compiler/rustc_arena/src/lib.rs RUST 727 lines View on github.com → Search inside
1//! The arena, a fast but limited type of allocator.2//!3//! Arenas are a type of allocator that destroy the objects within, all at4//! once, once the arena itself is destroyed. They do not support deallocation5//! of individual objects while the arena itself is still alive. The benefit6//! of an arena is very fast allocation; just a pointer bump.7//!8//! This crate implements several kinds of arena.910// tidy-alphabetical-start11#![allow(clippy::mut_from_ref)] // Arena allocators are one place where this pattern is fine.12#![allow(internal_features)]13#![cfg_attr(test, feature(test))]14#![deny(unsafe_op_in_unsafe_fn)]15#![doc(test(no_crate_inject, attr(deny(warnings), allow(internal_features))))]16#![feature(decl_macro)]17#![feature(dropck_eyepatch)]18#![feature(never_type)]19#![feature(rustc_attrs)]20#![feature(unwrap_infallible)]21// tidy-alphabetical-end2223use std::alloc::Layout;24use std::cell::{Cell, RefCell};25use std::marker::PhantomData;26use std::mem::{self, MaybeUninit};27use std::ptr::{self, NonNull};28use std::{cmp, hint, slice};2930use smallvec::SmallVec;3132/// This calls the passed function while ensuring it won't be inlined into the caller.33#[inline(never)]34#[cold]35fn outline<F: FnOnce() -> R, R>(f: F) -> R {36    f()37}3839struct ArenaChunk<T = u8> {40    /// The raw storage for the arena chunk.41    storage: NonNull<[MaybeUninit<T>]>,42    /// The number of valid entries in the chunk.43    entries: usize,44}4546unsafe impl<#[may_dangle] T> Drop for ArenaChunk<T> {47    fn drop(&mut self) {48        unsafe { drop(Box::from_raw(self.storage.as_mut())) }49    }50}5152impl<T> ArenaChunk<T> {53    #[inline]54    unsafe fn new(capacity: usize) -> ArenaChunk<T> {55        ArenaChunk {56            storage: NonNull::from(Box::leak(Box::new_uninit_slice(capacity))),57            entries: 0,58        }59    }6061    /// Destroys this arena chunk.62    ///63    /// # Safety64    ///65    /// The caller must ensure that `len` elements of this chunk have been initialized.66    #[inline]67    unsafe fn destroy(&mut self, len: usize) {68        // The branch on needs_drop() is an -O1 performance optimization.69        // Without the branch, dropping TypedArena<T> takes linear time.70        if mem::needs_drop::<T>() {71            // SAFETY: The caller must ensure that `len` elements of this chunk have72            // been initialized.73            unsafe {74                let slice = self.storage.as_mut();75                slice[..len].assume_init_drop();76            }77        }78    }7980    // Returns a pointer to the first allocated object.81    #[inline]82    fn start(&mut self) -> *mut T {83        self.storage.as_ptr() as *mut T84    }8586    // Returns a pointer to the end of the allocated space.87    #[inline]88    fn end(&mut self) -> *mut T {89        unsafe {90            if size_of::<T>() == 0 {91                // A pointer as large as possible for zero-sized elements.92                ptr::without_provenance_mut(!0)93            } else {94                self.start().add(self.storage.len())95            }96        }97    }98}99100// The arenas start with PAGE-sized chunks, and then each new chunk is twice as101// big as its predecessor, up until we reach HUGE_PAGE-sized chunks, whereupon102// we stop growing. This scales well, from arenas that are barely used up to103// arenas that are used for 100s of MiBs. Note also that the chosen sizes match104// the usual sizes of pages and huge pages on Linux.105const PAGE: usize = 4096;106const HUGE_PAGE: usize = 2 * 1024 * 1024;107108/// An arena that can hold objects of only one type.109pub struct TypedArena<T> {110    /// A pointer to the next object to be allocated.111    ptr: Cell<*mut T>,112113    /// A pointer to the end of the allocated area. When this pointer is114    /// reached, a new chunk is allocated.115    end: Cell<*mut T>,116117    /// A vector of arena chunks.118    chunks: RefCell<Vec<ArenaChunk<T>>>,119120    /// Marker indicating that dropping the arena causes its owned121    /// instances of `T` to be dropped.122    _own: PhantomData<T>,123}124125impl<T> Default for TypedArena<T> {126    /// Creates a new `TypedArena`.127    fn default() -> TypedArena<T> {128        TypedArena {129            // We set both `ptr` and `end` to 0 so that the first call to130            // alloc() will trigger a grow().131            ptr: Cell::new(ptr::null_mut()),132            end: Cell::new(ptr::null_mut()),133            chunks: Default::default(),134            _own: PhantomData,135        }136    }137}138139impl<T> TypedArena<T> {140    /// Allocates an object in the `TypedArena`, returning a reference to it.141    #[inline]142    pub fn alloc(&self, object: T) -> &mut T {143        assert!(size_of::<T>() != 0);144145        if self.ptr == self.end {146            self.grow(1)147        }148149        unsafe {150            let ptr = self.ptr.get();151            // Advance the pointer.152            self.ptr.set(self.ptr.get().add(1));153            // Write into uninitialized memory.154            ptr::write(ptr, object);155            &mut *ptr156        }157    }158159    #[inline]160    fn can_allocate(&self, additional: usize) -> bool {161        // FIXME: this should *likely* use `offset_from`, but more162        // investigation is needed (including running tests in miri).163        let available_bytes = self.end.get().addr() - self.ptr.get().addr();164        let additional_bytes = additional.checked_mul(size_of::<T>()).unwrap();165        available_bytes >= additional_bytes166    }167168    /// Allocates storage for `len >= 1` values in this arena, and returns a169    /// raw pointer to the first value's storage.170    ///171    /// # Safety172    ///173    /// Caller must initialize each of the `len` slots to a droppable value174    /// before the arena is dropped.175    ///176    /// In practice, this typically means that the caller must be able to177    /// raw-copy `len` already-initialized values into the slice without any178    /// possibility of panicking.179    ///180    /// FIXME(Zalathar): This is *very* fragile; perhaps we need a different181    /// approach to arena-allocating slices of droppable values.182    #[inline]183    unsafe fn alloc_raw_slice(&self, len: usize) -> *mut T {184        assert!