1//! The arena, a fast but limited type of allocator.2//!3//! Arenas are a type of allocator that destroy the objects within, all at4//! once, once the arena itself is destroyed. They do not support deallocation5//! of individual objects while the arena itself is still alive. The benefit6//! of an arena is very fast allocation; just a pointer bump.7//!8//! This crate implements several kinds of arena.910// tidy-alphabetical-start11#![allow(clippy::mut_from_ref)] // Arena allocators are one place where this pattern is fine.12#![allow(internal_features)]13#![cfg_attr(test, feature(test))]14#![deny(unsafe_op_in_unsafe_fn)]15#![doc(test(no_crate_inject, attr(deny(warnings), allow(internal_features))))]16#![feature(decl_macro)]17#![feature(dropck_eyepatch)]18#![feature(never_type)]19#![feature(rustc_attrs)]20#![feature(unwrap_infallible)]21// tidy-alphabetical-end2223use std::alloc::Layout;24use std::cell::{Cell, RefCell};25use std::marker::PhantomData;26use std::mem::{self, MaybeUninit};27use std::ptr::{self, NonNull};28use std::{cmp, hint, slice};2930use smallvec::SmallVec;3132/// This calls the passed function while ensuring it won't be inlined into the caller.33#[inline(never)]34#[cold]35fn outline<F: FnOnce() -> R, R>(f: F) -> R {36 f()37}3839struct ArenaChunk<T = u8> {40 /// The raw storage for the arena chunk.41 storage: NonNull<[MaybeUninit<T>]>,42 /// The number of valid entries in the chunk.43 entries: usize,44}4546unsafe impl<#[may_dangle] T> Drop for ArenaChunk<T> {47 fn drop(&mut self) {48 unsafe { drop(Box::from_raw(self.storage.as_mut())) }49 }50}5152impl<T> ArenaChunk<T> {53 #[inline]54 unsafe fn new(capacity: usize) -> ArenaChunk<T> {55 ArenaChunk {56 storage: NonNull::from(Box::leak(Box::new_uninit_slice(capacity))),57 entries: 0,58 }59 }6061 /// Destroys this arena chunk.62 ///63 /// # Safety64 ///65 /// The caller must ensure that `len` elements of this chunk have been initialized.66 #[inline]67 unsafe fn destroy(&mut self, len: usize) {68 // The branch on needs_drop() is an -O1 performance optimization.69 // Without the branch, dropping TypedArena<T> takes linear time.70 if mem::needs_drop::<T>() {71 // SAFETY: The caller must ensure that `len` elements of this chunk have72 // been initialized.73 unsafe {74 let slice = self.storage.as_mut();75 slice[..len].assume_init_drop();76 }77 }78 }7980 // Returns a pointer to the first allocated object.81 #[inline]82 fn start(&mut self) -> *mut T {83 self.storage.as_ptr() as *mut T84 }8586 // Returns a pointer to the end of the allocated space.87 #[inline]88 fn end(&mut self) -> *mut T {89 unsafe {90 if size_of::<T>() == 0 {91 // A pointer as large as possible for zero-sized elements.92 ptr::without_provenance_mut(!0)93 } else {94 self.start().add(self.storage.len())95 }96 }97 }98}99100// The arenas start with PAGE-sized chunks, and then each new chunk is twice as101// big as its predecessor, up until we reach HUGE_PAGE-sized chunks, whereupon102// we stop growing. This scales well, from arenas that are barely used up to103// arenas that are used for 100s of MiBs. Note also that the chosen sizes match104// the usual sizes of pages and huge pages on Linux.105const PAGE: usize = 4096;106const HUGE_PAGE: usize = 2 * 1024 * 1024;107108/// An arena that can hold objects of only one type.109pub struct TypedArena<T> {110 /// A pointer to the next object to be allocated.111 ptr: Cell<*mut T>,112113 /// A pointer to the end of the allocated area. When this pointer is114 /// reached, a new chunk is allocated.115 end: Cell<*mut T>,116117 /// A vector of arena chunks.118 chunks: RefCell<Vec<ArenaChunk<T>>>,119120 /// Marker indicating that dropping the arena causes its owned121 /// instances of `T` to be dropped.122 _own: PhantomData<T>,123}124125impl<T> Default for TypedArena<T> {126 /// Creates a new `TypedArena`.127 fn default() -> TypedArena<T> {128 TypedArena {129 // We set both `ptr` and `end` to 0 so that the first call to130 // alloc() will trigger a grow().131 ptr: Cell::new(ptr::null_mut()),132 end: Cell::new(ptr::null_mut()),133 chunks: Default::default(),134 _own: PhantomData,135 }136 }137}138139impl<T> TypedArena<T> {140 /// Allocates an object in the `TypedArena`, returning a reference to it.141 #[inline]142 pub fn alloc(&self, object: T) -> &mut T {143 assert!(size_of::<T>() != 0);144145 if self.ptr == self.end {146 self.grow(1)147 }148149 unsafe {150 let ptr = self.ptr.get();151 // Advance the pointer.152 self.ptr.set(self.ptr.get().add(1));153 // Write into uninitialized memory.154 ptr::write(ptr, object);155 &mut *ptr156 }157 }158159 #[inline]160 fn can_allocate(&self, additional: usize) -> bool {161 // FIXME: this should *likely* use `offset_from`, but more162 // investigation is needed (including running tests in miri).163 let available_bytes = self.end.get().addr() - self.ptr.get().addr();164 let additional_bytes = additional.checked_mul(size_of::<T>()).unwrap();165 available_bytes >= additional_bytes166 }167168 /// Allocates storage for `len >= 1` values in this arena, and returns a169 /// raw pointer to the first value's storage.170 ///171 /// # Safety172 ///173 /// Caller must initialize each of the `len` slots to a droppable value174 /// before the arena is dropped.175 ///176 /// In practice, this typically means that the caller must be able to177 /// raw-copy `len` already-initialized values into the slice without any178 /// possibility of panicking.179 ///180 /// FIXME(Zalathar): This is *very* fragile; perhaps we need a different181 /// approach to arena-allocating slices of droppable values.182 #[inline]183 unsafe fn alloc_raw_slice(&self, len: usize) -> *mut T {184 assert!