Contracts and Harnesses for <*mut T>::add, sub and offset

library/core/src/ptr/mut_ptr.rs

@@ -3,6 +3,10 @@ use crate::cmp::Ordering::{Equal, Greater, Less};
 use crate::intrinsics::const_eval_select;
 use crate::mem::SizedTypeProperties;
 use crate::slice::{self, SliceIndex};
+use safety::{ensures, requires};
+
+#[cfg(kani)]
+use crate::kani;
 
 impl<T: ?Sized> *mut T {
     /// Returns `true` if the pointer is null.
@@ -403,6 +407,10 @@ impl<T: ?Sized> *mut T {
     #[rustc_const_stable(feature = "const_ptr_offset", since = "1.61.0")]
     #[inline(always)]
     #[cfg_attr(miri, track_caller)] // even without panics, this helps for Miri backtraces
+    #[requires(kani::mem::can_dereference(self))]
+    // TODO: Determine the valid value range for 'count' and update the precondition accordingly.
+    #[requires(count == 0)] // This precondition is currently a placeholder.
+    #[ensures(|result| kani::mem::can_dereference(result))]
     pub const unsafe fn offset(self, count: isize) -> *mut T
     where
         T: Sized,
@@ -947,6 +955,10 @@ impl<T: ?Sized> *mut T {
     #[rustc_const_stable(feature = "const_ptr_offset", since = "1.61.0")]
     #[inline(always)]
     #[cfg_attr(miri, track_caller)] // even without panics, this helps for Miri backtraces
+    #[requires(kani::mem::can_dereference(self))]
+    // TODO: Determine the valid value range for 'count' and update the precondition accordingly.
+    #[requires(count == 0)] // This precondition is currently a placeholder.
+    #[ensures(|result| kani::mem::can_dereference(result))]
     pub const unsafe fn add(self, count: usize) -> Self
     where
         T: Sized,
@@ -1022,6 +1034,10 @@ impl<T: ?Sized> *mut T {
     #[rustc_allow_const_fn_unstable(unchecked_neg)]
     #[inline(always)]
     #[cfg_attr(miri, track_caller)] // even without panics, this helps for Miri backtraces
+    #[requires(kani::mem::can_dereference(self))]
+    // TODO: Determine the valid value range for 'count' and update the precondition accordingly.
+    #[requires(count == 0)] // This precondition is currently a placeholder.
+    #[ensures(|result| kani::mem::can_dereference(result))]
     pub const unsafe fn sub(self, count: usize) -> Self
     where
         T: Sized,
@@ -2197,3 +2213,108 @@ impl<T: ?Sized> PartialOrd for *mut T {
         *self >= *other
     }
 }
+
+#[cfg(kani)]
+#[unstable(feature = "kani", issue = "none")]
+mod verify {
+    use crate::kani;
+
+    macro_rules! generate_mut_add_and_sub_harness {
+        ($type:ty, $proof_name:ident, $func_name:ident) => {
+            #[kani::proof_for_contract(<*mut $type>::$func_name)]
+            pub fn $proof_name() {
+                let mut test_val: $type = kani::any::<$type>();
+                let test_ptr: *mut $type = &mut test_val;
+                let count: usize = kani::any();
+                unsafe {
+                    test_ptr.$func_name(count);
+                }
+            }
+        };
+    }
+
+    // <*mut T>:: add() integer types verification
+    generate_mut_add_and_sub_harness!(i8, check_mut_add_i8, add);
+    generate_mut_add_and_sub_harness!(i16, check_mut_add_i16, add);
+    generate_mut_add_and_sub_harness!(i32, check_mut_add_i32, add);
+    generate_mut_add_and_sub_harness!(i64, check_mut_add_i64, add);
+    generate_mut_add_and_sub_harness!(i128, check_mut_add_i128, add);
+    generate_mut_add_and_sub_harness!(isize, check_mut_add_isize, add);
+    generate_mut_add_and_sub_harness!(u8, check_mut_add_u8, add);
+    generate_mut_add_and_sub_harness!(u16, check_mut_add_u16, add);
+    generate_mut_add_and_sub_harness!(u32, check_mut_add_u32, add);
+    generate_mut_add_and_sub_harness!(u64, check_mut_add_u64, add);
+    generate_mut_add_and_sub_harness!(u128, check_mut_add_u128, add);