(size_of::<T>() != 0);185        assert!(len != 0);186187        // Ensure the current chunk can fit `len` objects.188        if !self.can_allocate(len) {189            self.grow(len);190            debug_assert!(self.can_allocate(len));191        }192193        let start_ptr = self.ptr.get();194        // SAFETY: `can_allocate`/`grow` ensures that there is enough space for195        // `len` elements.196        unsafe { self.ptr.set(start_ptr.add(len)) };197        start_ptr198    }199200    /// Allocates the elements of this iterator into a contiguous slice in the `TypedArena`.201    ///202    /// Note: for reasons of reentrancy and panic safety we collect into a `SmallVec<[_; 8]>` before203    /// storing the elements in the arena.204    #[inline]205    pub fn alloc_from_iter<I: IntoIterator<Item = T>>(&self, iter: I) -> &mut [T] {206        self.try_alloc_from_iter(iter.into_iter().map(Ok::<T, !>)).into_ok()207    }208209    /// Allocates the elements of this iterator into a contiguous slice in the `TypedArena`.210    ///211    /// Note: for reasons of reentrancy and panic safety we collect into a `SmallVec<[_; 8]>` before212    /// storing the elements in the arena.213    #[inline]214    pub fn try_alloc_from_iter<E>(215        &self,216        iter: impl IntoIterator<Item = Result<T, E>>,217    ) -> Result<&mut [T], E> {218        // Despite the similarity with `DroplessArena`, we cannot reuse their fast case. The reason219        // is subtle: these arenas are reentrant. In other words, `iter` may very well be holding a220        // reference to `self` and adding elements to the arena during iteration.221        //222        // For this reason, if we pre-allocated any space for the elements of this iterator, we'd223        // have to track that some uninitialized elements are followed by some initialized elements,224        // else we might accidentally drop uninitialized memory if something panics or if the225        // iterator doesn't fill all the length we expected.226        //227        // So we collect all the elements beforehand, which takes care of reentrancy and panic228        // safety. This function is much less hot than `DroplessArena::alloc_from_iter`, so it229        // doesn't need to be hyper-optimized.230        assert!(size_of::<T>() != 0);231232        let vec: Result<SmallVec<[T; 8]>, E> = iter.into_iter().collect();233        let mut vec = vec?;234        if vec.is_empty() {235            return Ok(&mut []);236        }237        // Move the content to the arena by copying and then forgetting it.238        let len = vec.len();239240        // SAFETY: After allocating raw storage for exactly `len` values, we241        // must fully initialize the storage without panicking, and we must242        // also prevent the stale values in the vec from being dropped.243        Ok(unsafe {244            let start_ptr = self.alloc_raw_slice(len);245            // Initialize the newly-allocated storage without panicking.246            vec.as_ptr().copy_to_nonoverlapping(start_ptr, len);247            // Prevent the stale values in the vec from being dropped.248            vec.set_len(0);249            slice::from_raw_parts_mut(start_ptr, len)250        })251    }252253    /// Grows the arena.254    #[inline(never)]255    #[cold]256    fn grow(&self, additional: usize) {257        unsafe {258            // We need the element size to convert chunk sizes (ranging from259            // PAGE to HUGE_PAGE bytes) to element counts.260            let elem_size = cmp::max(1, size_of::<T>());261            let mut chunks = self.chunks.borrow_mut();262            let mut new_cap;263            if let Some(last_chunk) = chunks.last_mut() {264                // If a type is `!needs_drop`, we don't need to keep track of how many elements265                // the chunk stores - the field will be ignored anyway.266                if mem::needs_drop::<T>() {267                    // FIXME: this should *likely* use `offset_from`, but more268                    // investigation is needed (including running tests in miri).269                    let used_bytes = self.ptr.get().addr() - last_chunk.start().addr();270                    last_chunk.entries = used_bytes / size_of::<T>();271                }272273                // If the previous chunk's len is less than HUGE_PAGE274                // bytes, then this chunk will be least double the previous275                // chunk's size.276                new_cap = last_chunk.storage.len().min(HUGE_PAGE / elem_size / 2);277                new_cap *= 2;278            } else {279                new_cap = PAGE / elem_size;280            }281            // Also ensure that this chunk can fit `additional`.282            new_cap = cmp::max(additional, new_cap);283284            let chunk = chunks.push_mut(ArenaChunk::<T>::new(new_cap));285            self.ptr.set(chunk.start());286            self.end.set(chunk.end());287        }288    }289290    // Drops the contents of the last chunk. The last chunk is partially empty, unlike all other291    // chunks.292    fn clear_last_chunk(&self, last_chunk: &mut ArenaChunk<T>) {293        // Determine how much was filled.294        let start = last_chunk.start().addr();295        // We obtain the value of the pointer to the first uninitialized element.296        let end = self.ptr.get().addr();297        // We then calculate the number of elements to be dropped in the last chunk,298        // which is the filled area's length.299        assert_ne!