Add contracts for all functions in Alignment

[tautschnig]

Uses the contracts syntax introduced in #128045.

[rustbot]

Thanks for the pull request, and welcome! The Rust team is excited to review your changes, and you should hear from @tgross35 (or someone else) some time within the next two weeks.

Please see the contribution instructions for more information. Namely, in order to ensure the minimum review times lag, PR authors and assigned reviewers should ensure that the review label (S-waiting-on-review and S-waiting-on-author) stays updated, invoking these commands when appropriate:

• @rustbot author: the review is finished, PR author should check the comments and take action accordingly
• @rustbot review: the author is ready for a review, this PR will be queued again in the reviewer's queue

[jieyouxu]

You could also tag contracts-related PRs with F-contracts in the future via

@rustbot label: +F-contracts

in a comment / PR description.

[tgross35]

Could you say some more about the motivation? This feature was merged only a number of hours ago, that seems soon to start using in std. Even once it is more stable, what should and shouldn't get contracts is probably something that needs to get discussed.

@rust-lang/libs any thoughts here?

[jieyouxu]

Yeah, this was only approved as a lang experiment on the lang/compiler side, no idea what the situation is libs side (which certainly should be discussed).

cc @pnkfelix @nikomatsakis @celinval (lang liason and ppl who were implementing this feature compiler side)

[Noratrieb]

I'll libs nominate this for discussion (this should only be discussed after the contracts people mentioned above have replied).

[celinval]

Totally worth discussion, and it would be great to get some feedback on the features that are needed to meet the libs team bar. I am especially curious to see how you think contracts and ub_checks will interact.

[Noratrieb]

It would be useful to know what your plan/intention is with adding contracts here. Is it just to try them out or is annotating the standard library with contracts for downstream consumers part of the goal of contracts?

[tautschnig]

Could you say some more about the motivation? This feature was merged only a number of hours ago, that seems soon to start using in std. Even once it is more stable, what should and shouldn't get contracts is probably something that needs to get discussed.

As far as the motivation is concerned: we're working towards https://rust-lang.github.io/rust-project-goals/2025h1/std-contracts.html, and I created this (draft) PR with the hope to initiate discussion while knowing there is a lot more work to be done on our end.

As I am new contributor: is there other information that I can provide or another forum that I should use rather than this PR?

[tautschnig]

It would be useful to know what your plan/intention is with adding contracts here. Is it just to try them out or is annotating the standard library with contracts for downstream consumers part of the goal of contracts?

Our current goal is https://rust-lang.github.io/rust-project-goals/2025h1/std-contracts.html, though we are in early stages and it indeed is about trying out what works best. Eventually we want to enable verification of downstream consumers, but a lot more work will be required before we get there.

[tgross35]

As far as the motivation is concerned: we're working towards https://rust-lang.github.io/rust-project-goals/2025h1/std-contracts.html, and I created this (draft) PR with the hope to initiate discussion while knowing there is a lot more work to be done on our end.

As I am new contributor: is there other information that I can provide or another forum that I should use rather than this PR?

Are there any docs on how contracts work as they exist today? Ignoring the stability question, we need something to refer to about how to use these properly, e.g. in https://doc.rust-lang.org/nightly/unstable-book/. Also, how are contracts that get merged into r-l/rust being verified?

The linked page is somewhat vague about what this means for std. I think we could also use a policy page in the library dev guide (https://std-dev-guide.rust-lang.org) giving guidelines for their use, based on the outcome of any discussion that happens.

Bringing this up on the libs zulip would be a good idea to get the ball rolling https://rust-lang.zulipchat.com/#narrow/channel/219381-t-libs.

[Amanieu]

We discussed this in the libs meeting today. We're happy to add contracts to the standard library as an experiment, as long as this doesn't get in the way of normal standard library development. Depending on how the contracts feature evolves, we may reconsider our level of support.

[scottmcm]

Why not requires(align.is_power_of_two())? What is it about this attribute that needs to write out the implementation instead of using the method like how the ensures on the line below does?

[tautschnig]

At the time of originally writing this I was wondering about performance (mainly in the context of verification tools). It seemed unnecessary to do a full popcount when a subtraction and bitwise and would also do the trick. But maybe we should first focus on readability.

[oxalica]

At the time of originally writing this I was wondering about performance (mainly in the context of verification tools). It seemed unnecessary to do a full popcount when a subtraction and bitwise and would also do the trick.

Seems is_power_of_two actually give more optimal (branchless) codegen than the manual version: https://godbolt.org/z/c5McsafYj
Even in rustc 1.32, the earliest version with usize::is_power_of_two, it does not do popcount, once you have opt-level >=1.

But maybe we should first focus on readability.

And also for consistency with other contracts.

