Contracts & Harnesses for non_null::new and non_null::new_unchecked

[QinyuanWu]

Towards #53

Changes

• added contract and harness for non_null::new
• added contract and harness for non_null::new_unchecked

The difference between the two APIs is that non_null::new can handle null pointers while non_null::new_unchecked does not. Therefore the contract for non_null::new does not require a nonnull pointer.

Revalidation

To revalidate the verification results, run kani verify-std -Z unstable-options "path/to/library" -Z function-contracts -Z mem-predicates --harness ptr::non_null::verify::non_null_check_new. This will run both harnesses. All default checks should pass:

Kani Rust Verifier 0.55.0 (standalone)
Checking harness ptr::non_null::verify::non_null_check_new...
...
SUMMARY:
 ** 0 of 1849 failed

VERIFICATION:- SUCCESSFUL
Verification Time: 3.5815656s

Checking harness ptr::non_null::verify::non_null_check_new_unchecked...
...
SUMMARY:
 ** 0 of 1559 failed

VERIFICATION:- SUCCESSFUL
Verification Time: 0.25408816s

Complete - 2 successfully verified harnesses, 0 failures, 2 total.

[zhassan-aws]

Nice work! A few comments.

[QinyuanWu]

@zhassan-aws if everything else looks good I will squash the commits.

[zhassan-aws]

Thanks!

[zhassan-aws]

@zhassan-aws if everything else looks good I will squash the commits.

No need to. We squash on merge.

[QinyuanWu]

@zhassan-aws Thank you! Do we need another reviewer for approval to merge?

[zhassan-aws]

Yes.

[celinval]

I think it would be great to have harnesses that covers all possible values of the raw pointer. Something like:

let ptr = kani::any::<usize>() as *mut i32;
let _ = NonNull::new_unchecked(ptr);

Note that we cannot use the same strategy for functions where we need to ensure pointer validity.

[celinval]

Awesome! thanks