+    generate_mut_add_and_sub_harness!(usize, check_mut_add_usize, add);   
+
+    // <*mut T>:: add() unit type verification
+    generate_mut_add_and_sub_harness!((), check_mut_add_unit, add);
+
+    // <*mut T>:: add() composite types verification
+    generate_mut_add_and_sub_harness!((i8, i8), check_mut_add_tuple_1, add);
+    generate_mut_add_and_sub_harness!((f64, bool), check_mut_add_tuple_2, add);
+    generate_mut_add_and_sub_harness!((i32, f64, bool), check_mut_add_tuple_3, add);
+    generate_mut_add_and_sub_harness!((i8, u16, i32, u64, isize), check_mut_add_tuple_4, add);
+
+    // <*mut T>:: sub() integer types verification
+    generate_mut_add_and_sub_harness!(i8, check_mut_sub_i8, sub);
+    generate_mut_add_and_sub_harness!(i16, check_mut_sub_i16, sub);
+    generate_mut_add_and_sub_harness!(i32, check_mut_sub_i32, sub);
+    generate_mut_add_and_sub_harness!(i64, check_mut_sub_i64, sub);
+    generate_mut_add_and_sub_harness!(i128, check_mut_sub_i128, sub);
+    generate_mut_add_and_sub_harness!(isize, check_mut_sub_isize, sub);
+    generate_mut_add_and_sub_harness!(u8, check_mut_sub_u8, sub);
+    generate_mut_add_and_sub_harness!(u16, check_mut_sub_u16, sub);
+    generate_mut_add_and_sub_harness!(u32, check_mut_sub_u32, sub);
+    generate_mut_add_and_sub_harness!(u64, check_mut_sub_u64, sub);
+    generate_mut_add_and_sub_harness!(u128, check_mut_sub_u128, sub);
+    generate_mut_add_and_sub_harness!(usize, check_mut_sub_usize, sub);
+
+    // <*mut T>:: sub() unit type verification
+    generate_mut_add_and_sub_harness!((), check_mut_sub_unit, sub);
+
+    // <*mut T>:: sub() composite types verification
+    generate_mut_add_and_sub_harness!((i8, i8), check_mut_sub_tuple_1, sub);
+    generate_mut_add_and_sub_harness!((f64, bool), check_mut_sub_tuple_2, sub);
+    generate_mut_add_and_sub_harness!((i32, f64, bool), check_mut_sub_tuple_3, sub);
+    generate_mut_add_and_sub_harness!((i8, u16, i32, u64, isize), check_mut_sub_tuple_4, sub);
+
+
+    // fn <*mut T>::offset verification begin
+    macro_rules! generate_mut_offset_harness {
+      ($type:ty, $proof_name:ident) => {
+            #[kani::proof_for_contract(<*mut $type>::offset)]
+            pub fn $proof_name() {
+                let mut test_val: $type = kani::any::<$type>();
+                let test_ptr: *mut $type = &mut test_val;
+                let count: isize = kani::any();
+                unsafe {
+                    test_ptr.offset(count);
+                }
+            }
+        };
+    }
+
+    // fn <*mut T>::offset integer types verification
+    generate_mut_offset_harness!(i8, check_mut_offset_i8);
+    generate_mut_offset_harness!(i16, check_mut_offset_i16);
+    generate_mut_offset_harness!(i32, check_mut_offset_i32);
+    generate_mut_offset_harness!(i64, check_mut_offset_i64);
+    generate_mut_offset_harness!(i128, check_mut_offset_i128);
+    generate_mut_offset_harness!(isize, check_mut_offset_isize);
+    generate_mut_offset_harness!(u8, check_mut_offset_u8);
+    generate_mut_offset_harness!(u16, check_mut_offset_u16);
+    generate_mut_offset_harness!(u32, check_mut_offset_u32);
+    generate_mut_offset_harness!(u64, check_mut_offset_u64);
+    generate_mut_offset_harness!(u128, check_mut_offset_u128);
+    generate_mut_offset_harness!(usize, check_mut_offset_usize);
+
+    // fn <*mut T>::offset unit type verification
+    generate_mut_offset_harness!((), check_mut_offset_unit);
+
+    // fn <*mut T>::offset composite type verification
+    generate_mut_offset_harness!((i8, i8), check_mut_offset_tuple_1);
+    generate_mut_offset_harness!((f64, bool), check_mut_offset_tuple_2);
+    generate_mut_offset_harness!((i32, f64, bool), check_mut_offset_tuple_3);
+    generate_mut_offset_harness!((i8, u16, i32, u64, isize), check_mut_offset_tuple_4);
+}