Remove `Immutable` bound on unions

[jswrenn]

Steps:

• Revise UnsafeCell safety precondition on Ptr::project
  • Add this to Relax safety precondition of Ptr::cast_unsized #999?
• Revise is_bit_valid in union derive to Ptr::into_exclusive_or_post_monomorphization_error and remove Immutable bounds on fields.

[joshlf]

Here's a possible design that would allow us to do this. It turns out it doesn't actually work, but it's illustrative of the design space, so I'm writing it up anyway.

We need some way of ensuring that either the union contains no UnsafeCells or that the pointer is an exclusive pointer (or both). Requiring one or the other is pretty easy:

• To require no UnsafeCells, we can require an Immutable bound (as we do today)
• To require an exclusive pointer, we can use Ptr::into_exclusive_or_post_monomorphization_error

Permitting either to satisfy our constraint is difficult since both requirements on their own are too strict. We need code which will fail to compile (either during an early compilation pass or during post-monomorphization) only when both conditions are violated: ie, when the type contains UnsafeCells and the pointer is non-exclusive.

Here's how we might get this to work. First, we add the following API to TryFromBytes:

#[doc(hidden)]
fn assert_is_aliasing_safe_or_post_monomorphization_error<Aliasing>();

We implement it recursively for all composite types as appropriate. Then, in the implementation of is_bit_valid for unions, we call it in order to justify that field projection is sound.

---

Why doesn't this work? Because of MaybeUninit. In particular, we implement TryFromBytes for MaybeUninit<T> without requiring T: TryFromBytes. MaybeUninit<T> contains UnsafeCells if T does, so its impl of assert_is_aliasing_safe_or_post_monomorphization_error needs to recurse into T, but T doesn't have such an impl because it's not TryFromBytes.