lint: transmuting known null pointer to ref

[llogiq]

mem::transmute(std::ptr::null()) – this is undefined behavior.

[felix91gr]

I think I can try this one while Oli's busy (I'm atm also working on #3803 under his mentorship). Would you be willing to mentor me here? :)

[flip1995]

This is practically just two matches on methods. First you have to find calls to transmute and then you have to match the first argument of the call, whether it's a call to null. That should get you started. There also may be other methods to create a null pointer like casting 0 as *const _.

If you got any questions, just ask or open a WIP PR. I'm happy to help you from there.

[felix91gr]

Okay I'm now making a first UI test for this. It should show all the cases that we're looking for in this lint.

Which cases are missing?

fn transmute_0() {
    let zero : *const i32 = 0 as *const_;
    let zero_ts : &i32 = std::mem::transmute(zero);
}

fn transmute_null() {
    let nil : *const i32 = std::ptr::null();
    let nil_ts : &i32 = std::mem::transmute(nil);
}

fn main() {
    transmute_0();
    transmute_null();
}

[flip1995]

Maybe you can also add:

pub const ZPTR: *const usize = 0 as *const _;
...
... std::mem::transmute(ZPTR); ...

... std::mem::transmute(0 as *const _); ...

Maybe also some different types, but that shouldn't be an issue on getting this lint working.

[felix91gr]

Thank you!

This should use a LateLintPass, right? Since this is more than just a syntactic analysis.

[felix91gr]

Working on this at #3848

[tesuji]

Could we close this now?

[felix91gr]

Maybe? I'm not sure, @lzutao. The thing is, my PR implemented this but only the trivial bits. There are many cases where one would see that a null pointer was transmuted, but we can't lint those yet because miri isn't yet as complete as we needed.

The idea was that at some point we could do simple constant propagation over a stretch of code using miri, and then check if transmute was being called with any propagated null pointers. This is very hard and not necessary to do by hand, but doing it with miri would be trivial. That's why we chose to wait on it before completing this feature :3