Add contracts for all functions in `Alignment` #136578

tautschnig · 2025-02-05T12:24:55Z

Uses the contracts syntax introduced in #128045.

rustbot · 2025-02-05T12:25:04Z

Thanks for the pull request, and welcome! The Rust team is excited to review your changes, and you should hear from @tgross35 (or someone else) some time within the next two weeks.

Please see the contribution instructions for more information. Namely, in order to ensure the minimum review times lag, PR authors and assigned reviewers should ensure that the review label (S-waiting-on-review and S-waiting-on-author) stays updated, invoking these commands when appropriate:

@rustbot author: the review is finished, PR author should check the comments and take action accordingly
@rustbot review: the author is ready for a review, this PR will be queued again in the reviewer's queue

library/core/src/ptr/alignment.rs

jieyouxu · 2025-02-05T12:34:32Z

You could also tag contracts-related PRs with F-contracts in the future via

@rustbot label: +F-contracts

in a comment / PR description.

tgross35 · 2025-02-05T12:57:33Z

Could you say some more about the motivation? This feature was merged only a number of hours ago, that seems soon to start using in std. Even once it is more stable, what should and shouldn't get contracts is probably something that needs to get discussed.

@rust-lang/libs any thoughts here?

jieyouxu · 2025-02-05T13:00:46Z

Yeah, this was only approved as a lang experiment on the lang/compiler side, no idea what the situation is libs side (which certainly should be discussed).

cc @pnkfelix @nikomatsakis @celinval (lang liason and ppl who were implementing this feature compiler side)

Noratrieb · 2025-02-05T13:14:06Z

I'll libs nominate this for discussion (this should only be discussed after the contracts people mentioned above have replied).

celinval · 2025-02-05T20:34:45Z

Totally worth discussion, and it would be great to get some feedback on the features that are needed to meet the libs team bar. I am especially curious to see how you think contracts and ub_checks will interact.

Noratrieb · 2025-02-05T21:37:17Z

It would be useful to know what your plan/intention is with adding contracts here. Is it just to try them out or is annotating the standard library with contracts for downstream consumers part of the goal of contracts?

tautschnig · 2025-02-05T21:37:47Z

Could you say some more about the motivation? This feature was merged only a number of hours ago, that seems soon to start using in std. Even once it is more stable, what should and shouldn't get contracts is probably something that needs to get discussed.

As far as the motivation is concerned: we're working towards https://rust-lang.github.io/rust-project-goals/2025h1/std-contracts.html, and I created this (draft) PR with the hope to initiate discussion while knowing there is a lot more work to be done on our end.

As I am new contributor: is there other information that I can provide or another forum that I should use rather than this PR?

tautschnig · 2025-02-05T21:42:07Z

It would be useful to know what your plan/intention is with adding contracts here. Is it just to try them out or is annotating the standard library with contracts for downstream consumers part of the goal of contracts?

Our current goal is https://rust-lang.github.io/rust-project-goals/2025h1/std-contracts.html, though we are in early stages and it indeed is about trying out what works best. Eventually we want to enable verification of downstream consumers, but a lot more work will be required before we get there.

tgross35 · 2025-02-05T22:17:04Z

As far as the motivation is concerned: we're working towards https://rust-lang.github.io/rust-project-goals/2025h1/std-contracts.html, and I created this (draft) PR with the hope to initiate discussion while knowing there is a lot more work to be done on our end.

As I am new contributor: is there other information that I can provide or another forum that I should use rather than this PR?

Are there any docs on how contracts work as they exist today? Ignoring the stability question, we need something to refer to about how to use these properly, e.g. in https://doc.rust-lang.org/nightly/unstable-book/. Also, how are contracts that get merged into r-l/rust being verified?

The linked page is somewhat vague about what this means for std. I think we could also use a policy page in the library dev guide (https://std-dev-guide.rust-lang.org) giving guidelines for their use, based on the outcome of any discussion that happens.

Bringing this up on the libs zulip would be a good idea to get the ball rolling https://rust-lang.zulipchat.com/#narrow/channel/219381-t-libs.

library/core/src/ptr/alignment.rs

    #[unstable(feature = "ptr_alignment_type", issue = "102070")]
    #[inline]
    #[must_use]
+    #[cfg_attr(not(bootstrap), contracts::requires(mem::align_of::<T>().is_power_of_two()))]


Amanieu · 2025-02-12T17:44:06Z

We discussed this in the libs meeting today. We're happy to add contracts to the standard library as an experiment, as long as this doesn't get in the way of normal standard library development. Depending on how the contracts feature evolves, we may reconsider our level of support.

library/core/src/ptr/alignment.rs

Updated via `./x.py test mir-opt --bless --stage 1` plus a manual tweak of `tests/mir-opt/gvn_ptr_eq_with_constant.main.GVN.diff`.

rustbot · 2025-10-30T08:28:58Z

This PR was rebased onto a different master commit. Here's a range-diff highlighting what actually changed.

