See also: #3763
impl_for_transmute_from! is documented as safe to invoke because it emits bounds that make the generated trait impl sound. Its proof currently uses reciprocal TransmuteFrom<_, Safe, Safe> bounds to conclude that the represented type and representation type have equivalent bit validity.
That conclusion is only justified when the two referents have the same size. TransmuteFrom explicitly conveys no safety guarantee for unequal-sized referents, so reciprocal TransmuteFrom bounds alone do not establish equal bit validity.
All current visible invocations appear to independently use equal-sized representations, so this is a latent soundness hole in the macro contract rather than a known bad generated impl. The helper should enforce an appropriate size-equality / CastExact witness before relying on the reciprocal TransmuteFrom bounds.
This was exposed while clarifying the pointer-transmute model in #3686 and #3690.
Authored by an AI agent acting on Josh Liebow-Feeser's behalf.
impl_for_transmute_from!is documented as safe to invoke because it emits bounds that make the generated trait impl sound. Its proof currently uses reciprocalTransmuteFrom<_, Safe, Safe>bounds to conclude that the represented type and representation type have equivalent bit validity.That conclusion is only justified when the two referents have the same size.
TransmuteFromexplicitly conveys no safety guarantee for unequal-sized referents, so reciprocalTransmuteFrombounds alone do not establish equal bit validity.All current visible invocations appear to independently use equal-sized representations, so this is a latent soundness hole in the macro contract rather than a known bad generated impl. The helper should enforce an appropriate size-equality /
CastExactwitness before relying on the reciprocalTransmuteFrombounds.This was exposed while clarifying the pointer-transmute model in #3686 and #3690.
Authored by an AI agent acting on Josh Liebow-Feeser's behalf.