1 // Copyright 2014-2015 The Rust Project Developers. See the COPYRIGHT
2 // file at the top-level directory of this distribution and at
3 // http://rust-lang.org/COPYRIGHT.
5 // Licensed under the Apache License, Version 2.0 <LICENSE-APACHE or
6 // http://www.apache.org/licenses/LICENSE-2.0> or the MIT license
7 // <LICENSE-MIT or http://opensource.org/licenses/MIT>, at your
8 // option. This file may not be copied, modified, or distributed
9 // except according to those terms.
11 use check
::regionck
::{self, Rcx}
;
15 use middle
::subst
::{self, Subst}
;
16 use middle
::ty
::{self, Ty}
;
17 use util
::ppaux
::{Repr, UserString}
;
20 use syntax
::codemap
::{self, Span}
;
22 /// check_drop_impl confirms that the Drop implementation identfied by
23 /// `drop_impl_did` is not any more specialized than the type it is
24 /// attached to (Issue #8142).
28 /// 1. The self type must be nominal (this is already checked during
31 /// 2. The generic region/type parameters of the impl's self-type must
32 /// all be parameters of the Drop impl itself (i.e. no
33 /// specialization like `impl Drop for Foo<i32>`), and,
35 /// 3. Any bounds on the generic parameters must be reflected in the
36 /// struct/enum definition for the nominal type itself (i.e.
37 /// cannot do `struct S<T>; impl<T:Clone> Drop for S<T> { ... }`).
39 pub fn check_drop_impl(tcx
: &ty
::ctxt
, drop_impl_did
: ast
::DefId
) -> Result
<(), ()> {
40 let ty
::TypeScheme
{ generics
: ref dtor_generics
,
41 ty
: ref dtor_self_type
} = ty
::lookup_item_type(tcx
, drop_impl_did
);
42 let dtor_predicates
= ty
::lookup_predicates(tcx
, drop_impl_did
);
43 match dtor_self_type
.sty
{
44 ty
::ty_enum(self_type_did
, self_to_impl_substs
) |
45 ty
::ty_struct(self_type_did
, self_to_impl_substs
) |
46 ty
::ty_closure(self_type_did
, self_to_impl_substs
) => {
47 try
!(ensure_drop_params_and_item_params_correspond(tcx
,
53 ensure_drop_predicates_are_implied_by_item_defn(tcx
,
60 // Destructors only work on nominal types. This was
61 // already checked by coherence, so we can panic here.
62 let span
= tcx
.map
.def_id_span(drop_impl_did
, codemap
::DUMMY_SP
);
64 span
, &format
!("should have been rejected by coherence check: {}",
65 dtor_self_type
.repr(tcx
)));
70 fn ensure_drop_params_and_item_params_correspond
<'tcx
>(
72 drop_impl_did
: ast
::DefId
,
73 drop_impl_generics
: &ty
::Generics
<'tcx
>,
74 drop_impl_ty
: &ty
::Ty
<'tcx
>,
75 self_type_did
: ast
::DefId
) -> Result
<(), ()>
77 // New strategy based on review suggestion from nikomatsakis.
79 // (In the text and code below, "named" denotes "struct/enum", and
80 // "generic params" denotes "type and region params")
82 // 1. Create fresh skolemized type/region "constants" for each of
83 // the named type's generic params. Instantiate the named type
84 // with the fresh constants, yielding `named_skolem`.
86 // 2. Create unification variables for each of the Drop impl's
87 // generic params. Instantiate the impl's Self's type with the
88 // unification-vars, yielding `drop_unifier`.
90 // 3. Attempt to unify Self_unif with Type_skolem. If unification
91 // succeeds, continue (i.e. with the predicate checks).
93 let ty
::TypeScheme
{ generics
: ref named_type_generics
,
95 ty
::lookup_item_type(tcx
, self_type_did
);
97 let infcx
= infer
::new_infer_ctxt(tcx
);
98 infcx
.commit_if_ok(|snapshot
| {
99 let (named_type_to_skolem
, skol_map
) =
100 infcx
.construct_skolemized_subst(named_type_generics
, snapshot
);
101 let named_type_skolem
= named_type
.subst(tcx
, &named_type_to_skolem
);
103 let drop_impl_span
= tcx
.map
.def_id_span(drop_impl_did
, codemap
::DUMMY_SP
);
104 let drop_to_unifier
=
105 infcx
.fresh_substs_for_generics(drop_impl_span
, drop_impl_generics
);
106 let drop_unifier
= drop_impl_ty
.subst(tcx
, &drop_to_unifier
);
108 if let Ok(()) = infer
::mk_eqty(&infcx
, true, infer
::TypeOrigin
::Misc(drop_impl_span
),
109 named_type_skolem
, drop_unifier
) {
110 // Even if we did manage to equate the types, the process
111 // may have just gathered unsolvable region constraints
112 // like `R == 'static` (represented as a pair of subregion
113 // constraints) for some skolemization constant R.