(size_of::<T>() != 0);185 assert!(len != 0);186187 // Ensure the current chunk can fit `len` objects.188 if !self.can_allocate(len) {189 self.grow(len);190 debug_assert!(self.can_allocate(len));191 }192193 let start_ptr = self.ptr.get();194 // SAFETY: `can_allocate`/`grow` ensures that there is enough space for195 // `len` elements.196 unsafe { self.ptr.set(start_ptr.add(len)) };197 start_ptr198 }199200 /// Allocates the elements of this iterator into a contiguous slice in the `TypedArena`.201 ///202 /// Note: for reasons of reentrancy and panic safety we collect into a `SmallVec<[_; 8]>` before203 /// storing the elements in the arena.204 #[inline]205 pub fn alloc_from_iter<I: IntoIterator<Item = T>>(&self, iter: I) -> &mut [T] {206 self.try_alloc_from_iter(iter.into_iter().map(Ok::<T, !>)).into_ok()207 }208209 /// Allocates the elements of this iterator into a contiguous slice in the `TypedArena`.210 ///211 /// Note: for reasons of reentrancy and panic safety we collect into a `SmallVec<[_; 8]>` before212 /// storing the elements in the arena.213 #[inline]214 pub fn try_alloc_from_iter<E>(215 &self,216 iter: impl IntoIterator<Item = Result<T, E>>,217 ) -> Result<&mut [T], E> {218 // Despite the similarity with `DroplessArena`, we cannot reuse their fast case. The reason219 // is subtle: these arenas are reentrant. In other words, `iter` may very well be holding a220 // reference to `self` and adding elements to the arena during iteration.221 //222 // For this reason, if we pre-allocated any space for the elements of this iterator, we'd223 // have to track that some uninitialized elements are followed by some initialized elements,224 // else we might accidentally drop uninitialized memory if something panics or if the225 // iterator doesn't fill all the length we expected.226 //227 // So we collect all the elements beforehand, which takes care of reentrancy and panic228 // safety. This function is much less hot than `DroplessArena::alloc_from_iter`, so it229 // doesn't need to be hyper-optimized.230 assert!(size_of::<T>() != 0);231232 let vec: Result<SmallVec<[T; 8]>, E> = iter.into_iter().collect();233 let mut vec = vec?;234 if vec.is_empty() {235 return Ok(&mut []);236 }237 // Move the content to the arena by copying and then forgetting it.238 let len = vec.len();239240 // SAFETY: After allocating raw storage for exactly `len` values, we241 // must fully initialize the storage without panicking, and we must242 // also prevent the stale values in the vec from being dropped.243 Ok(unsafe {244 let start_ptr = self.alloc_raw_slice(len);245 // Initialize the newly-allocated storage without panicking.246 vec.as_ptr().copy_to_nonoverlapping(start_ptr, len);247 // Prevent the stale values in the vec from being dropped.248 vec.set_len(0);249 slice::from_raw_parts_mut(start_ptr, len)250 })251 }252253 /// Grows the arena.254 #[inline(never)]255 #[cold]256 fn grow(&self, additional: usize) {257 unsafe {258 // We need the element size to convert chunk sizes (ranging from259 // PAGE to HUGE_PAGE bytes) to element counts.260 let elem_size = cmp::max(1, size_of::<T>());261 let mut chunks = self.chunks.borrow_mut();262 let mut new_cap;263 if let Some(last_chunk) = chunks.last_mut() {264 // If a type is `!needs_drop`, we don't need to keep track of how many elements265 // the chunk stores - the field will be ignored anyway.266 if mem::needs_drop::<T>() {267 // FIXME: this should *likely* use `offset_from`, but more268 // investigation is needed (including running tests in miri).269 let used_bytes = self.ptr.get().addr() - last_chunk.start().addr();270 last_chunk.entries = used_bytes / size_of::<T>();271 }272273 // If the previous chunk's len is less than HUGE_PAGE274 // bytes, then this chunk will be least double the previous275 // chunk's size.276 new_cap = last_chunk.storage.len().min(HUGE_PAGE / elem_size / 2);277 new_cap *= 2;278 } else {279 new_cap = PAGE / elem_size;280 }281 // Also ensure that this chunk can fit `additional`.282 new_cap = cmp::max(additional, new_cap);283284 let chunk = chunks.push_mut(ArenaChunk::<T>::new(new_cap));285 self.ptr.set(chunk.start());286 self.end.set(chunk.end());287 }288 }289290 // Drops the contents of the last chunk. The last chunk is partially empty, unlike all other291 // chunks.292 fn clear_last_chunk(&self, last_chunk: &mut ArenaChunk<T>) {293 // Determine how much was filled.294 let start = last_chunk.start().addr();295 // We obtain the value of the pointer to the first uninitialized element.296 let end = self.ptr.get().addr();297 // We then calculate the number of elements to be dropped in the last chunk,298 // which is the filled area's length.299 assert_ne!