comparison rust/hg-cpython/src/ancestors.rs @ 51255:24d3298189d7

rust-index: document safety invariants being upheld for every `unsafe` block

We've added a lot of `unsafe` code that shares Rust structs with Python.
While this is unfortunate, it is also unavoidable, so let's at least
systematically explain why each call to `unsafe` is sound.

If any of the unsafe code ends up being wrong (because everyone screws up
at some point), this change at least continues the unspoken rule of always
explaining the need for `unsafe`, so we at least get a chance to think.

51254:f94c10334bcb

//
// It would be nice for UnsharedPyLeaked to provide this directly as a variant
// of the `map` method with a signature such as:
//
// ```
//   unafe fn map_or_err(py: Python,
//                       f: impl FnOnce(T) -> Result(U, E),
//                       convert_err: impl FnOnce(Python, E) -> PyErr)
// ```
//
// This would spare users of the `cpython` crate the additional `unsafe` deref
// to inspect the error and return it outside `UnsafePyLeaked`, and the
// subsequent unwrapping that this function performs.

    py: Python,
    leaked: UnsafePyLeaked<Result<T, E>>,
    convert_err: impl FnOnce(Python, E) -> PyErr,
) -> PyResult<UnsafePyLeaked<T>> {
    // Result.inspect_err is unstable in Rust 1.61
    if let Err(e) = *unsafe { leaked.try_borrow(py)? } {
        return Err(convert_err(py, e));
    }
    Ok(unsafe {
        leaked.map(py, |res| {
            res.expect("Error case should have already be treated")
        })
    })

py_class!(pub class AncestorsIterator |py| {
    data inner: RefCell<UnsafePyLeaked<VCGAncestorsIterator<PySharedIndex>>>;

    def __next__(&self) -> PyResult<Option<PyRevision>> {
        let mut leaked = self.inner(py).borrow_mut();
        let mut inner = unsafe { leaked.try_borrow_mut(py)? };
        match inner.next() {
            Some(Err(e)) => Err(GraphError::pynew_from_vcsgraph(py, e)),
            None => Ok(None),
            Some(Ok(r)) => Ok(Some(PyRevision(r))),
        }
    }

    def __contains__(&self, rev: PyRevision) -> PyResult<bool> {
        let mut leaked = self.inner(py).borrow_mut();
        let mut inner = unsafe { leaked.try_borrow_mut(py)? };
        inner.contains(rev.0)
            .map_err(|e| GraphError::pynew_from_vcsgraph(py, e))
    }

        initrevs: PyObject,
        stoprev: PyRevision,
        inclusive: bool,
    ) -> PyResult<AncestorsIterator> {
        let index = py_rust_index_to_graph(py, index)?;
        let initvec: Vec<_> = {
            let borrowed_idx = unsafe { index.try_borrow(py)? };
            rev_pyiter_collect(py, &initrevs, &*borrowed_idx)?
        };
        let res_ait = unsafe {
            index.map(py, |idx| {
                VCGAncestorsIterator::new(
                    idx,
                    initvec.into_iter().map(|r| r.0),

    data stoprev: PyRevision;
    data inclusive: bool;

    def __contains__(&self, rev: PyRevision) -> PyResult<bool> {
        let leaked = self.inner(py).borrow();
        let inner: &RefCell<VCGLazyAncestors<PySharedIndex>> =
            &*unsafe { leaked.try_borrow(py)? };
        let inner_mut: &mut VCGLazyAncestors<PySharedIndex> =
            &mut *inner.borrow_mut();
        inner_mut.contains(rev.0)

                                     *self.inclusive(py))
    }

    def __bool__(&self) -> PyResult<bool> {
        let leaked = self.inner(py).borrow();
        let inner = unsafe { leaked.try_borrow(py)? };
        let empty = inner.borrow().is_empty();
        Ok(!empty)
    }

        inclusive: bool
    ) -> PyResult<Self> {
        let cloned_index = index.clone_ref(py);
        let index = py_rust_index_to_graph(py, index)?;
        let initvec: Vec<_> = {
            let borrowed_idx =  unsafe {index.try_borrow(py)?};
            rev_pyiter_collect(py, &initrevs, &*borrowed_idx)?
        };