115 // However, the leak_check method allows us to confirm
116 // that no skolemized regions escaped (i.e. were related
117 // to other regions in the constraint graph).
118 if let Ok(()) = infcx
.leak_check(&skol_map
, snapshot
) {
123 span_err
!(tcx
.sess
, drop_impl_span
, E0366
,
124 "Implementations of Drop cannot be specialized");
125 let item_span
= tcx
.map
.span(self_type_did
.node
);
126 tcx
.sess
.span_note(item_span
,
127 "Use same sequence of generic type and region \
128 parameters that is on the struct/enum definition");
133 /// Confirms that every predicate imposed by dtor_predicates is
134 /// implied by assuming the predicates attached to self_type_did.
135 fn ensure_drop_predicates_are_implied_by_item_defn
<'tcx
>(
136 tcx
: &ty
::ctxt
<'tcx
>,
137 drop_impl_did
: ast
::DefId
,
138 dtor_predicates
: &ty
::GenericPredicates
<'tcx
>,
139 self_type_did
: ast
::DefId
,
140 self_to_impl_substs
: &subst
::Substs
<'tcx
>) -> Result
<(), ()> {
142 // Here is an example, analogous to that from
143 // `compare_impl_method`.
145 // Consider a struct type:
147 // struct Type<'c, 'b:'c, 'a> {
148 // x: &'a Contents // (contents are irrelevant;
149 // y: &'c Cell<&'b Contents>, // only the bounds matter for our purposes.)
154 // impl<'z, 'y:'z, 'x:'y> Drop for P<'z, 'y, 'x> {
155 // fn drop(&mut self) { self.y.set(self.x); } // (only legal if 'x: 'y)
158 // We start out with self_to_impl_substs, that maps the generic
159 // parameters of Type to that of the Drop impl.
161 // self_to_impl_substs = {'c => 'z, 'b => 'y, 'a => 'x}
163 // Applying this to the predicates (i.e. assumptions) provided by the item
164 // definition yields the instantiated assumptions:
168 // We then check all of the predicates of the Drop impl:
172 // and ensure each is in the list of instantiated
173 // assumptions. Here, `'y:'z` is present, but `'x:'y` is
174 // absent. So we report an error that the Drop impl injected a
175 // predicate that is not present on the struct definition.
177 assert_eq
!(self_type_did
.krate
, ast
::LOCAL_CRATE
);
179 let drop_impl_span
= tcx
.map
.def_id_span(drop_impl_did
, codemap
::DUMMY_SP
);
181 // We can assume the predicates attached to struct/enum definition
183 let generic_assumptions
= ty
::lookup_predicates(tcx
, self_type_did
);
185 let assumptions_in_impl_context
= generic_assumptions
.instantiate(tcx
, &self_to_impl_substs
);
186 assert
!(assumptions_in_impl_context
.predicates
.is_empty_in(subst
::SelfSpace
));
187 assert
!(assumptions_in_impl_context
.predicates
.is_empty_in(subst
::FnSpace
));
188 let assumptions_in_impl_context
=
189 assumptions_in_impl_context
.predicates
.get_slice(subst
::TypeSpace
);
191 // An earlier version of this code attempted to do this checking
192 // via the traits::fulfill machinery. However, it ran into trouble
193 // since the fulfill machinery merely turns outlives-predicates
194 // 'a:'b and T:'b into region inference constraints. It is simpler
195 // just to look for all the predicates directly.
197 assert
!(dtor_predicates
.predicates
.is_empty_in(subst
::SelfSpace
));
198 assert
!(dtor_predicates
.predicates
.is_empty_in(subst
::FnSpace
));
199 let predicates
= dtor_predicates
.predicates
.get_slice(subst
::TypeSpace
);
200 for predicate
in predicates
{
201 // (We do not need to worry about deep analysis of type
202 // expressions etc because the Drop impls are already forced
203 // to take on a structure that is roughly a alpha-renaming of
204 // the generic parameters of the item definition.)
206 // This path now just checks *all* predicates via the direct
207 // lookup, rather than using fulfill machinery.
209 // However, it may be more efficient in the future to batch
210 // the analysis together via the fulfill , rather than the
211 // repeated `contains` calls.
