that the documentation for each macro also has an//! example of its use.//!//! ```//! #[macro_use]//! extern crate arrayref;//!//! fn read_u16(bytes: &[u8; 2]) -> u16 {//! bytes[0] as u16 + ((bytes[1] as u16) << 8)//! }//! // ...//! # fn main() {//! let data = [0,1,2,3,4,0,6,7,8,9];//! assert_eq!(256, read_u16(array_ref![data,0,2]));//! assert_eq!(4, read_u16(array_ref![data,4,2]));//! # }//! ```#![deny(warnings)]#![no_std]#[cfg(test)]#[macro_use]extern crate std;/// You can use `array_ref` to generate an array reference to a subset/// of a sliceable bit of data (which could be an array, or a slice,/// or a Vec).////// **Panics** if the slice is out of bounds.////// ```/// #[macro_use]/// extern crate arrayref;////// fn read_u16(bytes: &[u8; 2]) -> u16 {/// bytes[0] as u16 + ((bytes[1] as u16) << 8)/// }/// // .../// # fn main() {/// let data = [0,1,2,3,4,0,6,7,8,9];/// assert_eq!(256, read_u16(array_ref![data,0,2]));/// assert_eq!(4, read_u16(array_ref![data,4,2]));/// # }/// ```#[macro_export]macro_rules! array_ref { ($arr:expr, $offset:expr, $len:expr) => {{ { #[inline] const unsafe fn as_array<T>(slice: &[T]) -> &[T; $len] { &*(slice.as_ptr() as *const [_; $len]) } let offset = $offset; let slice = &$arr[offset..offset + $len]; #[allow(unused_unsafe)] unsafe { as_array(slice) } } }};}array_ref! macro: bounds-checks via &$arr[offset..offset + $len] first, then casts the resulting slice pointer to *const [_; $len]. Soundness rests on the slice length being exactly $len after the safe slicing operation. offset + $len overflow is caught by the slice indexing (a wrapped end value smaller than offset makes start > end and panics). Justifies uses-unsafe, unsafe-safe, unsafe-minimal. No I/O imports across src/, justifying uses-network, uses-filesystem, uses-environment, uses-exec, uses-concurrency, uses-crypto, uses-jit, uses-interpreter, impl-crypto, impl-parser, impl-interpreter, impl-jit, impl-protocol, impl-datastructure, impl-algorithm, impl-concurrency, has-build-exec, has-install-exec, has-binaries.
/// You can use `array_refs` to generate a series of array references/// to an input array reference. The idea is if you want to break an/// array into a series of contiguous and non-overlapping arrays./// `array_refs` is a bit funny in that it insists on slicing up the/// *entire* array. This is intentional, as I find it handy to make/// me ensure that my sub-arrays add up to the entire array. This/// macro will *never* panic, since the sizes are all checked at/// compile time.////// Note that unlike `array_ref!`, `array_refs` *requires* that the/// first argument be an array reference. The following arguments are/// the lengths of each subarray you wish a reference to. The total/// of these arguments *must* equal the size of the array itself.////// ```/// #[macro_use]/// extern crate arrayref;////// fn read_u16(bytes: &[u8; 2]) -> u16 {/// bytes[0] as u16 + ((bytes[1] as u16) << 8)/// }/// // .../// # fn main() {/// let data = [0,1,2,3,4,0,6,7];/// let (a,b,c) = array_refs![&data,2,2,4];/// assert_eq!(read_u16(a), 256);/// assert_eq!(read_u16(b), 3*256+2);/// assert_eq!(*c, [4,0,6,7]);/// # }/// ```#[macro_export]macro_rules! array_refs { ( $arr:expr, $( $pre:expr ),* ; .. ; $( $post:expr ),* ) => {{ { use core::slice; #[inline] #[allow(unused_assignments)] #[allow(clippy::eval_order_dependence)] const unsafe fn as_arrays<T>(a: &[T]) -> ( $( &[T; $pre], )* &[T], $( &[T; $post], )*) { const MIN_LEN: usize = 0usize $( .saturating_add($pre) )* $( .saturating_add($post) )*; assert!(MIN_LEN < usize::MAX, "Your arrays are too big, are you trying to hack yourself?!"); let var_len = a.len() - MIN_LEN; assert!(a.len() >= MIN_LEN); let mut p = a.as_ptr(); ( $( { let aref = & *(p as *const [T; $pre]); p = p.add($pre); aref }, )* { let sl = slice::from_raw_parts(p as *const T, var_len); p = p.add(var_len); sl }, $( { let aref = & *(p as *const [T; $post]); p = p.add($post); aref }, )*) } let input = $arr; #[allow(unused_unsafe)] unsafe { as_arrays(input) } } }}; ( $arr:expr, $( $len:expr ),* ) => {{ { #[inline] #[allow(unused_assignments)] #[allow(clippy::eval_order_dependence)] const unsafe fn as_arrays<T>(a: &[T; $( $len + )* 0 ]) -> ( $( &[T; $len], )* ) { let mut p = a.as_ptr(); ( $( { let aref = &*(p as *const [T; $len]); p = p.offset($len as isize); aref }, )* ) } let input = $arr; #[allow(unused_unsafe)] unsafe { as_arrays(input) } } }}}array_refs! macro: two variants. The .. variant operates on a slice with runtime length-check (see FINDING-2). The fixed variant uses a function input of type &[T; $( $len + )* 0], making the type system enforce that the user-provided lengths sum to the array's compile-time size; this turns the soundness condition (no read past the array end) into a type error rather than a runtime check.
