-
-
Notifications
You must be signed in to change notification settings - Fork 25
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix: unsound cache upcast #136
Conversation
2f1afdb
to
f4ac8c5
Compare
Removes the unsafe code around cache upcasting by introducing traited functions `as_ref` and `as_mut` on the AutoImplCacheRef trait. Also no longer requires the `unsafe` attribute.
f4ac8c5
to
874d027
Compare
// Safety: | ||
// This is safe because the trait `AutoImplCacheRef` is marked as unsafe and therefore the implementor must ensure that the | ||
// Cache is safe for concurrent access. This is used to implement cache for &T where T is a Cache. | ||
// The issue is we need to upcast the reference to a mutable reference, even though the implementor only ever requires a reference. | ||
// This is not safe unless T has some kind of interior mutability. | ||
unsafe { &mut *(cache as *const T as *mut T) } |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
There was actually nothing wrong with the way we used this. The issue would have been
struct CImpl {
cache: Mutex<i32>
}
impl Cache {
fn clear(&mut self) {
*self.cache.get_mut() = 0;
}
...
}
If the caller implemented the unsafe trait incorrectly it would be UB; now you might say well that is the point of the unsafe part. and you would be right, but i might as well catch it before they fuck up.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
My review is pretty useless here because I never wrote any unsafe and don't really know what's going on here. I don't even understand what this was for in the first place.
lgtm
It was so that we can allow for a cache to be a reference, rather than having an owned value. An example of this might be let cache = SharedCache::new()
loader.load("key", &cache);
loader.load("key", &cache); Rather than let cache = Arc::new(SharedCache::new())
loader.load("key", cache.clone());
loader.load("key", cache.clone()); |
I see. Always good to remove unsafe code. |
Proposed changes
Removes the unsafe code around cache upcasting by introducing traited functions
as_ref
andas_mut
on the AutoImplCacheRef trait. Also no longer requires theunsafe
attribute.Types of changes
What types of changes does your code introduce to Scuffle?
Put an
x
in the boxes that applyChecklist
Put an
x
in the boxes that apply. You can also fill these out after creating the PR. If you're unsure about any of them, don't hesitate to ask. We're here to help! This is simply a reminder of what we are going to look for before merging your code.Further comments
If this is a relatively large or complex change, you may want to start the discussion by explaining why you chose the solution you did, what alternatives you considered, etc.