(size_of::<T>(), 0);300        // FIXME: this should *likely* use `offset_from`, but more301        // investigation is needed (including running tests in miri).302        let diff = (end - start) / size_of::<T>();303        // Pass that to the `destroy` method.304        unsafe {305            last_chunk.destroy(diff);306        }307        // Reset the chunk.308        self.ptr.set(last_chunk.start());309    }310}311312unsafe impl<#[may_dangle] T> Drop for TypedArena<T> {313    fn drop(&mut self) {314        unsafe {315            // Determine how much was filled.316            let mut chunks_borrow = self.chunks.borrow_mut();317            if let Some(mut last_chunk) = chunks_borrow.pop() {318                // Drop the contents of the last chunk.319                self.clear_last_chunk(&mut last_chunk);320                // The last chunk will be dropped. Destroy all other chunks.321                for chunk in chunks_borrow.iter_mut() {322                    chunk.destroy(chunk.entries);323                }324            }325            // Box handles deallocation of `last_chunk` and `self.chunks`.326        }327    }328}329330unsafe impl<T: Send> Send for TypedArena<T> {}331332#[inline(always)]333fn align_down(val: usize, align: usize) -> usize {334    debug_assert!(align.is_power_of_two());335    val & !(align - 1)336}337338#[inline(always)]339fn align_up(val: usize, align: usize) -> usize {340    debug_assert!(align.is_power_of_two());341    (val + align - 1) & !(align - 1)342}343344// Pointer alignment is common in compiler types, so keep `DroplessArena` aligned to them345// to optimize away alignment code.346const DROPLESS_ALIGNMENT: usize = align_of::<usize>();347348/// An arena that can hold objects of multiple different types that impl `Copy`349/// and/or satisfy `!mem::needs_drop`.350pub struct DroplessArena {351    /// A pointer to the start of the free space.352    start: Cell<*mut u8>,353354    /// A pointer to the end of free space.355    ///356    /// The allocation proceeds downwards from the end of the chunk towards the357    /// start. (This is slightly simpler and faster than allocating upwards,358    /// see <https://fitzgeraldnick.com/2019/11/01/always-bump-downwards.html>.)359    /// When this pointer crosses the start pointer, a new chunk is allocated.360    ///361    /// This is kept aligned to DROPLESS_ALIGNMENT.362    end: Cell<*mut u8>,363364    /// A vector of arena chunks.365    chunks: RefCell<Vec<ArenaChunk>>,366}367368unsafe impl Send for DroplessArena {}369370impl Default for DroplessArena {371    #[inline]372    fn default() -> DroplessArena {373        DroplessArena {374            // We set both `start` and `end` to 0 so that the first call to375            // alloc() will trigger a grow().376            start: Cell::new(ptr::null_mut()),377            end: Cell::new(ptr::null_mut()),378            chunks: Default::default(),379        }380    }381}382383impl DroplessArena {384    #[inline(never)]385    #[cold]386    fn grow(&self, layout: Layout) {387        // Add some padding so we can align `self.end` while388        // still fitting in a `layout` allocation.389        let additional = layout.size() + cmp::max(DROPLESS_ALIGNMENT, layout.align()) - 1;390391        unsafe {392            let mut chunks = self.chunks.borrow_mut();393            let mut new_cap;394            if let Some(last_chunk) = chunks.last_mut() {395                // There is no need to update `last_chunk.entries` because that396                // field isn't used by `DroplessArena`.397398                // If the previous chunk's len is less than HUGE_PAGE399                // bytes, then this chunk will be least double the previous400                // chunk's size.401                new_cap = last_chunk.storage.len().min(HUGE_PAGE / 2);402                new_cap *= 2;403            } else {404                new_cap = PAGE;405            }406            // Also ensure that this chunk can fit `additional`.407            new_cap = cmp::max(additional, new_cap);408409            let chunk = chunks.push_mut(ArenaChunk::new(align_up(new_cap, PAGE)));410            self.start.set(chunk.start());411412            // Align the end to DROPLESS_ALIGNMENT.413            let end = align_down(chunk.end().addr(), DROPLESS_ALIGNMENT);414415            // Make sure we don't go past `start`. This should not happen since the allocation416            // should be at least DROPLESS_ALIGNMENT - 1 bytes.417            debug_assert!(chunk.start().addr() <= end);418419            self.end.set(chunk.end().with_addr(end));420        }421    }422423    #[inline]424    pub fn alloc_raw(&self, layout: Layout) -> *mut u8 {425        assert!(layout.size() != 0);426427        // This loop executes once or twice: if allocation fails the first428        // time, the `grow` ensures it will succeed the second time.429        loop {430            let start = self.start.get().addr();431            let old_end = self.end.get();432            let end = old_end.addr();433434            // Align allocated bytes so that `self.end` stays aligned to435            // DROPLESS_ALIGNMENT.436            let bytes = align_up(layout.size(), DROPLESS_ALIGNMENT);437438            // Tell LLVM that `end` is aligned to DROPLESS_ALIGNMENT.439            unsafe { hint::assert_unchecked(end == align_down(end, DROPLESS_ALIGNMENT)) };440441            if let Some(sub) = end.checked_sub(bytes) {442                let new_end = align_down(sub, layout.align());443                if start <= new_end {444                    let new_end = old_end.with_addr(new_end);445                    // `new_end` is aligned to DROPLESS_ALIGNMENT as `align_down`446                    // preserves alignment as both `end` and `bytes` are already447                    // aligned to DROPLESS_ALIGNMENT.448                    self.end.set(new_end);449                    return new_end;450                }451            }452453            // No free space left. Allocate a new chunk to satisfy the request.454            // On failure the grow will panic or abort.455            self.grow(layout);456        }457    }458459    #[inline]460    pub fn alloc<T>(&self, object: T) -> &mut T {461        assert!