Find a file
León Orell Valerian Liehr 4c11087e51 Rollup merge of #128045 - pnkfelix:rustc-contracts, r=oli-obk
#[contracts::requires(...)]  + #[contracts::ensures(...)]

cc https://github.com/rust-lang/rust/issues/128044

Updated contract support: attribute syntax for preconditions and postconditions, implemented via a series of desugarings  that culminates in:
1. a compile-time flag (`-Z contract-checks`) that, similar to `-Z ub-checks`, attempts to ensure that the decision of enabling/disabling contract checks is delayed until the end user program is compiled,
2. invocations of lang-items that handle invoking the precondition,  building a checker for the post-condition, and invoking that post-condition checker at the return sites for the function, and
3. intrinsics for the actual evaluation of pre- and post-condition predicates that third-party verification tools can intercept and reinterpret for their own purposes (e.g. creating shims of behavior that abstract away the function body and replace it solely with the pre- and post-conditions).

Known issues:

 * My original intent, as described in the MCP (https://github.com/rust-lang/compiler-team/issues/759) was   to have a rustc-prefixed attribute namespace (like   rustc_contracts::requires). But I could not get things working when I tried   to do rewriting via a rustc-prefixed builtin attribute-macro. So for now it  is called `contracts::requires`.

 * Our attribute macro machinery does not provide direct support for attribute arguments that are parsed like rust expressions. I spent some time trying to add that (e.g. something that would parse the attribute arguments as an AST while treating the remainder of the items as a token-tree), but its too big a lift for me to undertake. So instead I hacked in something approximating that goal, by semi-trivially desugaring the token-tree attribute contents into internal AST constucts. This may be too fragile for the long-term.
   * (In particular, it *definitely* breaks when you try to add a contract to a function like this: `fn foo1(x: i32) -> S<{ 23 }> { ... }`, because its token-tree based search for where to inject the internal AST constructs cannot immediately see that the `{ 23 }` is within a generics list. I think we can live for this for the short-term, i.e. land the work, and continue working on it while in parallel adding a new attribute variant that takes a token-tree attribute alongside an AST annotation, which would completely resolve the issue here.)

* the *intent* of `-Z contract-checks` is that it behaves like `-Z ub-checks`, in that we do not prematurely commit to including or excluding the contract evaluation in upstream crates (most notably, `core` and `std`). But the current test suite does not actually *check* that this is the case. Ideally the test suite would be extended with a multi-crate test that explores the matrix of enabling/disabling contracts on both the upstream lib and final ("leaf") bin crates.
2025-02-05 05:03:01 +01:00
.cargo Merge commit '0f8eabd623' into clippyup 2024-08-24 18:33:44 -04:00
.github Merge commit '51d49c1ae2' into clippy-subtree-update 2025-01-28 19:33:54 +01:00
book Convert two rustc_middle::lint functions to Span methods. 2025-02-02 13:57:34 +11:00
clippy_config Merge commit '51d49c1ae2' into clippy-subtree-update 2025-01-28 19:33:54 +01:00
clippy_dev Merge commit '51d49c1ae2' into clippy-subtree-update 2025-01-28 19:33:54 +01:00
clippy_dummy Merge commit '51d49c1ae2' into clippy-subtree-update 2025-01-28 19:33:54 +01:00
clippy_lints Rollup merge of #136422 - nnethercote:convert-lint-functions, r=Noratrieb 2025-02-02 18:05:24 +01:00
clippy_utils Rollup merge of #128045 - pnkfelix:rustc-contracts, r=oli-obk 2025-02-05 05:03:01 +01:00
etc/relicense Merge commit '83e42a2337' into clippyup 2023-04-11 15:31:08 +02:00
lintcheck Merge commit '51d49c1ae2' into clippy-subtree-update 2025-01-28 19:33:54 +01:00
rustc_tools_util Merge commit '51d49c1ae2' into clippy-subtree-update 2025-01-28 19:33:54 +01:00
src Some cleanups around EarlyDiagCtxt 2025-02-02 16:06:43 +00:00
tests Merge commit '51d49c1ae2' into clippy-subtree-update 2025-01-28 19:33:54 +01:00
util Merge commit '51d49c1ae2' into clippy-subtree-update 2025-01-28 19:33:54 +01:00
.editorconfig Merge commit '83e42a2337' into clippyup 2023-04-11 15:31:08 +02:00
.gitattributes git attribute macros not allowed in submodules 2020-03-29 06:58:37 -07:00
.gitignore Merge commit 'a109190d70' into clippy-subtree-update 2024-10-18 13:44:06 +02:00
.remarkrc Merge commit '61eb38aeda' into clippyup 2021-07-01 18:17:38 +02:00
build.rs Merge commit '4bdfb0741d' into clippyup 2022-12-17 14:12:54 +01:00
Cargo.toml Merge commit '51d49c1ae2' into clippy-subtree-update 2025-01-28 19:33:54 +01:00
CHANGELOG.md Merge commit '51d49c1ae2' into clippy-subtree-update 2025-01-28 19:33:54 +01:00
clippy.toml Merge commit '19e305bb57' into clippy-subtree-update 2025-01-09 18:57:00 +01:00
CODE_OF_CONDUCT.md Merge commit 'f4850f7292' into clippyup 2022-11-21 20:51:52 +01:00
CONTRIBUTING.md Merge commit '51d49c1ae2' into clippy-subtree-update 2025-01-28 19:33:54 +01:00
COPYRIGHT Merge commit '26ac6aab02' 2024-01-11 17:27:03 +01:00
LICENSE-APACHE Merge commit '26ac6aab02' 2024-01-11 17:27:03 +01:00
LICENSE-MIT Merge commit '26ac6aab02' 2024-01-11 17:27:03 +01:00
README.md Merge commit '51d49c1ae2' into clippy-subtree-update 2025-01-28 19:33:54 +01:00
rinja.toml Merge commit 'a109190d70' into clippy-subtree-update 2024-10-18 13:44:06 +02:00
rust-toolchain Merge commit '51d49c1ae2' into clippy-subtree-update 2025-01-28 19:33:54 +01:00
rustfmt.toml Merge commit '51d49c1ae2' into clippy-subtree-update 2025-01-28 19:33:54 +01:00
triagebot.toml Merge commit '51d49c1ae2' into clippy-subtree-update 2025-01-28 19:33:54 +01:00