        let res_lazy =
            unsafe { index.map(py, |idx| VCGLazyAncestors::new(
                idx,
                initvec.into_iter().map(|r| r.0),
                stoprev.0,
                inclusive
            ))};
        let lazy = pyleaked_or_map_err(py, res_lazy,
                                       GraphError::pynew_from_vcsgraph)?;
        let lazy_cell = unsafe { lazy.map(py, RefCell::new)};
        let res = Self::create_instance(
            py, RefCell::new(lazy_cell),
            cloned_index, initrevs, stoprev, inclusive)?;
        Ok(res)

        bases: PyObject
    )
    -> PyResult<MissingAncestors> {
        let cloned_index = index.clone_ref(py);
        let inner_index = py_rust_index_to_graph(py, index)?;
        let bases_vec: Vec<_> = {
            let borrowed_idx = unsafe { inner_index.try_borrow(py)? };
            rev_pyiter_collect(py, &bases, &*borrowed_idx)?
        };

        let inner = unsafe {
            inner_index.map(py, |idx| CoreMissing::new(idx, bases_vec))
        };
        MissingAncestors::create_instance(
            py,

        )
    }

    def hasbases(&self) -> PyResult<bool> {
        let leaked = self.inner(py).borrow();
        let inner: &CoreMissing<PySharedIndex> =
            &*unsafe { leaked.try_borrow(py)? };
        Ok(inner.has_bases())
    }

    def addbases(&self, bases: PyObject) -> PyResult<PyObject> {
        let bases_vec: Vec<_> = {
            let leaked = py_rust_index_to_graph(py,
                                               self.index(py).clone_ref(py))?;
            let index = &*unsafe { leaked.try_borrow(py)? };
            rev_pyiter_collect(py, &bases, index)?
        };

        let mut leaked = self.inner(py).borrow_mut();
        let inner: &mut CoreMissing<PySharedIndex> =
            &mut *unsafe { leaked.try_borrow_mut(py)? };

        inner.add_bases(bases_vec);
        // cpython doc has examples with PyResult<()> but this gives me

        Ok(py.None())
    }

    def bases(&self) -> PyResult<HashSet<PyRevision>> {
        let leaked = self.inner(py).borrow();
        let inner: &CoreMissing<PySharedIndex> =
            &*unsafe { leaked.try_borrow(py)? };
        Ok(inner.get_bases()
           .iter()
           .map(|r| PyRevision(r.0))

        )
    }

    def basesheads(&self) -> PyResult<HashSet<PyRevision>> {
        let leaked = self.inner(py).borrow();
        let inner: &CoreMissing<PySharedIndex> =
            &*unsafe { leaked.try_borrow(py)? };
        Ok(
            inner
                .bases_heads()

            //    discard
            //  - define a trait for sets of revisions in the core and
            //    implement it for a Python set rewrapped with the GIL marker
            let leaked = py_rust_index_to_graph(py,
                                               self.index(py).clone_ref(py))?;
            let index = &*unsafe { leaked.try_borrow(py)? };
            rev_pyiter_collect(py, &revs, &*index)?
        };

        let mut leaked = self.inner(py).borrow_mut();
        let inner: &mut CoreMissing<PySharedIndex> =
            &mut *unsafe { leaked.try_borrow_mut(py)? };

        inner.remove_ancestors_from(&mut revs_pyset)
            .map_err(|e| GraphError::pynew(py, e))?;

    def missingancestors(&self, revs: PyObject) -> PyResult<PyList> {
        let revs_vec: Vec<Revision> = {
            let leaked = py_rust_index_to_graph(py,
                                               self.index(py).clone_ref(py))?;
            let index = &*unsafe { leaked.try_borrow(py)? };
            rev_pyiter_collect(py, &revs, index)?
        };

        let mut leaked = self.inner(py).borrow_mut();
        let inner: &mut CoreMissing<PySharedIndex> =
            &mut *unsafe { leaked.try_borrow_mut(py)? };

        let missing_vec = match inner.missing_ancestors(revs_vec) {
            Ok(missing) => missing,

51255:24d3298189d7

//
// It would be nice for UnsharedPyLeaked to provide this directly as a variant
// of the `map` method with a signature such as:
//
// ```
//   unsafe fn map_or_err(py: Python,
//                        f: impl FnOnce(T) -> Result(U, E),
//                        convert_err: impl FnOnce(Python, E) -> PyErr)
// ```
//
// This would spare users of the `cpython` crate the additional `unsafe` deref
// to inspect the error and return it outside `UnsafePyLeaked`, and the
// subsequent unwrapping that this function performs.

