|
11 | 11 | //! until it gets dropped. We say that the pointee is "pinned".
|
12 | 12 | //!
|
13 | 13 | //! By default, all types in Rust are movable. Rust allows passing all types by-value,
|
14 |
| -//! and common smart-pointer types such as `Box<T>` and `&mut T` allow replacing and |
15 |
| -//! moving the values they contain: you can move out of a `Box<T>`, or you can use [`mem::swap`]. |
16 |
| -//! [`Pin<P>`] wraps a pointer type `P`, so `Pin<Box<T>>` functions much like a regular `Box<T>`: |
17 |
| -//! when a `Pin<Box<T>>` gets dropped, so do its contents, and the memory gets deallocated. |
18 |
| -//! Similarly, `Pin<&mut T>` is a lot like `&mut T`. However, [`Pin<P>`] does not let clients |
19 |
| -//! actually obtain a `Box<T>` or `&mut T` to pinned data, which implies that you cannot use |
20 |
| -//! operations such as [`mem::swap`]: |
| 14 | +//! and common smart-pointer types such as [`Box<T>`] and `&mut T` allow replacing and |
| 15 | +//! moving the values they contain: you can move out of a [`Box<T>`], or you can use [`mem::swap`]. |
| 16 | +//! [`Pin<P>`] wraps a pointer type `P`, so [`Pin`]`<`[`Box`]`<T>>` functions much like a regular |
| 17 | +//! [`Box<T>`]: when a [`Pin`]`<`[`Box`]`<T>>` gets dropped, so do its contents, and the memory gets |
| 18 | +//! deallocated. Similarly, [`Pin`]`<&mut T>` is a lot like `&mut T`. However, [`Pin<P>`] does |
| 19 | +//! not let clients actually obtain a [`Box<T>`] or `&mut T` to pinned data, which implies that you |
| 20 | +//! cannot use operations such as [`mem::swap`]: |
21 | 21 | //!
|
22 | 22 | //! ```
|
23 | 23 | //! use std::pin::Pin;
|
|
30 | 30 | //! ```
|
31 | 31 | //!
|
32 | 32 | //! It is worth reiterating that [`Pin<P>`] does *not* change the fact that a Rust compiler
|
33 |
| -//! considers all types movable. [`mem::swap`] remains callable for any `T`. Instead, `Pin<P>` |
34 |
| -//! prevents certain *values* (pointed to by pointers wrapped in `Pin<P>`) from being |
| 33 | +//! considers all types movable. [`mem::swap`] remains callable for any `T`. Instead, [`Pin<P>`] |
| 34 | +//! prevents certain *values* (pointed to by pointers wrapped in [`Pin<P>`]) from being |
35 | 35 | //! moved by making it impossible to call methods that require `&mut T` on them
|
36 | 36 | //! (like [`mem::swap`]).
|
37 | 37 | //!
|
38 | 38 | //! [`Pin<P>`] can be used to wrap any pointer type `P`, and as such it interacts with
|
39 |
| -//! [`Deref`] and [`DerefMut`]. A `Pin<P>` where `P: Deref` should be considered |
40 |
| -//! as a "`P`-style pointer" to a pinned `P::Target` -- so, a `Pin<Box<T>>` is |
41 |
| -//! an owned pointer to a pinned `T`, and a `Pin<Rc<T>>` is a reference-counted |
| 39 | +//! [`Deref`] and [`DerefMut`]. A [`Pin<P>`] where `P: Deref` should be considered |
| 40 | +//! as a "`P`-style pointer" to a pinned `P::Target` -- so, a [`Pin`]`<`[`Box`]`<T>>` is |
| 41 | +//! an owned pointer to a pinned `T`, and a [`Pin`]`<`[`Rc`]`<T>>` is a reference-counted |
42 | 42 | //! pointer to a pinned `T`.
|
43 | 43 | //! For correctness, [`Pin<P>`] relies on the implementations of [`Deref`] and
|
44 | 44 | //! [`DerefMut`] not to move out of their `self` parameter, and only ever to
|
|
48 | 48 | //!
