Repository navigation
Make implementing ClassType in declare_class! safe #528
Description
Implementing ClassType in declare_class! is unsafe because we need the user to uphold a few safety guarantees, and that was just the most convenient place to put the unsafe keyword.
After #521 though, the only safety guarantees that the user needs to uphold are:
- Any invariants that the superclass
ClassType::Supermay have must be upheld. ClassType::Mutabilitymust be correct.Dropmust be implemented correctly.
We should work on ways to make fulfilling these unsafe requirements more granular.
One possibility for requirement 2 would be to migrate from an associated type Mutability to a constant, that you must initialize with unsafe if you need certain features:
pub struct Mutability {}
impl Mutability {
pub const fn interior_mutable() -> Self {
todo!()
}
/// # Safety
/// ... clearly detailed docs for when this is safe ...
pub const unsafe fn main_thread_only() -> Self {
todo!()
}
// ...
}
// Usage
declare_class!(
struct MyClass;
unsafe impl ClassType for MyClass {
type Super = NSObject;
const MUTABILITY: Mutability = Mutability::interior_mutable();
// Or
// SAFETY: ...
// const MUTABILITY: Mutability = unsafe { Mutability::main_thread_only() };
const NAME: &'static str = "MyClass";
}
// ...
);
Activity
madsmtm commentedon Nov 28, 2023
Hmm, just realized that the proposed idea won't work, since you could do
const MUTABILITY: Mutability = NSView::MUTABILITY;, and thereby bypass theunsafe.madsmtm commentedon Sep 17, 2024
Since #563, the associated
Mutabilitytype is changed toThreadKind, and I've implemented a check to ensure that you can't set an incorrect thread kind.I'm considering moving
Dropto afn dealloc(&self), to avoid the mutability issue if you callself.retain()insidedealloc. This would also be a slight perf hit, since you could no longer do things likeself.ivars_mut().my_ivar.get_mut(), you'd still have to do interior mutability inside your deallocation method, but that's probably fine. Besides, instance variables themselves can still use&mutsafely, it's just the class itself which can't.