Rollup merge of #129449 - coolreader18:pin-as_deref_mut-signature, r=… · patricklam/verify-rust-std@acf6f03
@@ -1291,8 +1291,8 @@ impl<Ptr: Deref> Pin<Ptr> {
12911291 /// // Now, if `x` was the only reference, we have a mutable reference to
12921292 /// // data that we pinned above, which we could use to move it as we have
12931293 /// // seen in the previous example. We have violated the pinning API contract.
1294- /// }
1295- /// ```
1294+ /// }
1295+ /// ```
12961296 ///
12971297 /// ## Pinning of closure captures
12981298 ///
@@ -1370,33 +1370,6 @@ impl<Ptr: Deref> Pin<Ptr> {
13701370unsafe { Pin::new_unchecked(&*self.__pointer) }
13711371}
137213721373-/// Unwraps this `Pin<Ptr>`, returning the underlying `Ptr`.
1374- ///
1375- /// # Safety
1376- ///
1377- /// This function is unsafe. You must guarantee that you will continue to
1378- /// treat the pointer `Ptr` as pinned after you call this function, so that
1379- /// the invariants on the `Pin` type can be upheld. If the code using the
1380- /// resulting `Ptr` does not continue to maintain the pinning invariants that
1381- /// is a violation of the API contract and may lead to undefined behavior in
1382- /// later (safe) operations.
1383- ///
1384- /// Note that you must be able to guarantee that the data pointed to by `Ptr`
1385- /// will be treated as pinned all the way until its `drop` handler is complete!
1386- ///
1387- /// *For more information, see the [`pin` module docs][self]*
1388- ///
1389- /// If the underlying data is [`Unpin`], [`Pin::into_inner`] should be used
1390- /// instead.
1391- #[inline(always)]
1392-#[rustc_const_unstable(feature = "const_pin", issue = "76654")]
1393-#[stable(feature = "pin_into_inner", since = "1.39.0")]
1394-pub const unsafe fn into_inner_unchecked(pin: Pin<Ptr>) -> Ptr {
1395- pin.__pointer
1396-}
1397-}
1398-1399-impl<Ptr: DerefMut> Pin<Ptr> {
14001373/// Gets a mutable reference to the pinned value this `Pin<Ptr>` points to.
14011374 ///
14021375 /// This is a generic method to go from `&mut Pin<Pointer<T>>` to `Pin<&mut T>`.
@@ -1428,11 +1401,55 @@ impl<Ptr: DerefMut> Pin<Ptr> {
14281401 /// ```
14291402 #[stable(feature = "pin", since = "1.33.0")]
14301403#[inline(always)]
1431-pub fn as_mut(&mut self) -> Pin<&mut Ptr::Target> {
1404+pub fn as_mut(&mut self) -> Pin<&mut Ptr::Target>
1405+where
1406+Ptr: DerefMut,
1407+{
14321408// SAFETY: see documentation on this function
14331409unsafe { Pin::new_unchecked(&mut *self.__pointer) }
14341410}
143514111412+/// Gets `Pin<&mut T>` to the underlying pinned value from this nested `Pin`-pointer.
1413+ ///
1414+ /// This is a generic method to go from `Pin<&mut Pin<Pointer<T>>>` to `Pin<&mut T>`. It is
1415+ /// safe because the existence of a `Pin<Pointer<T>>` ensures that the pointee, `T`, cannot
1416+ /// move in the future, and this method does not enable the pointee to move. "Malicious"
1417+ /// implementations of `Ptr::DerefMut` are likewise ruled out by the contract of
1418+ /// `Pin::new_unchecked`.
1419+ #[unstable(feature = "pin_deref_mut", issue = "86918")]
1420+#[must_use = "`self` will be dropped if the result is not used"]
1421+#[inline(always)]
1422+pub fn as_deref_mut(self: Pin<&mut Pin<Ptr>>) -> Pin<&mut Ptr::Target>
1423+where
1424+Ptr: DerefMut,
1425+{
1426+// SAFETY: What we're asserting here is that going from
1427+//
1428+// Pin<&mut Pin<Ptr>>
1429+//
1430+// to
1431+//
1432+// Pin<&mut Ptr::Target>
1433+//
1434+// is safe.
1435+//
1436+// We need to ensure that two things hold for that to be the case:
1437+//
1438+// 1) Once we give out a `Pin<&mut Ptr::Target>`, a `&mut Ptr::Target` will not be given out.
1439+// 2) By giving out a `Pin<&mut Ptr::Target>`, we do not risk violating
1440+// `Pin<&mut Pin<Ptr>>`
1441+//
1442+// The existence of `Pin<Ptr>` is sufficient to guarantee #1: since we already have a
1443+// `Pin<Ptr>`, it must already uphold the pinning guarantees, which must mean that
1444+// `Pin<&mut Ptr::Target>` does as well, since `Pin::as_mut` is safe. We do not have to rely
1445+// on the fact that `Ptr` is _also_ pinned.
