adjust const_eval_select documentation

[RalfJung]

"The Rust compiler assumes" indicates that this is language UB, but I don't think that is a good idea. This UB would be very hard to test for and looks like a way-too-big footgun. @oli-obk suggested this is meant to be more like "library UB", so I tried to adjust the docs accordingly.

I also removed all references to "referential transparency". That is a rather vague concept used to mean many different things, and I honestly have no idea what exactly is meant by it in this specific instance. But I assume @fee1-dead had in their mind a property that all const fn code upholds, so by demanding that the runtime code and the const-time code are observably equivalent, whatever that property is would also be enforced here.

Cc @rust-lang/wg-const-eval

[rust-highfive]

r? @joshtriplett

(rust-highfive has picked a reviewer for you, use r? to override)

[RalfJung]

I started adjusting the const_eval_select safety comments accordingly, which lead me to realize that align_offset uses this operation. (Was wg-const-eval Cc'd for this? I was not aware of this, but it is possible I missed notifications.)

This is a problem, because align_offset is safe, but now it allows safe code to implement a "are we at compile-time" check! If we want any kind of assumption that compile-time and run-time code are equivalent (such as what is demonstrated by the example I added to the doc comment), then we can not have such an operation.

Put differently, we basically have to pick one of the two options:

• We have to say that it is okay for safe const fn to behave differently at compiletime and runtime (basically removing the safety requirement from const_eval_select, and saying that the bug in the example is in crate B).
• We have to make all functions that can implement a "are we at compile-time" unsafe -- in particular, we cannot use const_eval_select in align_offset.

[RalfJung]

Here's an example of how to cause UB by assuming (just in a library, not as the compiler) that a const fn behaves consistently at compiletime and runtime:

#![feature(const_align_offset)]
use std::hint::unreachable_unchecked;

// Crate A
pub const fn inconsistent() -> usize {
    (&13 as *const i32).align_offset(2)
}

// Crate B
pub fn main() {
  const X: usize = inconsistent();
  let x = inconsistent();
  if x != X { unsafe { unreachable_unchecked(); }}
}

[fee1-dead]

I mostly copied the documentation from a previous PR. (#64683)

[dtolnay]

@bors r+ rollup

[bors]

📌 Commit 85558ad has been approved by dtolnay

[bors]

🌲 The tree is currently closed for pull requests below priority 100. This pull request will be tested once the tree is reopened.