From<bool> and Bounded's invariant for signed N = 1

From<bool> and Bounded's invariant for signed N = 1

[Younes Akhouayri]

Hi,

There seems to be an invariant violation in the generic From<bool>
implementation for Bounded.

As I understand it, Bounded<i8, 1> can represent only -1 and 0, while
i8::from(true) produces 1. However, this safe code is accepted:

let value: Bounded<i8, 1> = true.into();
let _raw: i8 = *value;

Bounded::<i8, 1>::try_new(1) rejects the same value, but From<bool>
passes it directly to the unsafe __new() constructor. The resulting
Bounded value violates the invariant relied upon by Deref, whose
failure branch calls unreachable_unchecked().

Am I missing an intended constraint on this conversion? If not, it
seems the signed N = 1 case needs to be excluded or handled
differently.

Any thoughts?

Thanks,
Younes

Re: From<bool> and Bounded's invariant for signed N = 1

[Miguel Ojeda]

On Thu, Aug 13, 2026 at 11:46 AM Younes Akhouayri <git@younes.io> wrote:
>
> Any thoughts?

Thanks for the report!

That is correct, good eyes -- indeed, the `Deref` bites us again like
in 223aa25aee82.

Do you want to write a patch?

Cheers,
Miguel

Re: From<bool> and Bounded's invariant for signed N = 1

[Alexandre Courbot]

On Thu Aug 13, 2026 at 6:46 PM JST, Younes Akhouayri wrote:
> Hi,
>
> There seems to be an invariant violation in the generic From<bool>
> implementation for Bounded.
>
> As I understand it, Bounded<i8, 1> can represent only -1 and 0, while
> i8::from(true) produces 1. However, this safe code is accepted:
>
> let value: Bounded<i8, 1> = true.into();
> let _raw: i8 = *value;
>
> Bounded::<i8, 1>::try_new(1) rejects the same value, but From<bool>
> passes it directly to the unsafe __new() constructor. The resulting
> Bounded value violates the invariant relied upon by Deref, whose
> failure branch calls unreachable_unchecked().
>
> Am I missing an intended constraint on this conversion? If not, it
> seems the signed N = 1 case needs to be excluded or handled
> differently.
>
> Any thoughts?

I think you are correct. There is a `Signedness` associated type on the
`Integer` trait, so it should be trivial to exclude signed integers - do
you want to send a patch for that?