[cxx-interop] Lifetime dependence on a class is unsafe

[Xazax-hun]

Swift cannot guarantee exclusivity of a class. On the other hand, lifetimebound annotations on the C++ side do not guarantee exclusivity. To resolve this issue, we ignore lifetime dependency annotations that introduce exclusive dependence on classes and import functions with ignored annotations as unsafe. Currently, Swift has no language feature to support these scenarios but it might get new features in the future to help people work around this problem.

rdar://153747746

[fahadnayyar]

Swift cannot guarantee exclusivity of a class. On the other hand, lifetimebound annotations on the C++ side do not guarantee exclusivity.

I'm a bit confused about this statement. Could you please explain it a little more?

[Xazax-hun]

Could you please explain it a little more?

Swift guarantees exclusivity for value types like structs and enums. On the other hand, people are free to share class types. As a result, the compiler or the runtime has no idea how many aliases are there for a class. But some Swift types like MutableSpan has exclusivity guarantees. Imagine something like:

@lifetime(borrow self)
public func getBufferContents() -> MutableSpan<UInt8> { ... }

where self is a class. Since there might be multiple aliases of self, one could call getBufferContents on these aliases violating the exclusivity guarantees of MutableSpan. Since Swift cannot verify the correctness of this code it rejects this construct. Unfortunately, we could create something like this when we are importing code from C++ as lifetimebound only describes some lifetime constraints for some values but tells us nothing about the exclusivity. This PR makes sure we do not create "safe" overloads that are in fact unsafe and also marks constructs like this unsafe when we import them from C++.

[Xazax-hun]

@swift-ci please smoke test

[Xazax-hun]

@swift-ci please smoke test macos