Rebasing is a normal part of keeping PRs up to date, so no action is needed—this note is just to help reviewers.

tautschnig · 2025-10-30T17:20:33Z

@bors try @rust-timer queue

rust-bors · 2025-10-30T17:20:37Z

@tautschnig: 🔑 Insufficient privileges: not in try users

saethlin · 2025-10-30T17:54:19Z

@bors try @rust-timer queue

Add contracts for all functions in `Alignment`

rust-bors · 2025-10-30T20:06:48Z

☀️ Try build successful (CI)
Build commit: 061e529 (061e5294bd1ede721004372c2f0b8a76f042fa86, parent: 8205e6b75ec656305ac235d4726d2c7a1ddcef14)

rust-timer · 2025-10-30T21:20:32Z

Finished benchmarking commit (061e529): comparison URL.

Overall result: ❌✅ regressions and improvements - please read the text below

Benchmarking this pull request means it may be perf-sensitive – we'll automatically label it not fit for rolling up. You can override this, but we strongly advise not to, due to possible changes in compiler perf.

Next Steps: If you can justify the regressions found in this try perf run, please do so in sufficient writing along with @rustbot label: +perf-regression-triaged. If not, please fix the regressions and do another perf run. If its results are neutral or positive, the label will be automatically removed.

@bors rollup=never
@rustbot label: -S-waiting-on-perf +perf-regression

Instruction count

Our most reliable metric. Used to determine the overall result above. However, even this metric can be noisy.

	mean	range	count
Regressions ❌ (primary)	0.2%	[0.2%, 0.2%]	1
Regressions ❌ (secondary)	0.4%	[0.3%, 0.8%]	5
Improvements ✅ (primary)	-1.0%	[-1.3%, -0.7%]	2
Improvements ✅ (secondary)	-1.3%	[-1.3%, -1.3%]	1
All ❌✅ (primary)	-0.6%	[-1.3%, 0.2%]	3

Max RSS (memory usage)

Results (primary -1.4%, secondary 3.5%)

A less reliable metric. May be of interest, but not used to determine the overall result above.

	mean	range	count
Regressions ❌ (primary)	3.4%	[3.4%, 3.4%]	1
Regressions ❌ (secondary)	3.5%	[1.7%, 5.3%]	7
Improvements ✅ (primary)	-3.7%	[-3.8%, -3.7%]	2
Improvements ✅ (secondary)	-	-	0
All ❌✅ (primary)	-1.4%	[-3.8%, 3.4%]	3

Cycles

Results (secondary -2.4%)

A less reliable metric. May be of interest, but not used to determine the overall result above.

	mean	range	count
Regressions ❌ (primary)	-	-	0
Regressions ❌ (secondary)	-	-	0
Improvements ✅ (primary)	-	-	0
Improvements ✅ (secondary)	-2.4%	[-2.8%, -2.1%]	3
All ❌✅ (primary)	-	-	0

Binary size

Results (primary -0.1%, secondary 0.1%)

A less reliable metric. May be of interest, but not used to determine the overall result above.

	mean	range	count
Regressions ❌ (primary)	0.1%	[0.0%, 0.2%]	5
Regressions ❌ (secondary)	0.1%	[0.0%, 0.2%]	2
Improvements ✅ (primary)	-1.1%	[-1.1%, -1.1%]	1
Improvements ✅ (secondary)	-	-	0
All ❌✅ (primary)	-0.1%	[-1.1%, 0.2%]	6

Bootstrap: 475.886s -> 473.036s (-0.60%)
Artifact size: 390.36 MiB -> 390.45 MiB (0.02%)

tgross35

The contract bits in alignment.rs seem fine to me, but it doesn't look like Ralf's comment about avoiding rustc_allow_const_fn_unstable at #136578 (comment) hasn't been resolved - is there something to do there?

Ralf is more involve with all of this than I, so
r? RalfJung

View changes since this review

tgross35 · 2025-11-19T14:25:40Z

library/core/src/ptr/alignment.rs

+    #[rustc_const_unstable(feature = "contracts", issue = "128044")]
+    #[core::contracts::ensures(
+        move |result: &usize|
+        *result > 0 && *result == !(self.as_usize() -1) &&


Suggested change

*result > 0 && *result == !(self.as_usize() -1) &&

*result > 0 && *result == !(self.as_usize() - 1) &&

Formatting nit

RalfJung · 2025-11-25T14:58:44Z

it doesn't look like Ralf's comment about avoiding rustc_allow_const_fn_unstable at #136578 (comment) hasn't been resolved

@rustbot author

rustbot · 2025-11-25T14:58:49Z

Reminder, once the PR becomes ready for a review, use @rustbot ready.

