Are long-lived references to thread_local variables allowed?

[theemathas]

Is the following code sound?

thread_local! {
    static X: String = String::from("abc");
}

/// SAFETY: If this function is called in a certain thread,
/// then the returned reference must not be used after
/// the "top-level function" of that thread finishes.
unsafe fn smuggle() -> &'static String {
    &*X.with(|a| a as *const String)
}

In other words, is it guaranteed that:

• A thread-local's address is stable?
• &mut references won't be created to thread-locals until it's time to run thread-local destructors?

[RalfJung]

There is no way to get a &mut to thread-locals in safe code. And the address is indeed stable.

However once the destructor of the thread-local gets run, the reference gets invalidated, so the 'static lifetime is a lie. You seem to be aware of that.

The notion of "soundness" of an unsafe function is non-trivial to define so it's not entirely clear what you are asking about.

[theemathas]

And the address is indeed stable.

Is this documented anywhere?

[RalfJung]

Not that I am aware of.

thread-locals are a library feature, so this would be a t-libs-api issue to be raised in https://github.com/rust-lang/rust/issues/

[joboet]

The answers to your questions are currently yes and yes. Als Ralf pointed out, this isn't documented anywhere though, so it isn't something you should rely on (yet). On the other hand, I don't consider this behaviour likely to change. Thus, if you truly need this, please file a PR adjusting the thread_local! documentation to add the necessary guarantees, and T-libs-api might consider adding them.