Add HasField::project; simplify is_bit_valid

This method projects from `PtrInner<_, Self>` to a `PtrInner` of a field
of `Self`. In this commit, we use `HasField::project` to considerably
simplify `is_bit_valid` implementations.

gherrit-pr-id: G9e7039c715e1ec53e6d860909bb0d618898fd46b

Author: jswrenn

src/lib.rs

@@ -372,6 +372,8 @@ use core::{
 use std::io;
 
 use crate::pointer::invariant::{self, BecauseExclusive};
+#[doc(hidden)]
+pub use crate::pointer::PtrInner;
 pub use crate::{
     byte_slice::*,
     byteorder::*,
@@ -1109,6 +1111,9 @@ pub unsafe trait HasField<Field, const VARIANT_ID: u128, const FIELD_ID: u128> {
 
     /// The type of the field.
     type Type: ?Sized;
+
+    /// Projects from `slf` to the field.
+    fn project(slf: PtrInner<'_, Self>) -> PtrInner<'_, Self::Type>;
 }
 
 /// Analyzes whether a type is [`FromZeros`].

zerocopy-derive/src/enum.rs

@@ -9,7 +9,8 @@
 use proc_macro2::TokenStream;
 use quote::quote;
 use syn::{
-    parse_quote, spanned::Spanned as _, DataEnum, DeriveInput, Error, Fields, Generics, Ident, Path,
+    parse_quote, spanned::Spanned as _, DataEnum, DeriveInput, Error, Fields, Generics, Ident,
+    Index, Path,
 };
 
 use crate::{
@@ -162,6 +163,13 @@ fn generate_variant_structs(
     }
 }
 
+fn variants_union_field_ident(ident: &Ident) -> Ident {
+    let variant_ident_str = crate::ext::to_ident_str(ident);
+    // Field names are prefixed with `__field_` to prevent name collision
+    // with the `__nonempty` field.
+    Ident::new(&format!("__field_{}", variant_ident_str), ident.span())
+}
+
 fn generate_variants_union(generics: &Generics, data: &DataEnum) -> TokenStream {
     let (_, ty_generics, _) = generics.split_for_impl();
 
@@ -172,10 +180,7 @@ fn generate_variants_union(generics: &Generics, data: &DataEnum) -> TokenStream
             return None;
         }
 
-        // Field names are prefixed with `__field_` to prevent name collision
-        // with the `__nonempty` field.
-        let field_name_str = crate::ext::to_ident_str(&variant.ident);
-        let field_name = Ident::new(&format!("__field_{}", field_name_str), variant.ident.span());
+        let field_name = variants_union_field_ident(&variant.ident);
         let variant_struct_ident = variant_struct_ident(&variant.ident);
 
         Some(quote! {
@@ -248,16 +253,19 @@ pub(crate) fn derive_is_bit_valid(
     let variant_structs = generate_variant_structs(enum_ident, generics, data, zerocopy_crate);
     let variants_union = generate_variants_union(generics, data);
 
-    let (_, ty_generics, _) = generics.split_for_impl();
+    let (_, ref ty_generics, _) = generics.split_for_impl();
 
