From 5b2be889f9003231a0b6b5d0e12206998036bb04 Mon Sep 17 00:00:00 2001 From: enricobuehler Date: Tue, 28 Jul 2026 23:17:02 +0200 Subject: [PATCH] refactor(capture/windows): two `# Safety` sections that stated no contract MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The previous commit took the markers with no `# Safety` at all. These two HAVE one, and that is what makes them worth naming: a section can exist and still describe nothing a caller can violate. `resolve_render_adapter` takes **no arguments**. Its section read "calls DXGI factory/adapter enumeration; returns owned COM objects or an error" — a summary of the body. With no parameters and no globals touched, there is no way to call it wrongly. `create_nv12` asked that "`device` must be a live D3D11 device". It takes `&ID3D11Device`, a borrowed reference-counted COM wrapper, so the borrow itself is that guarantee — safe Rust cannot produce a dangling one. The remainder ("the returned texture is owned by the caller") is an ownership note, the same distinction `service::open_log_handle` already draws in its doc. Every other parameter is a plain scalar. Both bodies already had their explicit block, so again nothing moved. `create_nv12`'s proof said "on the live `device` borrow (per the contract above)" and now says the borrow is what keeps it live — a proof that pointed at a contract being deleted had to stop pointing at it. The other four were read and KEPT, and they are the shape of a real one: `channel::send` and `duplicate_and_deliver` take raw `HANDLE`s; `prepare_blend_scratch` requires the caller to hold the slot's keyed mutex before it copies; `pyro_fence_signal` must run on the thread owning the immediate context, which is load-bearing precisely because `IddPushCapturer` is `unsafe impl Send` and so CAN be moved. `verify_is_wudfhost` (raw `HANDLE`, and the driver-channel security check) keeps its marker too. pf-capture: 21 `unsafe fn` -> 8, every survivor carrying an obligation a caller can actually break. Verified on .47: pf-capture clippy `-D warnings` rc=0 + 18 Windows tests pass, host/pf-encode/ pf-vdisplay green; Linux .21 fmt + both CI clippy steps rc=0. --- .../pf-capture/src/windows/synthetic_nv12.rs | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/crates/pf-capture/src/windows/synthetic_nv12.rs b/crates/pf-capture/src/windows/synthetic_nv12.rs index ae2b41e8..206ad2dd 100644 --- a/crates/pf-capture/src/windows/synthetic_nv12.rs +++ b/crates/pf-capture/src/windows/synthetic_nv12.rs @@ -137,9 +137,10 @@ impl Capturer for SyntheticNv12Capturer { /// Resolve the same render adapter the encoder will pick (`PUNKTFUNK_RENDER_ADAPTER` / preference / /// max-VRAM LUID), falling back to adapter 0. /// -/// # Safety -/// Calls DXGI factory/adapter enumeration; returns owned COM objects or an error. -unsafe fn resolve_render_adapter() -> Result { +/// Safe: it takes no arguments, so there is nothing a caller could get wrong — it creates the +/// factory itself and returns an owned adapter. The `# Safety` section it used to carry ("calls +/// DXGI enumeration; returns owned COM objects") described the body, which is not a contract. +fn resolve_render_adapter() -> Result { // SAFETY: three `?`/`Ok`-checked DXGI enumeration calls over owned locals — the factory is // created here and the adapters it returns own their own COM references. No raw pointers. unsafe { @@ -155,9 +156,10 @@ unsafe fn resolve_render_adapter() -> Result { /// Create an NV12 `Texture2D` with the given usage/CPU-access/bind flags. /// -/// # Safety -/// `device` must be a live D3D11 device; the returned texture is owned by the caller. -unsafe fn create_nv12( +/// Safe: its old `# Safety` asked for "a live D3D11 device", which `&ID3D11Device` — a borrowed, +/// reference-counted COM wrapper — already guarantees; the rest ("the returned texture is owned by +/// the caller") is an ownership note, not a soundness obligation. Every flag is a plain scalar. +fn create_nv12( device: &ID3D11Device, width: u32, height: u32, @@ -181,8 +183,8 @@ unsafe fn create_nv12( ..Default::default() }; let mut tex: Option = None; - // SAFETY: one `?`-checked `CreateTexture2D` on the live `device` borrow (per the contract - // above), with a fully-initialized stack descriptor and a live `Option` out-param. + // SAFETY: one `?`-checked `CreateTexture2D` on the `&ID3D11Device` borrow, which the borrow + // itself keeps live, with a fully-initialized stack descriptor and a live `Option` out-param. unsafe { device .CreateTexture2D(&desc, None, Some(&mut tex))