(size_of::<T>(), 0);300 // FIXME: this should *likely* use `offset_from`, but more301 // investigation is needed (including running tests in miri).302 let diff = (end - start) / size_of::<T>();303 // Pass that to the `destroy` method.304 unsafe {305 last_chunk.destroy(diff);306 }307 // Reset the chunk.308 self.ptr.set(last_chunk.start());309 }310}311312unsafe impl<#[may_dangle] T> Drop for TypedArena<T> {313 fn drop(&mut self) {314 unsafe {315 // Determine how much was filled.316 let mut chunks_borrow = self.chunks.borrow_mut();317 if let Some(mut last_chunk) = chunks_borrow.pop() {318 // Drop the contents of the last chunk.319 self.clear_last_chunk(&mut last_chunk);320 // The last chunk will be dropped. Destroy all other chunks.321 for chunk in chunks_borrow.iter_mut() {322 chunk.destroy(chunk.entries);323 }324 }325 // Box handles deallocation of `last_chunk` and `self.chunks`.326 }327 }328}329330unsafe impl<T: Send> Send for TypedArena<T> {}331332#[inline(always)]333fn align_down(val: usize, align: usize) -> usize {334 debug_assert!(align.is_power_of_two());335 val & !(align - 1)336}337338#[inline(always)]339fn align_up(val: usize, align: usize) -> usize {340 debug_assert!(align.is_power_of_two());341 (val + align - 1) & !(align - 1)342}343344// Pointer alignment is common in compiler types, so keep `DroplessArena` aligned to them345// to optimize away alignment code.346const DROPLESS_ALIGNMENT: usize = align_of::<usize>();347348/// An arena that can hold objects of multiple different types that impl `Copy`349/// and/or satisfy `!mem::needs_drop`.350pub struct DroplessArena {351 /// A pointer to the start of the free space.352 start: Cell<*mut u8>,353354 /// A pointer to the end of free space.355 ///356 /// The allocation proceeds downwards from the end of the chunk towards the357 /// start. (This is slightly simpler and faster than allocating upwards,358 /// see <https://fitzgeraldnick.com/2019/11/01/always-bump-downwards.html>.)359 /// When this pointer crosses the start pointer, a new chunk is allocated.360 ///361 /// This is kept aligned to DROPLESS_ALIGNMENT.362 end: Cell<*mut u8>,363364 /// A vector of arena chunks.365 chunks: RefCell<Vec<ArenaChunk>>,366}367368unsafe impl Send for DroplessArena {}369370impl Default for DroplessArena {371 #[inline]372 fn default() -> DroplessArena {373 DroplessArena {374 // We set both `start` and `end` to 0 so that the first call to375 // alloc() will trigger a grow().376 start: Cell::new(ptr::null_mut()),377 end: Cell::new(ptr::null_mut()),378 chunks: Default::default(),379 }380 }381}382383impl DroplessArena {384 #[inline(never)]385 #[cold]386 fn grow(&self, layout: Layout) {387 // Add some padding so we can align `self.end` while388 // still fitting in a `layout` allocation.389 let additional = layout.size() + cmp::max(DROPLESS_ALIGNMENT, layout.align()) - 1;390391 unsafe {392 let mut chunks = self.chunks.borrow_mut();393 let mut new_cap;394 if let Some(last_chunk) = chunks.last_mut() {395 // There is no need to update `last_chunk.entries` because that396 // field isn't used by `DroplessArena`.397398 // If the previous chunk's len is less than HUGE_PAGE399 // bytes, then this chunk will be least double the previous400 // chunk's size.401 new_cap = last_chunk.storage.len().min(HUGE_PAGE / 2);402 new_cap *= 2;403 } else {404 new_cap = PAGE;405 }406 // Also ensure that this chunk can fit `additional`.407 new_cap = cmp::max(additional, new_cap);408409 let chunk = chunks.push_mut(ArenaChunk::new(align_up(new_cap, PAGE)));410 self.start.set(chunk.start());411412 // Align the end to DROPLESS_ALIGNMENT.413 let end = align_down(chunk.end().addr(), DROPLESS_ALIGNMENT);414415 // Make sure we don't go past `start`. This should not happen since the allocation416 // should be at least DROPLESS_ALIGNMENT - 1 bytes.417 debug_assert!(chunk.start().addr() <= end);418419 self.end.set(chunk.end().with_addr(end));420 }421 }422423 #[inline]424 pub fn alloc_raw(&self, layout: Layout) -> *mut u8 {425 assert!(layout.size() != 0);426427 // This loop executes once or twice: if allocation fails the first428 // time, the `grow` ensures it will succeed the second time.429 loop {430 let start = self.start.get().addr();431 let old_end = self.end.get();432 let end = old_end.addr();433434 // Align allocated bytes so that `self.end` stays aligned to435 // DROPLESS_ALIGNMENT.436 let bytes = align_up(layout.size(), DROPLESS_ALIGNMENT);437438 // Tell LLVM that `end` is aligned to DROPLESS_ALIGNMENT.439 unsafe { hint::assert_unchecked(end == align_down(end, DROPLESS_ALIGNMENT)) };440441 if let Some(sub) = end.checked_sub(bytes) {442 let new_end = align_down(sub, layout.align());443 if start <= new_end {444 let new_end = old_end.with_addr(new_end);445 // `new_end` is aligned to DROPLESS_ALIGNMENT as `align_down`446 // preserves alignment as both `end` and `bytes` are already447 // aligned to DROPLESS_ALIGNMENT.448 self.end.set(new_end);449 return new_end;450 }451 }452453 // No free space left. Allocate a new chunk to satisfy the request.454 // On failure the grow will panic or abort.455 self.grow(layout);456 }457 }458459 #[inline]460 pub fn alloc<T>(&self, object: T) -> &mut T {461 assert!