     let has_fields = data.variants().into_iter().flat_map(|(variant, fields)| {
         let variant_ident = &variant.unwrap().ident;
+        let variant_struct_ident = variant_struct_ident(variant_ident);
+        let variants_union_field_ident = variants_union_field_ident(variant_ident);
         let field: Box<syn::Type> = parse_quote!(());
-        fields.into_iter().map(move |(vis, ident, ty)| {
+        fields.into_iter().enumerate().map(move |(idx, (vis, ident, ty))| {
             // Rust does not presently support explicit visibility modifiers on
             // enum fields, but we guard against the possibility to ensure this
             // derive remains sound.
             assert!(matches!(vis, syn::Visibility::Inherited));
+            let variant_struct_field_index = Index::from(idx + 1);
             ImplBlockBuilder::new(
                 ast,
                 data,
@@ -274,6 +282,63 @@ pub(crate) fn derive_is_bit_valid(
             )
             .inner_extras(quote! {
                 type Type = #ty;
+
+                #[inline(always)]
+                fn project(slf: #zerocopy_crate::PtrInner<'_, Self>) -> #zerocopy_crate::PtrInner<'_, Self::Type> {
+                    // SAFETY: By invariant on `___ZerocopyRawEnum`,
+                    // `___ZerocopyRawEnum` has the same layout as `Self`.
+                    let slf = unsafe { slf.cast::<___ZerocopyRawEnum #ty_generics>() };
+                    let slf = slf.as_non_null().as_ptr();
+
+                    // Project into the variant. SAFETY: `PtrInner` promises it
+                    // references either a zero-sized byte range, or else will
+                    // reference a byte range that is entirely contained within
+                    // an allocated object. In either case, this guarantees that
+                    // `(*slf).variants.#variants_union_field_ident` is
+                    // in-bounds of `slf`, and `variant` will maintain these
+                    // same invariants for its referent type.
+                    let variant = unsafe {
+                        #zerocopy_crate::util::macro_util::core_reexport::ptr::addr_of_mut!((*slf).variants.#variants_union_field_ident)
+                    };
+
+                    // Unwrap the variant from `ManuallyDrop`. This cast is
+                    // size-preserving; by invariant on `ManuallyDrop<T>`,
+                    // `ManuallyDrop<T>` and `T` have identical layouts and
+                    // maintains the referent invariants of `variant`.
+                    let variant = variant as *mut #variant_struct_ident #ty_generics;
+
+                    // Project the field. SAFETY: `variant` promises it
+                    // references either a zero-sized byte range, or else will
+                    // reference a byte range that is entirely contained within
+                    // an allocated object. In either case, this guarantees that
+                    // `(*variant).#variant_struct_field_index` is in-bounds of
+                    // `variant`, and `field` will maintain these same
+                    // invariants for its referent type.
+                    let field = unsafe {
+                        #zerocopy_crate::util::macro_util::core_reexport::ptr::addr_of_mut!((*variant).#variant_struct_field_index)
+                    };
+
+                    // SAFETY: `field` promises it references either a
+                    // zero-sized byte range, or else will reference a byte
+                    // range that is entirely contained within an allocated
+                    // object. In either case, this guarantees that
+                    // `(*variant).#variant_struct_field_index` is in-bounds of
+                    // `variant`, and does not wrap around the address space.
+                    // Consequently, `field` is non-null, and `ptr` inherits
+                    // these same invariants.
+                    let ptr = unsafe { #zerocopy_crate::util::macro_util::core_reexport::ptr::NonNull::new_unchecked(field) };
+
+                    // SAFETY:
+                    // 0. `ptr` addresses a subset of the bytes of `slf`, so by
+                    //    invariant on `slf: PtrInner`, if `ptr`'s referent is
+                    //    not zero sized, then `ptr` has valid provenance for
+                    //    its referent, which is entirely contained in some Rust
+                    //    allocation, `A`.
+                    // 1. By invariant on `slf: PtrInner`, if `ptr`'s referent
+                    //    is not zero sized, `A` is guaranteed to live for at
+                    //    least `'a`.
+                    unsafe { #zerocopy_crate::PtrInner::new(ptr) }
+                }
             })
             .build()
         })

zerocopy-derive/src/lib.rs

@@ -774,6 +774,34 @@ fn derive_has_field_struct_union(
         )
         .inner_extras(quote! {
             type Type = #ty;
+
+            #[inline(always)]
+            fn project(slf: #zerocopy_crate::PtrInner<'_, Self>) -> #zerocopy_crate::PtrInner<'_, Self::Type> {
+                let slf = slf.as_non_null().as_ptr();
+                // SAFETY: `PtrInner` promises it references either a zero-sized
+                // byte range, or else will reference a byte range that is
+                // entirely contained within an allocated object. In either
+                // case, this guarantees that `(*slf).#ident` is in-bounds of
+                // `slf`.
+                let field = unsafe { #zerocopy_crate::util::macro_util::core_reexport::ptr::addr_of_mut!((*slf).#ident) };
+                // SAFETY: `PtrInner` promises it references either a zero-sized
+                // byte range, or else will reference a byte range that is
+                // entirely contained within an allocated object. In either
+                // case, this guarantees that field projection will not wrap
+                // around the address space, and so `field` will be non-null.
+                let ptr = unsafe { #zerocopy_crate::util::macro_util::core_reexport::ptr::NonNull::new_unchecked(field) };
+                // SAFETY:
+                // 0. `ptr` addresses a subset of the bytes of
+                //    `slf`, so by invariant on `slf: PtrInner`,
+                //    if `ptr`'s referent is not zero sized,
+                //    then `ptr` has valid provenance for its
+                //    referent, which is entirely contained in
+                //    some Rust allocation, `A`.
+                // 1. By invariant on `slf: PtrInner`, if
+                //    `ptr`'s referent is not zero sized, `A` is
+                //    guaranteed to live for at least `'a`.
+                unsafe { #zerocopy_crate::PtrInner::new(ptr) }
+            }
         })
         .build()
     });
@@ -816,6 +844,7 @@ fn derive_try_from_bytes_struct(
                     use #zerocopy_crate::pointer::PtrInner;
 
