@@ -165,6 +165,7 @@ mod imp {
165165 mut err_pipe : ChildStderr ,
166166 data : & mut dyn FnMut ( bool , & mut Vec < u8 > , bool ) ,
167167 ) -> io:: Result < ( ) > {
168+ // FIXME(#139616): justify why this is sound.
168169 unsafe {
169170 libc:: fcntl ( out_pipe. as_raw_fd ( ) , libc:: F_SETFL , libc:: O_NONBLOCK ) ;
170171 libc:: fcntl ( err_pipe. as_raw_fd ( ) , libc:: F_SETFL , libc:: O_NONBLOCK ) ;
@@ -175,6 +176,7 @@ mod imp {
175176 let mut out = Vec :: new ( ) ;
176177 let mut err = Vec :: new ( ) ;
177178
179+ // FIXME(#139616): justify why this is sound.
178180 let mut fds: [ libc:: pollfd ; 2 ] = unsafe { mem:: zeroed ( ) } ;
179181 fds[ 0 ] . fd = out_pipe. as_raw_fd ( ) ;
180182 fds[ 0 ] . events = libc:: POLLIN ;
@@ -185,6 +187,7 @@ mod imp {
185187
186188 while nfds > 0 {
187189 // wait for either pipe to become readable using `select`
190+ // FIXME(#139616): justify why this is sound.
188191 let r = unsafe { libc:: poll ( fds. as_mut_ptr ( ) , nfds, -1 ) } ;
189192 if r == -1 {
190193 let err = io:: Error :: last_os_error ( ) ;
@@ -256,6 +259,7 @@ mod imp {
256259 port. add_handle ( 0 , & out_pipe) ?;
257260 port. add_handle ( 1 , & err_pipe) ?;
258261
262+ // FIXME(#139616): justify why this is sound.
259263 unsafe {
260264 let mut out_pipe = Pipe :: new ( out_pipe, & mut out) ;
261265 let mut err_pipe = Pipe :: new ( err_pipe, & mut err) ;
@@ -284,18 +288,23 @@ mod imp {
284288 }
285289
286290 impl < ' a > Pipe < ' a > {
291+ // FIXME(#139616): document caller contract.
287292 unsafe fn new < P : IntoRawHandle > ( p : P , dst : & ' a mut Vec < u8 > ) -> Pipe < ' a > {
288293 Pipe {
289294 dst,
290- pipe : NamedPipe :: from_raw_handle ( p. into_raw_handle ( ) ) ,
295+ // FIXME(#139616): justify why this is sound.
296+ pipe : unsafe { NamedPipe :: from_raw_handle ( p. into_raw_handle ( ) ) } ,
291297 overlapped : Overlapped :: zero ( ) ,
292298 done : false ,
293299 }
294300 }
295301
302+ // FIXME(#139616): document caller contract.
296303 unsafe fn read ( & mut self ) -> io:: Result < ( ) > {
297- let dst = slice_to_end ( self . dst ) ;
298- match self . pipe . read_overlapped ( dst, self . overlapped . raw ( ) ) {
304+ // FIXME(#139616): justify why this is sound.
305+ let dst = unsafe { slice_to_end ( self . dst ) } ;
306+ // FIXME(#139616): justify why this is sound.
307+ match unsafe { self . pipe . read_overlapped ( dst, self . overlapped . raw ( ) ) } {
299308 Ok ( _) => Ok ( ( ) ) ,
300309 Err ( e) => {
301310 if e. raw_os_error ( ) == Some ( ERROR_BROKEN_PIPE . 0 as i32 ) {
@@ -308,22 +317,31 @@ mod imp {
308317 }
309318 }
310319
320+ // FIXME(#139616): document caller contract.
311321 unsafe fn complete ( & mut self , status : & CompletionStatus ) {
312322 let prev = self . dst . len ( ) ;
313- self . dst . set_len ( prev + status. bytes_transferred ( ) as usize ) ;
323+ // FIXME(#139616): justify why this is sound.
324+ unsafe { self . dst . set_len ( prev + status. bytes_transferred ( ) as usize ) } ;
314325 if status. bytes_transferred ( ) == 0 {
315326 self . done = true ;
316327 }
317328 }
318329 }
319330
331+ // FIXME(#139616): document caller contract.
320332 unsafe fn slice_to_end ( v : & mut Vec < u8 > ) -> & mut [ u8 ] {
321333 if v. capacity ( ) == 0 {
322334 v. reserve ( 16 ) ;
323335 }
324336 if v. capacity ( ) == v. len ( ) {
325337 v. reserve ( 1 ) ;
326338 }
327- slice:: from_raw_parts_mut ( v. as_mut_ptr ( ) . offset ( v. len ( ) as isize ) , v. capacity ( ) - v. len ( ) )
339+ // FIXME(#139616): justify why this is sound.
340+ unsafe {
341+ slice:: from_raw_parts_mut (
342+ v. as_mut_ptr ( ) . offset ( v. len ( ) as isize ) ,
343+ v. capacity ( ) - v. len ( ) ,
344+ )
345+ }
328346 }
329347}
0 commit comments