(!mem::needs_drop::<T>());462 assert!(size_of::<T>() != 0);463464 let mem = self.alloc_raw(Layout::new::<T>()) as *mut T;465466 unsafe {467 // Write into uninitialized memory.468 ptr::write(mem, object);469 &mut *mem470 }471 }472473 /// Allocates a slice of objects that are copied into the `DroplessArena`, returning a mutable474 /// reference to it. Will panic if passed a zero-sized type.475 ///476 /// Panics:477 ///478 /// - Zero-sized types479 /// - Zero-length slices480 #[inline]481 pub fn alloc_slice<T>(&self, slice: &[T]) -> &mut [T]482 where483 T: Copy,484 {485 assert!(!mem::needs_drop::<T>());486 assert!(size_of::<T>() != 0);487 assert!(!slice.is_empty());488489 let mem = self.alloc_raw(Layout::for_value::<[T]>(slice)) as *mut T;490491 unsafe {492 mem.copy_from_nonoverlapping(slice.as_ptr(), slice.len());493 slice::from_raw_parts_mut(mem, slice.len())494 }495 }496497 /// Allocates a string slice that is copied into the `DroplessArena`, returning a498 /// reference to it. Will panic if passed an empty string.499 ///500 /// Panics:501 ///502 /// - Zero-length string503 #[inline]504 pub fn alloc_str(&self, string: &str) -> &str {505 let slice = self.alloc_slice(string.as_bytes());506507 // SAFETY: the result has a copy of the same valid UTF-8 bytes.508 unsafe { std::str::from_utf8_unchecked(slice) }509 }510511 /// # Safety512 ///513 /// The caller must ensure that `mem` is valid for writes up to `size_of::<T>() * len`, and that514 /// that memory stays allocated and not shared for the lifetime of `self`. This must hold even515 /// if `iter.next()` allocates onto `self`.516 #[inline]517 unsafe fn write_from_iter<T, I: Iterator<Item = T>>(518 &self,519 mut iter: I,520 len: usize,521 mem: *mut T,522 ) -> &mut [T] {523 let mut i = 0;524 // Use a manual loop since LLVM manages to optimize it better for525 // slice iterators526 loop {527 // SAFETY: The caller must ensure that `mem` is valid for writes up to528 // `size_of::<T>() * len`.529 unsafe {530 match iter.next() {531 Some(value) if i < len => mem.add(i).write(value),532 Some(_) | None => {533 // We only return as many items as the iterator gave us, even534 // though it was supposed to give us `len`535 return slice::from_raw_parts_mut(mem, i);536 }537 }538 }539 i += 1;540 }541 }542543 #[inline]544 pub fn alloc_from_iter<T, I: IntoIterator<Item = T>>(&self, iter: I) -> &mut [T] {545 assert!(!mem::needs_drop::<T>());546 assert!(size_of::<T>() != 0);547548 // Warning: this function is reentrant: `iter` could hold a reference to `&self` and549 // allocate additional elements while we're iterating.550 let iter = iter.into_iter();551552 let size_hint = iter.size_hint();553554 match size_hint {555 (min, Some(max)) if min == max => {556 // We know the exact number of elements the iterator expects to produce here.557 let len = min;558559 if len == 0 {560 return &mut [];561 }562563 let mem = self.alloc_raw(Layout::array::<T>(len).unwrap()) as *mut T;564 // SAFETY: `write_from_iter` doesn't touch `self`. It only touches the slice we just565 // reserved. If the iterator panics or doesn't output `len` elements, this will566 // leave some unallocated slots in the arena, which is fine because we do not call567 // `drop`.568 unsafe { self.write_from_iter(iter, len, mem) }569 }570 (_, _) => outline(move || self.try_alloc_from_iter(iter.map(Ok::<T, !>)).into_ok()),571 }572 }573574 #[inline]575 pub fn try_alloc_from_iter<T, E>(576 &self,577 iter: impl IntoIterator<Item = Result<T, E>>,578 ) -> Result<&mut [T], E> {579 // Despite the similarity with `alloc_from_iter`, we cannot reuse their fast case, as we580 // cannot know the minimum length of the iterator in this case.581 assert!(!mem::needs_drop::<T>());582 assert!(size_of::<T>() != 0);583584 // Takes care of reentrancy.585 let vec: Result<SmallVec<[T; 8]>, E> = iter.into_iter().collect();586 let mut vec = vec?;587 if vec.is_empty() {588 return Ok(&mut []);589 }590 // Move the content to the arena by copying and then forgetting it.591 let len = vec.len();592 Ok(unsafe {593 let start_ptr = self.alloc_raw(Layout::for_value::<[T]>(vec.as_slice())) as *mut T;594 vec.as_ptr().copy_to_nonoverlapping(start_ptr, len);595 vec.set_len(0);596 slice::from_raw_parts_mut(start_ptr, len)597 })598 }599}600601/// Declares an `Arena` that can allocate values of a variety of `Copy`, `needs_drop` and602/// `!needs_drop` types.603///604/// The declared arena actually contains a single [`DroplessArena`], plus a separate605/// [`TypedArena`] for each of the types listed in the body of the macro invocation.606///607/// Any type that is `Copy` can be allocated in the arena without needing to be listed608/// explicitly. Those values will be