Add a UB-check to `Vec::set_len`

[scottmcm]

Today, set_len has a debug_assert! on the length being legal:

rust/library/alloc/src/vec/mod.rs

Lines 1950 to 1956 in 855e0fe

	#[inline]
	#[stable(feature = "rust1", since = "1.0.0")]
	pub unsafe fn set_len(&mut self, new_len: usize) {
	debug_assert!(new_len <= self.capacity());
	self.len = new_len;
	}

It would be nice, assuming the compilation time hit is tolerable, to upgrade that to a UB-check in order to better catch people making over-long vectors.

[scottmcm]

Come to think of it, a similar one in Vec::from_raw_parts_in to ensure that len <= capacity would also be good.

(Vec::from_raw_parts is the one that's more likely to matter right now, but it calls from_raw_parts_in so just one there would be enough.)

[xizheyin]

set_len is now an unsafe method. Do we need to set it to set_len_unchecked and add a set_len with checking? By the way, what is the process that needs to be in place for API changes and do we need to add tests (my first time in this area)?

[scottmcm]

A UB-check does not make it safe. They don't run in release builds.

This issue is not an API change, just a small thing to help people catch accidentally-unsound unsafe code.

Here's an example of a similar UB-check in slice::from_raw_parts:

rust/library/core/src/slice/raw.rs

Lines 124 to 141 in b1d2f2c

	pub const unsafe fn from_raw_parts<'a, T>(data: *const T, len: usize) -> &'a [T] {
	// SAFETY: the caller must uphold the safety contract for `from_raw_parts`.
	unsafe {
	ub_checks::assert_unsafe_precondition!(
	check_language_ub,
	"slice::from_raw_parts requires the pointer to be aligned and non-null, and the total size of the slice not to exceed `isize::MAX`",
	(
	data: *mut () = data as *mut (),
	size: usize = size_of::<T>(),
	align: usize = align_of::<T>(),
	len: usize = len,
	) =>
	ub_checks::maybe_is_aligned_and_not_null(data, align, false)
	&& ub_checks::is_valid_allocation_size(size, len)
	);
	&*ptr::slice_from_raw_parts(data, len)
	}
	}

(set_len actually can't fully check the preconditions, because there's no way to test at runtime whether the memory in question has been initialized. The safe API already exists; it's called resize.)

[xizheyin]

I would like to have a try.

@rustbot claim