(!mem::needs_drop::<T>());462        assert!(size_of::<T>() != 0);463464        let mem = self.alloc_raw(Layout::new::<T>()) as *mut T;465466        unsafe {467            // Write into uninitialized memory.468            ptr::write(mem, object);469            &mut *mem470        }471    }472473    /// Allocates a slice of objects that are copied into the `DroplessArena`, returning a mutable474    /// reference to it. Will panic if passed a zero-sized type.475    ///476    /// Panics:477    ///478    ///  - Zero-sized types479    ///  - Zero-length slices480    #[inline]481    pub fn alloc_slice<T>(&self, slice: &[T]) -> &mut [T]482    where483        T: Copy,484    {485        assert!(!mem::needs_drop::<T>());486        assert!(size_of::<T>() != 0);487        assert!(!slice.is_empty());488489        let mem = self.alloc_raw(Layout::for_value::<[T]>(slice)) as *mut T;490491        unsafe {492            mem.copy_from_nonoverlapping(slice.as_ptr(), slice.len());493            slice::from_raw_parts_mut(mem, slice.len())494        }495    }496497    /// Allocates a string slice that is copied into the `DroplessArena`, returning a498    /// reference to it. Will panic if passed an empty string.499    ///500    /// Panics:501    ///502    ///  - Zero-length string503    #[inline]504    pub fn alloc_str(&self, string: &str) -> &str {505        let slice = self.alloc_slice(string.as_bytes());506507        // SAFETY: the result has a copy of the same valid UTF-8 bytes.508        unsafe { std::str::from_utf8_unchecked(slice) }509    }510511    /// # Safety512    ///513    /// The caller must ensure that `mem` is valid for writes up to `size_of::<T>() * len`, and that514    /// that memory stays allocated and not shared for the lifetime of `self`. This must hold even515    /// if `iter.next()` allocates onto `self`.516    #[inline]517    unsafe fn write_from_iter<T, I: Iterator<Item = T>>(518        &self,519        mut iter: I,520        len: usize,521        mem: *mut T,522    ) -> &mut [T] {523        let mut i = 0;524        // Use a manual loop since LLVM manages to optimize it better for525        // slice iterators526        loop {527            // SAFETY: The caller must ensure that `mem` is valid for writes up to528            // `size_of::<T>() * len`.529            unsafe {530                match iter.next() {531                    Some(value) if i < len => mem.add(i).write(value),532                    Some(_) | None => {533                        // We only return as many items as the iterator gave us, even534                        // though it was supposed to give us `len`535                        return slice::from_raw_parts_mut(mem, i);536                    }537                }538            }539            i += 1;540        }541    }542543    #[inline]544    pub fn alloc_from_iter<T, I: IntoIterator<Item = T>>(&self, iter: I) -> &mut [T] {545        assert!(!mem::needs_drop::<T>());546        assert!(size_of::<T>() != 0);547548        // Warning: this function is reentrant: `iter` could hold a reference to `&self` and549        // allocate additional elements while we're iterating.550        let iter = iter.into_iter();551552        let size_hint = iter.size_hint();553554        match size_hint {555            (min, Some(max)) if min == max => {556                // We know the exact number of elements the iterator expects to produce here.557                let len = min;558559                if len == 0 {560                    return &mut [];561                }562563                let mem = self.alloc_raw(Layout::array::<T>(len).unwrap()) as *mut T;564                // SAFETY: `write_from_iter` doesn't touch `self`. It only touches the slice we just565                // reserved. If the iterator panics or doesn't output `len` elements, this will566                // leave some unallocated slots in the arena, which is fine because we do not call567                // `drop`.568                unsafe { self.write_from_iter(iter, len, mem) }569            }570            (_, _) => outline(move || self.try_alloc_from_iter(iter.map(Ok::<T, !>)).into_ok()),571        }572    }573574    #[inline]575    pub fn try_alloc_from_iter<T, E>(576        &self,577        iter: impl IntoIterator<Item = Result<T, E>>,578    ) -> Result<&mut [T], E> {579        // Despite the similarity with `alloc_from_iter`, we cannot reuse their fast case, as we580        // cannot know the minimum length of the iterator in this case.581        assert!(!mem::needs_drop::<T>());582        assert!