Clippy

License: MIT OR Apache-2.0

A collection of lints to catch common mistakes and improve your Rust code.

There are over 750 lints included in this crate!

Lints are divided into categories, each with a default lint level. You can choose how much Clippy is supposed to annoy help you by changing the lint level by category.

Category Description Default level
clippy::all all lints that are on by default (correctness, suspicious, style, complexity, perf) warn/deny
clippy::correctness code that is outright wrong or useless deny
clippy::suspicious code that is most likely wrong or useless warn
clippy::style code that should be written in a more idiomatic way warn
clippy::complexity code that does something simple but in a complex way warn
clippy::perf code that can be written to run faster warn
clippy::pedantic lints which are rather strict or have occasional false positives allow
clippy::restriction lints which prevent the use of language and library features1 allow
clippy::nursery new lints that are still under development allow
clippy::cargo lints for the cargo manifest allow

More to come, please file an issue if you have ideas!

The restriction category should, emphatically, not be enabled as a whole. The contained lints may lint against perfectly reasonable code, may not have an alternative suggestion, and may contradict any other lints (including other categories). Lints should be considered on a case-by-case basis before enabling.


Table of contents:

Usage

Below are instructions on how to use Clippy as a cargo subcommand, in projects that do not use cargo, or in Travis CI.

As a cargo subcommand (cargo clippy)

One way to use Clippy is by installing Clippy through rustup as a cargo subcommand.

Step 1: Install Rustup

You can install Rustup on supported platforms. This will help us install Clippy and its dependencies.

If you already have Rustup installed, update to ensure you have the latest Rustup and compiler:

rustup update

Step 2: Install Clippy

Once you have rustup and the latest stable release (at least Rust 1.29) installed, run the following command:

rustup component add clippy

If it says that it can't find the clippy component, please run rustup self update.

Step 3: Run Clippy

Now you can run Clippy by invoking the following command:

cargo clippy

Automatically applying Clippy suggestions

Clippy can automatically apply some lint suggestions, just like the compiler. Note that --fix implies --all-targets, so it can fix as much code as it can.

cargo clippy --fix

Workspaces

All the usual workspace options should work with Clippy. For example the following command will run Clippy on the example crate:

cargo clippy -p example

As with cargo check, this includes dependencies that are members of the workspace, like path dependencies. If you want to run Clippy only on the given crate, use the --no-deps option like this:

cargo clippy -p example -- --no-deps

Using clippy-driver

Clippy can also be used in projects that do not use cargo. To do so, run clippy-driver with the same arguments you use for rustc. For example:

clippy-driver --edition 2018 -Cpanic=abort foo.rs

Note that clippy-driver is designed for running Clippy only and should not be used as a general replacement for rustc. clippy-driver may produce artifacts that are not optimized as expected, for example.

