From<bool> and Bounded's invariant for signed N = 1

From<bool> and Bounded's invariant for signed N = 1

[Younes Akhouayri]

Hi,

There seems to be an invariant violation in the generic From<bool>
implementation for Bounded.

As I understand it, Bounded<i8, 1> can represent only -1 and 0, while
i8::from(true) produces 1. However, this safe code is accepted:

let value: Bounded<i8, 1> = true.into();
let _raw: i8 = *value;

Bounded::<i8, 1>::try_new(1) rejects the same value, but From<bool>
passes it directly to the unsafe __new() constructor. The resulting
Bounded value violates the invariant relied upon by Deref, whose
failure branch calls unreachable_unchecked().

Am I missing an intended constraint on this conversion? If not, it
seems the signed N = 1 case needs to be excluded or handled
differently.

Any thoughts?

Thanks,
Younes

Re: From<bool> and Bounded's invariant for signed N = 1

[Miguel Ojeda]

On Thu, Aug 13, 2026 at 11:46 AM Younes Akhouayri <git@younes.io> wrote:
>
> Any thoughts?

Thanks for the report!

That is correct, good eyes -- indeed, the `Deref` bites us again like
in 223aa25aee82.

Do you want to write a patch?

Cheers,
Miguel

Re: From<bool> and Bounded's invariant for signed N = 1

[Alexandre Courbot]

On Thu Aug 13, 2026 at 6:46 PM JST, Younes Akhouayri wrote:
> Hi,
>
> There seems to be an invariant violation in the generic From<bool>
> implementation for Bounded.
>
> As I understand it, Bounded<i8, 1> can represent only -1 and 0, while
> i8::from(true) produces 1. However, this safe code is accepted:
>
> let value: Bounded<i8, 1> = true.into();
> let _raw: i8 = *value;
>
> Bounded::<i8, 1>::try_new(1) rejects the same value, but From<bool>
> passes it directly to the unsafe __new() constructor. The resulting
> Bounded value violates the invariant relied upon by Deref, whose
> failure branch calls unreachable_unchecked().
>
> Am I missing an intended constraint on this conversion? If not, it
> seems the signed N = 1 case needs to be excluded or handled
> differently.
>
> Any thoughts?

I think you are correct. There is a `Signedness` associated type on the
`Integer` trait, so it should be trivial to exclude signed integers - do
you want to send a patch for that?

Re: From<bool> and Bounded's invariant for signed N = 1

[Younes Akhouayri]

Thank you both for the feedback. Yes, I can send a patch.

Just to confirm the intended scope: excluding signed integers entirely would also remove valid conversions such as Bounded::<i8, 2>::from(true), since signed Bounded values with N >= 2 can represent both 0 and 1.

Would you prefer the simpler unsigned-only restriction, or should the patch preserve signed conversions for N >= 2?


--

Best regards,
Younes



Aug 13, 2026, 15:04 by acourbot@nvidia.com:

> On Thu Aug 13, 2026 at 6:46 PM JST, Younes Akhouayri wrote:
>
>> Hi,
>>
>> There seems to be an invariant violation in the generic From<bool>
>> implementation for Bounded.
>>
>> As I understand it, Bounded<i8, 1> can represent only -1 and 0, while
>> i8::from(true) produces 1. However, this safe code is accepted:
>>
>> let value: Bounded<i8, 1> = true.into();
>> let _raw: i8 = *value;
>>
>> Bounded::<i8, 1>::try_new(1) rejects the same value, but From<bool>
>> passes it directly to the unsafe __new() constructor. The resulting
>> Bounded value violates the invariant relied upon by Deref, whose
>> failure branch calls unreachable_unchecked().
>>
>> Am I missing an intended constraint on this conversion? If not, it
>> seems the signed N = 1 case needs to be excluded or handled
>> differently.
>>
>> Any thoughts?
>>
>
> I think you are correct. There is a `Signedness` associated type on the
> `Integer` trait, so it should be trivial to exclude signed integers - do
> you want to send a patch for that?
>