[rust-log-analyzer]

The job x86_64-gnu-llvm-18 failed! Check out the build log: (web) (plain)

Click to see the possible cause of the failure (guessed by this bot)

#22 exporting to docker image format
#22 sending tarball 28.9s done
#22 DONE 35.1s
##[endgroup]
Setting extra environment values for docker:  --env ENABLE_GCC_CODEGEN=1 --env GCC_EXEC_PREFIX=/usr/lib/gcc/
[CI_JOB_NAME=x86_64-gnu-llvm-18]
debug: `DISABLE_CI_RUSTC_IF_INCOMPATIBLE` configured.
---
sccache: Starting the server...
##[group]Configure the build
configure: processing command line
configure: 
configure: build.configure-args := ['--build=x86_64-unknown-linux-gnu', '--llvm-root=/usr/lib/llvm-18', '--enable-llvm-link-shared', '--set', 'rust.randomize-layout=true', '--set', 'rust.thin-lto-import-instr-limit=10', '--enable-verbose-configure', '--enable-sccache', '--disable-manage-submodules', '--enable-locked-deps', '--enable-cargo-native-static', '--set', 'rust.codegen-units-std=1', '--set', 'dist.compression-profile=balanced', '--dist-compression-formats=xz', '--set', 'rust.lld=false', '--disable-dist-src', '--release-channel=nightly', '--enable-debug-assertions', '--enable-overflow-checks', '--enable-llvm-assertions', '--set', 'rust.verify-llvm-ir', '--set', 'rust.codegen-backends=llvm,cranelift,gcc', '--set', 'llvm.static-libstdcpp', '--enable-new-symbol-mangling']
configure: target.x86_64-unknown-linux-gnu.llvm-config := /usr/lib/llvm-18/bin/llvm-config
configure: llvm.link-shared     := True
configure: rust.randomize-layout := True
configure: rust.thin-lto-import-instr-limit := 10
---
   Compiling object v0.36.7
   Compiling std v0.0.0 (/checkout/library/std)
   Compiling cc v1.2.0
   Compiling compiler_builtins v0.1.146
error[E0015]: cannot call non-const function `build_check_ensures::<usize, {closure@library/core/src/mem/mod.rs:489:53: 489:69}>` in constant functions
    |
    |
489 | #[cfg_attr(not(bootstrap), core::contracts::ensures(|result: &usize| result.is_power_of_two()))]
    |
    = note: calls in constant functions are limited to constant functions, tuple structs and tuple variants

error[E0015]: cannot call non-const closure in constant functions
error[E0015]: cannot call non-const closure in constant functions
   --> library/core/src/mem/mod.rs:489:28
    |
489 | #[cfg_attr(not(bootstrap), core::contracts::ensures(|result: &usize| result.is_power_of_two()))]
    |
    = note: calls in constant functions are limited to constant functions, tuple structs and tuple variants


error[E0015]: cannot call non-const function `build_check_ensures::<alignment::Alignment, {closure@library/core/src/ptr/alignment.rs:47:13: 47:33}>` in constant functions
   |
   |
46 |       #[cfg_attr(not(bootstrap), core::contracts::ensures(
   |  ________________________________^
47 | |             |result: &Alignment| result.as_usize().is_power_of_two()))]
   |
   = note: calls in constant functions are limited to constant functions, tuple structs and tuple variants

error[E0015]: cannot call non-const closure in constant functions
error[E0015]: cannot call non-const closure in constant functions
  --> library/core/src/ptr/alignment.rs:46:32
   |
46 |       #[cfg_attr(not(bootstrap), core::contracts::ensures(
   |  ________________________________^
47 | |             |result: &Alignment| result.as_usize().is_power_of_two()))]
   |
   = note: calls in constant functions are limited to constant functions, tuple structs and tuple variants


error[E0015]: cannot call non-const function `build_check_ensures::<Option<alignment::Alignment>, {closure@library/core/src/ptr/alignment.rs:60:13: 60:41}>` in constant functions
   |
   |
59 |       #[cfg_attr(not(bootstrap), core::contracts::ensures(
   |  ________________________________^
60 | |             |result: &Option<Alignment>| align.is_power_of_two() == result.is_some() &&
61 | |             (result.is_none() || result.unwrap().as_usize() == align)))]
   |
   = note: calls in constant functions are limited to constant functions, tuple structs and tuple variants

error[E0015]: cannot call non-const closure in constant functions
error[E0015]: cannot call non-const closure in constant functions
  --> library/core/src/ptr/alignment.rs:59:32
   |
59 |       #[cfg_attr(not(bootstrap), core::contracts::ensures(
   |  ________________________________^
60 | |             |result: &Option<Alignment>| align.is_power_of_two() == result.is_some() &&
61 | |             (result.is_none() || result.unwrap().as_usize() == align)))]
   |
   = note: calls in constant functions are limited to constant functions, tuple structs and tuple variants

error: cannot call non-const intrinsic `contract_check_requires` in constant functions
error: cannot call non-const intrinsic `contract_check_requires` in constant functions
  --> library/core/src/ptr/alignment.rs:81:32
   |
81 |     #[cfg_attr(not(bootstrap), core::contracts::requires(align > 0 && (align & (align - 1)) == 0))]


