-
-
Notifications
You must be signed in to change notification settings - Fork 513
Added comments when using unsafe #1501
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -133,6 +133,8 @@ pub fn clamp_vec<T: Number, const D: usize>( | |
/// | ||
/// The floating-point value's bit-level representation is preserved. | ||
/// | ||
/// Using unsafe is sound because the bitwise representation of f32 fits in i32 | ||
/// | ||
/// # See also: | ||
/// | ||
/// * [`float_bits_to_int_vec()`] | ||
|
@@ -167,6 +169,8 @@ pub fn float_bits_to_int_vec<const D: usize>(v: &TVec<f32, D>) -> TVec<i32, D> { | |
/// | ||
/// The floating-point value's bit-level representation is preserved. | ||
/// | ||
/// Using unsafe is sound because the bitwise representation of f32 fits in i32 | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. As above. |
||
/// | ||
/// # See also: | ||
/// | ||
/// * [`float_bits_to_int()`] | ||
|
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -161,6 +161,7 @@ where | |
lapack_check!(info); | ||
|
||
// Copy lower triangle to upper triangle. | ||
// Using unsafe to ensure the bounds i and j are always valid indices, | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. This comment doesn't make sense. The unsafe operation requires that the indices are in bounds; it does nothing to ensure that is actually the case. The comment should explain how we know it's the case. |
||
for i in 0..dim { | ||
for j in i + 1..dim { | ||
unsafe { *self.l.get_unchecked_mut((i, j)) = *self.l.get_unchecked((j, i)) }; | ||
|
@@ -196,6 +197,9 @@ pub trait CholeskyScalar: Scalar + Copy { | |
fn xpotri(uplo: u8, n: i32, a: &mut [Self], lda: i32, info: &mut i32); | ||
} | ||
|
||
/// This macro uses unsafe to manually ensure memory safety for external functions | ||
/// For incorrectly sized and initialized matrices and arrays, undefined behavior will occur | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. This comment seems to be arguing that the use of unsafety is incorrect. If that's true, then we should fix the unsoundness, not just declare its presence. Several similar looking instances below. |
||
/// Also, it helps with pointer dereferencing | ||
macro_rules! cholesky_scalar_impl( | ||
($N: ty, $xpotrf: path, $xpotrs: path, $xpotri: path) => ( | ||
impl CholeskyScalar for $N { | ||
|
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -105,7 +105,9 @@ macro_rules! svd_impl( | |
let mut lwork = -1 as i32; | ||
let mut info = 0; | ||
let mut iwork = vec![0; 8 * cmp::min(nrows.value(), ncols.value())]; | ||
|
||
|
||
// Using unsafe to manually ensure memory safety for external function lapack_func | ||
// Rust cannot check the slices' or raw poinnters' safety | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Here and below, the comment must explain exactly what the safety invariants are, and how we know they're satisfied. |
||
unsafe { | ||
$lapack_func(job, nrows.value() as i32, ncols.value() as i32, m.as_mut_slice(), | ||
lda, &mut s.as_mut_slice(), u.as_mut_slice(), ldu as i32, vt.as_mut_slice(), | ||
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This documentation goes inside the function, on the
unsafe
block. The use of unsafety in the implementation is not public; the purpose of the comment is to help a developer or auditor who is looking at the implementation.