stored in the [`DroplessArena`].609///610/// Types that are `!Copy` can only be allocated if they are listed in the macro invocation.611/// For types that are `!Copy + needs_drop`, values will be stored in the corresponding612/// [`TypedArena`] and will be dropped when the arena is dropped.613///614/// As an optimization, types that are `!Copy + !needs_drop` will actually be stored in the615/// [`DroplessArena`], and the corresponding [`TypedArena`] will remain empty. This makes616/// better use of the dropless arena's storage blocks, while the overhead of having a few617/// unused typed-arenas is negligible.618#[rustc_macro_transparency = "semiopaque"]619pub macro declare_arena(620 // Each of these entries becomes a `$name: TypedArena<$ty>` field in the arena.621 // This allows values of non-copy type $ty to be allocated in the arena.622 // The field names must be distinct, but have no further significance.623 $(624 $name:ident: $ty:ty,625 )*626) {627 #[derive(Default)]628 pub struct Arena<'tcx> {629 pub dropless: $crate::DroplessArena,630 $($name: $crate::TypedArena<$ty>,)*631 }632633 pub trait ArenaAllocatable<'tcx, C = rustc_arena::IsNotCopy>: Sized {634 #[allow(clippy::mut_from_ref)]635 fn allocate_on(self, arena: &'tcx Arena<'tcx>) -> &'tcx mut Self;636 #[allow(clippy::mut_from_ref)]637 fn allocate_from_iter(638 arena: &'tcx Arena<'tcx>,639 iter: impl ::std::iter::IntoIterator<Item = Self>,640 ) -> &'tcx mut [Self];641 }642643 // Any type that impls `Copy` can be arena-allocated in the `DroplessArena`.644 impl<'tcx, T: Copy> ArenaAllocatable<'tcx, rustc_arena::IsCopy> for T {645 #[inline]646 #[allow(clippy::mut_from_ref)]647 fn allocate_on(self, arena: &'tcx Arena<'tcx>) -> &'tcx mut Self {648 arena.dropless.alloc(self)649 }650 #[inline]651 #[allow(clippy::mut_from_ref)]652 fn allocate_from_iter(653 arena: &'tcx Arena<'tcx>,654 iter: impl ::std::iter::IntoIterator<Item = Self>,655 ) -> &'tcx mut [Self] {656 arena.dropless.alloc_from_iter(iter)657 }658 }659 $(660 impl<'tcx> ArenaAllocatable<'tcx, rustc_arena::IsNotCopy> for $ty {661 #[inline]662 fn allocate_on(self, arena: &'tcx Arena<'tcx>) -> &'tcx mut Self {663 if !::std::mem::needs_drop::<Self>() {664 arena.dropless.alloc(self)665 } else {666 arena.$name.alloc(self)667 }668 }669670 #[inline]671 #[allow(clippy::mut_from_ref)]672 fn allocate_from_iter(673 arena: &'tcx Arena<'tcx>,674 iter: impl ::std::iter::IntoIterator<Item = Self>,675 ) -> &'tcx mut [Self] {676 if !::std::mem::needs_drop::<Self>() {677 arena.dropless.alloc_from_iter(iter)678 } else {679 arena.$name.alloc_from_iter(iter)680 }681 }682 }683 )*684685 impl<'tcx> Arena<'tcx> {686 #[inline]687 #[allow(clippy::mut_from_ref)]688 pub fn alloc<T: ArenaAllocatable<'tcx, C>, C>(&'tcx self, value: T) -> &mut T {689 value.allocate_on(self)690 }691692 // Any type that impls `Copy` can have slices be arena-allocated in the `DroplessArena`.693 #[inline]694 #[allow(clippy::mut_from_ref)]695 pub fn alloc_slice<T: ::std::marker::Copy>(&self, value: &[T]) -> &mut [T] {696 if value.is_empty() {697 return &mut [];698 }699 self.dropless.alloc_slice(value)700 }701702 #[inline]703 pub fn alloc_str(&self, string: &str) -> &str {704 if string.is_empty() {705 return "";706 }707 self.dropless.alloc_str(string)708 }709710 #[allow(clippy::mut_from_ref)]711 pub fn alloc_from_iter<T: ArenaAllocatable<'tcx, C>, C>(712 &'tcx self,713 iter: impl ::std::iter::IntoIterator<Item = T>,714 ) -> &mut [T] {715 T::allocate_from_iter(self, iter)716 }717 }718}719720// Marker types that let us give different behaviour for arenas allocating721// `Copy` types vs `!Copy` types.722pub struct IsCopy;723pub struct IsNotCopy;724725#[cfg(test)]726mod tests;
Code quality findings 68
Critical: Use of 'unsafe' keyword bypasses Rust's safety guarantees. Requires careful auditing, clear justification (FFI, specific optimizations), and minimal scope.
error
safety
unsafe-block
unsafe impl<#[may_dangle] T> Drop for ArenaChunk<T> {
Critical: Use of 'unsafe' keyword bypasses Rust's safety guarantees. Requires careful auditing, clear justification (FFI, specific optimizations), and minimal scope.
error
safety
unsafe-block
unsafe { drop(Box::from_raw(self.storage.as_mut())) }
Critical: Use of 'unsafe' keyword bypasses Rust's safety guarantees. Requires careful auditing, clear justification (FFI, specific optimizations), and minimal scope.
error
safety
unsafe-block
unsafe fn new(capacity: usize) -> ArenaChunk<T> {
Critical: Use of 'unsafe' keyword bypasses Rust's safety guarantees. Requires careful auditing, clear justification (FFI, specific optimizations), and minimal scope.
error
safety
unsafe-block
unsafe fn destroy(&mut self, len: usize) {
Critical: Use of 'unsafe' keyword bypasses Rust's safety guarantees. Requires careful auditing, clear justification (FFI, specific optimizations), and minimal scope.
error
safety
unsafe-block
unsafe {
Critical: Use of 'unsafe' keyword bypasses Rust's safety guarantees. Requires careful auditing, clear justification (FFI, specific optimizations), and minimal scope.
