Major change: additional requirements for rust-reference-safety/Unpin, which now includes "tail padding is safe to write to".
Before, it was assumed a type could be put in a `&mut` if the type was trivially relocatable. However, some types are trivially relocatable, but nonetheless not actually safe to use in Rust via a mutable reference. They can be written to by `memcpy`, but **Rust will `memcpy` an incorrect number of bytes**. These types can still be handled by value, but all references Rust receives from C++ must be `Pin`.
In addition to ensuring types are trivially relocatable, to get a completely idiomatic interface in Rust, those types must also be final leaf types.
This is described more completely in the newly-added doc in google3/devtools/rust/cc_interop/g3doc/unpin.
---
Thanks:
* dmitrig@ for helping organize my thoughts on this, and suggesting `final` and giving up on `[[no_unique_address]]`, instead of my thought of e.g. "`data size == stride`")
* lexer@ and the rest of the Rust room for discussing this at length with me a month or so ago and giving me a lot of intellectual food to chew on.
PiperOrigin-RevId: 417820502
diff --git a/rs_bindings_from_cc/ir.rs b/rs_bindings_from_cc/ir.rs
index 6ac3bcb..553d778 100644
--- a/rs_bindings_from_cc/ir.rs
+++ b/rs_bindings_from_cc/ir.rs
@@ -279,12 +279,46 @@
pub move_constructor: SpecialMemberFunc,
pub destructor: SpecialMemberFunc,
pub is_trivial_abi: bool,
+ pub is_final: bool,
}
impl Record {
pub fn owning_crate_name(&self) -> Result<&str> {
self.owning_target.target_name()
}
+
+ /// Whether this type has Rust-like object semantics for mutating
+ /// assignment, and can be passed by mut reference as a result.
+ ///
+ /// If a type `T` is mut reference safe, it can be possed as a `&mut T`
+ /// safely. Otherwise, mutable references must use `Pin<&mut T>`.
+ ///
+ /// Conditions:
+ ///
+ /// 1. It is trivially relocatable, and thus can be passed by value and have
+ /// its memory directly mutated by Rust using memcpy-like
+ /// assignment/swap.
+ ///
+ /// 2. It cannot overlap with any other objects. In particular, it cannot be
+ /// inherited from, as inheritance allows for the tail padding to be
+ /// reused by other objects.
+ ///
+ /// (In future versions, we could also include types which are POD for
+ /// the purpose of layout, but this is less predictable to C++ users,
+ /// and ABI-specific.)
+ ///
+ /// We are assuming, for the moment, that no object is stored in a
+ /// `[[no_unique_address]]` variable. Much like packed structs and
+ /// the like, users of `[[no_unique_address]]` must be very careful
+ /// when passing mutable references to Rust.
+ ///
+ /// Described in more detail at: docs/unpin
+ ///
+ /// TODO(b/200067242): Actually force mut references to !is_unpin to be
+ /// Pin<&mut T>.
+ pub fn is_unpin(&self) -> bool {
+ self.is_trivial_abi && self.is_final
+ }
}
#[derive(Debug, PartialEq, Eq, Hash, Clone, Deserialize)]
