Announcing Rust 1.41.0

The release combines a substantial trait-coherence relaxation with important Cargo, FFI, and standard-library changes.

Rust 1.41.0 relaxes the orphan rule to permit useful trait implementations involving a local type, makes cargo install update outdated packages, introduces a less conflict-prone format for new Cargo.lock files, and guarantees a carefully constrained ABI correspondence between Box<T> and C pointers. It also expands the standard library, starts landing MIR optimizations intended to improve compile time, and marks the last release at the current support level for 32-bit Apple targets.

Breaking News

Changes that may make code or platforms move

Compatibility notes

At least at present, avoid using Box<T> for functions defined in C and invoked from Rust. Mirror the C types as closely as possible: using Box<T> where C declares T* can lead to undefined behavior.
Users of Rust 1.41.0 should upgrade to Rust 1.41.1 as soon as possible because 1.41.0 introduced a soundness regression and a miscompilation that could cause segmentation faults.

Compatibility notes

Users of Rust 1.41.0 should upgrade as soon as possible. The two critical regressions fixed here do not affect earlier Rust releases.

Local trait parameters permit more foreign-type implementations

Rust’s orphan rule prevents ecosystem breakage when a dependency adds a trait implementation: an implementation is allowed only when either the trait or the implemented type is local to the current crate. Before Rust 1.41.0, its treatment of generics was unnecessarily strict and could make composition cumbersome or impossible even with workarounds such as the newtype pattern.

For example, Rust 1.40.0 rejected this conversion from a crate’s local BetterVec<T> to the standard library’s foreign Vec<T> because both From and Vec were foreign:

impl<T> From<BetterVec<T>> for Vec<T> {
    // ...
}

It is an instance of the following pattern:

impl<T> ForeignTrait<LocalType> for ForeignType<T> {
    // ...
}

Rust 1.41.0 permits the implementation because the foreign trait is parameterized by a local type. The precise generic coherence rules remain more involved; the stabilization report and RFC provide the details.

Cargo updates installed packages and reduces lockfile conflicts

Starting with Rust 1.41.0, cargo install updates an existing installation when a newer release of that crate is available. Previously, the only option was --force, which reinstalls the binary crate even when it is already up to date.

Cargo also introduces a new Cargo.lock format designed to avoid unnecessary merge conflicts when dependencies change on separate branches. Cargo uses the lockfile to record dependency versions and checksums for consistent builds. The new format applies to newly created lockfiles; existing lockfiles continue using the previous format. The design choices are described in the implementing pull request.

Box gains a constrained C-pointer ABI guarantee

For T: Sized, Rust 1.41.0 declares Box<T> representation- and ABI-compatible with C’s T*. An extern "C" Rust function called from C can therefore use Box<T> where its corresponding C declaration uses T*. For example:

// C header

// Returns ownership to the caller.
struct Foo* foo_new(void);

// Takes ownership from the caller; no-op when invoked with NULL.
void foo_delete(struct Foo*);

#[repr(C)]
pub struct Foo;

#[no_mangle]
pub extern "C" fn foo_new() -> Box<Foo> {
    Box::new(Foo)
}

// The possibility of NULL is represented with the `Option<_>`.
#[no_mangle]
pub extern "C" fn foo_delete(_: Option<Box<Foo>>) {}

The guarantee does not remove Box’s validity requirements: a Box<T> must remain non-null, aligned, and ready for deallocation by the global allocator. It is therefore best to use only boxes originating from the global allocator. The Box<T> documentation gives further details.

