Closed nicklan closed 4 days ago
Attention: Patch coverage is 86.66667%
with 6 lines
in your changes missing coverage. Please review.
Project coverage is 79.56%. Comparing base (
5a114ef
) to head (859d57b
). Report is 1 commits behind head on main.
Files with missing lines | Patch % | Lines |
---|---|---|
ffi/src/lib.rs | 84.21% | 6 Missing :warning: |
:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.
woah very awesome! excited for this!!
What changes are proposed in this pull request?
This PR adds a test where we start to use miri to make sure we're not doing anything crazy in our FFI. Initially it just tests a couple of things, which already uncovered an issue (see below). We need to add lots more unit tests for the various ffi functions to get miri to validate what we're doing.
This uncovered that the way we were getting pointers in handles was actually unsound. Previously we would do something like:
To get the pointer. This is fine, but note that we are converting from
&T
into aNonNull<T>
here, which is supported in the trait, but marks the memory asSharedReadOnly
because we don't own the reference.But to free the memory we use
into_inner()
which wants to do:This takes
Unique
ownership of the pointer, which is not valid because we only created it inSharedReadOnly
.This PR switches to use
Box::leak
to get pointers, which constructs them with the correct memory tag. It's possible there are cases where we DO want the memory tagged asSharedReadOnly
, but in that case I think we'd have to keep a reference around in rust to ever be able to free things, since experimenting indicates that all thefrom_raw
calls (Arc, Rc, Box) want the memory to be at leastSharedReadWrite
.Box in particular wants
Unique
. I need to do some more research about if Arc/Rc::into_raw produce a thin pointer or not, as they place less stringent requirements in theirfrom_raw
.For now, to minimize change, I'm sticking with Box.
How was this change tested?
Added some unit tests