Travis CI

You can add Clippy to Travis CI in the same way you use it locally:

language: rust
rust:
  - stable
  - beta
before_script:
  - rustup component add clippy
script:
  - cargo clippy
  # if you want the build job to fail when encountering warnings, use
  - cargo clippy -- -D warnings
  # in order to also check tests and non-default crate features, use
  - cargo clippy --all-targets --all-features -- -D warnings
  - cargo test
  # etc.

Note that adding -D warnings will cause your build to fail if any warnings are found in your code. That includes warnings found by rustc (e.g. dead_code, etc.). If you want to avoid this and only cause an error for Clippy warnings, use #![deny(clippy::all)] in your code or -D clippy::all on the command line. (You can swap clippy::all with the specific lint category you are targeting.)

Configuration

Allowing/denying lints

You can add options to your code to allow/warn/deny Clippy lints:

  • the whole set of Warn lints using the clippy lint group (#![deny(clippy::all)]). Note that rustc has additional lint groups.

  • all lints using both the clippy and clippy::pedantic lint groups (#![deny(clippy::all)], #![deny(clippy::pedantic)]). Note that clippy::pedantic contains some very aggressive lints prone to false positives.

  • only some lints (#![deny(clippy::single_match, clippy::box_vec)], etc.)

  • allow/warn/deny can be limited to a single function or module using #[allow(...)], etc.

Note: allow means to suppress the lint for your code. With warn the lint will only emit a warning, while with deny the lint will emit an error, when triggering for your code. An error causes Clippy to exit with an error code, so is useful in scripts like CI/CD.

If you do not want to include your lint levels in your code, you can globally enable/disable lints by passing extra flags to Clippy during the run:

To allow lint_name, run

cargo clippy -- -A clippy::lint_name

And to warn on lint_name, run

cargo clippy -- -W clippy::lint_name

This also works with lint groups. For example, you can run Clippy with warnings for all lints enabled:

cargo clippy -- -W clippy::pedantic

If you care only about a single lint, you can allow all others and then explicitly warn on the lint(s) you are interested in:

cargo clippy -- -A clippy::all -W clippy::useless_format -W clippy::...

Configure the behavior of some lints

Some lints can be configured in a TOML file named clippy.toml or .clippy.toml. It contains a basic variable = value mapping e.g.

avoid-breaking-exported-api = false
disallowed-names = ["toto", "tata", "titi"]

The table of configurations contains all config values, their default, and a list of lints they affect. Each configurable lint , also contains information about these values.

For configurations that are a list type with default values such as disallowed-names, you can use the unique value ".." to extend the default values instead of replacing them.

# default of disallowed-names is ["foo", "baz", "quux"]
disallowed-names = ["bar", ".."] # -> ["bar", "foo", "baz", "quux"]

Note

clippy.toml or .clippy.toml cannot be used to allow/deny lints.

To deactivate the “for further information visit lint-link” message you can define the CLIPPY_DISABLE_DOCS_LINKS environment variable.

Specifying the minimum supported Rust version

Projects that intend to support old versions of Rust can disable lints pertaining to newer features by specifying the minimum supported Rust version (MSRV) in the Clippy configuration file.

msrv = "1.30.0"

Alternatively, the rust-version field in the Cargo.toml can be used.

# Cargo.toml
rust-version = "1.30"

The MSRV can also be specified as an attribute, like below.

#![feature(custom_inner_attributes)]
#![clippy::msrv = "1.30.0"]

fn main() {
  ...
}

You can also omit the patch version when specifying the MSRV, so msrv = 1.30 is equivalent to msrv = 1.30.0.

Note: custom_inner_attributes is an unstable feature, so it has to be enabled explicitly.

Lints that recognize this configuration option can be found here

Contributing

If you want to contribute to Clippy, you can find more information in CONTRIBUTING.md.

License

Copyright 2014-2024 The Rust Project Developers

Licensed under the Apache License, Version 2.0 <LICENSE-APACHE or https://www.apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or https://opensource.org/licenses/MIT>, at your option. Files in the project may not be copied, modified, or distributed except according to those terms.


  1. Some use cases for restriction lints include:

    ↩︎