                     true #(&& {
+                        let project = <Self as #zerocopy_crate::HasField<_, 0, { #zerocopy_crate::ident_id!(#field_names) }>>::project;
                         // SAFETY:
                         // - `project` is a field projection, and so it
                         //   addresses a subset of the bytes addressed by `slf`
@@ -824,31 +853,6 @@ fn derive_try_from_bytes_struct(
                         //   at the same byte ranges in the returned pointer's
                         //   referent as they do in `*slf`
                         let field_candidate = unsafe {
-                            let project = |slf: PtrInner<'_, Self>| {
-                                let slf = slf.as_non_null().as_ptr();
-                                let field = core_reexport::ptr::addr_of_mut!((*slf).#field_names);
-                                // SAFETY: `cast_unsized_unchecked` promises
-                                // that `slf` will either reference a zero-sized
-                                // byte range, or else will reference a byte
-                                // range that is entirely contained within an
-                                // allocated object. In either case, this
-                                // guarantees that field projection will not
-                                // wrap around the address space, and so `field`
-                                // will be non-null.
-                                let ptr = unsafe { core_reexport::ptr::NonNull::new_unchecked(field) };
-                                // SAFETY:
-                                // 0. `ptr` addresses a subset of the bytes of
-                                //    `slf`, so by invariant on `slf: PtrInner`,
-                                //    if `ptr`'s referent is not zero sized,
-                                //    then `ptr` has valid provenance for its
-                                //    referent, which is entirely contained in
-                                //    some Rust allocation, `A`.
-                                // 1. By invariant on `slf: PtrInner`, if
-                                //    `ptr`'s referent is not zero sized, `A` is
-                                //    guaranteed to live for at least `'a`.
-                                unsafe { PtrInner::new(ptr) }
-                            };
-
                             candidate.reborrow().cast_unsized_unchecked(project)
                         };
 
@@ -901,6 +905,7 @@ fn derive_try_from_bytes_union(
                     use #zerocopy_crate::pointer::PtrInner;
 
                     false #(|| {
+                        let project = <Self as #zerocopy_crate::HasField<_, 0, { #zerocopy_crate::ident_id!(#field_names) }>>::project;
                         // SAFETY:
                         // - `project` is a field projection, and so it
                         //   addresses a subset of the bytes addressed by `slf`
@@ -910,31 +915,6 @@ fn derive_try_from_bytes_union(
                         //   returned pointer's referent contain any
                         //   `UnsafeCell`s
                         let field_candidate = unsafe {
-                            let project = |slf: PtrInner<'_, Self>| {
-                                let slf = slf.as_non_null().as_ptr();
-                                let field = core_reexport::ptr::addr_of_mut!((*slf).#field_names);
-                                // SAFETY: `cast_unsized_unchecked` promises
-                                // that `slf` will either reference a zero-sized
-                                // byte range, or else will reference a byte
-                                // range that is entirely contained within an
-                                // allocated object. In either case, this
-                                // guarantees that field projection will not
-                                // wrap around the address space, and so `field`
-                                // will be non-null.
-                                let ptr = unsafe { core_reexport::ptr::NonNull::new_unchecked(field) };
-                                // SAFETY:
-                                // 0. `ptr` addresses a subset of the bytes of
-                                //    `slf`, so by invariant on `slf: PtrInner`,
-                                //    if `ptr`'s referent is not zero sized,
-                                //    then `ptr` has valid provenance for its
-                                //    referent, which is entirely contained in
-                                //    some Rust allocation, `A`.
-                                // 1. By invariant on `slf: PtrInner`, if
-                                //    `ptr`'s referent is not zero sized, `A` is
-                                //    guaranteed to live for at least `'a`.
-                                unsafe { PtrInner::new(ptr) }
-                            };
-
                             candidate.reborrow().cast_unsized_unchecked(project)
                         };