Struct ConstNonNull

pub struct ConstNonNull<T: ?Sized> { /* private fields */ }

*mut T but non-zero and covariant.

This is often the correct thing to use when building data structures using raw pointers, but is ultimately more dangerous to use because of its additional properties. If you’re not sure if you should use NonNull<T>, just use *mut T!

Unlike *mut T, the pointer must always be non-null, even if the pointer is never dereferenced. This is so that enums may use this forbidden value as a discriminant – Option<NonNull<T>> has the same size as *mut T. However the pointer may still dangle if it isn’t dereferenced.

Unlike *mut T, NonNull<T> was chosen to be covariant over T. This makes it possible to use NonNull<T> when building covariant types, but introduces the risk of unsoundness if used in a type that shouldn’t actually be covariant. (The opposite choice was made for *mut T even though technically the unsoundness could only be caused by calling unsafe functions.)

Covariance is correct for most safe abstractions, such as Box, Rc, Arc, Vec, and LinkedList. This is the case because they provide a public API that follows the normal shared XOR mutable rules of Rust.

If your type cannot safely be covariant, you must ensure it contains some additional field to provide invariance. Often this field will be a PhantomData type like PhantomData<Cell<T>> or PhantomData<&'a mut T>.

Notice that NonNull<T> has a From instance for &T. However, this does not change the fact that mutating through a (pointer derived from a) shared reference is undefined behavior unless the mutation happens inside an UnsafeCell<T>. The same goes for creating a mutable reference from a shared reference. When using this From instance without an UnsafeCell<T>, it is your responsibility to ensure that as_mut is never called, and as_ptr is never used for mutation.

Representation

Thanks to the null pointer optimization, NonNull<T> and Option<NonNull<T>> are guaranteed to have the same size and alignment:

use std::ptr::NonNull;

assert_eq!(size_of::<NonNull<i16>>(), size_of::<Option<NonNull<i16>>>());
assert_eq!(align_of::<NonNull<i16>>(), align_of::<Option<NonNull<i16>>>());

assert_eq!(size_of::<NonNull<str>>(), size_of::<Option<NonNull<str>>>());
assert_eq!(align_of::<NonNull<str>>(), align_of::<Option<NonNull<str>>>());

Implementations

impl<T: Sized> ConstNonNull<T>

pub const fn dangling() -> Self

Creates a new NonNull that is dangling, but well-aligned.

This is useful for initializing types which lazily allocate, like Vec::new does.

Note that the pointer value may potentially represent a valid pointer to a T, which means this must not be used as a “not yet initialized” sentinel value. Types that lazily allocate must track initialization by some other means.

Examples

use std::ptr::NonNull;

let ptr = NonNull::<u32>::dangling();
// Important: don't try to access the value of `ptr` without
// initializing it first! The pointer is not null but isn't valid either!

pub const unsafe fn as_uninit_ref<'a>(self) -> &'a MaybeUninit<T>

Returns a shared references to the value. In contrast to as_ref, this does not require that the value has to be initialized.

For the mutable counterpart see as_uninit_mut.

Safety

When calling this method, you have to ensure that the pointer is convertible to a reference. Note that because the created reference is to MaybeUninit<T>, the source pointer can point to uninitialized memory.

pub const fn from_unique(unique: Unique<T>) -> Self

Create a new ConstNonNull from a Unique.

pub const fn from_non_null(pointer: NonNull<T>) -> Self

Create a new ConstNonNull from a NonNull<T>.

impl<T: ?Sized> ConstNonNull<T>

pub const unsafe fn new_unchecked(ptr: *const T) -> Self

Creates a new NonNull.

Safety

ptr must be non-null.

Examples

use std::ptr::NonNull;

let mut x = 0u32;
let ptr = unsafe { NonNull::new_unchecked(&mut x as *mut _) };

Incorrect usage of this function:

use std::ptr::NonNull;

// NEVER DO THAT!!! This is undefined behavior. ⚠️
let ptr = unsafe { NonNull::<u32>::new_unchecked(std::ptr::null_mut()) };

pub const fn new(ptr: *mut T) -> Option<Self>

Creates a new NonNull if ptr is non-null.

Panics during const evaluation

This method will panic during const evaluation if the pointer cannot be determined to be null or not. See is_null for more information.