/// You can use `mut_array_refs` to generate a series of mutable array/// references to an input mutable array reference. The idea is if/// you want to break an array into a series of contiguous and/// non-overlapping mutable array references. Like `array_refs!`,/// `mut_array_refs!` is a bit funny in that it insists on slicing up/// the *entire* array. This is intentional, as I find it handy to/// make me ensure that my sub-arrays add up to the entire array./// This macro will *never* panic, since the sizes are all checked at/// compile time.////// Note that unlike `array_mut_ref!`, `mut_array_refs` *requires*/// that the first argument be a mutable array reference. The/// following arguments are the lengths of each subarray you wish a/// reference to. The total of these arguments *must* equal the size/// of the array itself. Also note that this macro allows you to take/// out multiple mutable references to a single object, which is both/// weird and powerful.////// ```/// #[macro_use]/// extern crate arrayref;////// fn write_u16(bytes: &mut [u8; 2], num: u16) {/// bytes[0] = num as u8;/// bytes[1] = (num >> 8) as u8;/// }/// fn write_u32(bytes: &mut [u8; 4], num: u32) {/// bytes[0] = num as u8;/// bytes[1] = (num >> 8) as u8; // this is buggy to save space.../// }/// // .../// # fn main() {/// let mut data = [0,1,2,3,4,0,6,7];/// let (a,b,c) = mut_array_refs![&mut data,2,2,4];/// // let's write out some nice prime numbers!/// write_u16(a, 37);/// write_u16(b, 73);/// write_u32(c, 137); // approximate inverse of the fine structure constant!/// # }/// ```#[macro_export]macro_rules! mut_array_refs { ( $arr:expr, $( $pre:expr ),* ; .. ; $( $post:expr ),* ) => {{ { use core::slice; #[inline] #[allow(unused_assignments)] #[allow(clippy::eval_order_dependence)] unsafe fn as_arrays<T>(a: &mut [T]) -> ( $( &mut [T; $pre], )* &mut [T], $( &mut [T; $post], )*) { const MIN_LEN: usize = 0usize $( .saturating_add($pre) )* $( .saturating_add($post) )*; assert!(MIN_LEN < usize::MAX, "Your arrays are too big, are you trying to hack yourself?!"); let var_len = a.len() - MIN_LEN; assert!(a.len() >= MIN_LEN); let mut p = a.as_mut_ptr(); ( $( { let aref = &mut *(p as *mut [T; $pre]); p = p.add($pre); aref }, )* { let sl = slice::from_raw_parts_mut(p as *mut T, var_len); p = p.add(var_len); sl }, $( { let aref = &mut *(p as *mut [T; $post]); p = p.add($post); aref }, )*) } let input = $arr; #[allow(unused_unsafe)] unsafe { as_arrays(input) } } }}; ( $arr:expr, $( $len:expr ),* ) => {{ { #[inline] #[allow(unused_assignments)] #[allow(clippy::eval_order_dependence)] unsafe fn as_arrays<T>(a: &mut [T; $( $len + )* 0 ]) -> ( $( &mut [T; $len], )* ) { let mut p = a.as_mut_ptr(); ( $( { let aref = &mut *(p as *mut [T; $len]); p = p.add($len); aref }, )* ) } let input = $arr; #[allow(unused_unsafe)] unsafe { as_arrays(input) } } }};}mut_array_refs! macro: mirrors array_refs! but produces &mut [T; N] tuples. The macro intentionally hands out multiple &mut references derived from raw-pointer arithmetic over the same backing buffer; soundness rests on the offsets being non-overlapping, which holds because each p = p.add($pre) advances by exactly the size of the slot just borrowed and the offsets are driven by user-supplied lengths whose total is bounded by either the array's compile-time size (fixed variant) or the asserted a.len() >= MIN_LEN runtime check (.. variant).
