lint: transmuting known null pointer to ref

[llogiq]

mem::transmute(std::ptr::null()) – this is undefined behavior.

[felix91gr]

I think I can try this one while Oli's busy (I'm atm also working on #3803 under his mentorship). Would you be willing to mentor me here? :)

[flip1995]

This is practically just two matches on methods. First you have to find calls to transmute and then you have to match the first argument of the call, whether it's a call to null. That should get you started. There also may be other methods to create a null pointer like casting 0 as *const _.

If you got any questions, just ask or open a WIP PR. I'm happy to help you from there.

[felix91gr]

Okay I'm now making a first UI test for this. It should show all the cases that we're looking for in this lint.

Which cases are missing?

fn transmute_0() {
    let zero : *const i32 = 0 as *const_;
    let zero_ts : &i32 = std::mem::transmute(zero);
}

fn transmute_null() {
    let nil : *const i32 = std::ptr::null();
    let nil_ts : &i32 = std::mem::transmute(nil);
}

fn main() {
    transmute_0();
    transmute_null();
}

[flip1995]

Maybe you can also add:

pub const ZPTR: *const usize = 0 as *const _;
...
... std::mem::transmute(ZPTR); ...

... std::mem::transmute(0 as *const _); ...

Maybe also some different types, but that shouldn't be an issue on getting this lint working.

[felix91gr]

Thank you!

This should use a LateLintPass, right? Since this is more than just a syntactic analysis.

[felix91gr]

Working on this at #3848

[tesuji]

Could we close this now?

[felix91gr]

Maybe? I'm not sure, @lzutao. The thing is, my PR implemented this but only the trivial bits. There are many cases where one would see that a null pointer was transmuted, but we can't lint those yet because miri isn't yet as complete as we needed.

The idea was that at some point we could do simple constant propagation over a stretch of code using miri, and then check if transmute was being called with any propagated null pointers. This is very hard and not necessary to do by hand, but doing it with miri would be trivial. That's why we chose to wait on it before completing this feature :3

[felix91gr]

Is there anyone working on this at the moment? If I understand correctly, the constant propagation machinery should now be able to propagate the null pointers. Am I right, @oli-obk?

If so, and if no one is working on this, then I'd like to get back on this so we can close this issue :D