|
49 | 49 | //! Many types are always freely movable, even when pinned, because they do not
|
50 | 50 | //! rely on having a stable address. This includes all the basic types (like
|
51 |
| -//! `bool`, `i32`, and references) as well as types consisting solely of these |
| 51 | +//! [`bool`], [`i32`], and references) as well as types consisting solely of these |
52 | 52 | //! types. Types that do not care about pinning implement the [`Unpin`]
|
53 | 53 | //! auto-trait, which cancels the effect of [`Pin<P>`]. For `T: Unpin`,
|
54 |
| -//! `Pin<Box<T>>` and `Box<T>` function identically, as do `Pin<&mut T>` and |
| 54 | +//! [`Pin`]`<`[`Box`]`<T>>` and [`Box<T>`] function identically, as do [`Pin`]`<&mut T>` and |
55 | 55 | //! `&mut T`.
|
56 | 56 | //!
|
57 |
| -//! Note that pinning and `Unpin` only affect the pointed-to type `P::Target`, not the pointer |
58 |
| -//! type `P` itself that got wrapped in `Pin<P>`. For example, whether or not `Box<T>` is |
59 |
| -//! `Unpin` has no effect on the behavior of `Pin<Box<T>>` (here, `T` is the |
| 57 | +//! Note that pinning and [`Unpin`] only affect the pointed-to type `P::Target`, not the pointer |
| 58 | +//! type `P` itself that got wrapped in [`Pin<P>`]. For example, whether or not [`Box<T>`] is |
| 59 | +//! [`Unpin`] has no effect on the behavior of [`Pin`]`<`[`Box`]`<T>>` (here, `T` is the |
60 | 60 | //! pointed-to type).
|
61 | 61 | //!
|
62 | 62 | //! # Example: self-referential struct
|
|
122 | 122 | //!
|
123 | 123 | //! To make this work, every element has pointers to its predecessor and successor in
|
124 | 124 | //! the list. Elements can only be added when they are pinned, because moving the elements
|
125 |
| -//! around would invalidate the pointers. Moreover, the `Drop` implementation of a linked |
| 125 | +//! around would invalidate the pointers. Moreover, the [`Drop`] implementation of a linked |
126 | 126 | //! list element will patch the pointers of its predecessor and successor to remove itself
|
127 | 127 | //! from the list.
|
128 | 128 | //!
|
129 |
| -//! Crucially, we have to be able to rely on `drop` being called. If an element |
130 |
| -//! could be deallocated or otherwise invalidated without calling `drop`, the pointers into it |
| 129 | +//! Crucially, we have to be able to rely on [`drop`] being called. If an element |
| 130 | +//! could be deallocated or otherwise invalidated without calling [`drop`], the pointers into it |
131 | 131 | //! from its neighbouring elements would become invalid, which would break the data structure.
|
132 | 132 | //!
|
133 |
| -//! Therefore, pinning also comes with a `drop`-related guarantee. |
| 133 | +//! Therefore, pinning also comes with a [`drop`]-related guarantee. |
134 | 134 | //!
|
135 | 135 | //! # `Drop` guarantee
|
136 | 136 | //!
|
|
139 | 139 | //! otherwise invalidating the memory used to store the data is restricted, too.
|
140 | 140 | //! Concretely, for pinned data you have to maintain the invariant
|
141 | 141 | //! that *its memory will not get invalidated or repurposed from the moment it gets pinned until
|
142 |
| -//! when `drop` is called*. Memory can be invalidated by deallocation, but also by |
| 142 | +//! when [`drop`] is called*. Memory can be invalidated by deallocation, but also by |
143 | 143 | //! replacing a [`Some(v)`] by [`None`], or calling [`Vec::set_len`] to "kill" some elements
|
144 | 144 | //! off of a vector. It can be repurposed by using [`ptr::write`] to overwrite it without
|
145 | 145 | //! calling the destructor first.
|
|
148 | 148 | //! section needs to function correctly.