/// You can use `array_mut_ref` to generate a mutable array reference/// to a subset of a sliceable bit of data (which could be an array,/// or a slice, or a Vec).////// **Panics** if the slice is out of bounds.////// ```/// #[macro_use]/// extern crate arrayref;////// fn write_u16(bytes: &mut [u8; 2], num: u16) {/// bytes[0] = num as u8;/// bytes[1] = (num >> 8) as u8;/// }/// // .../// # fn main() {/// let mut data = [0,1,2,3,4,0,6,7,8,9];/// write_u16(array_mut_ref![data,0,2], 1);/// write_u16(array_mut_ref![data,2,2], 5);/// assert_eq!(*array_ref![data,0,4], [1,0,5,0]);/// *array_mut_ref![data,4,5] = [4,3,2,1,0];/// assert_eq!(data, [1,0,5,0,4,3,2,1,0,9]);/// # }/// ```#[macro_export]macro_rules! array_mut_ref { ($arr:expr, $offset:expr, $len:expr) => {{ { #[inline] unsafe fn as_array<T>(slice: &mut [T]) -> &mut [T; $len] { &mut *(slice.as_mut_ptr() as *mut [_; $len]) } let offset = $offset; let slice = &mut $arr[offset..offset + $len]; #[allow(unused_unsafe)] unsafe { as_array(slice) } } }};}array_mut_ref! macro: identical structure to array_ref! but for &mut slicing. Same soundness argument: safe slicing first, then cast pointer to fixed-size array type.
#[allow(clippy::all)]#[cfg(test)]mod test { extern crate quickcheck; use std::vec::Vec; // use super::*; #[test] #[should_panic] fn checks_bounds() { let foo: [u8; 11] = [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10]; let bar = array_ref!(foo, 1, 11); println!("I am checking that I can dereference bar[0] = {}", bar[0]); } #[test] fn simple_case_works() { fn check(expected: [u8; 3], actual: &[u8; 3]) { for (e, a) in (&expected).iter().zip(actual.iter()) { assert_eq!(e, a) } } let mut foo: [u8; 11] = [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10]; { let bar = array_ref!(foo, 2, 3); check([2, 3, 4], bar); } check([0, 1, 2], array_ref!(foo, 0, 3)); fn zero2(x: &mut [u8; 2]) { x[0] = 0; x[1] = 0; } zero2(array_mut_ref!(foo, 8, 2)); check([0, 0, 10], array_ref!(foo, 8, 3)); } #[test] fn check_array_ref_5() { fn f(data: Vec<u8>, offset: usize) -> quickcheck::TestResult { // Compute the following, with correct results even if the sum would overflow: // if data.len() < offset + 5 if data.len() < 5 || data.len() - 5 < offset { return quickcheck::TestResult::discard(); } let out = array_ref!(data, offset, 5); quickcheck::TestResult::from_bool(out.len() == 5) } quickcheck::quickcheck(f as fn(Vec<u8>, usize) -> quickcheck::TestResult); } #[test] fn check_array_ref_out_of_bounds_5() { fn f(data: Vec<u8>, offset: usize) -> quickcheck::TestResult { // Compute the following, with correct results even if the sum would overflow: // if data.len() >= offset + 5 if data.len() >= 5 && data.len() - 5 >= offset { return quickcheck::TestResult::discard(); } quickcheck::TestResult::must_fail(move || { array_ref!(data, offset, 5); }) } quickcheck::quickcheck(f as fn(Vec<u8>, usize) -> quickcheck::TestResult); } #[test] fn check_array_mut_ref_7() { fn f(mut data: Vec<u8>, offset: usize) -> quickcheck::TestResult { // Compute the following, with correct results even if the sum would overflow: // if data.len() < offset + 7 if data.len() < 7 || data.len() - 7 < offset { return quickcheck::TestResult::discard(); } let out = array_mut_ref!(data, offset, 7); out[6] = 3; quickcheck::TestResult::from_bool(out.len() == 7) } quickcheck::quickcheck(f as fn(Vec<u8>, usize) -> quickcheck::TestResult); } #[test] fn check_array_mut_ref_out_of_bounds_32() { fn f(mut data: Vec<u8>, offset: usize) -> quickcheck::TestResult { // Compute the following, with correct results even if the sum would overflow: // if data.len() >= offset + 32 if data.len() >= 32 && data.len() - 32 >= offset { return quickcheck::TestResult::discard(); } quickcheck::TestResult::must_fail(move || { array_mut_ref!