(size_of::<T>() != 0);583584        // Takes care of reentrancy.585        let vec: Result<SmallVec<[T; 8]>, E> = iter.into_iter().collect();586        let mut vec = vec?;587        if vec.is_empty() {588            return Ok(&mut []);589        }590        // Move the content to the arena by copying and then forgetting it.591        let len = vec.len();592        Ok(unsafe {593            let start_ptr = self.alloc_raw(Layout::for_value::<[T]>(vec.as_slice())) as *mut T;594            vec.as_ptr().copy_to_nonoverlapping(start_ptr, len);595            vec.set_len(0);596            slice::from_raw_parts_mut(start_ptr, len)597        })598    }599}600601/// Declares an `Arena` that can allocate values of a variety of `Copy`, `needs_drop` and602/// `!needs_drop` types.603///604/// The declared arena actually contains a single [`DroplessArena`], plus a separate605/// [`TypedArena`] for each of the types listed in the body of the macro invocation.606///607/// Any type that is `Copy` can be allocated in the arena without needing to be listed608/// explicitly. Those values will be stored in the [`DroplessArena`].609///610/// Types that are `!Copy` can only be allocated if they are listed in the macro invocation.611/// For types that are `!Copy + needs_drop`, values will be stored in the corresponding612/// [`TypedArena`] and will be dropped when the arena is dropped.613///614/// As an optimization, types that are `!Copy + !needs_drop` will actually be stored in the615/// [`DroplessArena`], and the corresponding [`TypedArena`] will remain empty. This makes616/// better use of the dropless arena's storage blocks, while the overhead of having a few617/// unused typed-arenas is negligible.618#[rustc_macro_transparency = "semiopaque"]619pub macro declare_arena(620    // Each of these entries becomes a `$name: TypedArena<$ty>` field in the arena.621    // This allows values of non-copy type $ty to be allocated in the arena.622    // The field names must be distinct, but have no further significance.623    $(624        $name:ident: $ty:ty,625    )*626) {627    #[derive(Default)]628    pub struct Arena<'tcx> {629        pub dropless: $crate::DroplessArena,630        $($name: $crate::TypedArena<$ty>,)*631    }632633    pub trait ArenaAllocatable<'tcx, C = rustc_arena::IsNotCopy>: Sized {634        #[allow(clippy::mut_from_ref)]635        fn allocate_on(self, arena: &'tcx Arena<'tcx>) -> &'tcx mut Self;636        #[allow(clippy::mut_from_ref)]637        fn allocate_from_iter(638            arena: &'tcx Arena<'tcx>,639            iter: impl ::std::iter::IntoIterator<Item = Self>,640        ) -> &'tcx mut [Self];641    }642643    // Any type that impls `Copy` can be arena-allocated in the `DroplessArena`.644    impl<'tcx, T: Copy> ArenaAllocatable<'tcx, rustc_arena::IsCopy> for T {645        #[inline]646        #[allow(clippy::mut_from_ref)]647        fn allocate_on(self, arena: &'tcx Arena<'tcx>) -> &'tcx mut Self {648            arena.dropless.alloc(self)649        }650        #[inline]651        #[allow(clippy::mut_from_ref)]652        fn allocate_from_iter(653            arena: &'tcx Arena<'tcx>,654            iter: impl ::std::iter::IntoIterator<Item = Self>,655        ) -> &'tcx mut [Self] {656            arena.dropless.alloc_from_iter(iter)657        }658    }659    $(660        impl<'tcx> ArenaAllocatable<'tcx, rustc_arena::IsNotCopy> for $ty {661            #[inline]662            fn allocate_on(self, arena: &'tcx Arena<'tcx>) -> &'tcx mut Self {663                if !::std::mem::needs_drop::<Self>() {664                    arena.dropless.alloc(self)665                } else {666                    arena.$name.alloc(self)667                }668            }669670            #[inline]671            #[allow(clippy::mut_from_ref)]672            fn allocate_from_iter(673                arena: &'tcx Arena<'tcx>,674                iter: impl ::std::iter::IntoIterator<Item = Self>,675            ) -> &'tcx mut [Self] {676                if !::std::mem::needs_drop::<Self>() {677                    arena.dropless.alloc_from_iter(iter)678                } else {679                    arena.$name.alloc_from_iter(iter)680                }681            }682        }683    )*684685    impl<'tcx> Arena<'tcx> {686        #[inline]687        #[allow(clippy::mut_from_ref)]688        pub fn alloc<T: ArenaAllocatable<'tcx, C>, C>(&'tcx self, value: T) -> &mut T {689            value.allocate_on(self)690        }691692        // Any type that impls `Copy` can have slices be arena-allocated in the `DroplessArena`.693        #[inline]694        #[allow(clippy::mut_from_ref)]695        pub fn alloc_slice<T: ::std::marker::Copy>(&self, value: &[T]) -> &mut [T] {696            if value.is_empty() {697                return &mut [];698            }699            self.dropless.alloc_slice(value)700        }701702        #[inline]703        pub fn alloc_str(&self, string: &str) -> &str {704            if string.is_empty() {705                return "";706            }707            self.dropless.alloc_str(string)708        }709710        #[allow(clippy::mut_from_ref)]711        pub fn alloc_from_iter<T: ArenaAllocatable<'tcx, C>, C>(712            &'tcx self,713            iter: impl ::std::iter::IntoIterator<Item = T>,714        ) -> &mut [T] {715            T::allocate_from_iter(self, iter)716        }717    }718}719720// Marker types that let us give different behaviour for arenas allocating721// `Copy` types vs `!Copy` types.722pub struct IsCopy;723pub struct IsNotCopy;724725#[cfg(test)]726mod tests;

Code quality findings 68

Critical: Use of 'unsafe' keyword bypasses Rust's safety guarantees. Requires careful auditing, clear justification (FFI, specific optimizations), and minimal scope.
error safety unsafe-block
unsafe impl<#[may_dangle] T> Drop for ArenaChunk<T> {
Critical: Use of 'unsafe' keyword bypasses Rust's safety guarantees. Requires careful auditing, clear justification (FFI, specific optimizations), and minimal scope.
error safety unsafe-block
unsafe { drop(Box::from_raw(self.storage.as_mut())) }
Critical: Use of 'unsafe' keyword bypasses Rust's safety guarantees. Requires careful auditing, clear justification (FFI, specific optimizations), and minimal scope.
error safety unsafe-block
unsafe fn new(capacity: usize) -> ArenaChunk<T> {
Critical: Use of 'unsafe' keyword bypasses Rust's safety guarantees. Requires careful auditing, clear justification (FFI, specific optimizations), and minimal scope.
error safety unsafe-block
unsafe fn destroy(&mut self, len: usize) {
Critical: Use of 'unsafe' keyword bypasses Rust's safety guarantees. Requires careful auditing, clear justification (FFI, specific optimizations), and minimal scope.
