pub trait FillableBytes: Sealed + Copy { }Expand description
Marker for types LibQRng::fill may write raw CSPRNG bytes over.
§Contract
Implementing this asserts that every bit pattern of the type is a valid
value. fill reinterprets the destination slice as bytes and overwrites
it with CSPRNG output, so any type for which some bit pattern is invalid
would be left holding an invalid value — undefined behaviour independent of
whether the value is ever read.
§Why it is sealed, and why it is not Copy + Default
fill’s bound was T: Copy + Default until card t_1594295d. That is a
weaker and different property: bool is Copy + Default and only
0x00/0x01 are valid bit patterns; char is Copy + Default and must be
a Unicode scalar value. Random bytes satisfy neither. The bound read as
“any simple value type”, and the two most obvious simple value types it
admitted were exactly the two it must not.
The trait is sealed so the validity claim cannot be asserted from outside
this crate, where it would not be checkable. It is implemented for the
integer primitives only — the types that genuinely accept every bit
pattern. Notably absent and deliberately so: bool, char, f32/f64
(every pattern is a valid float, including signalling NaNs, but a random
“float” is almost never what a caller means — ask for integers and convert),
and NonZero* (zero is invalid by construction).
Dyn Compatibility§
This trait is not dyn compatible.
In older versions of Rust, dyn compatibility was called "object safety".