error
safety
unsafe-block
unsafe {
Critical: Use of 'unsafe' keyword bypasses Rust's safety guarantees. Requires careful auditing, clear justification (FFI, specific optimizations), and minimal scope.
error
safety
unsafe-block
unsafe {
Critical: Use of 'unsafe' keyword bypasses Rust's safety guarantees. Requires careful auditing, clear justification (FFI, specific optimizations), and minimal scope.
error
safety
unsafe-block
unsafe fn alloc_raw_slice(&self, len: usize) -> *mut T {
Critical: Use of 'unsafe' keyword bypasses Rust's safety guarantees. Requires careful auditing, clear justification (FFI, specific optimizations), and minimal scope.
error
safety
unsafe-block
unsafe { self.ptr.set(start_ptr.add(len)) };
Critical: Use of 'unsafe' keyword bypasses Rust's safety guarantees. Requires careful auditing, clear justification (FFI, specific optimizations), and minimal scope.
error
safety
unsafe-block
Ok(unsafe {
Critical: Use of 'unsafe' keyword bypasses Rust's safety guarantees. Requires careful auditing, clear justification (FFI, specific optimizations), and minimal scope.
error
safety
unsafe-block
unsafe {
Critical: Use of 'unsafe' keyword bypasses Rust's safety guarantees. Requires careful auditing, clear justification (FFI, specific optimizations), and minimal scope.
error
safety
unsafe-block
unsafe {
Critical: Use of 'unsafe' keyword bypasses Rust's safety guarantees. Requires careful auditing, clear justification (FFI, specific optimizations), and minimal scope.
error
safety
unsafe-block
unsafe impl<#[may_dangle] T> Drop for TypedArena<T> {
Critical: Use of 'unsafe' keyword bypasses Rust's safety guarantees. Requires careful auditing, clear justification (FFI, specific optimizations), and minimal scope.
error
safety
unsafe-block
unsafe {
Critical: Use of 'unsafe' keyword bypasses Rust's safety guarantees. Requires careful auditing, clear justification (FFI, specific optimizations), and minimal scope.
error
safety
unsafe-block
unsafe impl<T: Send> Send for TypedArena<T> {}
Critical: Use of 'unsafe' keyword bypasses Rust's safety guarantees. Requires careful auditing, clear justification (FFI, specific optimizations), and minimal scope.
error
safety
unsafe-block
unsafe impl Send for DroplessArena {}
Critical: Use of 'unsafe' keyword bypasses Rust's safety guarantees. Requires careful auditing, clear justification (FFI, specific optimizations), and minimal scope.
error
safety
unsafe-block
unsafe {
Critical: Use of 'unsafe' keyword bypasses Rust's safety guarantees. Requires careful auditing, clear justification (FFI, specific optimizations), and minimal scope.
error
safety
unsafe-block
unsafe { hint::assert_unchecked(end == align_down(end, DROPLESS_ALIGNMENT)) };
Critical: Use of 'unsafe' keyword bypasses Rust's safety guarantees. Requires careful auditing, clear justification (FFI, specific optimizations), and minimal scope.
error
safety
unsafe-block
unsafe {
Critical: Use of 'unsafe' keyword bypasses Rust's safety guarantees. Requires careful auditing, clear justification (FFI, specific optimizations), and minimal scope.
error
safety
unsafe-block
unsafe {
Critical: Use of 'unsafe' keyword bypasses Rust's safety guarantees. Requires careful auditing, clear justification (FFI, specific optimizations), and minimal scope.
error
safety
unsafe-block
unsafe { std::str::from_utf8_unchecked(slice) }
Critical: Use of 'unsafe' keyword bypasses Rust's safety guarantees. Requires careful auditing, clear justification (FFI, specific optimizations), and minimal scope.
error
safety
unsafe-block
unsafe fn write_from_iter<T, I: Iterator<Item = T>>(
Critical: Use of 'unsafe' keyword bypasses Rust's safety guarantees. Requires careful auditing, clear justification (FFI, specific optimizations), and minimal scope.
error
safety
unsafe-block
unsafe {
Critical: Use of 'unsafe' keyword bypasses Rust's safety guarantees. Requires careful auditing, clear justification (FFI, specific optimizations), and minimal scope.
error
safety
unsafe-block
unsafe { self.write_from_iter(iter, len, mem) }
Critical: Use of 'unsafe' keyword bypasses Rust's safety guarantees. Requires careful auditing, clear justification (FFI, specific optimizations), and minimal scope.
error
safety
unsafe-block
Ok(unsafe {
Warning: Direct indexing (e.g., `vec[i]`, `slice[i]`) panics on out-of-bounds access. Prefer using `.get(index)` or `.get_mut(index)` which return Option<&T>/Option<&mut T>.
warning
correctness
unchecked-indexing
slice[..len].assume_init_drop();
Warning: '.unwrap()' will panic on None/Err variants. Prefer using pattern matching (match, if let), combinators (map, and_then), or the '?' operator for robust error handling.
warning
correctness
unwrap-usage
let additional_bytes = additional.checked_mul(size_of::<T>()).unwrap();
Warning: Direct indexing (e.g., `vec[i]`, `slice[i]`) panics on out-of-bounds access. Prefer using `.get(index)` or `.get_mut(index)` which return Option<&T>/Option<&mut T>.
warning
correctness
unchecked-indexing
pub fn alloc_from_iter<I: IntoIterator<Item = T>>(&self, iter: I) -> &mut [T] {
Warning: Direct indexing (e.g., `vec[i]`, `slice[i]`) panics on out-of-bounds access. Prefer using `.get(index)` or `.get_mut(index)` which return Option<&T>/Option<&mut T>.
