Request for feature: unsafe as a qualifier for structure fields

[mstewartgallus]

When wrapping low-level, and unsafe APIs like OpenGL ES there is often a need to provide fallbacks to unsafety. Currently, one has to create private fields, and a large amount of ugly conversion functions in the style of unsafe fn raw_handle(&self)->gl::GLuint, and unsafe fn from_raw_handle(gl::GLuint)->Attribute<State, T>. I would prefer not to.

The best existing workaround would probable be to generate these conversion functions using a macro that would be used like unsafe_field!(raw_handle, Attribute<State, T>). I am not sure how best to create such a macro though.

I feel a nice solution to this problem would be the ability to tag structure fields with the unsafe keyword so that they could only be accessed within an unsafe block.

The syntax pub struct Attribute<'self, S, T> { unsafe context: &'self Context, unsafe contents: gl::GLuint } seems intuitive to me but does not generalize nicely to enumerations, or tuple structs.

[Aatch]

Safety in rust generally refers to memory safety. As a general rule, data is not unsafe, only operations. I don't see how accessing a field in a struct could be unsafe.

[mstewartgallus]

@Aatch Well accessing the field (the raw_handle method) probable shouldn't be unsafe (like converting to unsafe pointers) but the operation to set the field to an arbitrary integer from_raw_handle should be unsafe (like getting a safe pointer from an unsafe pointer.)

[huonw]

Triage: I do think this is much better handled by having private fields with unsafe methods (which are more flexible anyway, e.g. it allows one to institute some safety checks, if desired):

struct Attribute<'a, S, T> {
    priv context: &'a Context,
    priv contents: gl::GLuint
}
impl<'a, S, T> Attribute<'a, S, T> {
    unsafe fn set_contents(&mut self, x: gl::GLuint) { self.contents = x }
    // etc.
}

A macro_rules macro for it might look something like:

macro_rules! unsafe_fields {
    (<$('$lifetime: ident, )* 
      $($param: ident),*>
     $ty: ty: $( $field: ident: $field_ty: ty [$setter: ident] ),*) => {
        impl<$($param)*> $ty {
            $(
                pub fn $field<'a>(&'a self) -> &'a $field_ty { &self.$field }
                pub unsafe fn $setter(&mut self, x: $field_ty) {
                    self.$field = x
                }
            )*
        }
    }
}

unsafe_fields! {
    <'a, S, T> Attribute<'a, S, T>:
    context: &'a Context [set_context],
    contents: gl::GLuint [set_contents]
}

(I guess one could even factor that macro to define the struct itself, so that the field names and types are not being repeated.)

In any case, I see this as a very rare use-case, I don't think it's worth extending the language; however, I have not written many low-level wrapper libraries like this, so I'm not sure quite how painful it is.

[alexcrichton]

Closing, Unsafe<T> satisfies this to an extent, but we also have an official RFC process for language changes like this.