Re: [PATCH v3 16/27] rust: types: add `ForLt` trait for higher-ranked lifetime support

["Eliot Courtney" <ecourtney@nvidia.com>]

On Sun May 17, 2026 at 9:01 AM JST, Danilo Krummrich wrote:
> From: Gary Guo <gary@garyguo.net>
>
> There are a few cases, e.g. when dealing with data referencing each other,
> one might want to write code that are generic over lifetimes. For example,
> if you want take a function that takes `&'a Foo` and gives `Bar<'a>`, you
> can write:
>
>     f: impl for<'a> FnOnce(&'a Foo) -> Bar<'a>,
>
> However, it becomes tricky when you want that function to not have a fixed
> `Bar`, but have it be generic again. In this case, one needs something that
> is generic over types that are themselves generic over lifetimes.
>
> `ForLt` provides such support. It provides a trait `ForLt` which describes
> a type generic over lifetime. One may use `ForLt::Of<'a>` to get an
> instance of a type for a specific lifetime.
>
> For the case of cross referencing, one would almost always want the
> lifetime to be covariant. Therefore this is also made a requirement for the
> `ForLt` trait, so functions with `ForLt` trait bound can assume covariance.
>
> A macro `ForLt!()` is provided to be able to obtain a type that implements
> `ForLt`. For example, `ForLt!(for<'a> Bar<'a>)` would yield a type that
> `<TheType as ForLt>::Of<'a>` is `Bar<'a>`. This also works with lifetime
> elision, e.g. `ForLt!(Bar<'_>)` or for types without lifetime at all, e.g.
> `ForLt!(u32)`.
>
> The API design draws inspiration from the higher-kinded-types [1] crate,
> however different design decision has been taken (e.g. covariance
> requirement) and the implementation is independent.
>
> License headers use "Apache-2.0 OR MIT" because I anticipate this to be
> used in pin-init crate too which is licensed as such.
>
> Link: https://docs.rs/higher-kinded-types/ [1]
>
> Signed-off-by: Gary Guo <gary@garyguo.net>
> Signed-off-by: Danilo Krummrich <dakr@kernel.org>
> ---

> +trait TypeExt {
> +    fn expand_elided_lifetime(&self, explicit_lt: &Lifetime) -> Type;
> +    fn replace_lifetime(&self, src: &Lifetime, dst: &Lifetime) -> Type;
> +    fn has_lifetime(&self, lt: &Lifetime) -> bool;
> +}
> +
> +impl TypeExt for Type {
> +    fn expand_elided_lifetime(&self, explicit_lt: &Lifetime) -> Type {
> +        struct ElidedLifetimeExpander<'a>(&'a Lifetime);
> +
> +        impl VisitMut for ElidedLifetimeExpander<'_> {
> +            fn visit_lifetime_mut(&mut self, lifetime: &mut Lifetime) {
> +                // Expand explicit `'_`
> +                if lifetime.ident == "_" {
> +                    *lifetime = self.0.clone();
> +                }
> +            }
> +
> +            fn visit_type_reference_mut(&mut self, reference: &mut syn::TypeReference) {
> +                syn::visit_mut::visit_type_reference_mut(self, reference);
> +
> +                if reference.lifetime.is_none() {
> +                    reference.lifetime = Some(self.0.clone());
> +                }
> +            }
> +        }
> +
> +        let mut ret = self.clone();
> +        ElidedLifetimeExpander(explicit_lt).visit_type_mut(&mut ret);
> +        ret
> +    }
> +
> +    fn replace_lifetime(&self, src: &Lifetime, dst: &Lifetime) -> Type {
> +        struct LifetimeReplacer<'a>(&'a Lifetime, &'a Lifetime);
> +
> +        impl VisitMut for LifetimeReplacer<'_> {
> +            fn visit_lifetime_mut(&mut self, lifetime: &mut Lifetime) {
> +                if lifetime.ident == self.0.ident {
> +                    *lifetime = self.1.clone();
> +                }
> +            }
> +        }
> +
> +        let mut ret = self.clone();
> +        LifetimeReplacer(src, dst).visit_type_mut(&mut ret);
> +        ret
> +    }
> +
> +    fn has_lifetime(&self, lt: &Lifetime) -> bool {
> +        struct HasLifetime<'a>(&'a Lifetime, bool);
> +
> +        impl Visit<'_> for HasLifetime<'_> {
> +            fn visit_lifetime(&mut self, lifetime: &Lifetime) {
> +                if lifetime.ident == self.0.ident {
> +                    self.1 = true;
> +                }
> +            }
> +        }
> +
> +        let mut visitor = HasLifetime(lt, false);
> +        visitor.visit_type(self);
> +        visitor.1
> +    }
> +}
> +
> +struct Prover<'a>(&'a Lifetime, Vec<&'a Type>);
> +
> +impl<'a> Prover<'a> {
> +    /// Prove that `ty` is covariant over `'lt`.
> +    ///
> +    /// This also needs to prove that it'll be wellformed for any instance of `'lt`.
> +    /// It can be assumed that `ty` will be wellformed if `'lt` is substituted to `'static`.
> +    fn prove(&mut self, ty: &'a Type) {
> +        match ty {
> +            Type::Paren(ty) => self.prove(&ty.elem),
> +            Type::Group(ty) => self.prove(&ty.elem),
> +
> +            // No lifetime involved
> +            Type::Never(_) => {}
> +
> +            // `[T; N]` and `[T]` is covariant over `T`.
> +            Type::Array(ty) => self.prove(&ty.elem),
> +            Type::Slice(ty) => self.prove(&ty.elem),
> +
> +            Type::Tuple(ty) => {
> +                for elem in &ty.elems {
> +                    self.prove(elem);
> +                }
> +            }
> +
> +            // `*const T` is covariant over `T`
> +            Type::Ptr(ty) if ty.const_token.is_some() => self.prove(&ty.elem),
> +
> +            // `&T` is covariant over `T` and lifetime.
> +            //
> +            // Note that if we encounter `&'other_lt T`, then we still need to make sure the type
> +            // is wellformed if `T` involves `&'lt`, so we defer to the compiler.
> +            //
> +            // This is to block cases like `ForLt!(for<'a> &'static &'a u32)`, as the presence of
> +            // the type implies `'a: 'static` but this is unsound.
> +            Type::Reference(ty)
> +                if ty.mutability.is_none() && ty.lifetime.as_ref() == Some(self.0) =>
> +            {
> +                self.prove(&ty.elem)
> +            }
> +
> +            // `&[mut] T` is covariant over lifetime.
> +            // In case we have `&[mut] NoLifetime`, we don't need to do additional checks.
> +            Type::Reference(ty) if !ty.elem.has_lifetime(self.0) => (),
> +
> +            // No mention of lifetime at all, no need to perform compiler check.
> +            ty if !ty.has_lifetime(self.0) => (),

This treats macros as not having a lifetime, but it allows this which is
not covariant for 'a IIUC:

```
trait Trait {}

macro_rules! asdf {
  () => { dyn Trait };
}

type NotCovariant = ForLt!(for<'a> &'a mut asdf!());
```

And you can get rid of the macro too:

```
type NotCovariant = ForLt!(for<'a> &'a mut dyn Trait);
```

These are not covariant because dyn Trait has an elided +'a lifetime.

I feel that the syntactic checking is kinda difficult to get right since
it would need to handle all ways lifetimes can be elided now and in the
future.

Would it be that bad to always emit the proofs?