RalfJung · 2025-11-25T14:59:48Z

library/core/src/ptr/alignment.rs

    #[inline]
    #[must_use]
+    #[rustc_allow_const_fn_unstable(contracts)]
+    #[core::contracts::ensures(|result: &Alignment| result.as_usize().is_power_of_two())]


This is an odd contract, since the statement is true about all Alignment. Shouldn't it be a postcondition of as_usize instead?

RalfJung · 2025-11-25T15:00:37Z

library/core/src/ptr/alignment.rs

+    #[core::contracts::ensures(
+        move |result: &Option<Alignment>|
+        align.is_power_of_two() == result.is_some() &&
+        (result.is_none() || result.unwrap().as_usize() == align))]


The formatting here is not great, with the code having the same indentation level as the closure header. What about something like this?

Suggested change

#[core::contracts::ensures(

move |result: &Option<Alignment>|

align.is_power_of_two() == result.is_some() &&

(result.is_none() || result.unwrap().as_usize() == align))]

#[core::contracts::ensures(move |result: &Option<Alignment>|

align.is_power_of_two() == result.is_some() &&

(result.is_none() || result.unwrap().as_usize() == align)

)]

RalfJung · 2025-11-25T15:02:12Z

library/core/src/ptr/alignment.rs

+    #[rustc_allow_const_fn_unstable(contracts)]
+    #[core::contracts::ensures(
+        move |result: &NonZero<usize>|
+        result.get().is_power_of_two() && result.get() == self.as_usize())]


result.get() == self.as_usize() implies result.get().is_power_of_two()... seems odd to repeat that? If we always repeat the transitive closure of everything that can be deduced, that surely won't scale.^^

What we really need is Type invariant. This is basically repeating the type invariant which should be implied.

Well that would be even nicer, sure. But even with the status quo, I don't get the point of this contract. To make use of the is_power_of_two fact I have to call self.as_usize(), and at that point the is_power_of_two will be asserted. So what is the point of repeating it everywhere?

RalfJung · 2025-11-25T15:02:35Z

library/core/src/ptr/alignment.rs

+    #[core::contracts::requires(align.is_power_of_two())]
+    #[core::contracts::ensures(
+        move |result: &Alignment|
+        result.as_usize() == align && result.as_usize().is_power_of_two())]


result.as_usize().is_power_of_two() is redundant, it follows from the precondition and the first conjunct.

…ng, r=oli-obk Guard HIR lowered contracts with `contract_checks` Refactor contract HIR lowering to ensure no contract code is executed when contract-checks are disabled. The call to `contract_checks` is moved to inside the lowered fn body, and contract closures are built conditionally, ensuring no side-effects present in contracts occur when those are disabled. This partially addresses rust-lang#139548, i.e. the bad behavior no longer happens with contract checks disabled (`-Zcontract-checks=no`). The change is made in preparation for adding contract variable declarations - variables declared before the `requires` assertion, and accessible from both `requires` and `ensures`, but not in the function body (PR rust-lang#144444). As those declarations may also have side-effects, it's good to guard them with `contract_checks` - the new lowering approach allows for this to be done easily. Contracts tracking issue: rust-lang#128044 **Known limiatations**: - It is still possible to early return from the *function* from within a contract, e.g. ```rust #[ensures({if x > 0 { return 0 }; |_| true})] fn foo(x: u32) -> i32 { 42 } ``` When `foo` is called with an argument greater than 0, instead of `42`, `0` will be returned. As this is not a regression, it is not addressed in this PR. However, it may be worth revisiting later down the line, as users may expect a form of early return from *contract specifications*, and so returning from the entire *function* could cause confusion. - ~Contracts are still not optimised out when disabled. Currently, even when contracts are disabled, the code generated causes existing optimisations to fail, meaning even disabled contracts could impact runtime performance. This issue is blocking rust-lang#136578, and has not been addressed in this PR, i.e. the `mir-opt` and `codegen` tests that fail in rust-lang#136578 still fail with these new HIR lowering changes.~ Contracts should now be optimised out when disabled, however some regressions tests still need to be added to be sure that is indeed the case.

rustbot assigned tgross35 Feb 5, 2025

rustbot added S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. T-libs Relevant to the library team, which will review and decide on the PR/issue. labels Feb 5, 2025

This comment has been minimized.

Sign in to view

jieyouxu added the F-contracts `#![feature(contracts)]` label Feb 5, 2025

jieyouxu reviewed Feb 5, 2025

View reviewed changes

library/core/src/ptr/alignment.rs Outdated Show resolved Hide resolved

jieyouxu mentioned this pull request Feb 5, 2025

Tracking Issue for Contracts #128044

Open

9 tasks

Noratrieb added the I-libs-nominated Nominated for discussion during a libs team meeting. label Feb 5, 2025

tautschnig force-pushed the upstream-contracts/alignment branch from d46f868 to 7288286 Compare February 5, 2025 22:06

This comment has been minimized.

