memorysafety / rav1d

An AV1 decoder in Rust.
BSD 2-Clause "Simplified" License
321 stars 22 forks source link

`struct DisjointMut`: `unsafe impl Send + Sync` #1316

Closed kkysen closed 2 months ago

kkysen commented 2 months ago

Does this reasoning make sense?

In particular, I'm unsure about the provenanceless thing and data races not leading to memory unsafety. Is this worth it to say? Is it worth it to add an unsafe trait Provenanceless to ensure such a thing at a more detailed level? I do think it's an important point that data races won't lead to memory unsafety, though.

kkysen commented 2 months ago

Do we need the T: Send + Sync bounds in the unsafe impl Send + Sync here? Because as is, Rav1dPictureDataComponent is not Send or Sync (which we need it to be) since it contains a ptr: NonNull<u8>. This ptr is not Sync, however, as no synchronization is done.

rinon commented 2 months ago

I think we need to require it. If that pointer is indeed safe to share we need to mark it as such.

kkysen commented 2 months ago

I think we need to require it. If that pointer is indeed safe to share we need to mark it as such.

It's not safe, though. That's the problem.

kkysen commented 2 months ago

Let me think about it some more.