Add a new lint UNCONSTRUCTABLE_PUB_STRUCT to detect unconstructable public structs

[mu001999]

Add a new lint UNCONSTRUCTABLE_PUB_STRUCT to detect unconstructable public structs, based on the following observations:

1. A public struct with private field(s) cannot be directly constructed from external crates.
2. Associated functions with a receiver require an already constructed value of type Self.
3. Therefore, public structs with private fields and their associated functions that take a receiver can be included in the local crate's dead code analysis.
4. If a public struct with private fields cannot be constructed in any reachable code path, it could be considered dead. Otherwise, liveness can be propagated to the struct and its associated functions with a receiver during the dead code analysis.

[rustbot]

r? @davidtwco

rustbot has assigned @davidtwco.
They will have a look at your PR within the next two weeks and either review your PR or reassign to another reviewer.

Use r? to explicitly pick a reviewer

[juntyr]

Would the lint fire on token structs that are public, have private fields, have no public constructor method, but expose a limited number of pre-constructed objects, e.g. through a static that contains an optional token?

[mu001999]

a static that contains an optional token

won't fire like private types used in such places

[davidtwco]

Nominating for t-lang to decide whether we want this lint, then I'll review the implementation.

Also, s/unconstructible/unconstructable.

[rustbot]

This PR was rebased onto a different master commit. Here's a range-diff highlighting what actually changed.

Rebasing is a normal part of keeping PRs up to date, so no action is needed—this note is just to help reviewers.

[Darksonn]

Does this trigger on structs that are intended only as marker types in generic parameters?

[mu001999]

Does this trigger on structs that are intended only as marker types in generic parameters?

Such types usually have intended private unit fields and this won't trigger on them. This will only trigger types with trivial fields but not be used or cannot be constructed.

[nikomatsakis]

Are there examples of code in the wild that is affected by this lint?

[scottmcm]

I worry about completeness here. If I have something like pub struct Foo(pub [u8]); it's not "constructible" in a sense, but it might be entirely expected anyway. What if there's something only created via slice_from_raw_parts and pointer casts to get &MyType?

---

Musing: what if this was signature-based, say? Could it be phrased as "why is this pub when it's not in a signature; maybe it should be pub(crate)?" or something?

[joshtriplett]

We discussed this in today's @rust-lang/lang meeting.

Was there any particular motivating use case that led to proposing this? Can you point to some code that motivated this?

We wondered about potential corner cases, notably structs that are only constructed in unsafe code. For instance, something using repr(C) or repr(transparent) that's constructed via transmute, or a dynamically sized type that requires unsafe code to construct. We're hoping those can be handled and won't produce false positives.

Once those are addressed, we'd like to see the (triaged) results of a crater run with this lint marked as deny-by-default, so we can get an idea of 1) how widespread this is and 2) whether this catches any issues.

[traviscross]

Please renominate for lang when these answers are available.