Examples

use std::ptr::NonNull;

let mut x = 0u32;
let ptr = NonNull::<u32>::new(&mut x as *mut _).expect("ptr is null!");

if let Some(ptr) = NonNull::<u32>::new(std::ptr::null_mut()) {
    unreachable!();
}

pub const fn from_ref(r: &T) -> Self

Converts a reference to a NonNull pointer.

pub fn addr(self) -> NonZero<usize>

Gets the “address” portion of the pointer.

For more details, see the equivalent method on a raw pointer, pointer::addr.

This is a Strict Provenance API.

pub fn with_addr(self, addr: NonZero<usize>) -> Self

Creates a new pointer with the given address and the provenance of self.

For more details, see the equivalent method on a raw pointer, pointer::with_addr.

This is a Strict Provenance API.

pub fn map_addr(self, f: impl FnOnce(NonZero<usize>) -> NonZero<usize>) -> Self

Creates a new pointer by mapping self’s address to a new one, preserving the provenance of self.

For more details, see the equivalent method on a raw pointer, pointer::map_addr.

This is a Strict Provenance API.

pub const fn as_ptr(self) -> *const T

Acquires the underlying *mut pointer.

Examples

use std::ptr::NonNull;

let mut x = 0u32;
let ptr = NonNull::new(&mut x).expect("ptr is null!");

let x_value = unsafe { *ptr.as_ptr() };
assert_eq!(x_value, 0);

unsafe { *ptr.as_ptr() += 2; }
let x_value = unsafe { *ptr.as_ptr() };
assert_eq!(x_value, 2);

pub const unsafe fn as_ref<'a>(&self) -> &'a T

Returns a shared reference to the value. If the value may be uninitialized, as_uninit_ref must be used instead.

For the mutable counterpart see as_mut.

Safety

When calling this method, you have to ensure that the pointer is convertible to a reference.

Examples

use std::ptr::NonNull;

let mut x = 0u32;
let ptr = NonNull::new(&mut x as *mut _).expect("ptr is null!");

let ref_x = unsafe { ptr.as_ref() };
println!("{ref_x}");

pub const fn cast<U>(self) -> ConstNonNull<U>

Casts to a pointer of another type.

Examples

use std::ptr::NonNull;

let mut x = 0u32;
let ptr = NonNull::new(&mut x as *mut _).expect("null pointer");

let casted_ptr = ptr.cast::<i8>();
let raw_ptr: *mut i8 = casted_ptr.as_ptr();

pub const unsafe fn offset(self, count: isize) -> Self

where T: Sized,

Adds an offset to a pointer.

count is in units of T; e.g., a count of 3 represents a pointer offset of 3 * size_of::<T>() bytes.

Safety

If any of the following conditions are violated, the result is Undefined Behavior:

• The computed offset, count * size_of::<T>() bytes, must not overflow isize.

• If the computed offset is non-zero, then self must be derived from a pointer to some allocated object, and the entire memory range between self and the result must be in bounds of that allocated object. In particular, this range must not “wrap around” the edge of the address space.

Allocated objects can never be larger than isize::MAX bytes, so if the computed offset stays in bounds of the allocated object, it is guaranteed to satisfy the first requirement. This implies, for instance, that vec.as_ptr().add(vec.len()) (for vec: Vec<T>) is always safe.

Examples

use std::ptr::NonNull;

let mut s = [1, 2, 3];
let ptr: NonNull<u32> = NonNull::new(s.as_mut_ptr()).unwrap();

unsafe {
    println!("{}", ptr.offset(1).read());
    println!("{}", ptr.offset(2).read());
}

pub const unsafe fn add(self, count: usize) -> Self

where T: Sized,

Adds an offset to a pointer (convenience for .offset(count as isize)).

count is in units of T; e.g., a count of 3 represents a pointer offset of 3 * size_of::<T>() bytes.

Safety

If any of the following conditions are violated, the result is Undefined Behavior:

• The computed offset, count * size_of::<T>() bytes, must not overflow isize.

• If the computed offset is non-zero, then self must be derived from a pointer to some allocated object, and the entire memory range between self and the result must be in bounds of that allocated object. In particular, this range must not “wrap around” the edge of the address space.

Allocated objects can never be larger than isize::MAX bytes, so if the computed offset stays in bounds of the allocated object, it is guaranteed to satisfy the first requirement. This implies, for instance, that vec.as_ptr().add(vec.len()) (for vec: Vec<T>) is always safe.

