e8a42d5851
Since the introduction of `Script` `unsafe` started slowly creeping in as more types with similar semantics were added. The `unsafe` in these cases is just for trivial conversions between various pointer-like types. As such, it's possible to move these into a single macro that takes care of the conversions at one place and avoid repeating the same `unsafe` code in the codebase. This decreases the cost of audits which now only need to happen in `internals`, focuses any changes to happen in that single macro and decreases the chance that we will mess up similarly to the recent `try_into().expect()` issue (but this time with UB rather than panic). The new macro accepts syntax very similar to the already-existing struct declarations with these differences: * The struct MUST NOT have `#[repr(transparent)]` - it's added by the macro * If the struct uses `PhantomData` it must be the first field and the real data must be the second field (to allow unsized types). * The struct must be immediately followed by an impl block containing at least on conversion function. * If the struct has generics the impl block has to use the same names of generics. * The conversion functions don't have bodies (similarly to required trait methods) and have a fixed set of allowed signatures. * Underscore (`_`) must be used in place of the inner type in the conversion function parameters. The existing code can simply call the macro with simple changes and get the same behavior without any direct use of `unsafe`. This change already calls the macro for all relevant existing types. There are still some usages left unrelated to the macro, except one additional conversion in reverse direction on `Script`. It could be moved as well but since it's on a single place so far it's not really required. |
||
|---|---|---|
| .. | ||
| contrib | ||
| embedded | ||
| examples | ||
| src | ||
| tests | ||
| CHANGELOG.md | ||
| Cargo.toml | ||