clarify that references size_of_val can never exceed isize::MAX

[RalfJung]

This is the underlying UB that rust-lang/rust#95252 and rust-lang/rust#95295 fix.

I also removed the statement

if the span is empty, "dangling" is the same as "non-null"

since it contradicts what the library docs say about zero-sized accesses/types.

[ehuss]

I'm a bit unclear about the interaction of ZST and dangling (I'm likely misunderstanding this). Per the std docs:

However, casting any non-zero integer literal to a pointer is valid for zero-sized accesses, even if some memory happens to exist at that address and gets deallocated.

This seems to provide an exception to the dangling rule. That is, something like this?

// This points to some arbitrary location that was not allocated.
let x: *mut () = 1024 as *mut ();
unsafe {
    // This should not be undefined behavior?
    let y = *x;
}

If so, would it make sense to add a similar sentence here? Otherwise, this seems to be in contradiction to the std docs, since this description of "dangling" doesn't carve out this exception.

[RalfJung]

This seems to provide an exception to the dangling rule.

Well, it clarifies what the definition of "dangling" is when the size is 0.

The reference has so far been more vague on this subject, but yeah I can make that more clear here as well. We probably want an entire subsection on the question of "dangling pointers" then, since it is all rather subtle. However, this interacts closely with a bunch of questions around pointer provenance, which we are not (yet) willing to give final answers to...

[ehuss]

Thanks! Given the discussion in rust-lang/rust#95295 (comment) and the std docs and other places, I'm going to go ahead and merge.