warning
correctness
unchecked-indexing
) -> Result<&mut [T], E> {
Warning: Direct indexing (e.g., `vec[i]`, `slice[i]`) panics on out-of-bounds access. Prefer using `.get(index)` or `.get_mut(index)` which return Option<&T>/Option<&mut T>.
warning
correctness
unchecked-indexing
return Ok(&mut []);
Warning: Direct indexing (e.g., `vec[i]`, `slice[i]`) panics on out-of-bounds access. Prefer using `.get(index)` or `.get_mut(index)` which return Option<&T>/Option<&mut T>.
warning
correctness
unchecked-indexing
pub fn alloc_slice<T>(&self, slice: &[T]) -> &mut [T]
Warning: Direct indexing (e.g., `vec[i]`, `slice[i]`) panics on out-of-bounds access. Prefer using `.get(index)` or `.get_mut(index)` which return Option<&T>/Option<&mut T>.
warning
correctness
unchecked-indexing
) -> &mut [T] {
Warning: Direct indexing (e.g., `vec[i]`, `slice[i]`) panics on out-of-bounds access. Prefer using `.get(index)` or `.get_mut(index)` which return Option<&T>/Option<&mut T>.
warning
correctness
unchecked-indexing
pub fn alloc_from_iter<T, I: IntoIterator<Item = T>>(&self, iter: I) -> &mut [T] {
Warning: Direct indexing (e.g., `vec[i]`, `slice[i]`) panics on out-of-bounds access. Prefer using `.get(index)` or `.get_mut(index)` which return Option<&T>/Option<&mut T>.
warning
correctness
unchecked-indexing
return &mut [];
Warning: '.unwrap()' will panic on None/Err variants. Prefer using pattern matching (match, if let), combinators (map, and_then), or the '?' operator for robust error handling.
warning
correctness
unwrap-usage
let mem = self.alloc_raw(Layout::array::<T>(len).unwrap()) as *mut T;
Warning: Direct indexing (e.g., `vec[i]`, `slice[i]`) panics on out-of-bounds access. Prefer using `.get(index)` or `.get_mut(index)` which return Option<&T>/Option<&mut T>.
warning
correctness
unchecked-indexing
) -> Result<&mut [T], E> {
Warning: Direct indexing (e.g., `vec[i]`, `slice[i]`) panics on out-of-bounds access. Prefer using `.get(index)` or `.get_mut(index)` which return Option<&T>/Option<&mut T>.
warning
correctness
unchecked-indexing
return Ok(&mut []);
Warning: Direct indexing (e.g., `vec[i]`, `slice[i]`) panics on out-of-bounds access. Prefer using `.get(index)` or `.get_mut(index)` which return Option<&T>/Option<&mut T>.
warning
correctness
unchecked-indexing
/// The declared arena actually contains a single [`DroplessArena`], plus a separate
Warning: Direct indexing (e.g., `vec[i]`, `slice[i]`) panics on out-of-bounds access. Prefer using `.get(index)` or `.get_mut(index)` which return Option<&T>/Option<&mut T>.
warning
correctness
unchecked-indexing
/// explicitly. Those values will be stored in the [`DroplessArena`].
Warning: Direct indexing (e.g., `vec[i]`, `slice[i]`) panics on out-of-bounds access. Prefer using `.get(index)` or `.get_mut(index)` which return Option<&T>/Option<&mut T>.
warning
correctness
unchecked-indexing
/// [`DroplessArena`], and the corresponding [`TypedArena`] will remain empty. This makes
Warning: Direct indexing (e.g., `vec[i]`, `slice[i]`) panics on out-of-bounds access. Prefer using `.get(index)` or `.get_mut(index)` which return Option<&T>/Option<&mut T>.
warning
correctness
unchecked-indexing
) -> &'tcx mut [Self];
Warning: Direct indexing (e.g., `vec[i]`, `slice[i]`) panics on out-of-bounds access. Prefer using `.get(index)` or `.get_mut(index)` which return Option<&T>/Option<&mut T>.
warning
correctness
unchecked-indexing
) -> &'tcx mut [Self] {
Warning: Direct indexing (e.g., `vec[i]`, `slice[i]`) panics on out-of-bounds access. Prefer using `.get(index)` or `.get_mut(index)` which return Option<&T>/Option<&mut T>.
warning
correctness
unchecked-indexing
) -> &'tcx mut [Self] {
Warning: Direct indexing (e.g., `vec[i]`, `slice[i]`) panics on out-of-bounds access. Prefer using `.get(index)` or `.get_mut(index)` which return Option<&T>/Option<&mut T>.
warning
correctness
unchecked-indexing
pub fn alloc_slice<T: ::std::marker::Copy>(&self, value: &[T]) -> &mut [T] {
Warning: Direct indexing (e.g., `vec[i]`, `slice[i]`) panics on out-of-bounds access. Prefer using `.get(index)` or `.get_mut(index)` which return Option<&T>/Option<&mut T>.
warning
correctness
unchecked-indexing
return &mut [];
Warning: Direct indexing (e.g., `vec[i]`, `slice[i]`) panics on out-of-bounds access. Prefer using `.get(index)` or `.get_mut(index)` which return Option<&T>/Option<&mut T>.
warning
correctness
unchecked-indexing
) -> &mut [T] {
Info: Use of raw pointers (*const T, *mut T) typically requires 'unsafe' blocks for dereferencing. Ensure usage is justified (FFI, low-level optimizations) and memory safety is manually upheld.
