starlark-rust

Reading a value's vtable creates an instance of , a union whose largest variant (the 16-byte field) sets its size. However, produces a zero-sized value with an 8 byte header, so the reference claims 8 bytes past the bounds of the allocation.

This is a follow-up on #199. This does the following: Add constructor on records, allowing you to create records. Make FrozenRecord and FrozenRecordType pub, allowing you to work directly with frozen records (in my use case, for example, record types are frozen into globals so we don't need unfrozen record types). Add len to record types, allowing you to preallocate capacity via Vec::with_capacity before calling above.

Slicing a list, string or tuple with a stride of panics instead of evaluating. Verified at (current ). The published crate has the identical code. Reproduction Same for and . is unaffected — it is lazy and does not reach . Root cause (): is an , and the absolute value of is not representable as an , so overflows. The value reaches line 133 because the two earlier exits do not cover it — returns at , and only reverses. The boundary is unpacked with , so is an accepted value. Its neighbours on both sides behave correctly: So it is a single value between a correct evaluation and a clean error, rather than a range problem. Scope This affects builds with overflow checks on — debug builds and, notably, , since the profile enables by default. With overflow checks off, wraps to , and since for every in-range index, only index survives the filter — which after the reverse is the correct element. I checked a release build against CPython for , and and the output matched in each case. So this is a panic, not a wrong-answer bug, and I don't want to overstate it. Suggested fix returns a , which represents exactly: I applied that locally. The three panicking cases return , and — matching CPython — and passes: 946 + 152 tests, 0 failures*. Happy to send a PR. How this was found Found while evaluating Rust verification tooling. Working this through the midas-lex guidance workflow identifies the spec owner here as a precondition: requires its argument to have a representable absolute value, and unpacking a stride as does not establish that. Stating the obligation in Verus proves that is the unique* accepted stride that violates it, and that is total over the whole accepted range — which is where the boundary table above came from.