@@ -43,8 +43,12 @@ use crate::convert::TryInto as _;
4343use crate :: slice:: memchr;
4444use crate :: { cmp, fmt} ;
4545
46+ use safety:: { requires, ensures} ;
47+
4648#[ cfg( kani) ]
4749use crate :: kani;
50+ #[ cfg( kani) ]
51+ use crate :: kani:: mem:: same_allocation;
4852
4953// Pattern
5054
@@ -1885,6 +1889,7 @@ fn simd_contains(needle: &str, haystack: &str) -> Option<bool> {
18851889/// Both slices must have the same length.
18861890#[ cfg( all( target_arch = "x86_64" , target_feature = "sse2" ) ) ] // only called on x86
18871891#[ inline]
1892+ #[ requires( x. len( ) == y. len( ) ) ]
18881893unsafe fn small_slice_eq ( x : & [ u8 ] , y : & [ u8 ] ) -> bool {
18891894 debug_assert_eq ! ( x. len( ) , y. len( ) ) ;
18901895 // This function is adapted from
@@ -1951,13 +1956,37 @@ unsafe fn small_slice_eq(x: &[u8], y: &[u8]) -> bool {
19511956#[ cfg( kani) ]
19521957#[ unstable( feature = "kani" , issue = "none" ) ]
19531958pub mod verify {
1959+ use super :: * ;
1960+
1961+ pub fn any_slice_of_array < T , const LENGTH : usize > ( arr : & [ T ; LENGTH ] ) -> & [ T ] {
1962+ let ( from, to) = any_range :: < LENGTH > ( ) ;
1963+ & arr[ from..to]
1964+ }
1965+
1966+ /// A mutable version of the previous function
1967+ pub fn any_slice_of_array_mut < T , const LENGTH : usize > ( arr : & mut [ T ; LENGTH ] ) -> & mut [ T ] {
1968+ let ( from, to) = any_range :: < LENGTH > ( ) ;
1969+ & mut arr[ from..to]
1970+ }
1971+
1972+ fn any_range < const LENGTH : usize > ( ) -> ( usize , usize ) {
1973+ let from: usize = kani:: any ( ) ;
1974+ let to: usize = kani:: any ( ) ;
1975+ kani:: assume ( to <= LENGTH ) ;
1976+ kani:: assume ( from <= to) ;
1977+ ( from, to)
1978+ }
1979+
19541980 #[ cfg( all( target_arch = "x86_64" , target_feature = "sse2" ) ) ] // only called on x86
19551981 #[ kani:: proof]
19561982 pub fn check_small_slice_eq ( ) {
1957- let _ = Box :: new ( 0 ) ;
19581983 const ARR_SIZE : usize = 1000 ;
1959- let x: [ i32 ; ARR_SIZE ] = kani:: any ( ) ;
1960- let y: [ i32 ; ARR_SIZE ] = kani:: any ( ) ;
1961- small_slice_eq ( x, y) ;
1984+ let x: [ u8 ; ARR_SIZE ] = kani:: any ( ) ;
1985+ let y: [ u8 ; ARR_SIZE ] = kani:: any ( ) ;
1986+ let xs = any_slice_of_array ( & x) ;
1987+ let ys = any_slice_of_array ( & y) ;
1988+ unsafe {
1989+ small_slice_eq ( xs, ys) ;
1990+ }
19621991 }
19631992}
0 commit comments