Examples

use std::ptr::NonNull;

let s: &str = "123";
let ptr: NonNull<u8> = NonNull::new(s.as_ptr().cast_mut()).unwrap();

unsafe {
    println!("{}", ptr.add(1).read() as char);
    println!("{}", ptr.add(2).read() as char);
}

pub const unsafe fn byte_add(self, count: usize) -> Self

Calculates the offset from a pointer in bytes (convenience for .byte_offset(count as isize)).

count is in units of bytes.

This is purely a convenience for casting to a u8 pointer and using add on it. See that method for documentation and safety requirements.

For non-Sized pointees this operation changes only the data pointer, leaving the metadata untouched.

Safety

valid pointer

pub const unsafe fn sub(self, count: usize) -> Self

where T: Sized,

Subtracts an offset from a pointer (convenience for .offset((count as isize).wrapping_neg())).

count is in units of T; e.g., a count of 3 represents a pointer offset of 3 * size_of::<T>() bytes.

Safety

If any of the following conditions are violated, the result is Undefined Behavior:

• The computed offset, count * size_of::<T>() bytes, must not overflow isize.

• If the computed offset is non-zero, then self must be derived from a pointer to some allocated object, and the entire memory range between self and the result must be in bounds of that allocated object. In particular, this range must not “wrap around” the edge of the address space.

Allocated objects can never be larger than isize::MAX bytes, so if the computed offset stays in bounds of the allocated object, it is guaranteed to satisfy the first requirement. This implies, for instance, that vec.as_ptr().add(vec.len()) (for vec: Vec<T>) is always safe.

Examples

use std::ptr::NonNull;

let s: &str = "123";

unsafe {
    let end: NonNull<u8> = NonNull::new(s.as_ptr().cast_mut()).unwrap().add(3);
    println!("{}", end.sub(1).read() as char);
    println!("{}", end.sub(2).read() as char);
}

pub const unsafe fn byte_sub(self, count: usize) -> Self

Calculates the offset from a pointer in bytes (convenience for .byte_offset((count as isize).wrapping_neg())).

count is in units of bytes.

This is purely a convenience for casting to a u8 pointer and using sub on it. See that method for documentation and safety requirements.

For non-Sized pointees this operation changes only the data pointer, leaving the metadata untouched.

Safety

valid pointer

pub const unsafe fn offset_from(self, origin: ConstNonNull<T>) -> isize

where T: Sized,

Calculates the distance between two pointers within the same allocation. The returned value is in units of T: the distance in bytes divided by mem::size_of::<T>().

This is equivalent to (self as isize - origin as isize) / (mem::size_of::<T>() as isize), except that it has a lot more opportunities for UB, in exchange for the compiler better understanding what you are doing.

The primary motivation of this method is for computing the len of an array/slice of T that you are currently representing as a “start” and “end” pointer (and “end” is “one past the end” of the array). In that case, end.offset_from(start) gets you the length of the array.

All of the following safety requirements are trivially satisfied for this usecase.

Safety

If any of the following conditions are violated, the result is Undefined Behavior:

• self and origin must either

  • point to the same address, or
  • both be derived from a pointer to the same allocated object, and the memory range between the two pointers must be in bounds of that object. (See below for an example.)

• The distance between the pointers, in bytes, must be an exact multiple of the size of T.

As a consequence, the absolute distance between the pointers, in bytes, computed on mathematical integers (without “wrapping around”), cannot overflow an isize. This is implied by the in-bounds requirement, and the fact that no allocated object can be larger than isize::MAX bytes.

The requirement for pointers to be derived from the same allocated object is primarily needed for const-compatibility: the distance between pointers into different allocated objects is not known at compile-time. However, the requirement also exists at runtime and may be exploited by optimizations. If you wish to compute the difference between pointers that are not guaranteed to be from the same allocation, use (self as isize - origin as isize) / mem::size_of::<T>().

Panics

This function panics if T is a Zero-Sized Type (“ZST”).