error[E0015]: cannot call non-const function `build_check_ensures::<alignment::Alignment, {closure@library/core/src/ptr/alignment.rs:83:13: 83:33}>` in constant functions
   |
   |
82 | /     #[cfg_attr(not(bootstrap), core::contracts::ensures(
83 | |             |result: &Alignment| result.as_usize() == align &&
84 | |             result.as_usize().is_power_of_two()))]
   |
   = note: calls in constant functions are limited to constant functions, tuple structs and tuple variants

error[E0015]: cannot call non-const closure in constant functions
error[E0015]: cannot call non-const closure in constant functions
  --> library/core/src/ptr/alignment.rs:82:5
   |
82 | /     #[cfg_attr(not(bootstrap), core::contracts::ensures(
83 | |             |result: &Alignment| result.as_usize() == align &&
84 | |             result.as_usize().is_power_of_two()))]
   |
   = note: calls in constant functions are limited to constant functions, tuple structs and tuple variants


error[E0015]: cannot call non-const function `build_check_ensures::<usize, {closure@library/core/src/ptr/alignment.rs:101:13: 101:29}>` in constant functions
    |
    |
100 |       #[cfg_attr(not(bootstrap), core::contracts::ensures(
    |  ________________________________^
101 | |             |result: &usize| result.is_power_of_two()))]
    |
    = note: calls in constant functions are limited to constant functions, tuple structs and tuple variants

error[E0015]: cannot call non-const closure in constant functions
error[E0015]: cannot call non-const closure in constant functions
   --> library/core/src/ptr/alignment.rs:100:32
    |
100 |       #[cfg_attr(not(bootstrap), core::contracts::ensures(
    |  ________________________________^
101 | |             |result: &usize| result.is_power_of_two()))]
    |
    = note: calls in constant functions are limited to constant functions, tuple structs and tuple variants


error[E0015]: cannot call non-const function `build_check_ensures::<NonZero<usize>, {closure@library/core/src/ptr/alignment.rs:110:13: 110:38}>` in constant functions
    |
    |
109 |       #[cfg_attr(not(bootstrap), core::contracts::ensures(
    |  ________________________________^
110 | |             |result: &NonZero<usize>| result.get().is_power_of_two() &&
111 | |             result.get() == self.as_usize()))]
    |
    = note: calls in constant functions are limited to constant functions, tuple structs and tuple variants

error[E0015]: cannot call non-const closure in constant functions
error[E0015]: cannot call non-const closure in constant functions
   --> library/core/src/ptr/alignment.rs:109:32
    |
109 |       #[cfg_attr(not(bootstrap), core::contracts::ensures(
    |  ________________________________^
110 | |             |result: &NonZero<usize>| result.get().is_power_of_two() &&
111 | |             result.get() == self.as_usize()))]
    |
    = note: calls in constant functions are limited to constant functions, tuple structs and tuple variants

error: cannot call non-const intrinsic `contract_check_requires` in constant functions
error: cannot call non-const intrinsic `contract_check_requires` in constant functions
   --> library/core/src/ptr/alignment.rs:137:32
    |
137 |     #[cfg_attr(not(bootstrap), core::contracts::requires(self.as_usize().is_power_of_two()))]


error[E0015]: cannot call non-const function `build_check_ensures::<u32, {closure@library/core/src/ptr/alignment.rs:139:13: 139:27}>` in constant functions
    |
    |
138 | /     #[cfg_attr(not(bootstrap), core::contracts::ensures(
139 | |             |result: &u32| *result < usize::BITS &&
140 | |             (1usize << *result) == self.as_usize()))]
    |
    = note: calls in constant functions are limited to constant functions, tuple structs and tuple variants

error[E0015]: cannot call non-const closure in constant functions
error[E0015]: cannot call non-const closure in constant functions
   --> library/core/src/ptr/alignment.rs:138:5
    |
138 | /     #[cfg_attr(not(bootstrap), core::contracts::ensures(
139 | |             |result: &u32| *result < usize::BITS &&
140 | |             (1usize << *result) == self.as_usize()))]
    |
    = note: calls in constant functions are limited to constant functions, tuple structs and tuple variants


error[E0015]: cannot call non-const function `build_check_ensures::<usize, {closure@library/core/src/ptr/alignment.rs:171:13: 171:29}>` in constant functions
    |
    |
170 |       #[cfg_attr(not(bootstrap), core::contracts::ensures(
    |  ________________________________^
171 | |             |result: &usize| *result > 0 &&
172 | |             *result == !(self.as_usize() -1) &&
173 | |             self.as_usize() & *result == self.as_usize()))]
    |
    = note: calls in constant functions are limited to constant functions, tuple structs and tuple variants

error[E0015]: cannot call non-const closure in constant functions
error[E0015]: cannot call non-const closure in constant functions
   --> library/core/src/ptr/alignment.rs:170:32
    |
170 |       #[cfg_attr(not(bootstrap), core::contracts::ensures(
    |  ________________________________^
171 | |             |result: &usize| *result > 0 &&
172 | |             *result == !(self.as_usize() -1) &&
173 | |             self.as_usize() & *result == self.as_usize()))]
    |
    = note: calls in constant functions are limited to constant functions, tuple structs and tuple variants

For more information about this error, try `rustc --explain E0015`.