From 538c49cd18ad261733e158010b1f525bdf12b7f0 Mon Sep 17 00:00:00 2001 From: Douglas Deslauriers Date: Tue, 10 Jun 2025 18:24:44 +0000 Subject: [PATCH 1/6] [Guideline] Add do not divide by 0 --- src/coding-guidelines/expressions.rst | 40 +++++++++++++++++++++++++++ 1 file changed, 40 insertions(+) diff --git a/src/coding-guidelines/expressions.rst b/src/coding-guidelines/expressions.rst index b73b172..00deec3 100644 --- a/src/coding-guidelines/expressions.rst +++ b/src/coding-guidelines/expressions.rst @@ -81,3 +81,43 @@ Expressions } fn with_base(_: &Base) { ... } + +.. guideline:: Do not divide by 0 + :id: gui_kMbiWbn8Z6g5 + :category: Mandatory + :status: draft + :release: latest + :fls: fls_Q9dhNiICGIfr + :decidability: Undecidable + :scope: System + :tags: numerics + + This guideline applies when unsigned integer or two’s complement division is performed. This includes the + evaluation of a remainder expression. + + .. rationale:: + :id: rat_h84NjY2tLSBW + :status: draft + + Integer division by zero results in a panic, which is an abnormal program state and may terminate the process. + + .. non_compliant_example:: + :id: non_compl_ex_LLs3vY8aGz0F + :status: draft + + When the division is performed, the right operand is evaluated to zero and the program panics. + + .. code-block:: rust + + let x = 0; + let x = 5 / x; + + .. compliant_example:: + :id: compl_ex_Ri9pP5Ch3kbb + :status: draft + + There is no compliant way to perform integer division by zero + + .. code-block:: rust + + let x = 5 % 5; From a9760357bfe29359ca0ded83dbd354357003c3aa Mon Sep 17 00:00:00 2001 From: Douglas Deslauriers Date: Tue, 24 Jun 2025 17:23:21 +0000 Subject: [PATCH 2/6] Remove example code from compliant example As stated there is no compliant way to do this, so no example should be present. --- src/coding-guidelines/expressions.rst | 4 ---- 1 file changed, 4 deletions(-) diff --git a/src/coding-guidelines/expressions.rst b/src/coding-guidelines/expressions.rst index 00deec3..9bb6197 100644 --- a/src/coding-guidelines/expressions.rst +++ b/src/coding-guidelines/expressions.rst @@ -117,7 +117,3 @@ Expressions :status: draft There is no compliant way to perform integer division by zero - - .. code-block:: rust - - let x = 5 % 5; From 899d8266d25903d9ddb3dd9a620c145fca1f9c18 Mon Sep 17 00:00:00 2001 From: Douglas Deslauriers Date: Wed, 25 Jun 2025 13:56:39 +0000 Subject: [PATCH 3/6] Add compliant example with a suggestion While the guideline does not strictly apply to this example, it is a good suggestion for what to do instead. --- src/coding-guidelines/expressions.rst | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/src/coding-guidelines/expressions.rst b/src/coding-guidelines/expressions.rst index 9bb6197..6babfdb 100644 --- a/src/coding-guidelines/expressions.rst +++ b/src/coding-guidelines/expressions.rst @@ -116,4 +116,9 @@ Expressions :id: compl_ex_Ri9pP5Ch3kbb :status: draft - There is no compliant way to perform integer division by zero + There is no compliant way to perform integer division by zero. A checked division will prevent any + division by zero from happening. The programmer can then handle the returned Option. + + .. code-block:: rust + + let x = 5u8.checked_div(0); From 982d7e9e479b835e89dd4015b3acf2e9017dbe07 Mon Sep 17 00:00:00 2001 From: Douglas Deslauriers Date: Mon, 14 Jul 2025 16:33:32 -0400 Subject: [PATCH 4/6] Lowercasing of guideline metadata Co-authored-by: Pete LeVasseur --- src/coding-guidelines/expressions.rst | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/coding-guidelines/expressions.rst b/src/coding-guidelines/expressions.rst index 6babfdb..f51927d 100644 --- a/src/coding-guidelines/expressions.rst +++ b/src/coding-guidelines/expressions.rst @@ -84,12 +84,12 @@ Expressions .. guideline:: Do not divide by 0 :id: gui_kMbiWbn8Z6g5 - :category: Mandatory + :category: mandatory :status: draft :release: latest :fls: fls_Q9dhNiICGIfr - :decidability: Undecidable - :scope: System + :decidability: undecidable + :scope: system :tags: numerics This guideline applies when unsigned integer or two’s complement division is performed. This includes the From 681be7efa528ec16c3f9bbeeaee7b5f8e82cc360 Mon Sep 17 00:00:00 2001 From: Douglas Deslauriers Date: Mon, 14 Jul 2025 16:34:15 -0400 Subject: [PATCH 5/6] Add Rust std link transformation Co-authored-by: Pete LeVasseur --- src/coding-guidelines/expressions.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/coding-guidelines/expressions.rst b/src/coding-guidelines/expressions.rst index f51927d..305d6a5 100644 --- a/src/coding-guidelines/expressions.rst +++ b/src/coding-guidelines/expressions.rst @@ -117,7 +117,7 @@ Expressions :status: draft There is no compliant way to perform integer division by zero. A checked division will prevent any - division by zero from happening. The programmer can then handle the returned Option. + division by zero from happening. The programmer can then handle the returned :std:``std::option::Option``. .. code-block:: rust From 7fd5a7b5b94a17393b507d515229ee7ba00568ed Mon Sep 17 00:00:00 2001 From: Douglas Deslauriers Date: Thu, 17 Jul 2025 17:36:18 +0000 Subject: [PATCH 6/6] Clarify scope of expressions this applies to --- src/coding-guidelines/expressions.rst | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/src/coding-guidelines/expressions.rst b/src/coding-guidelines/expressions.rst index 305d6a5..f31a2de 100644 --- a/src/coding-guidelines/expressions.rst +++ b/src/coding-guidelines/expressions.rst @@ -92,8 +92,18 @@ Expressions :scope: system :tags: numerics - This guideline applies when unsigned integer or two’s complement division is performed. This includes the - evaluation of a remainder expression. + This guideline applies when unsigned integer or two’s complement division is performed during the + evaluation of an `ArithmeticExpression + `_. + + Note that this includes the evaluation of a `RemainderExpression + `_, which uses unsigned integer or two's + complement division. + + This rule does not apply to evaluation of a :std:`core::ops::Div` trait on types other than `integer + types `_. The use of + :std:`std::num::NonZero` or is therefore a recommended way to avoid the undecidability of this + guideline. .. rationale:: :id: rat_h84NjY2tLSBW