213 if !assumptions_in_impl_context
.contains(&predicate
) {
214 let item_span
= tcx
.map
.span(self_type_did
.node
);
215 let req
= predicate
.user_string(tcx
);
216 span_err
!(tcx
.sess
, drop_impl_span
, E0367
,
217 "The requirement `{}` is added only by the Drop impl.", req
);
218 tcx
.sess
.span_note(item_span
,
219 "The same requirement must be part of \
220 the struct/enum definition");
224 if tcx
.sess
.has_errors() {
230 /// check_safety_of_destructor_if_necessary confirms that the type
231 /// expression `typ` conforms to the "Drop Check Rule" from the Sound
232 /// Generic Drop (RFC 769).
236 /// The Drop Check Rule is the following:
238 /// Let `v` be some value (either temporary or named) and 'a be some
239 /// lifetime (scope). If the type of `v` owns data of type `D`, where
241 /// (1.) `D` has a lifetime- or type-parametric Drop implementation, and
242 /// (2.) the structure of `D` can reach a reference of type `&'a _`, and
245 /// (A.) the Drop impl for `D` instantiates `D` at 'a directly,
246 /// i.e. `D<'a>`, or,
248 /// (B.) the Drop impl for `D` has some type parameter with a
249 /// trait bound `T` where `T` is a trait that has at least
252 /// then 'a must strictly outlive the scope of v.
256 /// This function is meant to by applied to the type for every
257 /// expression in the program.
258 pub fn check_safety_of_destructor_if_necessary
<'a
, 'tcx
>(rcx
: &mut Rcx
<'a
, 'tcx
>,
261 scope
: region
::CodeExtent
) {
262 debug
!("check_safety_of_destructor_if_necessary typ: {} scope: {:?}",
263 typ
.repr(rcx
.tcx()), scope
);
265 // types that have been traversed so far by `traverse_type_if_unseen`
266 let mut breadcrumbs
: Vec
<Ty
<'tcx
>> = Vec
::new();
268 let result
= iterate_over_potentially_unsafe_regions_in_type(
279 Err(Error
::Overflow(ref ctxt
, ref detected_on_typ
)) => {
281 span_err
!(tcx
.sess
, span
, E0320
,
282 "overflow while adding drop-check rules for {}",
283 typ
.user_string(rcx
.tcx()));
285 TypeContext
::Root
=> {
286 // no need for an additional note if the overflow
287 // was somehow on the root.
289 TypeContext
::EnumVariant { def_id, variant, arg_index }
=> {
290 // FIXME (pnkfelix): eventually lookup arg_name
291 // for the given index on struct variants.
295 "overflowed on enum {} variant {} argument {} type: {}",
296 ty
::item_path_str(tcx
, def_id
),
299 detected_on_typ
.user_string(rcx
.tcx()));
301 TypeContext
::Struct { def_id, field }
=> {
305 "overflowed on struct {} field {} type: {}",
306 ty
::item_path_str(tcx
, def_id
),
308 detected_on_typ
.user_string(rcx
.tcx()));
316 Overflow(TypeContext
, ty
::Ty
<'tcx
>),
332 // The `depth` counts the number of calls to this function;
333 // the `xref_depth` counts the subset of such calls that go
334 // across a `Box<T>` or `PhantomData<T>`.
335 fn iterate_over_potentially_unsafe_regions_in_type
<'a
, 'tcx
>(
336 rcx
: &mut Rcx
<'a
, 'tcx
>,
337 breadcrumbs
: &mut Vec
<Ty
<'tcx
>>,
338 context
: TypeContext
,
339 ty_root
: ty
::Ty
<'tcx
>,
341 scope
: region
::CodeExtent
,
343 xref_depth
: usize) -> Result
<(), Error
<'tcx
>>
345 // Issue #22443: Watch out for overflow. While we are careful to
346 // handle regular types properly, non-regular ones cause problems.
347 let recursion_limit
= rcx
.tcx().sess
.recursion_limit
.get();
348 if xref_depth
>= recursion_limit
{
349 return Err(Error
::Overflow(context
, ty_root
))
352 let origin
= || infer
::SubregionOrigin
::SafeDestructor(span
);
353 let mut walker
= ty_root
.walk();
354 let opt_phantom_data_def_id
= rcx
.tcx().lang_items
.phantom_data();
356 let destructor_for_type
= rcx
.tcx().destructor_for_type
.borrow();
358 let xref_depth_orig
= xref_depth
;
360 while let Some(typ
) = walker
.next() {
361 // Avoid recursing forever.