Examples

Basic usage:

use std::ptr::NonNull;

let a = [0; 5];
let ptr1: NonNull<u32> = NonNull::from(&a[1]);
let ptr2: NonNull<u32> = NonNull::from(&a[3]);
unsafe {
    assert_eq!(ptr2.offset_from(ptr1), 2);
    assert_eq!(ptr1.offset_from(ptr2), -2);
    assert_eq!(ptr1.offset(2), ptr2);
    assert_eq!(ptr2.offset(-2), ptr1);
}

Incorrect usage:

use std::ptr::NonNull;

let ptr1 = NonNull::new(Box::into_raw(Box::new(0u8))).unwrap();
let ptr2 = NonNull::new(Box::into_raw(Box::new(1u8))).unwrap();
let diff = (ptr2.addr().get() as isize).wrapping_sub(ptr1.addr().get() as isize);
// Make ptr2_other an "alias" of ptr2.add(1), but derived from ptr1.
let diff_plus_1 = diff.wrapping_add(1);
let ptr2_other = NonNull::new(ptr1.as_ptr().wrapping_byte_offset(diff_plus_1)).unwrap();
assert_eq!(ptr2.addr(), ptr2_other.addr());
// Since ptr2_other and ptr2 are derived from pointers to different objects,
// computing their offset is undefined behavior, even though
// they point to addresses that are in-bounds of the same object!

let one = unsafe { ptr2_other.offset_from(ptr2) }; // Undefined Behavior! ⚠️

pub const unsafe fn byte_offset_from<U: ?Sized>( self, origin: ConstNonNull<U>, ) -> isize

Calculates the distance between two pointers within the same allocation. The returned value is in units of bytes.

This is purely a convenience for casting to a u8 pointer and using offset_from on it. See that method for documentation and safety requirements.

For non-Sized pointees this operation considers only the data pointers, ignoring the metadata.

pub const unsafe fn read(self) -> T

where T: Sized,

Reads the value from self without moving it. This leaves the memory in self unchanged.

See ptr::read for safety concerns and examples.

pub unsafe fn read_volatile(self) -> T

where T: Sized,

Performs a volatile read of the value from self without moving it. This leaves the memory in self unchanged.

Volatile operations are intended to act on I/O memory, and are guaranteed to not be elided or reordered by the compiler across other volatile operations.

See ptr::read_volatile for safety concerns and examples.

pub const unsafe fn read_unaligned(self) -> T

where T: Sized,

Reads the value from self without moving it. This leaves the memory in self unchanged.

Unlike read, the pointer may be unaligned.

See ptr::read_unaligned for safety concerns and examples.

pub const unsafe fn copy_to(self, dest: NonNull<T>, count: usize)

where T: Sized,

Copies count * size_of<T> bytes from self to dest. The source and destination may overlap.

NOTE: this has the same argument order as ptr::copy.

See ptr::copy for safety concerns and examples.

pub const unsafe fn copy_to_nonoverlapping(self, dest: NonNull<T>, count: usize)

where T: Sized,

Copies count * size_of<T> bytes from self to dest. The source and destination may not overlap.

NOTE: this has the same argument order as ptr::copy_nonoverlapping.

See ptr::copy_nonoverlapping for safety concerns and examples.

pub fn align_offset(self, align: usize) -> usize

where T: Sized,

Computes the offset that needs to be applied to the pointer in order to make it aligned to align.

If it is not possible to align the pointer, the implementation returns usize::MAX.

The offset is expressed in number of T elements, and not bytes.

There are no guarantees whatsoever that offsetting the pointer will not overflow or go beyond the allocation that the pointer points into. It is up to the caller to ensure that the returned offset is correct in all terms other than alignment.

When this is called during compile-time evaluation (which is unstable), the implementation may return usize::MAX in cases where that can never happen at runtime. This is because the actual alignment of pointers is not known yet during compile-time, so an offset with guaranteed alignment can sometimes not be computed. For example, a buffer declared as [u8; N] might be allocated at an odd or an even address, but at compile-time this is not yet known, so the execution has to be correct for either choice. It is therefore impossible to find an offset that is guaranteed to be 2-aligned. (This behavior is subject to change, as usual for unstable APIs.)

Panics

The function panics if align is not a power-of-two.

Examples

Accessing adjacent u8 as u16

use std::mem::align_of;
use std::ptr::NonNull;

let x = [5_u8, 6, 7, 8, 9];
let ptr = NonNull::new(x.as_ptr() as *mut u8).unwrap();
let offset = ptr.align_offset(align_of::<u16>());

if offset < x.len() - 1 {
    let u16_ptr = ptr.add(offset).cast::<u16>();
    assert!(u16_ptr.read() == u16::from_ne_bytes([5, 6]) || u16_ptr.read() == u16::from_ne_bytes([6, 7]));
} else {
    // while the pointer can be aligned via `offset`, it would point
    // outside the allocation
}

pub fn is_aligned(self) -> bool

where T: Sized,

Returns whether the pointer is properly aligned for T.

