`integer_to_ptr_transmutes` turns `transmute::<.. &str>` into `&*std::ptr::with_exposed_provenance::<str>` causing error

[matthiaskrgr]

Using the following flags

--force-warn integer_to_ptr_transmutes

this code:

use std::mem::transmute;
fn main() {
    for &my_bool in &[true, false] {
        unsafe {
            println!("{}", transmute::<_, &str>(!-(my_bool as i128) & transmute::<_, i128>("false !") | -(my_bool as i128) & transmute::<_, i128>("true !")));
        }
    }
}

caused the following diagnostics:

    Checking _snippet_0 v0.1.0 (/tmp/icemaker_global_tempdir.W9mV5T7suTWy/icemaker_clippyfix_tempdir.fJmt0nSEOelZ/_snippet_0)
warning: transmuting an integer to a pointer creates a pointer without provenance
 --> src/main.rs:5:28
  |
5 | ...", transmute::<_, &str>(!-(my_bool as i128) & transmute::<_, i128>("false !") | -(my_bool as i128) & transmute::<_, i128>("true !")));
  |       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  |
  = note: this is dangerous because dereferencing the resulting pointer is undefined behavior
  = note: exposed provenance semantics can be used to create a pointer based on some previously exposed provenance
  = help: if you truly mean to create a pointer without provenance, use `std::ptr::without_provenance_mut`
  = help: for more information about transmute, see <https://doc.rust-lang.org/std/mem/fn.transmute.html#transmutation-between-pointers-and-integers>
  = help: for more information about exposed provenance, see <https://doc.rust-lang.org/std/ptr/index.html#exposed-provenance>
  = note: requested on the command line with `--force-warn integer-to-ptr-transmutes`
help: use `std::ptr::with_exposed_provenance` instead to use a previously exposed provenance
  |
5 -             println!("{}", transmute::<_, &str>(!-(my_bool as i128) & transmute::<_, i128>("false !") | -(my_bool as i128) & transmute::<_, i128>("true !")));
5 +             println!("{}", &*std::ptr::with_exposed_provenance::<str>(!-(my_bool as i128) & transmute::<_, i128>("false !") | -(my_bool as i128) & transmute::<_, i128>("true !")));
  |

warning: `_snippet_0` (bin "_snippet_0") generated 1 warning (run `cargo clippy --fix --bin "_snippet_0"` to apply 1 suggestion)
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.22s

However after applying these diagnostics, the resulting code:

use std::mem::transmute;
fn main() {
    for &my_bool in &[true, false] {
        unsafe {
            println!("{}", &*std::ptr::with_exposed_provenance::<str>((!-(my_bool as i128) & transmute::<_, i128>("false !") | -(my_bool as i128) & transmute::<_, i128>("true !")).try_into().unwrap()));
        }
    }
}

no longer compiled:

    Checking _snippet_0 v0.1.0 (/tmp/icemaker_global_tempdir.W9mV5T7suTWy/icemaker_clippyfix_tempdir.fJmt0nSEOelZ/_snippet_0)
error[E0277]: the size for values of type `str` cannot be known at compilation time
   --> src/main.rs:5:66
    |
  5 | ...   println!("{}", &*std::ptr::with_exposed_provenance::<str>((!-(my_bool as i128) & transmute::<_, i128>("false !") | -(my_bool as i12...
    |                                                            ^^^ doesn't have a size known at compile-time
    |
    = help: the trait `std::marker::Sized` is not implemented for `str`
note: required by an implicit `Sized` bound in `std::ptr::with_exposed_provenance`
   --> /home/matthias/.rustup/toolchains/master/lib/rustlib/src/rust/library/core/src/ptr/mod.rs:981:38
    |
981 | pub const fn with_exposed_provenance<T>(addr: usize) -> *const T {
    |                                      ^ required by the implicit `Sized` requirement on this type parameter in `with_exposed_provenance`

For more information about this error, try `rustc --explain E0277`.
error: could not compile `_snippet_0` (bin "_snippet_0" test) due to 1 previous error
warning: build failed, waiting for other jobs to finish...
error: could not compile `_snippet_0` (bin "_snippet_0") due to 1 previous error

Version:

rustc 1.91.0-nightly (91ee6a405 2025-08-26)
binary: rustc
commit-hash: 91ee6a4057ce4bf1ab6d2f932cae497488d67c81
commit-date: 2025-08-26
host: x86_64-unknown-linux-gnu
release: 1.91.0-nightly
LLVM version: 21.1.0

[Urgau]

Further reduced to:

fn main() {
    let _a = unsafe { std::mem::transmute::<_, &str>(125i128.try_into().unwrap()) };
}

[Urgau]

There are two issues with the above example:

1. the input argument is being silently changed between the transmute (i128) and with_exposed_provenance (usize) due to the .try_into().unwrap()
2. the second is that with_exposed_provenance is ill-suited for &str, we should suggest using std::str::from_raw_parts or std::ptr::from_raw_parts
   • more generally the problem applies to any unsized type

I think the first immediate step is to stop linting/suggesting with_exposed_provenance on any unsized type.

It's unclear to me if/how we would suggest std::str::from_raw_parts and friends.

cc @RalfJung

[RalfJung]

Yeah for an unsized type I'd really like to know what the user wanted to do, giving general advice for that is tricky.^^