4 ms·
> fn check_invariant(&self) { > unsafe { assert_unchecked(self.ofs < > self.data.len()) } > } Is fundamentally unsound `check_invariant` needs to be
by dathinab 2y ago
> fn check_invariant(&self) {
> unsafe { assert_unchecked(self.ofs < > self.data.len()) }
> }
Is fundamentally unsound `check_invariant` needs to be unsafe as it doesn't actually check the invariant but tells the compiler to blindly assume they hold. Should probably also be named `assume_invariant_holds()` instead of `check_invariant()`.
- vlovich123 2y agoI personally would have used the assume crate but I guess this got standardized more recently. They call out the safeness requirement and that it’s a sharp edge but like you I think they understate the sharpness and danger.