    py: Python,
    leaked: UnsafePyLeaked<Result<T, E>>,
    convert_err: impl FnOnce(Python, E) -> PyErr,
) -> PyResult<UnsafePyLeaked<T>> {
    // Result.inspect_err is unstable in Rust 1.61
    // Safety: we don't leak the "faked" reference out of `UnsafePyLeaked`
    if let Err(e) = *unsafe { leaked.try_borrow(py)? } {
        return Err(convert_err(py, e));
    }
    // Safety: we don't leak the "faked" reference out of `UnsafePyLeaked`
    Ok(unsafe {
        leaked.map(py, |res| {
            res.expect("Error case should have already be treated")
        })
    })

py_class!(pub class AncestorsIterator |py| {
    data inner: RefCell<UnsafePyLeaked<VCGAncestorsIterator<PySharedIndex>>>;

    def __next__(&self) -> PyResult<Option<PyRevision>> {
        let mut leaked = self.inner(py).borrow_mut();
        // Safety: we don't leak the "faked" reference out of `UnsafePyLeaked`
        let mut inner = unsafe { leaked.try_borrow_mut(py)? };
        match inner.next() {
            Some(Err(e)) => Err(GraphError::pynew_from_vcsgraph(py, e)),
            None => Ok(None),
            Some(Ok(r)) => Ok(Some(PyRevision(r))),
        }
    }

    def __contains__(&self, rev: PyRevision) -> PyResult<bool> {
        let mut leaked = self.inner(py).borrow_mut();
        // Safety: we don't leak the "faked" reference out of `UnsafePyLeaked`
        let mut inner = unsafe { leaked.try_borrow_mut(py)? };
        inner.contains(rev.0)
            .map_err(|e| GraphError::pynew_from_vcsgraph(py, e))
    }

        initrevs: PyObject,
        stoprev: PyRevision,
        inclusive: bool,
    ) -> PyResult<AncestorsIterator> {
        let index = py_rust_index_to_graph(py, index)?;
        // Safety: we don't leak the "faked" reference out of `UnsafePyLeaked`
        let initvec: Vec<_> = {
            let borrowed_idx = unsafe { index.try_borrow(py)? };
            rev_pyiter_collect(py, &initrevs, &*borrowed_idx)?
        };
        // Safety: we don't leak the "faked" reference out of `UnsafePyLeaked`
        let res_ait = unsafe {
            index.map(py, |idx| {
                VCGAncestorsIterator::new(
                    idx,
                    initvec.into_iter().map(|r| r.0),

    data stoprev: PyRevision;
    data inclusive: bool;

    def __contains__(&self, rev: PyRevision) -> PyResult<bool> {
        let leaked = self.inner(py).borrow();
        // Safety: we don't leak the "faked" reference out of `UnsafePyLeaked`
        let inner: &RefCell<VCGLazyAncestors<PySharedIndex>> =
            &*unsafe { leaked.try_borrow(py)? };
        let inner_mut: &mut VCGLazyAncestors<PySharedIndex> =
            &mut *inner.borrow_mut();
        inner_mut.contains(rev.0)

                                     *self.inclusive(py))
    }

    def __bool__(&self) -> PyResult<bool> {
        let leaked = self.inner(py).borrow();
        // Safety: we don't leak the "faked" reference out of `UnsafePyLeaked`
        let inner = unsafe { leaked.try_borrow(py)? };
        let empty = inner.borrow().is_empty();
        Ok(!empty)
    }

        inclusive: bool
    ) -> PyResult<Self> {
        let cloned_index = index.clone_ref(py);
        let index = py_rust_index_to_graph(py, index)?;
        let initvec: Vec<_> = {
            // Safety: we don't leak the "faked" reference out of `UnsafePyLeaked`
            let borrowed_idx =  unsafe {index.try_borrow(py)?};
            rev_pyiter_collect(py, &initrevs, &*borrowed_idx)?
        };

        // Safety: we don't leak the "faked" reference out of `UnsafePyLeaked`
        let res_lazy =
            unsafe { index.map(py, |idx| VCGLazyAncestors::new(
                idx,
                initvec.into_iter().map(|r| r.0),
                stoprev.0,
                inclusive
            ))};
        let lazy = pyleaked_or_map_err(py, res_lazy,
                                       GraphError::pynew_from_vcsgraph)?;
        // Safety: we don't leak the "faked" reference out of `UnsafePyLeaked`
        let lazy_cell = unsafe { lazy.map(py, RefCell::new)};
        let res = Self::create_instance(
            py, RefCell::new(lazy_cell),
            cloned_index, initrevs, stoprev, inclusive)?;
        Ok(res)

        bases: PyObject
    )
    -> PyResult<MissingAncestors> {
        let cloned_index = index.clone_ref(py);
        let inner_index = py_rust_index_to_graph(py, index)?;
        // Safety: we don't leak the "faked" reference out of `UnsafePyLeaked`
        let bases_vec: Vec<_> = {
            let borrowed_idx = unsafe { inner_index.try_borrow(py)? };
            rev_pyiter_collect(py, &bases, &*borrowed_idx)?
        };