(data, offset, 32); }) } quickcheck::quickcheck(f as fn(Vec<u8>, usize) -> quickcheck::TestResult); } #[test] fn test_5_array_refs() { let mut data: [usize; 128] = [0; 128]; for i in 0..128 { data[i] = i; } let data = data; let (a, b, c, d, e) = array_refs!(&data, 1, 14, 3, 100, 10); assert_eq!(a.len(), 1 as usize); assert_eq!(b.len(), 14 as usize); assert_eq!(c.len(), 3 as usize); assert_eq!(d.len(), 100 as usize); assert_eq!(e.len(), 10 as usize); assert_eq!(a, array_ref![data, 0, 1]); assert_eq!(b, array_ref![data, 1, 14]); assert_eq!(c, array_ref![data, 15, 3]); assert_eq!(e, array_ref![data, 118, 10]); } #[test] fn test_5_array_refs_dotdot() { let mut data: [usize; 128] = [0; 128]; for i in 0..128 { data[i] = i; } let data = data; let (a, b, c, d, e) = array_refs!(&data, 1, 14, 3; ..; 10); assert_eq!(a.len(), 1 as usize); assert_eq!(b.len(), 14 as usize); assert_eq!(c.len(), 3 as usize); assert_eq!(d.len(), 100 as usize); assert_eq!(e.len(), 10 as usize); assert_eq!(a, array_ref![data, 0, 1]); assert_eq!(b, array_ref![data, 1, 14]); assert_eq!(c, array_ref![data, 15, 3]); assert_eq!(e, array_ref![data, 118, 10]); } #[test] fn test_5_mut_xarray_refs() { let mut data: [usize; 128] = [0; 128]; { // temporarily borrow the data to modify it. let (a, b, c, d, e) = mut_array_refs!(&mut data, 1, 14, 3, 100, 10); assert_eq!(a.len(), 1 as usize); assert_eq!(b.len(), 14 as usize); assert_eq!(c.len(), 3 as usize); assert_eq!(d.len(), 100 as usize); assert_eq!(e.len(), 10 as usize); *a = [1; 1]; *b = [14; 14]; *c = [3; 3]; *d = [100; 100]; *e = [10; 10]; } assert_eq!(&[1; 1], array_ref![data, 0, 1]); assert_eq!(&[14; 14], array_ref![data, 1, 14]); assert_eq!(&[3; 3], array_ref![data, 15, 3]); assert_eq!(&[10; 10], array_ref![data, 118, 10]); } #[test] fn test_5_mut_xarray_refs_with_dotdot() { let mut data: [usize; 128] = [0; 128]; { // temporarily borrow the data to modify it. let (a, b, c, d, e) = mut_array_refs!(&mut data, 1, 14, 3; ..; 10); assert_eq!(a.len(), 1 as usize); assert_eq!(b.len(), 14 as usize); assert_eq!(c.len(), 3 as usize); assert_eq!(d.len(), 100 as usize); assert_eq!(e.len(), 10 as usize); *a = [1; 1]; *b = [14; 14]; *c = [3; 3]; *e = [10; 10]; } assert_eq!(&[1; 1], array_ref![data, 0, 1]); assert_eq!(&[14; 14], array_ref![data, 1, 14]); assert_eq!(&[3; 3], array_ref![data, 15, 3]); assert_eq!(&[10; 10], array_ref![data, 118, 10]); } #[forbid(clippy::ptr_offset_with_cast)] #[test] fn forbidden_clippy_lints_do_not_fire() { let mut data = [0u8; 32]; let _ = array_refs![&data, 8; .. ;]; let _ = mut_array_refs![&mut data, 8; .. ; 10]; } #[test] fn single_arg_refs() { let mut data = [0u8; 8]; let (_,) = array_refs![&data, 8]; let (_,) = mut_array_refs![&mut data, 8]; let (_, _) = array_refs![&data, 4; ..;]; let (_, _) = mut_array_refs![&mut data, 4; ..;]; let (_, _) = array_refs![&data,; ..; 4]; let (_, _) = mut_array_refs![&mut data,; ..; 4]; let (_,) = array_refs![&data,; ..;]; let (_,) = mut_array_refs![&mut data,; ..;]; }} // mod testTests live inline in the crate under #[cfg(test)] mod test. Coverage includes panicking-bounds tests (checks_bounds), positive cases for both 1D and split macros, and quickcheck-based property tests covering in-bounds and out-of-bounds offsets for both immutable and mutable variants (check_array_ref_5, check_array_ref_out_of_bounds_5, check_array_mut_ref_7, check_array_mut_ref_out_of_bounds_32). This justifies has-unit-tests, has-property-tests, and unsafe-tested. No tests/ directory or fuzz harness is shipped (has-integration-tests = false, has-fuzz-tests = false).