3 ms·
I think this is a little too dumbed down for me to see the relevance to the actual problem. Also, I believ 1&2 both require unsafe code to implement the trait
by eximius 7y ago
I think this is a little too dumbed down for me to see the relevance to the actual problem.
Also, I believ 1&2 both require unsafe code to implement the trait that allows the unsoundness.
For what &T can I safely implement DerefMut? Is it the fault of Pin that a type has DerefMut implemented that the unsafe block of that implementation doesn't uphold safety?
- steveklabnik 7y agoThe relevance to the problem is that even if these examples needed unsafe code, that doesn't mean that there's no problem. "resilient to unsafe code" is not the right way to think about unsafe. > For what &T can I safely implement DerefMut? Is it the fault of Pin that a type has DerefMut implemented that the unsafe block of that implementation doesn't uphold safety? It is the fault of Pin's safety guidelines, which suggest a contract that is not actually enough to uphold safety. That's why this is considered an unsoundness in Pin, and not a problem with the code written with unsafe. That is: > that the unsafe block of that implementation doesn't uphold safety? is not correct, the unsafe block does everything it's supposed to to uphold safety.
- eximius 7y agoI can see the argument that Pin should be safe if you meet the contract it claims to need. The requirements are not sufficiently tight. Fair enough.