Standard-library additions shorten result handling and expose pointer counts

The standard library stabilizes or adds the following capabilities:

Result::map_or and Result::map_or_else, analogous to Option::map_or and Option::map_or_else, provide shorthands for the .map(|val| process(val)).unwrap_or(default) pattern.
NonZero* numeric types now implement From<NonZero*> when converting from a smaller integer width; for example, NonZeroU16 implements From<NonZeroU8>. The change is documented in its pull request.
std::rc::Weak::weak_count, std::rc::Weak::strong_count, std::sync::Weak::weak_count, and std::sync::Weak::strong_count return, respectively, the number of weak rc::Weak<T> or sync::Weak<T> pointers and strong Rc<T> or Arc<T> pointers to an allocation.
MaybeUninit<T> now implements fmt::Debug.

Compiler optimization work begins as 32-bit Apple support approaches demotion

Rust 1.41.0 started landing MIR optimizations that should improve compile time; the associated Inside Rust post describes that work.

This is also the last release with the current level of compiler support for 32-bit Apple targets, including i686-apple-darwin. Starting with Rust 1.42.0, those targets will be demoted to the lowest support tier. The project’s 32-bit Apple target announcement provides more information.

Errata · Point releases

Rust 1.41.1

27 February 2020 blog post

Rust 1.41.1 fixes two critical regressions introduced in Rust 1.41.0: a soundness hole involving static lifetimes and an LLVM miscompilation that could omit bounds checks and cause segmentation faults. It also corrects a separate interaction between 'static and Copy implementations that had existed since Rust 1.0. Users of Rust 1.41.0 were advised to upgrade as soon as possible; earlier releases were not affected by the two regressions.

Static assignments once again enforce the declared lifetime

Changes to the internal representation of static values in Rust 1.41.0 caused the borrow checker to omit type checking for static items. That accidentally allowed a temporary whose lifetime was shorter than 'static to be assigned to a static variable:

static mut MY_STATIC: &'static u8 = &0;

fn main() {
    let my_temporary = 42;
    unsafe {
        // Erroneously allowed in 1.41.0:
        MY_STATIC = &my_temporary;
    }
}

Rust 1.41.1 restores the check, so the program fails to compile:

error[E0597]: `my_temporary` does not live long enough
 --> src/main.rs:6:21
  |
6 |         MY_STATIC = &my_temporary;
  |         ------------^^^^^^^^^^^^^
  |         |           |
  |         |           borrowed value does not live long enough
  |         assignment requires that `my_temporary` is borrowed for `'static`
7 |     }
8 | }
  | - `my_temporary` dropped here while still borrowed

The regression is tracked in issue #69114 and was corrected by PR #69145.

Copy now respects the implementation’s static-lifetime restriction

Since Rust 1.0, the following erroneous program had compiled:

#[derive(Clone)]
struct Foo<'a>(&'a u32);
impl Copy for Foo<'static> {}

fn main() {
    let temporary = 2;
    let foo = (Foo(&temporary),);
    drop(foo.0); // Accessing a part of `foo` is necessary.
    drop(foo.0); // Indexing an array would also work.
}

Rust 1.41.1 fixes the issue in the same pull request as the static-item regression. The compiler now reports:

error[E0597]: `temporary` does not live long enough
  --> src/main.rs:7:20
   |
7  |     let foo = (Foo(&temporary),);
   |                    ^^^^^^^^^^ borrowed value does not live long enough
8  |     drop(foo.0);
   |          ----- copying this value requires that
   |                `temporary` is borrowed for `'static`
9  |     drop(foo.0);
10 | }
   | - `temporary` dropped here while still borrowed

Foo<'a> implements Copy only when 'a: 'static. The lifetime '0 of temporary does not outlive 'static, so Foo<'0> is not Copy and the second use of drop must be rejected.

Restored bounds checks prevent an LLVM-driven miscompilation

In a few cases, Rust 1.41.0 omitted bounds checks in memory-allocation code, causing segmentation faults when out-of-bounds values were supplied. The miscompilation came from an LLVM optimization-pass change introduced in LLVM 9 and reverted in LLVM 10.

Because Rust 1.41.0 used a snapshot of LLVM 9, Rust 1.41.1 cherry-picks that revert and addresses the miscompilation. Further details are in issue #69225.