error safety unsafe-block
unsafe {
Critical: Use of 'unsafe' keyword bypasses Rust's safety guarantees. Requires careful auditing, clear justification (FFI, specific optimizations), and minimal scope.
error safety unsafe-block
unsafe {
Critical: Use of 'unsafe' keyword bypasses Rust's safety guarantees. Requires careful auditing, clear justification (FFI, specific optimizations), and minimal scope.
error safety unsafe-block
unsafe {
Critical: Use of 'unsafe' keyword bypasses Rust's safety guarantees. Requires careful auditing, clear justification (FFI, specific optimizations), and minimal scope.
error safety unsafe-block
unsafe fn alloc_raw_slice(&self, len: usize) -> *mut T {
Critical: Use of 'unsafe' keyword bypasses Rust's safety guarantees. Requires careful auditing, clear justification (FFI, specific optimizations), and minimal scope.
error safety unsafe-block
unsafe { self.ptr.set(start_ptr.add(len)) };
Critical: Use of 'unsafe' keyword bypasses Rust's safety guarantees. Requires careful auditing, clear justification (FFI, specific optimizations), and minimal scope.
error safety unsafe-block
Ok(unsafe {
Critical: Use of 'unsafe' keyword bypasses Rust's safety guarantees. Requires careful auditing, clear justification (FFI, specific optimizations), and minimal scope.
error safety unsafe-block
unsafe {
Critical: Use of 'unsafe' keyword bypasses Rust's safety guarantees. Requires careful auditing, clear justification (FFI, specific optimizations), and minimal scope.
error safety unsafe-block
unsafe {
Critical: Use of 'unsafe' keyword bypasses Rust's safety guarantees. Requires careful auditing, clear justification (FFI, specific optimizations), and minimal scope.
error safety unsafe-block
unsafe impl<#[may_dangle] T> Drop for TypedArena<T> {
Critical: Use of 'unsafe' keyword bypasses Rust's safety guarantees. Requires careful auditing, clear justification (FFI, specific optimizations), and minimal scope.
error safety unsafe-block
unsafe {
Critical: Use of 'unsafe' keyword bypasses Rust's safety guarantees. Requires careful auditing, clear justification (FFI, specific optimizations), and minimal scope.
error safety unsafe-block
unsafe impl<T: Send> Send for TypedArena<T> {}
Critical: Use of 'unsafe' keyword bypasses Rust's safety guarantees. Requires careful auditing, clear justification (FFI, specific optimizations), and minimal scope.
error safety unsafe-block
unsafe impl Send for DroplessArena {}
Critical: Use of 'unsafe' keyword bypasses Rust's safety guarantees. Requires careful auditing, clear justification (FFI, specific optimizations), and minimal scope.
error safety unsafe-block
unsafe {
Critical: Use of 'unsafe' keyword bypasses Rust's safety guarantees. Requires careful auditing, clear justification (FFI, specific optimizations), and minimal scope.
error safety unsafe-block
unsafe { hint::assert_unchecked(end == align_down(end, DROPLESS_ALIGNMENT)) };
Critical: Use of 'unsafe' keyword bypasses Rust's safety guarantees. Requires careful auditing, clear justification (FFI, specific optimizations), and minimal scope.
error safety unsafe-block
unsafe {
Critical: Use of 'unsafe' keyword bypasses Rust's safety guarantees. Requires careful auditing, clear justification (FFI, specific optimizations), and minimal scope.
error safety unsafe-block
unsafe {
Critical: Use of 'unsafe' keyword bypasses Rust's safety guarantees. Requires careful auditing, clear justification (FFI, specific optimizations), and minimal scope.
error safety unsafe-block
unsafe { std::str::from_utf8_unchecked(slice) }
Critical: Use of 'unsafe' keyword bypasses Rust's safety guarantees. Requires careful auditing, clear justification (FFI, specific optimizations), and minimal scope.
error safety unsafe-block
unsafe fn write_from_iter<T, I: Iterator<Item = T>>(
Critical: Use of 'unsafe' keyword bypasses Rust's safety guarantees. Requires careful auditing, clear justification (FFI, specific optimizations), and minimal scope.
error safety unsafe-block
unsafe {
Critical: Use of 'unsafe' keyword bypasses Rust's safety guarantees. Requires careful auditing, clear justification (FFI, specific optimizations), and minimal scope.
error safety unsafe-block
unsafe { self.write_from_iter(iter, len, mem) }
Critical: Use of 'unsafe' keyword bypasses Rust's safety guarantees. Requires careful auditing, clear justification (FFI, specific optimizations), and minimal scope.
error safety unsafe-block
Ok(unsafe {
Warning: Direct indexing (e.g., `vec[i]`, `slice[i]`) panics on out-of-bounds access. Prefer using `.get(index)` or `.get_mut(index)` which return Option<&T>/Option<&mut T>.
warning correctness unchecked-indexing
slice[..len].assume_init_drop();
Warning: '.unwrap()' will panic on None/Err variants. Prefer using pattern matching (match, if let), combinators (map, and_then), or the '?' operator for robust error handling.
warning correctness unwrap-usage
let additional_bytes = additional.checked_mul(size_of::<T>()).unwrap();
Warning: Direct indexing (e.g., `vec[i]`, `slice[i]`) panics on out-of-bounds access. Prefer using `.get(index)` or `.get_mut(index)` which return Option<&T>/Option<&mut T>.
warning correctness unchecked-indexing
pub fn alloc_from_iter<I: IntoIterator<Item = T>>(&self, iter: I) -> &mut [T] {
Warning: Direct indexing (e.g., `vec[i]`, `slice[i]`) panics on out-of-bounds access. Prefer using `.get(index)` or `.get_mut(index)` which return Option<&T>/Option<&mut T>.