362 if breadcrumbs
.contains(&typ
) {
365 breadcrumbs
.push(typ
);
367 // If we encounter `PhantomData<T>`, then we should replace it
368 // with `T`, the type it represents as owned by the
369 // surrounding context, before doing further analysis.
370 let (typ
, xref_depth
) = match typ
.sty
{
371 ty
::ty_struct(struct_did
, substs
) => {
372 if opt_phantom_data_def_id
== Some(struct_did
) {
373 let item_type
= ty
::lookup_item_type(rcx
.tcx(), struct_did
);
374 let tp_def
= item_type
.generics
.types
375 .opt_get(subst
::TypeSpace
, 0).unwrap();
376 let new_typ
= substs
.type_for_def(tp_def
);
377 debug
!("replacing phantom {} with {}",
378 typ
.repr(rcx
.tcx()), new_typ
.repr(rcx
.tcx()));
379 (new_typ
, xref_depth_orig
+ 1)
381 (typ
, xref_depth_orig
)
385 // Note: When ty_uniq is removed from compiler, the
386 // definition of `Box<T>` must carry a PhantomData that
387 // puts us into the previous case.
388 ty
::ty_uniq(new_typ
) => {
389 debug
!("replacing ty_uniq {} with {}",
390 typ
.repr(rcx
.tcx()), new_typ
.repr(rcx
.tcx()));
391 (new_typ
, xref_depth_orig
+ 1)
395 (typ
, xref_depth_orig
)
399 let opt_type_did
= match typ
.sty
{
400 ty
::ty_struct(struct_did
, _
) => Some(struct_did
),
401 ty
::ty_enum(enum_did
, _
) => Some(enum_did
),
406 opt_type_did
.and_then(|did
| destructor_for_type
.get(&did
));
408 debug
!("iterate_over_potentially_unsafe_regions_in_type \
409 {}typ: {} scope: {:?} opt_dtor: {:?} xref: {}",
410 (0..depth
).map(|_
| ' '
).collect
::<String
>(),
411 typ
.repr(rcx
.tcx()), scope
, opt_dtor
, xref_depth
);
413 // If `typ` has a destructor, then we must ensure that all
414 // borrowed data reachable via `typ` must outlive the parent
415 // of `scope`. This is handled below.
417 // However, there is an important special case: by
418 // parametricity, any generic type parameters have *no* trait
419 // bounds in the Drop impl can not be used in any way (apart
420 // from being dropped), and thus we can treat data borrowed
421 // via such type parameters remains unreachable.
423 // For example, consider `impl<T> Drop for Vec<T> { ... }`,
424 // which does have to be able to drop instances of `T`, but
425 // otherwise cannot read data from `T`.
427 // Of course, for the type expression passed in for any such
428 // unbounded type parameter `T`, we must resume the recursive
429 // analysis on `T` (since it would be ignored by
430 // type_must_outlive).
432 // FIXME (pnkfelix): Long term, we could be smart and actually
433 // feed which generic parameters can be ignored *into* `fn
434 // type_must_outlive` (or some generalization thereof). But
435 // for the short term, it probably covers most cases of
436 // interest to just special case Drop impls where: (1.) there
437 // are no generic lifetime parameters and (2.) *all* generic
438 // type parameters are unbounded. If both conditions hold, we
439 // simply skip the `type_must_outlive` call entirely (but
440 // resume the recursive checking of the type-substructure).
442 let has_dtor_of_interest
;
444 if let Some(&dtor_method_did
) = opt_dtor
{
445 let impl_did
= ty
::impl_of_method(rcx
.tcx(), dtor_method_did
)
447 rcx
.tcx().sess
.span_bug(
448 span
, "no Drop impl found for drop method")
451 let dtor_typescheme
= ty
::lookup_item_type(rcx
.tcx(), impl_did
);
452 let dtor_generics
= dtor_typescheme
.generics
;
453 let dtor_predicates
= ty
::lookup_predicates(rcx
.tcx(), impl_did
);
455 let has_pred_of_interest
= dtor_predicates
.predicates
.iter().any(|pred
| {
456 // In `impl<T> Drop where ...`, we automatically
457 // assume some predicate will be meaningful and thus
458 // represents a type through which we could reach
459 // borrowed data. However, there can be implicit
460 // predicates (namely for Sized), and so we still need
461 // to walk through and filter out those cases.
