rust-cpython: move borrow_mut() to PySharedRefCell

rust-cpython: move borrow_mut() to PySharedRefCell

PySharedRefCell() will host almost all py_shared public functions. This change
is the first step.

borrow_mut() can be safely implemented since PySharedRefCell knows its inner
object is managed by its own py_shared_state.

--- a/rust/hg-cpython/src/ref_sharing.rs	Sat Sep 14 23:01:51 2019 +0900
+++ b/rust/hg-cpython/src/ref_sharing.rs	Sat Sep 14 23:17:19 2019 +0900
@@ -140,9 +140,15 @@
         self.inner.as_ptr()
     }
 
-    pub unsafe fn borrow_mut(&self) -> RefMut<T> {
-        // must be borrowed by self.py_shared_state(py).borrow_mut().
-        self.inner.borrow_mut()
+    // TODO: maybe this should be named as try_borrow_mut(), and use
+    // inner.try_borrow_mut(). The current implementation panics if
+    // self.inner has been borrowed, but returns error if py_shared_state
+    // refuses to borrow.
+    pub fn borrow_mut<'a>(
+        &'a self,
+        py: Python<'a>,
+    ) -> PyResult<PyRefMut<'a, T>> {
+        self.py_shared_state.borrow_mut(py, self.inner.borrow_mut())
     }
 }
 
@@ -231,6 +237,7 @@
         $leaked: ident,
     ) => {
         impl $name {
+            // TODO: remove this function in favor of inner(py).borrow_mut()
             fn borrow_mut<'a>(
                 &'a self,
                 py: Python<'a>,
@@ -239,8 +246,7 @@
                 // assert $data_member type
                 use crate::ref_sharing::PySharedRefCell;
                 let data: &PySharedRefCell<_> = self.$data_member(py);
-                data.py_shared_state
-                    .borrow_mut(py, unsafe { data.borrow_mut() })
+                data.borrow_mut(py)
             }
 
             /// Returns a leaked reference and its management object.