Fix unsound lock guard: Remove Send and Sync autotraits from the lock guard #8
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Having Send on the lock guard is unsound. (Or at least it doesn't make any sense to send a lock guard to another thread).
Having Sync on the lock guard is unsound, unless T is Sync.
Normally this should use negative trait impls to get rid of Send and Sync.
However, negative trait impls are not fully stabilized, yet.
Use a phantom pointer instead. That's a bit overly strict in that it also removes Sync, if T is Sync.
But I think that's a low price to pay.
The following code exploits the bug:
Without the bug fix, the printed value sometimes differs from the expected result 42 due to races.
With the bug fix applied, the code doesn't compile anymore. (as is expected, because the guard usage is unsound.)
The bug had also been present in stdlib MutexGuard. See this for a detailed explanation:
https://www.ralfj.de/blog/2017/06/09/mutexguard-sync.html