Examples

use std::ptr::NonNull;

// On some platforms, the alignment of i32 is less than 4.
#[repr(align(4))]
struct AlignedI32(i32);

let data = AlignedI32(42);
let ptr = NonNull::<AlignedI32>::from(&data);

assert!(ptr.is_aligned());
assert!(!NonNull::new(ptr.as_ptr().wrapping_byte_add(1)).unwrap().is_aligned());

impl<T> ConstNonNull<[T]>

pub const fn slice_from_raw_parts(data: ConstNonNull<T>, len: usize) -> Self

Creates a non-null raw slice from a thin pointer and a length.

The len argument is the number of elements, not the number of bytes.

This function is safe, but dereferencing the return value is unsafe. See the documentation of slice::from_raw_parts for slice safety requirements.

Examples

use std::ptr::NonNull;

// create a slice pointer when starting out with a pointer to the first element
let mut x = [5, 6, 7];
let nonnull_pointer = NonNull::new(x.as_mut_ptr()).unwrap();
let slice = NonNull::slice_from_raw_parts(nonnull_pointer, 3);
assert_eq!(unsafe { slice.as_ref()[2] }, 7);

(Note that this example artificially demonstrates a use of this method, but let slice = NonNull::from(&x[..]); would be a better way to write code like this.)

pub const fn len(self) -> usize

Returns the length of a non-null raw slice.

The returned value is the number of elements, not the number of bytes.

This function is safe, even when the non-null raw slice cannot be dereferenced to a slice because the pointer does not have a valid address.

Examples

use std::ptr::NonNull;

let slice: NonNull<[i8]> = NonNull::slice_from_raw_parts(NonNull::dangling(), 3);
assert_eq!(slice.len(), 3);

pub const fn is_empty(self) -> bool

Returns true if the non-null raw slice has a length of 0.

Examples

use std::ptr::NonNull;

let slice: NonNull<[i8]> = NonNull::slice_from_raw_parts(NonNull::dangling(), 3);
assert!(!slice.is_empty());

pub const fn as_non_null_ptr(self) -> ConstNonNull<T>

Returns a non-null pointer to the slice’s buffer.

Examples

#![feature(slice_ptr_get)]
use std::ptr::NonNull;

let slice: NonNull<[i8]> = NonNull::slice_from_raw_parts(NonNull::dangling(), 3);
assert_eq!(slice.as_non_null_ptr(), NonNull::<i8>::dangling());

Trait Implementations

impl<T: ?Sized> Clone for ConstNonNull<T>

fn clone(&self) -> Self

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<T: ?Sized> Debug for ConstNonNull<T>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<T: ?Sized> From<&T> for ConstNonNull<T>

fn from(r: &T) -> Self

Converts a &T to a NonNull<T>.

This conversion is safe and infallible since references cannot be null.

impl<T: ?Sized> From<Unique<T>> for ConstNonNull<T>

fn from(unique: Unique<T>) -> Self

Converts to this type from the input type.

impl<T: ?Sized> Hash for ConstNonNull<T>

fn hash<H: Hasher>(&self, state: &mut H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl<T: ?Sized> Ord for ConstNonNull<T>

fn cmp(&self, other: &Self) -> Ordering

This method returns an Ordering between self and other.

fn max(self, other: Self) -> Self

where Self: Sized,

Compares and returns the maximum of two values.

fn min(self, other: Self) -> Self

where Self: Sized,

Compares and returns the minimum of two values.

fn clamp(self, min: Self, max: Self) -> Self

where Self: Sized,

Restrict a value to a certain interval.

impl<T: ?Sized> PartialEq for ConstNonNull<T>

fn eq(&self, other: &Self) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl<T: ?Sized> PartialOrd for ConstNonNull<T>

fn partial_cmp(&self, other: &Self) -> Option<Ordering>

This method returns an ordering between self and other values if one exists.

fn lt(&self, other: &Rhs) -> bool

Tests less than (for self and other) and is used by the < operator.

fn le(&self, other: &Rhs) -> bool

Tests less than or equal to (for self and other) and is used by the <= operator.

fn gt(&self, other: &Rhs) -> bool

Tests greater than (for self and other) and is used by the > operator.

fn ge(&self, other: &Rhs) -> bool

Tests greater than or equal to (for self and other) and is used by the >= operator.

impl<T: ?Sized> Pointer for ConstNonNull<T>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<T: ?Sized> Copy for ConstNonNull<T>

impl<T: ?Sized> Eq for ConstNonNull<T>