        // Safety: we don't leak the "faked" reference out of `UnsafePyLeaked`
        let inner = unsafe {
            inner_index.map(py, |idx| CoreMissing::new(idx, bases_vec))
        };
        MissingAncestors::create_instance(
            py,

        )
    }

    def hasbases(&self) -> PyResult<bool> {
        let leaked = self.inner(py).borrow();
        // Safety: we don't leak the "faked" reference out of `UnsafePyLeaked`
        let inner: &CoreMissing<PySharedIndex> =
            &*unsafe { leaked.try_borrow(py)? };
        Ok(inner.has_bases())
    }

    def addbases(&self, bases: PyObject) -> PyResult<PyObject> {
        let bases_vec: Vec<_> = {
            let leaked = py_rust_index_to_graph(py,
                                               self.index(py).clone_ref(py))?;
            // Safety: we don't leak the "faked" reference out of `UnsafePyLeaked`
            let index = &*unsafe { leaked.try_borrow(py)? };
            rev_pyiter_collect(py, &bases, index)?
        };

        let mut leaked = self.inner(py).borrow_mut();
        // Safety: we don't leak the "faked" reference out of `UnsafePyLeaked`
        let inner: &mut CoreMissing<PySharedIndex> =
            &mut *unsafe { leaked.try_borrow_mut(py)? };

        inner.add_bases(bases_vec);
        // cpython doc has examples with PyResult<()> but this gives me

        Ok(py.None())
    }

    def bases(&self) -> PyResult<HashSet<PyRevision>> {
        let leaked = self.inner(py).borrow();
        // Safety: we don't leak the "faked" reference out of `UnsafePyLeaked`
        let inner: &CoreMissing<PySharedIndex> =
            &*unsafe { leaked.try_borrow(py)? };
        Ok(inner.get_bases()
           .iter()
           .map(|r| PyRevision(r.0))

        )
    }

    def basesheads(&self) -> PyResult<HashSet<PyRevision>> {
        let leaked = self.inner(py).borrow();
        // Safety: we don't leak the "faked" reference out of `UnsafePyLeaked`
        let inner: &CoreMissing<PySharedIndex> =
            &*unsafe { leaked.try_borrow(py)? };
        Ok(
            inner
                .bases_heads()

            //    discard
            //  - define a trait for sets of revisions in the core and
            //    implement it for a Python set rewrapped with the GIL marker
            let leaked = py_rust_index_to_graph(py,
                                               self.index(py).clone_ref(py))?;
            // Safety: we don't leak the "faked" reference out of `UnsafePyLeaked`
            let index = &*unsafe { leaked.try_borrow(py)? };
            rev_pyiter_collect(py, &revs, &*index)?
        };

        let mut leaked = self.inner(py).borrow_mut();
        // Safety: we don't leak the "faked" reference out of `UnsafePyLeaked`
        let inner: &mut CoreMissing<PySharedIndex> =
            &mut *unsafe { leaked.try_borrow_mut(py)? };

        inner.remove_ancestors_from(&mut revs_pyset)
            .map_err(|e| GraphError::pynew(py, e))?;

    def missingancestors(&self, revs: PyObject) -> PyResult<PyList> {
        let revs_vec: Vec<Revision> = {
            let leaked = py_rust_index_to_graph(py,
                                               self.index(py).clone_ref(py))?;
            // Safety: we don't leak the "faked" reference out of `UnsafePyLeaked`
            let index = &*unsafe { leaked.try_borrow(py)? };
            rev_pyiter_collect(py, &revs, index)?
        };

        let mut leaked = self.inner(py).borrow_mut();
        // Safety: we don't leak the "faked" reference out of `UnsafePyLeaked`
        let inner: &mut CoreMissing<PySharedIndex> =
            &mut *unsafe { leaked.try_borrow_mut(py)? };

        let missing_vec = match inner.missing_ancestors(revs_vec) {
            Ok(missing) => missing,