@@ -165,6 +165,7 @@ mod imp {
165
165
mut err_pipe : ChildStderr ,
166
166
data : & mut dyn FnMut ( bool , & mut Vec < u8 > , bool ) ,
167
167
) -> io:: Result < ( ) > {
168
+ // FIXME(#139616): justify why this is sound.
168
169
unsafe {
169
170
libc:: fcntl ( out_pipe. as_raw_fd ( ) , libc:: F_SETFL , libc:: O_NONBLOCK ) ;
170
171
libc:: fcntl ( err_pipe. as_raw_fd ( ) , libc:: F_SETFL , libc:: O_NONBLOCK ) ;
@@ -175,6 +176,7 @@ mod imp {
175
176
let mut out = Vec :: new ( ) ;
176
177
let mut err = Vec :: new ( ) ;
177
178
179
+ // FIXME(#139616): justify why this is sound.
178
180
let mut fds: [ libc:: pollfd ; 2 ] = unsafe { mem:: zeroed ( ) } ;
179
181
fds[ 0 ] . fd = out_pipe. as_raw_fd ( ) ;
180
182
fds[ 0 ] . events = libc:: POLLIN ;
@@ -185,6 +187,7 @@ mod imp {
185
187
186
188
while nfds > 0 {
187
189
// wait for either pipe to become readable using `select`
190
+ // FIXME(#139616): justify why this is sound.
188
191
let r = unsafe { libc:: poll ( fds. as_mut_ptr ( ) , nfds, -1 ) } ;
189
192
if r == -1 {
190
193
let err = io:: Error :: last_os_error ( ) ;
@@ -256,6 +259,7 @@ mod imp {
256
259
port. add_handle ( 0 , & out_pipe) ?;
257
260
port. add_handle ( 1 , & err_pipe) ?;
258
261
262
+ // FIXME(#139616): justify why this is sound.
259
263
unsafe {
260
264
let mut out_pipe = Pipe :: new ( out_pipe, & mut out) ;
261
265
let mut err_pipe = Pipe :: new ( err_pipe, & mut err) ;
@@ -284,18 +288,23 @@ mod imp {
284
288
}
285
289
286
290
impl < ' a > Pipe < ' a > {
291
+ // FIXME(#139616): document caller contract.
287
292
unsafe fn new < P : IntoRawHandle > ( p : P , dst : & ' a mut Vec < u8 > ) -> Pipe < ' a > {
288
293
Pipe {
289
294
dst,
290
- pipe : NamedPipe :: from_raw_handle ( p. into_raw_handle ( ) ) ,
295
+ // FIXME(#139616): justify why this is sound.
296
+ pipe : unsafe { NamedPipe :: from_raw_handle ( p. into_raw_handle ( ) ) } ,
291
297
overlapped : Overlapped :: zero ( ) ,
292
298
done : false ,
293
299
}
294
300
}
295
301
302
+ // FIXME(#139616): document caller contract.
296
303
unsafe fn read ( & mut self ) -> io:: Result < ( ) > {
297
- let dst = slice_to_end ( self . dst ) ;
298
- match self . pipe . read_overlapped ( dst, self . overlapped . raw ( ) ) {
304
+ // FIXME(#139616): justify why this is sound.
305
+ let dst = unsafe { slice_to_end ( self . dst ) } ;
306
+ // FIXME(#139616): justify why this is sound.
307
+ match unsafe { self . pipe . read_overlapped ( dst, self . overlapped . raw ( ) ) } {
299
308
Ok ( _) => Ok ( ( ) ) ,
300
309
Err ( e) => {
301
310
if e. raw_os_error ( ) == Some ( ERROR_BROKEN_PIPE . 0 as i32 ) {
@@ -308,22 +317,31 @@ mod imp {
308
317
}
309
318
}
310
319
320
+ // FIXME(#139616): document caller contract.
311
321
unsafe fn complete ( & mut self , status : & CompletionStatus ) {
312
322
let prev = self . dst . len ( ) ;
313
- self . dst . set_len ( prev + status. bytes_transferred ( ) as usize ) ;
323
+ // FIXME(#139616): justify why this is sound.
324
+ unsafe { self . dst . set_len ( prev + status. bytes_transferred ( ) as usize ) } ;
314
325
if status. bytes_transferred ( ) == 0 {
315
326
self . done = true ;
316
327
}
317
328
}
318
329
}
319
330
331
+ // FIXME(#139616): document caller contract.
320
332
unsafe fn slice_to_end ( v : & mut Vec < u8 > ) -> & mut [ u8 ] {
321
333
if v. capacity ( ) == 0 {
322
334
v. reserve ( 16 ) ;
323
335
}
324
336
if v. capacity ( ) == v. len ( ) {
325
337
v. reserve ( 1 ) ;
326
338
}
327
- slice:: from_raw_parts_mut ( v. as_mut_ptr ( ) . offset ( v. len ( ) as isize ) , v. capacity ( ) - v. len ( ) )
339
+ // FIXME(#139616): justify why this is sound.
340
+ unsafe {
341
+ slice:: from_raw_parts_mut (
342
+ v. as_mut_ptr ( ) . offset ( v. len ( ) as isize ) ,
343
+ v. capacity ( ) - v. len ( ) ,
344
+ )
345
+ }
328
346
}
329
347
}
0 commit comments