From ee29b3c3a9be2984ae22d14e75b77d9297f5a04d Mon Sep 17 00:00:00 2001 From: enricobuehler Date: Tue, 28 Jul 2026 23:44:16 +0200 Subject: [PATCH] refactor(client-core): three decoder lift methods that took nothing to get wrong MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `D3d11Decoder::lift`, `VaapiDecoder::map_dmabuf` and `VulkanDecoder::extract` each take `&mut self` and NOTHING else. They dereference `self.frame`, the `*mut AVFrame` the decoder allocates in its own constructor and owns until `Drop` — a pointer no caller supplies, can replace, or can invalidate. None carried a `# Safety` section, and each body was already one `unsafe {}` with its proof, so the marker was pure ceremony and its removal moves nothing. All three live in files the workspace `deny` already covers (`video_vulkan.rs` since the fence came off it), so they stay fully enforced. Worth recording why this is where the marker sweep STOPS for these two crates: every remaining candidate in pf-encode and pf-client-core sits inside a fenced file, and there removing a marker is not free. The fence excuses `unsafe_op_in_unsafe_fn`, which only applies to `unsafe fn` BODIES — a safe fn always needs explicit blocks — so unmarking an ash-dense helper forces exactly the whole-body `unsafe {}` this program rejected when it rejected `cargo fix`. The way to reach those is to reclaim the file first, not to unmark inside it. Verified on .21: fmt + `clippy --workspace --all-targets -- -D warnings` + the feature-gated `-p pf-encode` step, all rc=0. --- crates/pf-client-core/src/video_d3d11.rs | 2 +- crates/pf-client-core/src/video_vaapi.rs | 2 +- crates/pf-client-core/src/video_vulkan.rs | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/crates/pf-client-core/src/video_d3d11.rs b/crates/pf-client-core/src/video_d3d11.rs index a24506f4..3162ccf6 100644 --- a/crates/pf-client-core/src/video_d3d11.rs +++ b/crates/pf-client-core/src/video_d3d11.rs @@ -610,7 +610,7 @@ impl D3d11vaDecoder { /// BGRA8) under its keyed mutex and describe the hand-off. The mutex acquire also /// back-pressures against the presenter still reading this slot (only possible if the /// stream runs `RING_SLOTS` ahead of present). - unsafe fn lift(&mut self) -> Result { + fn lift(&mut self) -> Result { use ffmpeg::ffi; unsafe { if (*self.frame).format != ffi::AVPixelFormat::AV_PIX_FMT_D3D11 as i32 { diff --git a/crates/pf-client-core/src/video_vaapi.rs b/crates/pf-client-core/src/video_vaapi.rs index 98eacdd0..6eb1e311 100644 --- a/crates/pf-client-core/src/video_vaapi.rs +++ b/crates/pf-client-core/src/video_vaapi.rs @@ -139,7 +139,7 @@ impl VaapiDecoder { /// single-plane texture with the chroma dropped, painting the screen green. The fix: /// derive the COMBINED fourcc from the decoder's software pixel format (NV12 → /// `DRM_FORMAT_NV12`) and flatten every plane across every layer in order (Y then UV). - unsafe fn map_dmabuf(&mut self) -> Result { + fn map_dmabuf(&mut self) -> Result { use ffmpeg::ffi; unsafe { if (*self.frame).format != ffi::AVPixelFormat::AV_PIX_FMT_VAAPI as i32 { diff --git a/crates/pf-client-core/src/video_vulkan.rs b/crates/pf-client-core/src/video_vulkan.rs index ea422116..48c264c6 100644 --- a/crates/pf-client-core/src/video_vulkan.rs +++ b/crates/pf-client-core/src/video_vulkan.rs @@ -320,7 +320,7 @@ impl VulkanDecoder { /// guard — keeps the image + frames context alive through present) and ship the /// POINTERS; the presenter reads the live sync state under the frames-context lock /// at its own submit time. - unsafe fn extract(&mut self) -> Result { + fn extract(&mut self) -> Result { use ffmpeg::ffi; unsafe { if (*self.frame).format != ffi::AVPixelFormat::AV_PIX_FMT_VULKAN as i32 {