test: check the layout against the installed C headers

Compile a small C file against the real headers and let it export
the sizes and offsets of the C structsas globals, then compare against
those in the tests. The expected values now come from the C compiler
reading primitives_sequence.h.

The probe sits behind the abi_check feature, which is turned on by
adding a dependency to ourselves in the dev-dependencies. This builds
cc only for test targets and a plain build doesn't pull it in.

Assisted-by: Claude:claude-opus-5 [Claude Code]

Author: azerupi

rosidl_runtime_rs/Cargo.toml

@@ -22,14 +22,20 @@ default = []
 # This feature is solely for the purpose of being able to generate documentation without a ROS installation
 # The only intended usage of this feature is for docs.rs builders to work, and is not intended to be used by end users
 use_ros_shim = []
+# Adds the C compiler to build and link the C probe to test size/layout against the installed ROS 2 C headers
+abi_check = ["dep:cc"]
 
 [dev-dependencies]
+# Trick to enable the abi_check feature for the tests, without enabling it for the library itself
+rosidl_runtime_rs = { path = ".", features = ["abi_check"] }
 # Needed for writing property tests
 quickcheck = "1"
 # Needed for testing serde support
 serde_json = "1"
 
 [build-dependencies]
+# Compiles the probe that reports the layout of the installed C sequence structs
+cc = { version = "1", optional = true }
 # Needed for uploading documentation to docs.rs
 cfg-if = "1.0.0"
 # Reads the --cfg ros_distro flag under the ROS shim (matches rclrs)

rosidl_runtime_rs/build.rs

@@ -15,6 +15,27 @@ cfg_if::cfg_if! {
                 );
             }
         }
+
+        /// Compiles the probe that reports the layout of the installed C
+        /// sequence structs, so that the tests can check `Sequence<T>` against
+        /// this ROS installation instead of against a Rust recreation of those
+        /// structs.
+        #[cfg(feature = "abi_check")]
+        fn compile_sequence_abi_probe(ament_prefix_path_list: &str) {
+            let mut probe = cc::Build::new();
+            for ament_prefix_path in ament_prefix_path_list.split(':') {
+                // Iron and later nest the headers of a package one level
+                // deeper, so offer both conventions and let the compiler pick.
+                let include_path = Path::new(ament_prefix_path).join("include");
+                probe.include(include_path.join("rosidl_runtime_c"));
+                probe.include(include_path);
+            }
+            probe
+                .file("src/sequence_abi.c")
+                .compile("rosidl_rs_sequence_abi");
+
+            println!("cargo:rustc-cfg=has_c_abi_probe");
+        }
     }
 }
 
@@ -50,6 +71,7 @@ fn main() {
     );
     println!("cargo:rustc-cfg=ros_distro=\"{}\"", get_ros_distro());
     println!("cargo:rerun-if-env-changed={ROS_DISTRO}");
+    println!("cargo:rustc-check-cfg=cfg(has_c_abi_probe)");
 
     #[cfg(not(feature = "use_ros_shim"))]
     {
@@ -58,6 +80,9 @@ fn main() {
             let library_path = Path::new(ament_prefix_path).join("lib");
             println!("cargo:rustc-link-search=native={}", library_path.display());
         }
+
+        #[cfg(feature = "abi_check")]
+        compile_sequence_abi_probe(&ament_prefix_path_list);
     }
 