1446+//
1447+// For #2, we need to ensure that code given a `Pin<&mut Ptr::Target>` cannot cause the
1448+// `Pin<Ptr>` to move? That is not possible, since `Pin<&mut Ptr::Target>` no longer retains
1449+// any access to the `Ptr` itself, much less the `Pin<Ptr>`.
1450+unsafe { self.get_unchecked_mut() }.as_mut()
1451+}
1452+14361453/// Assigns a new value to the memory location pointed to by the `Pin<Ptr>`.
14371454 ///
14381455 /// This overwrites pinned data, but that is okay: the original pinned value's destructor gets
@@ -1457,10 +1474,36 @@ impl<Ptr: DerefMut> Pin<Ptr> {
14571474#[inline(always)]
14581475pub fn set(&mut self, value: Ptr::Target)
14591476where
1477+Ptr: DerefMut,
14601478Ptr::Target: Sized,
14611479{
14621480*(self.__pointer) = value;
14631481}
1482+1483+/// Unwraps this `Pin<Ptr>`, returning the underlying `Ptr`.
1484+ ///
1485+ /// # Safety
1486+ ///
1487+ /// This function is unsafe. You must guarantee that you will continue to
1488+ /// treat the pointer `Ptr` as pinned after you call this function, so that
1489+ /// the invariants on the `Pin` type can be upheld. If the code using the
1490+ /// resulting `Ptr` does not continue to maintain the pinning invariants that
1491+ /// is a violation of the API contract and may lead to undefined behavior in
1492+ /// later (safe) operations.
1493+ ///
1494+ /// Note that you must be able to guarantee that the data pointed to by `Ptr`
1495+ /// will be treated as pinned all the way until its `drop` handler is complete!
1496+ ///
1497+ /// *For more information, see the [`pin` module docs][self]*
1498+ ///
1499+ /// If the underlying data is [`Unpin`], [`Pin::into_inner`] should be used
1500+ /// instead.
1501+ #[inline(always)]
1502+#[rustc_const_unstable(feature = "const_pin", issue = "76654")]
1503+#[stable(feature = "pin_into_inner", since = "1.39.0")]
1504+pub const unsafe fn into_inner_unchecked(pin: Pin<Ptr>) -> Ptr {
1505+ pin.__pointer
1506+}
14641507}
1465150814661509impl<'a, T: ?Sized> Pin<&'a T> {
@@ -1613,46 +1656,6 @@ impl<T: ?Sized> Pin<&'static T> {
16131656}
16141657}
161516581616-impl<'a, Ptr: DerefMut> Pin<&'a mut Pin<Ptr>> {
1617-/// Gets `Pin<&mut T>` to the underlying pinned value from this nested `Pin`-pointer.
1618- ///
1619- /// This is a generic method to go from `Pin<&mut Pin<Pointer<T>>>` to `Pin<&mut T>`. It is
1620- /// safe because the existence of a `Pin<Pointer<T>>` ensures that the pointee, `T`, cannot
1621- /// move in the future, and this method does not enable the pointee to move. "Malicious"
1622- /// implementations of `Ptr::DerefMut` are likewise ruled out by the contract of
1623- /// `Pin::new_unchecked`.
1624- #[unstable(feature = "pin_deref_mut", issue = "86918")]
1625-#[must_use = "`self` will be dropped if the result is not used"]
1626-#[inline(always)]
1627-pub fn as_deref_mut(self) -> Pin<&'a mut Ptr::Target> {
1628-// SAFETY: What we're asserting here is that going from
1629-//
1630-// Pin<&mut Pin<Ptr>>
1631-//
1632-// to
1633-//
1634-// Pin<&mut Ptr::Target>
1635-//
1636-// is safe.
1637-//
1638-// We need to ensure that two things hold for that to be the case:
1639-//
1640-// 1) Once we give out a `Pin<&mut Ptr::Target>`, a `&mut Ptr::Target` will not be given out.
1641-// 2) By giving out a `Pin<&mut Ptr::Target>`, we do not risk violating
1642-// `Pin<&mut Pin<Ptr>>`
1643-//
1644-// The existence of `Pin<Ptr>` is sufficient to guarantee #1: since we already have a
1645-// `Pin<Ptr>`, it must already uphold the pinning guarantees, which must mean that
1646-// `Pin<&mut Ptr::Target>` does as well, since `Pin::as_mut` is safe. We do not have to rely
1647-// on the fact that `Ptr` is _also_ pinned.
1648-//
1649-// For #2, we need to ensure that code given a `Pin<&mut Ptr::Target>` cannot cause the
1650-// `Pin<Ptr>` to move? That is not possible, since `Pin<&mut Ptr::Target>` no longer retains
1651-// any access to the `Ptr` itself, much less the `Pin<Ptr>`.
1652-unsafe { self.get_unchecked_mut() }.as_mut()
1653-}
1654-}
1655-16561659impl<T: ?Sized> Pin<&'static mut T> {
16571660/// Gets a pinning mutable reference from a static mutable reference.
16581661 ///