once_self_cell VS miri

This issue says "Migrate code to use self_cell instead." That page says "It has undergone community code review from experienced Rust users." Looking at the review, issues were found and fixed earlier on, but my interpretation of the end of the thread is more that folks stopped responding with concerns, so confidence is now assumed but still not proven. The same was true of most (all?) other crates trying to solve the same problem, until enough people did find the unsoundness holes unique to each crate.

I've come across the zip example bevor, and even considered adding support for mutable access to the owner here https://github.com/Voultapher/self_cell/pull/36. See the last comment why I decided not to pursue this. Looking at the specific example, really what is the purpose of storing the lazy ZipReader result? IMO that's bit of bad design on the part of the zip crate. The stdlib APIs consume reader, allowing you to abstract over creation logic. If what you need to store, needs further pre-processing, why not pull that out? Specifically here, what is the point of having a self-referential struct that contains an owner ZipArchive that you will no longer be allowed to mutate. And a lazy reader ZipReader that you can then use to really read the file? If you need to abstract over the construction logic you could return (ZipArchive, Box ZipReader>), if you want to return the content you can return (ZipArchive, Vec) allowing further use of ZipArchive.

As the author of self_cell I can attest, that writing unsafe lifetime abstractions is exceedingly tricky and you will get it wrong, repeatedly. I'm not sure these problems in owning_ref can be solved without a serious overhaul of the API. For one it tracks too little information, both ouroboros and self_cell independently reached the conclusion that you have to mark the dependent as either covariant or not_covariant over the owner lifetime, and prohibit ever leaking direct references if the dependent is not_covariant. But the fun doesn't stop there, if the owner can have a lifetime too, things get extra tricky. If you want to dive deeper take a look at this discussion https://github.com/Voultapher/self_cell/pull/29.

Grouping the source and derived AST in the same struct without leaking the lifetime is something that greatly helped keep the API sane. Shameless plug https://github.com/Voultapher/self_cell

Thanks, I'll incorporate that into https://github.com/Voultapher/once_self_cell/issues/5

>While we are many missing language features away from this being the case, the noalias case is also magic descended upon box itself, with no user code ever having access to it.

I'm not sure why the author thinks there's magic behind Box. Box is not a special case of `noalias`. Run this snippet with miri and you'll see the same issue: https://play.rust-lang.org/?version=stable&mode=debug&editio...

`Box` _does_ have an expectation that its inner pointer is not aliased to another Box (even if used for readonly operations). See: https://github.com/rust-lang/miri/issues/1800#issuecomment-8...)

Miri [0] is an interpreter for the mid-level intermediate representation (MIR) generated by the Rust compiler. MIR is input for more processing steps of the compiler. However miri also runs MIR directly. This means miri is a VM. Of course it's not a bytecode VM, because MIR is not a bytecode AFAIK. I still think that miri is a interesting example.

And why does miri exist?

It is a lot slower. However it can check for some undefined behavior.

[0]: https://github.com/rust-lang/miri

Provenance is a dynamic property of pointer values. The actual underlying rules that a program must follow, even when using raw pointers and `unsafe`, are written in terms of provenance. Miri (https://github.com/rust-lang/miri) represents provenance as an actual value stored alongside each pointer's address, so it can check for violations of these rules.

Lifetimes are a static approximation of provenance. They are erased after being validated by the borrow checker, and do not exist in Miri or have any impact on what transformations the optimizer may perform. In other words, the provenance rules allow a superset of what the borrow checker allows.

There has been discussion of doing this with MIRI, which would be easier than all of rustc.

This issue has been fixed: https://github.com/rust-lang/miri/issues/2964

Actually, I've done more advanced tests with MIRI (see https://github.com/rust-lang/miri/issues/2920 for example) which allowed me to fix some issues. I've also made the code compatible with loom, but I didn't found the time yet to write and execute loom tests. That's on the TODO-list, and I need to track it with an issue too.

He is one of the big brains behind Miri, which is a interpreter that runs on the MIR (compiler representation between human code and asm/machine code) and detects undefined behavior. Super useful tool for language safety, pretty interesting on its own.

I would also run your tests in Miri (https://github.com/rust-lang/miri) to try to cover more bases.