     // Invalidate the built crate whenever this script changes

rosidl_runtime_rs/src/sequence.rs

@@ -715,46 +715,82 @@ mod tests {
         }
     }
 
-    /// The Rust `Sequence` must be the same size as the C
-    /// `rosidl_runtime_c__<T>__Sequence` it is cast to. From Lyrical on, every
-    /// type declared through ROSIDL_RUNTIME_C__PRIMITIVE_SEQUENCE gained two
-    /// trailing `bool` flags, and that macro covers `String`/`U16String` as well
-    /// as the numeric primitives. Message element types keep the 3-field layout.
+    // The layout of the C structs, as reported by src/sequence_abi.c after the
+    // C compiler read the headers of this ROS installation.
+    #[cfg(has_c_abi_probe)]
+    extern "C" {
+        static rosidl_rs_primitive_sequence_size: usize;
+        static rosidl_rs_string_sequence_size: usize;
+        static rosidl_rs_u16string_sequence_size: usize;
+        static rosidl_rs_sequence_data_offset: usize;
+        static rosidl_rs_sequence_size_offset: usize;
+        static rosidl_rs_sequence_capacity_offset: usize;
+        static rosidl_rs_sequence_align: usize;
+    }
+
+    /// `Sequence<T>` is handed to C as `rosidl_runtime_c__<T>__Sequence`, so it
+    /// has to be the size of that struct in the installed headers. From Lyrical
+    /// on, every type declared through ROSIDL_RUNTIME_C__PRIMITIVE_SEQUENCE
+    /// carries two trailing flags, and that macro covers `String` and
+    /// `U16String` as well as the numeric primitives.
     #[test]
-    fn test_sequence_layout_matches_c() {
-        // Mirrors of the two C shapes, so the expected size includes the same
-        // padding the C compiler applies rather than a hand-computed number.
-        #[repr(C)]
-        struct CSequence {
-            data: *mut u8,
-            size: usize,
-            capacity: usize,
-        }
-        #[repr(C)]
-        struct CSequenceWithFlags {
-            data: *mut u8,
-            size: usize,
-            capacity: usize,
-            flags: BufferFlags,
-        }
-        let expected = if cfg!(any(
-            ros_distro = "humble",
-            ros_distro = "jazzy",
-            ros_distro = "kilted"
-        )) {
-            std::mem::size_of::<CSequence>()
-        } else {
-            std::mem::size_of::<CSequenceWithFlags>()
+    #[cfg(has_c_abi_probe)]
+    fn test_sequence_size_matches_c() {
+        // SAFETY: These are `const size_t` objects with external linkage.
+        let (primitive, string, u16string) = unsafe {
+            (
+                rosidl_rs_primitive_sequence_size,
+                rosidl_rs_string_sequence_size,
+                rosidl_rs_u16string_sequence_size,
+            )
         };
-        assert_eq!(std::mem::size_of::<Sequence<f64>>(), expected);
-        assert_eq!(std::mem::size_of::<Sequence<u8>>(), expected);
-        assert_eq!(std::mem::size_of::<Sequence<crate::String>>(), expected);
-        assert_eq!(std::mem::size_of::<Sequence<crate::WString>>(), expected);
-        assert_eq!(std::mem::size_of::<BoundedSequence<f64, 4>>(), expected);
+
+        assert_eq!(std::mem::size_of::<Sequence<f64>>(), primitive);
+        assert_eq!(std::mem::size_of::<Sequence<u8>>(), primitive);
+        assert_eq!(std::mem::size_of::<Sequence<i16>>(), primitive);
+        assert_eq!(std::mem::size_of::<Sequence<bool>>(), primitive);
+        assert_eq!(std::mem::size_of::<BoundedSequence<f64, 4>>(), primitive);
+
+        assert_eq!(std::mem::size_of::<Sequence<crate::String>>(), string);
         assert_eq!(
             std::mem::size_of::<BoundedSequence<crate::String, 4>>(),
-            expected
+            string
         );
+        assert_eq!(
+            std::mem::size_of::<Sequence<crate::BoundedString<4>>>(),
+            string
+        );
+
+        assert_eq!(std::mem::size_of::<Sequence<crate::WString>>(), u16string);
+        assert_eq!(
+            std::mem::size_of::<BoundedSequence<crate::WString, 4>>(),
+            u16string
+        );
+        assert_eq!(
+            std::mem::size_of::<Sequence<crate::BoundedWString<4>>>(),
+            u16string
+        );
+    }
+
+    /// A matching size is not enough on its own, because it says nothing about
+    /// the order of the fields C reads and writes.
+    #[test]
+    #[cfg(has_c_abi_probe)]
+    fn test_sequence_field_offsets_match_c() {
+        // SAFETY: These are `const size_t` objects with external linkage.
+        let (data, size, capacity, align) = unsafe {
+            (
+                rosidl_rs_sequence_data_offset,
+                rosidl_rs_sequence_size_offset,
+                rosidl_rs_sequence_capacity_offset,
+                rosidl_rs_sequence_align,
+            )
+        };
+
+        assert_eq!(std::mem::offset_of!(Sequence<f64>, data), data);
+        assert_eq!(std::mem::offset_of!(Sequence<f64>, size), size);
+        assert_eq!(std::mem::offset_of!(Sequence<f64>, capacity), capacity);
+        assert_eq!(std::mem::align_of::<Sequence<f64>>(), align);
     }
 