info
safety
raw-pointer
fn start(&mut self) -> *mut T {
Info: Use of raw pointers (*const T, *mut T) typically requires 'unsafe' blocks for dereferencing. Ensure usage is justified (FFI, low-level optimizations) and memory safety is manually upheld.
info
safety
raw-pointer
self.storage.as_ptr() as *mut T
Info: Use of raw pointers (*const T, *mut T) typically requires 'unsafe' blocks for dereferencing. Ensure usage is justified (FFI, low-level optimizations) and memory safety is manually upheld.
info
safety
raw-pointer
fn end(&mut self) -> *mut T {
Info: Use of raw pointers (*const T, *mut T) typically requires 'unsafe' blocks for dereferencing. Ensure usage is justified (FFI, low-level optimizations) and memory safety is manually upheld.
info
safety
raw-pointer
ptr: Cell<*mut T>,
Info: Use of raw pointers (*const T, *mut T) typically requires 'unsafe' blocks for dereferencing. Ensure usage is justified (FFI, low-level optimizations) and memory safety is manually upheld.
info
safety
raw-pointer
end: Cell<*mut T>,
Info: Use of raw pointers (*const T, *mut T) typically requires 'unsafe' blocks for dereferencing. Ensure usage is justified (FFI, low-level optimizations) and memory safety is manually upheld.
info
safety
raw-pointer
unsafe fn alloc_raw_slice(&self, len: usize) -> *mut T {
Info: Use of raw pointers (*const T, *mut T) typically requires 'unsafe' blocks for dereferencing. Ensure usage is justified (FFI, low-level optimizations) and memory safety is manually upheld.
info
safety
raw-pointer
start: Cell<*mut u8>,
Info: Use of raw pointers (*const T, *mut T) typically requires 'unsafe' blocks for dereferencing. Ensure usage is justified (FFI, low-level optimizations) and memory safety is manually upheld.
info
safety
raw-pointer
end: Cell<*mut u8>,
Info: Use of raw pointers (*const T, *mut T) typically requires 'unsafe' blocks for dereferencing. Ensure usage is justified (FFI, low-level optimizations) and memory safety is manually upheld.
info
safety
raw-pointer
pub fn alloc_raw(&self, layout: Layout) -> *mut u8 {
Info: Use of raw pointers (*const T, *mut T) typically requires 'unsafe' blocks for dereferencing. Ensure usage is justified (FFI, low-level optimizations) and memory safety is manually upheld.
info
safety
raw-pointer
let mem = self.alloc_raw(Layout::new::<T>()) as *mut T;
Info: Use of raw pointers (*const T, *mut T) typically requires 'unsafe' blocks for dereferencing. Ensure usage is justified (FFI, low-level optimizations) and memory safety is manually upheld.
info
safety
raw-pointer
let mem = self.alloc_raw(Layout::for_value::<[T]>(slice)) as *mut T;
Info: Use of raw pointers (*const T, *mut T) typically requires 'unsafe' blocks for dereferencing. Ensure usage is justified (FFI, low-level optimizations) and memory safety is manually upheld.
info
safety
raw-pointer
mem: *mut T,
Info: Use of raw pointers (*const T, *mut T) typically requires 'unsafe' blocks for dereferencing. Ensure usage is justified (FFI, low-level optimizations) and memory safety is manually upheld.
info
safety
raw-pointer
let mem = self.alloc_raw(Layout::array::<T>(len).unwrap()) as *mut T;
Info: Use of raw pointers (*const T, *mut T) typically requires 'unsafe' blocks for dereferencing. Ensure usage is justified (FFI, low-level optimizations) and memory safety is manually upheld.
info
safety
raw-pointer
let start_ptr = self.alloc_raw(Layout::for_value::<[T]>(vec.as_slice())) as *mut T;
Info: Usage of `#[allow(...)]` suppresses compiler lints. Ensure the allowance is justified, well-scoped, and ideally temporary. Overuse can hide potential issues.
info
maintainability
allow-lint
#[allow(clippy::mut_from_ref)]
Info: Usage of `#[allow(...)]` suppresses compiler lints. Ensure the allowance is justified, well-scoped, and ideally temporary. Overuse can hide potential issues.
info
maintainability
allow-lint
#[allow(clippy::mut_from_ref)]
Info: Usage of `#[allow(...)]` suppresses compiler lints. Ensure the allowance is justified, well-scoped, and ideally temporary. Overuse can hide potential issues.
info
maintainability
allow-lint
#[allow(clippy::mut_from_ref)]
Info: Usage of `#[allow(...)]` suppresses compiler lints. Ensure the allowance is justified, well-scoped, and ideally temporary. Overuse can hide potential issues.
info
maintainability
allow-lint
#[allow(clippy::mut_from_ref)]
Info: Usage of `#[allow(...)]` suppresses compiler lints. Ensure the allowance is justified, well-scoped, and ideally temporary. Overuse can hide potential issues.
info
maintainability
allow-lint
#[allow(clippy::mut_from_ref)]
Info: Usage of `#[allow(...)]` suppresses compiler lints. Ensure the allowance is justified, well-scoped, and ideally temporary. Overuse can hide potential issues.
info
maintainability
allow-lint
#[allow(clippy::mut_from_ref)]
Info: Usage of `#[allow(...)]` suppresses compiler lints. Ensure the allowance is justified, well-scoped, and ideally temporary. Overuse can hide potential issues.
info
maintainability
allow-lint
#[allow(clippy::mut_from_ref)]
Info: Usage of `#[allow(...)]` suppresses compiler lints. Ensure the allowance is justified, well-scoped, and ideally temporary. Overuse can hide potential issues.
info
maintainability
allow-lint
#[allow(clippy::mut_from_ref)]