463 let result
= match *pred
{
464 ty
::Predicate
::Trait(ty
::Binder(ref t_pred
)) => {
465 let def_id
= t_pred
.trait_ref
.def_id
;
466 match rcx
.tcx().lang_items
.to_builtin_kind(def_id
) {
467 Some(ty
::BoundSend
) |
468 Some(ty
::BoundSized
) |
469 Some(ty
::BoundCopy
) |
470 Some(ty
::BoundSync
) => false,
474 ty
::Predicate
::Equate(..) |
475 ty
::Predicate
::RegionOutlives(..) |
476 ty
::Predicate
::TypeOutlives(..) |
477 ty
::Predicate
::Projection(..) => {
478 // we assume all of these where-clauses may
479 // give the drop implementation the capabilty
480 // to access borrowed data.
486 debug
!("typ: {} has interesting dtor due to generic preds, e.g. {}",
487 typ
.repr(rcx
.tcx()), pred
.repr(rcx
.tcx()));
493 // In `impl<'a> Drop ...`, we automatically assume
494 // `'a` is meaningful and thus represents a bound
495 // through which we could reach borrowed data.
497 // FIXME (pnkfelix): In the future it would be good to
498 // extend the language to allow the user to express,
499 // in the impl signature, that a lifetime is not
500 // actually used (something like `where 'a: ?Live`).
501 let has_region_param_of_interest
=
502 dtor_generics
.has_region_params(subst
::TypeSpace
);
504 has_dtor_of_interest
=
505 has_region_param_of_interest
||
506 has_pred_of_interest
;
508 if has_dtor_of_interest
{
509 debug
!("typ: {} has interesting dtor, due to \
510 region params: {} or pred: {}",
512 has_region_param_of_interest
,
513 has_pred_of_interest
);
515 debug
!("typ: {} has dtor, but it is uninteresting",
516 typ
.repr(rcx
.tcx()));
520 debug
!("typ: {} has no dtor, and thus is uninteresting",
521 typ
.repr(rcx
.tcx()));
522 has_dtor_of_interest
= false;
525 if has_dtor_of_interest
{
526 // If `typ` has a destructor, then we must ensure that all
527 // borrowed data reachable via `typ` must outlive the
528 // parent of `scope`. (It does not suffice for it to
529 // outlive `scope` because that could imply that the
530 // borrowed data is torn down in between the end of
531 // `scope` and when the destructor itself actually runs.)
534 match rcx
.tcx().region_maps
.opt_encl_scope(scope
) {
535 Some(parent_scope
) => ty
::ReScope(parent_scope
),
536 None
=> rcx
.tcx().sess
.span_bug(
537 span
, &format
!("no enclosing scope found for scope: {:?}",
541 regionck
::type_must_outlive(rcx
, origin(), typ
, parent_region
);
544 // Okay, `typ` itself is itself not reachable by a
545 // destructor; but it may contain substructure that has a
549 ty
::ty_struct(struct_did
, substs
) => {
550 debug
!("typ: {} is struct; traverse structure and not type-expression",
551 typ
.repr(rcx
.tcx()));
552 // Don't recurse; we extract type's substructure,
553 // so do not process subparts of type expression.
554 walker
.skip_current_subtree();
557 ty
::lookup_struct_fields(rcx
.tcx(), struct_did
);
558 for field
in fields
.iter() {
560 ty
::lookup_field_type(rcx
.tcx(),
564 try
!(iterate_over_potentially_unsafe_regions_in_type(
567 TypeContext
::Struct
{
579 ty
::ty_enum(enum_did
, substs
) => {
580 debug
!("typ: {} is enum; traverse structure and not type-expression",
581 typ
.repr(rcx
.tcx()));
582 // Don't recurse; we extract type's substructure,
583 // so do not process subparts of type expression.
584 walker
.skip_current_subtree();
586 let all_variant_info
=
587 ty
::substd_enum_variants(rcx
.tcx(),
590 for variant_info
in all_variant_info
.iter() {
591 for (i
, arg_type
) in variant_info
.args
.iter().enumerate() {
592 try
!(iterate_over_potentially_unsafe_regions_in_type(
595 TypeContext
::EnumVariant
{
597 variant
: variant_info
.name
,
609 ty
::ty_rptr(..) | ty
::ty_ptr(_
) | ty
::ty_bare_fn(..) => {
610 // Don't recurse, since references, pointers,
611 // boxes, and bare functions don't own instances
612 // of the types appearing within them.
613 walker
.skip_current_subtree();
618 // You might be tempted to pop breadcrumbs here after
619 // processing type's internals above, but then you hit
620 // exponential time blowup e.g. on
621 // compile-fail/huge-struct.rs. Instead, we do not remove
622 // anything from the breadcrumbs vector during any particular
623 // traversal, and instead clear it after the whole traversal