warning correctness unchecked-indexing
) -> Result<&mut [T], E> {
Warning: Direct indexing (e.g., `vec[i]`, `slice[i]`) panics on out-of-bounds access. Prefer using `.get(index)` or `.get_mut(index)` which return Option<&T>/Option<&mut T>.
warning correctness unchecked-indexing
return Ok(&mut []);
Warning: Direct indexing (e.g., `vec[i]`, `slice[i]`) panics on out-of-bounds access. Prefer using `.get(index)` or `.get_mut(index)` which return Option<&T>/Option<&mut T>.
warning correctness unchecked-indexing
pub fn alloc_slice<T>(&self, slice: &[T]) -> &mut [T]
Warning: Direct indexing (e.g., `vec[i]`, `slice[i]`) panics on out-of-bounds access. Prefer using `.get(index)` or `.get_mut(index)` which return Option<&T>/Option<&mut T>.
warning correctness unchecked-indexing
) -> &mut [T] {
Warning: Direct indexing (e.g., `vec[i]`, `slice[i]`) panics on out-of-bounds access. Prefer using `.get(index)` or `.get_mut(index)` which return Option<&T>/Option<&mut T>.
warning correctness unchecked-indexing
pub fn alloc_from_iter<T, I: IntoIterator<Item = T>>(&self, iter: I) -> &mut [T] {
Warning: Direct indexing (e.g., `vec[i]`, `slice[i]`) panics on out-of-bounds access. Prefer using `.get(index)` or `.get_mut(index)` which return Option<&T>/Option<&mut T>.
warning correctness unchecked-indexing
return &mut [];
Warning: '.unwrap()' will panic on None/Err variants. Prefer using pattern matching (match, if let), combinators (map, and_then), or the '?' operator for robust error handling.
warning correctness unwrap-usage
let mem = self.alloc_raw(Layout::array::<T>(len).unwrap()) as *mut T;
Warning: Direct indexing (e.g., `vec[i]`, `slice[i]`) panics on out-of-bounds access. Prefer using `.get(index)` or `.get_mut(index)` which return Option<&T>/Option<&mut T>.
warning correctness unchecked-indexing
) -> Result<&mut [T], E> {
Warning: Direct indexing (e.g., `vec[i]`, `slice[i]`) panics on out-of-bounds access. Prefer using `.get(index)` or `.get_mut(index)` which return Option<&T>/Option<&mut T>.
warning correctness unchecked-indexing
return Ok(&mut []);
Warning: Direct indexing (e.g., `vec[i]`, `slice[i]`) panics on out-of-bounds access. Prefer using `.get(index)` or `.get_mut(index)` which return Option<&T>/Option<&mut T>.
warning correctness unchecked-indexing
/// The declared arena actually contains a single [`DroplessArena`], plus a separate
Warning: Direct indexing (e.g., `vec[i]`, `slice[i]`) panics on out-of-bounds access. Prefer using `.get(index)` or `.get_mut(index)` which return Option<&T>/Option<&mut T>.
warning correctness unchecked-indexing
/// explicitly. Those values will be stored in the [`DroplessArena`].
Warning: Direct indexing (e.g., `vec[i]`, `slice[i]`) panics on out-of-bounds access. Prefer using `.get(index)` or `.get_mut(index)` which return Option<&T>/Option<&mut T>.
warning correctness unchecked-indexing
/// [`DroplessArena`], and the corresponding [`TypedArena`] will remain empty. This makes
Warning: Direct indexing (e.g., `vec[i]`, `slice[i]`) panics on out-of-bounds access. Prefer using `.get(index)` or `.get_mut(index)` which return Option<&T>/Option<&mut T>.
warning correctness unchecked-indexing
) -> &'tcx mut [Self];
Warning: Direct indexing (e.g., `vec[i]`, `slice[i]`) panics on out-of-bounds access. Prefer using `.get(index)` or `.get_mut(index)` which return Option<&T>/Option<&mut T>.
warning correctness unchecked-indexing
) -> &'tcx mut [Self] {
Warning: Direct indexing (e.g., `vec[i]`, `slice[i]`) panics on out-of-bounds access. Prefer using `.get(index)` or `.get_mut(index)` which return Option<&T>/Option<&mut T>.
warning correctness unchecked-indexing
) -> &'tcx mut [Self] {
Warning: Direct indexing (e.g., `vec[i]`, `slice[i]`) panics on out-of-bounds access. Prefer using `.get(index)` or `.get_mut(index)` which return Option<&T>/Option<&mut T>.
warning correctness unchecked-indexing
pub fn alloc_slice<T: ::std::marker::Copy>(&self, value: &[T]) -> &mut [T] {
Warning: Direct indexing (e.g., `vec[i]`, `slice[i]`) panics on out-of-bounds access. Prefer using `.get(index)` or `.get_mut(index)` which return Option<&T>/Option<&mut T>.
warning correctness unchecked-indexing
return &mut [];
Warning: Direct indexing (e.g., `vec[i]`, `slice[i]`) panics on out-of-bounds access. Prefer using `.get(index)` or `.get_mut(index)` which return Option<&T>/Option<&mut T>.
warning correctness unchecked-indexing
) -> &mut [T] {
Info: Use of raw pointers (*const T, *mut T) typically requires 'unsafe' blocks for dereferencing. Ensure usage is justified (FFI, low-level optimizations) and memory safety is manually upheld.
