Re: [PATCH 1/2] rust: alloc: extend safety requirements of Vec::set_len()

[Danilo Krummrich <dakr@kernel.org>]

On Sun, Mar 16, 2025 at 09:13:50AM -0400, Tamir Duberstein wrote:
> On Sun, Mar 16, 2025 at 9:01 AM Danilo Krummrich <dakr@kernel.org> wrote:
> >
> > On Sun, Mar 16, 2025 at 08:42:43AM -0400, Tamir Duberstein wrote:
> > > On Sun, Mar 16, 2025 at 8:31 AM Danilo Krummrich <dakr@kernel.org> wrote:
> > >
> > > > Let's go with just "must be taken ownership of" then. Unless there's subsequent
> > > > feedback, I won't send a new version for this, since you both already gave your
> > > > (conditional) RB for this.
> > >
> > > What does it mean to take ownership, if not to run the destructor?
> >
> > Taking responsibility over the decision of what should happen to the value, i.e.
> > forget about the value, drop it right away, keep it alive at a different memory
> > location.
> >
> > > Given Benno's insight, I think the safety text is correct as it
> > > existed before this patch.
> >
> > Without the addition there's no requirement for the caller to take ownership,
> > but that's what we want here. Without the requirement it would be on set_len()
> > to take a decision on what should happen with the value.
> 
> It isn't a safety requirement, right? I think it's fine to document,
> but given that neglecting to run a destructor is safe, it doesn't seem
> to affect safety.

I don't think there's a rule that safety requirements of unsafe functions must
only be used to guarantee memory safety, etc.

But you're right, if set_len() guarantees a default of what happens to the
value(s) when the caller doesn't take ownership, we could avoid the safety
requirement.

But I don't want set_len() to make any guarantees about about a default, instead
I want that the caller is forced to make an explicit and documented decision
over what happens to the discarded values.