     #[test]

rosidl_runtime_rs/src/sequence_abi.c

@@ -0,0 +1,41 @@
+// Reports the layout of the C structs in header files installed with the ROS 2 distribution.
+// rosidl_runtime_rs casts its types to those C structs so we need to make sure the sizes and
+// alignments match.
+//
+// Every sequence type, `String` and `U16String` included, is declared through
+// the ROSIDL_RUNTIME_C__PRIMITIVE_SEQUENCE macro, so one primitive sequence
+// stands in for the whole family, and only the string sequences need measuring
+// separately because their element structs have a size of their own.
+
+#include <stddef.h>
+
+#include <rosidl_runtime_c/primitives_sequence.h>
+#include <rosidl_runtime_c/string.h>
+#include <rosidl_runtime_c/u16string.h>
+
+typedef rosidl_runtime_c__double__Sequence primitive_sequence;
+
+// A member placed after a char sits at that member's alignment, which reports
+// the alignment without _Alignof and the C11 that it needs.
+struct alignment_probe
+{
+  char before;
+  primitive_sequence sequence;
+};
+
+// The sizes of the structs a Sequence<T> is cast to.
+const size_t rosidl_rs_primitive_sequence_size = sizeof(primitive_sequence);
+const size_t rosidl_rs_string_sequence_size = sizeof(rosidl_runtime_c__String__Sequence);
+const size_t rosidl_rs_u16string_sequence_size = sizeof(rosidl_runtime_c__U16String__Sequence);
+
+// Where C keeps the three fields both sides read and write, and how it aligns
+// the struct that holds them.
+const size_t rosidl_rs_sequence_data_offset = offsetof(primitive_sequence, data);
+const size_t rosidl_rs_sequence_size_offset = offsetof(primitive_sequence, size);
+const size_t rosidl_rs_sequence_capacity_offset = offsetof(primitive_sequence, capacity);
+const size_t rosidl_rs_sequence_align = offsetof(struct alignment_probe, sequence);
+
+// The flags belong to the sequence structs, so the string structs themselves
+// keep the same size on every distro.
+const size_t rosidl_rs_string_size = sizeof(rosidl_runtime_c__String);
+const size_t rosidl_rs_u16string_size = sizeof(rosidl_runtime_c__U16String);

rosidl_runtime_rs/src/string.rs

@@ -542,6 +542,30 @@ mod tests {
 
     use super::*;
 
+    // The layout of the C structs, as reported by src/sequence_abi.c after the
+    // C compiler read the headers of this ROS installation.
+    #[cfg(has_c_abi_probe)]
+    extern "C" {
+        static rosidl_rs_string_size: usize;
+        static rosidl_rs_u16string_size: usize;
+    }
+
+    /// The buffer flags belong to the sequence structs, not to the string
+    /// structs, so these sizes have to stay the same on every distro. Getting
+    /// this wrong the other way around would shift every field of a message
+    /// that holds a string.
+    #[test]
+    #[cfg(has_c_abi_probe)]
+    fn test_string_size_matches_c() {
+        // SAFETY: These are `const size_t` objects with external linkage.
+        let (string, u16string) = unsafe { (rosidl_rs_string_size, rosidl_rs_u16string_size) };
+
+        assert_eq!(std::mem::size_of::<String>(), string);
+        assert_eq!(std::mem::size_of::<BoundedString<4>>(), string);
+        assert_eq!(std::mem::size_of::<WString>(), u16string);
+        assert_eq!(std::mem::size_of::<BoundedWString<4>>(), u16string);
+    }
+
     impl Arbitrary for String {
         fn arbitrary(g: &mut Gen) -> Self {
             std::string::String::arbitrary(g).as_str().into()