info safety raw-pointer
fn start(&mut self) -> *mut T {
Info: Use of raw pointers (*const T, *mut T) typically requires 'unsafe' blocks for dereferencing. Ensure usage is justified (FFI, low-level optimizations) and memory safety is manually upheld.
info safety raw-pointer
self.storage.as_ptr() as *mut T
Info: Use of raw pointers (*const T, *mut T) typically requires 'unsafe' blocks for dereferencing. Ensure usage is justified (FFI, low-level optimizations) and memory safety is manually upheld.
info safety raw-pointer
fn end(&mut self) -> *mut T {
Info: Use of raw pointers (*const T, *mut T) typically requires 'unsafe' blocks for dereferencing. Ensure usage is justified (FFI, low-level optimizations) and memory safety is manually upheld.
info safety raw-pointer
ptr: Cell<*mut T>,
Info: Use of raw pointers (*const T, *mut T) typically requires 'unsafe' blocks for dereferencing. Ensure usage is justified (FFI, low-level optimizations) and memory safety is manually upheld.
info safety raw-pointer
end: Cell<*mut T>,
Info: Use of raw pointers (*const T, *mut T) typically requires 'unsafe' blocks for dereferencing. Ensure usage is justified (FFI, low-level optimizations) and memory safety is manually upheld.
info safety raw-pointer
unsafe fn alloc_raw_slice(&self, len: usize) -> *mut T {
Info: Use of raw pointers (*const T, *mut T) typically requires 'unsafe' blocks for dereferencing. Ensure usage is justified (FFI, low-level optimizations) and memory safety is manually upheld.
info safety raw-pointer
start: Cell<*mut u8>,
Info: Use of raw pointers (*const T, *mut T) typically requires 'unsafe' blocks for dereferencing. Ensure usage is justified (FFI, low-level optimizations) and memory safety is manually upheld.
info safety raw-pointer
end: Cell<*mut u8>,
Info: Use of raw pointers (*const T, *mut T) typically requires 'unsafe' blocks for dereferencing. Ensure usage is justified (FFI, low-level optimizations) and memory safety is manually upheld.
info safety raw-pointer
pub fn alloc_raw(&self, layout: Layout) -> *mut u8 {
Info: Use of raw pointers (*const T, *mut T) typically requires 'unsafe' blocks for dereferencing. Ensure usage is justified (FFI, low-level optimizations) and memory safety is manually upheld.
info safety raw-pointer
let mem = self.alloc_raw(Layout::new::<T>()) as *mut T;
Info: Use of raw pointers (*const T, *mut T) typically requires 'unsafe' blocks for dereferencing. Ensure usage is justified (FFI, low-level optimizations) and memory safety is manually upheld.
info safety raw-pointer
let mem = self.alloc_raw(Layout::for_value::<[T]>(slice)) as *mut T;
Info: Use of raw pointers (*const T, *mut T) typically requires 'unsafe' blocks for dereferencing. Ensure usage is justified (FFI, low-level optimizations) and memory safety is manually upheld.
info safety raw-pointer
mem: *mut T,
Info: Use of raw pointers (*const T, *mut T) typically requires 'unsafe' blocks for dereferencing. Ensure usage is justified (FFI, low-level optimizations) and memory safety is manually upheld.
info safety raw-pointer
let mem = self.alloc_raw(Layout::array::<T>(len).unwrap()) as *mut T;
Info: Use of raw pointers (*const T, *mut T) typically requires 'unsafe' blocks for dereferencing. Ensure usage is justified (FFI, low-level optimizations) and memory safety is manually upheld.
info safety raw-pointer
let start_ptr = self.alloc_raw(Layout::for_value::<[T]>(vec.as_slice())) as *mut T;
Info: Usage of `#[allow(...)]` suppresses compiler lints. Ensure the allowance is justified, well-scoped, and ideally temporary. Overuse can hide potential issues.
info maintainability allow-lint
#[allow(clippy::mut_from_ref)]
Info: Usage of `#[allow(...)]` suppresses compiler lints. Ensure the allowance is justified, well-scoped, and ideally temporary. Overuse can hide potential issues.
info maintainability allow-lint
#[allow(clippy::mut_from_ref)]
Info: Usage of `#[allow(...)]` suppresses compiler lints. Ensure the allowance is justified, well-scoped, and ideally temporary. Overuse can hide potential issues.
info maintainability allow-lint
#[allow(clippy::mut_from_ref)]
Info: Usage of `#[allow(...)]` suppresses compiler lints. Ensure the allowance is justified, well-scoped, and ideally temporary. Overuse can hide potential issues.
info maintainability allow-lint
#[allow(clippy::mut_from_ref)]
Info: Usage of `#[allow(...)]` suppresses compiler lints. Ensure the allowance is justified, well-scoped, and ideally temporary. Overuse can hide potential issues.
info maintainability allow-lint
#[allow(clippy::mut_from_ref)]
Info: Usage of `#[allow(...)]` suppresses compiler lints. Ensure the allowance is justified, well-scoped, and ideally temporary. Overuse can hide potential issues.
info maintainability allow-lint
#[allow(clippy::mut_from_ref)]
Info: Usage of `#[allow(...)]` suppresses compiler lints. Ensure the allowance is justified, well-scoped, and ideally temporary. Overuse can hide potential issues.
info maintainability allow-lint
#[allow(clippy::mut_from_ref)]
Info: Usage of `#[allow(...)]` suppresses compiler lints. Ensure the allowance is justified, well-scoped, and ideally temporary. Overuse can hide potential issues.
info maintainability allow-lint
#[allow(clippy::mut_from_ref)]

Get this view in your editor

Same data, no extra tab — call code_get_file + code_get_findings over MCP from Claude/Cursor/Copilot.