Sign in to view

Sky9x reviewed Feb 5, 2025

View reviewed changes

library/core/src/ptr/alignment.rs Outdated

#[unstable(feature = "ptr_alignment_type", issue = "102070")]

#[inline]

#[must_use]

#[cfg_attr(not(bootstrap), contracts::requires(mem::align_of::<T>().is_power_of_two()))]

This comment was marked as resolved.

Sign in to view

tautschnig force-pushed the upstream-contracts/alignment branch from 7288286 to c180bd0 Compare February 6, 2025 13:23

This comment has been minimized.

Sign in to view

tautschnig mentioned this pull request Feb 7, 2025

ICE when trying to compile code with contracts: No HirId for DefId #136683

Closed

tautschnig force-pushed the upstream-contracts/alignment branch from c180bd0 to 4322394 Compare February 11, 2025 13:46

This comment has been minimized.

Sign in to view

tautschnig mentioned this pull request Feb 12, 2025

Contract cannot be applied to const functions #136925

Closed

Amanieu removed the I-libs-nominated Nominated for discussion during a libs team meeting. label Feb 12, 2025

scottmcm reviewed Feb 12, 2025

View reviewed changes

library/core/src/ptr/alignment.rs Outdated Show resolved Hide resolved

Update expected MIR in tests

17e2c8a

Updated via `./x.py test mir-opt --bless --stage 1` plus a manual tweak of `tests/mir-opt/gvn_ptr_eq_with_constant.main.GVN.diff`.

tautschnig force-pushed the upstream-contracts/alignment branch from b7ba176 to 17e2c8a Compare October 30, 2025 08:28

This comment has been minimized.

Sign in to view

rust-bors bot added a commit that referenced this pull request Oct 30, 2025

Auto merge of #136578 - tautschnig:upstream-contracts/alignment, r=<try>

061e529

Add contracts for all functions in `Alignment`

rustbot added the S-waiting-on-perf Status: Waiting on a perf run to be completed. label Oct 30, 2025

This comment has been minimized.

Sign in to view

rustbot added perf-regression Performance regression. and removed S-waiting-on-perf Status: Waiting on a perf run to be completed. labels Oct 30, 2025

This was referenced Nov 6, 2025

Remove 'static bound on contract ensures closure #148595

Open

Contracts: primitive ownership assertions: owned and alloc_block rust-lang/compiler-team#942

Closed

tgross35 reviewed Nov 19, 2025

View reviewed changes

rustbot assigned RalfJung and unassigned tgross35 Nov 19, 2025

rustbot added S-waiting-on-author Status: This is awaiting some action (such as code changes or more information) from the author. and removed S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. labels Nov 25, 2025

RalfJung reviewed Nov 25, 2025

View reviewed changes

	result > 0 && result == !(self.as_usize() -1) &&
	result > 0 && result == !(self.as_usize() - 1) &&

Add contracts for all functions in Alignment #136578

Are you sure you want to change the base?

Add contracts for all functions in Alignment #136578

Uh oh!

Conversation

tautschnig commented Feb 5, 2025

Uh oh!

rustbot commented Feb 5, 2025

Uh oh!

This comment has been minimized.

Uh oh!

jieyouxu commented Feb 5, 2025

Uh oh!

tgross35 commented Feb 5, 2025

Uh oh!

jieyouxu commented Feb 5, 2025

Uh oh!

Noratrieb commented Feb 5, 2025

Uh oh!

celinval commented Feb 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Noratrieb commented Feb 5, 2025

Uh oh!

tautschnig commented Feb 5, 2025

Uh oh!

tautschnig commented Feb 5, 2025

Uh oh!

This comment has been minimized.

tgross35 commented Feb 5, 2025

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment has been minimized.

This comment has been minimized.

Amanieu commented Feb 12, 2025

Uh oh!

Uh oh!

rustbot commented Oct 30, 2025

Uh oh!

tautschnig commented Oct 30, 2025

Uh oh!

This comment has been minimized.

rust-bors bot commented Oct 30, 2025

Uh oh!

saethlin commented Oct 30, 2025

Uh oh!

This comment has been minimized.

This comment has been minimized.

rust-bors bot commented Oct 30, 2025

Uh oh!

This comment has been minimized.

rust-timer commented Oct 30, 2025

Overall result: ❌✅ regressions and improvements - please read the text below

Uh oh!

tgross35 left a comment • edited by rustbot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

RalfJung commented Nov 25, 2025

Uh oh!

rustbot commented Nov 25, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Add contracts for all functions in `Alignment` #136578

Add contracts for all functions in `Alignment` #136578

celinval commented Feb 5, 2025 •

edited

Loading

tgross35 left a comment •

edited by rustbot

Loading