add extended example from doener

nikomatsakis · nikomatsakis · commit f0daa526bdd3 · 2016-02-24T12:06:44.000-05:00
diff --git a/litmus_tests/usize_transfer.md b/litmus_tests/usize_transfer.md
@@ -0,0 +1,38 @@
+### Example
+
+```rust
+fn foo(x: &i32) -> usize {
+    x as *const _ as usize
+}
+
+fn bar(x: usize) -> i32 {
+    let y: &i32 = unsafe { std::mem::transmute(x as *const i32) };
+    *y
+}
+
+fn main() {
+    let x = 2;
+    println!("{}", bar(foo(&x)));
+}
+```
+
+### Explanation
+
+In this example, the value `x` is cast to a `usize` and then
+transmitted to `bar`, which then casts back to a pointer.  `bar` is
+declared as a safe function: strictly speaking, this seems
+semantically incorrect, because in fact it cannot accept any `usize`
+as argument. Rather, its inputs must meet very specific criteria (it
+must be a valid pointer that can be dereferenced). Nonetheless, the
+user has incorrectly put an unsafe block in the body, rather than in
+the signature, and so the compiler accepts this code.
+
+Either something in this example must be UB or else we have to be
+**very** limited in our ability to add "nocapture" annotations.  See
+the ["nocapture by safe fn"][nocap] example for further thoughts.
+
+[nocap]: ../optimizations/nocapture_by_safe_fn.md
+
+### Source
+
+doener on IRC
diff --git a/optimizations/nocapture_by_safe_fn.md b/optimizations/nocapture_by_safe_fn.md
@@ -50,6 +50,18 @@ can always assume that.
 - `escape_as_vec` -- variant on the previous case where it seems like
   we should be able to assume nocapture, even though the return type
   contains a `*const i32`.
+  
+nmatsakis notes: One possibility is that all of these examples *can
+be* legal, depending on the caller. That is, looking specifically as
+`escape_as_usize`, if the caller gets back a `usize` and transmutes it
+to a pointer which is then dereferenced, perhaps we can simply have
+very conservative rules on the caller because they have created a
+pointer with no known origin. However, this gets complicated if the
+caller passes the `usize` elsewhere without adding proper unsafe
+blocks; see the ["usize transfer"][ut] litmus test for an example of
+why.
+
+[ut]: ../litmus_tests/usize_transfer.md
 
 ### Source
 
