Add expose_provenance and from_exposed_provenance on NonNull

[RalfJung]

Proposal

Problem statement

expose_provenance and from_exposed_provenance exist on raw pointers but not on NonNull.

Motivating examples or use cases

This seems like a simple oversight; to my knowledge we generally aim for API consistency between NonNull and raw pointers.

Solution sketch

impl<T> NonNull<T> {
    pub fn expose_provenance(self) -> NonZero<usize>;
    pub fn from_exposed_provenance(addr: NonZero<usize>) -> Self;
}

Alternatives

We could do nothing.

Links and related work

• stabilize Strict Provenance and Exposed Provenance APIs rust#130350

What happens now?

This issue contains an API change proposal (or ACP) and is part of the libs-api team feature lifecycle. Once this issue is filed, the libs-api team will review open proposals as capability becomes available. Current response times do not have a clear estimate, but may be up to several months.

Possible responses

The libs team may respond in various different ways. First, the team will consider the problem (this doesn't require any concrete solution or alternatives to have been proposed):

• We think this problem seems worth solving, and the standard library might be the right place to solve it.
• We think that this probably doesn't belong in the standard library.

Second, if there's a concrete solution:

• We think this specific solution looks roughly right, approved, you or someone else should implement this. (Further review will still happen on the subsequent implementation PR.)
• We're not sure this is the right solution, and the alternatives or other materials don't give us enough information to be sure about that. Here are some questions we have that aren't answered, or rough ideas about alternatives we'd want to see discussed.

[kennytm]

while std::ptr::with_exposed_provenance::<T> requires T: Sized, <*const T>::expose_provenance has no such requirement. So for consistency NonNull<T>::expose_provenance should also allow unsized T.

impl<T: ?Sized> NonNull<T> {
    pub fn expose_provenance(self) -> NonZero<usize>;
}
impl<T> NonNull<T> { // or better T: ?Sized + Thin
    pub fn from_exposed_provenance(addr: NonZero<usize>) -> Self;
}

[traviscross]

This was discussed in the libs-api call today. The conclusion was, "ship it, inclusive of the minor fix mentioned by @kennytm." That is, this ACP is accepted, modulo that fix.

[RalfJung]

Turns out there's another function missing on NonNull: without_provenance. Could someone reopen the issue or should I file a new ACP?

[RalfJung]

Tracking issue: rust-lang/rust#135243
Implementation PR: rust-lang/rust#135242