|
149 | 149 | //!
|
150 | 150 | //! Notice that this guarantee does *not* mean that memory does not leak! It is still
|
151 |
| -//! completely okay not ever to call `drop` on a pinned element (e.g., you can still |
152 |
| -//! call [`mem::forget`] on a `Pin<Box<T>>`). In the example of the doubly-linked |
| 151 | +//! completely okay not ever to call [`drop`] on a pinned element (e.g., you can still |
| 152 | +//! call [`mem::forget`] on a [`Pin`]`<`[`Box`]`<T>>`). In the example of the doubly-linked |
153 | 153 | //! list, that element would just stay in the list. However you may not free or reuse the storage
|
154 |
| -//! *without calling `drop`*. |
| 154 | +//! *without calling [`drop`]*. |
155 | 155 | //!
|
156 | 156 | //! # `Drop` implementation
|
157 | 157 | //!
|
158 | 158 | //! If your type uses pinning (such as the two examples above), you have to be careful
|
159 |
| -//! when implementing `Drop`. The `drop` function takes `&mut self`, but this |
| 159 | +//! when implementing [`Drop`]. The [`drop`] function takes `&mut self`, but this |
160 | 160 | //! is called *even if your type was previously pinned*! It is as if the
|
161 |
| -//! compiler automatically called `get_unchecked_mut`. |
| 161 | +//! compiler automatically called [`Pin::get_unchecked_mut`]. |
162 | 162 | //!
|
163 | 163 | //! This can never cause a problem in safe code because implementing a type that
|
164 | 164 | //! relies on pinning requires unsafe code, but be aware that deciding to make
|
165 | 165 | //! use of pinning in your type (for example by implementing some operation on
|
166 |
| -//! `Pin<&Self>` or `Pin<&mut Self>`) has consequences for your `Drop` |
| 166 | +//! [`Pin`]`<&Self>` or [`Pin`]`<&mut Self>`) has consequences for your [`Drop`] |
167 | 167 | //! implementation as well: if an element of your type could have been pinned,
|
168 |
| -//! you must treat Drop as implicitly taking `Pin<&mut Self>`. |
| 168 | +//! you must treat [`Drop`] as implicitly taking [`Pin`]`<&mut Self>`. |
169 | 169 | //!
|
170 | 170 | //! For example, you could implement `Drop` as follows:
|
| 171 | +//! |
171 | 172 | //! ```rust,no_run
|
172 | 173 | //! # use std::pin::Pin;
|
173 | 174 | //! # struct Type { }
|
|
182 | 183 | //! }
|
183 | 184 | //! }
|
184 | 185 | //! ```
|
185 |
| -//! The function `inner_drop` has the type that `drop` *should* have, so this makes sure that |
| 186 | +//! |
| 187 | +//! The function `inner_drop` has the type that [`drop`] *should* have, so this makes sure that |
186 | 188 | //! you do not accidentally use `self`/`this` in a way that is in conflict with pinning.
|
187 | 189 | //!
|
188 | 190 | //! Moreover, if your type is `#[repr(packed)]`, the compiler will automatically
|
|
192 | 194 | //! # Projections and Structural Pinning
|
193 | 195 | //!
|
194 | 196 | //! When working with pinned structs, the question arises how one can access the
|
195 |
| -//! fields of that struct in a method that takes just `Pin<&mut Struct>`. |
| 197 | +//! fields of that struct in a method that takes just [`Pin`]`<&mut Struct>`. |
196 | 198 | //! The usual approach is to write helper methods (so called *projections*)
|
197 |
| -//! that turn `Pin<&mut Struct>` into a reference to the field, but what |
198 |
| -//! type should that reference have? Is it `Pin<&mut Field>` or `&mut Field`? |
| 199 | +//! that turn [`Pin`]`<&mut Struct>` into a reference to the field, but what |
| 200 | +//! type should that reference have? Is it [`Pin`]`<&mut Field>` or `&mut Field`? |
199 | 201 | //! The same question arises with the fields of an `enum`, and also when considering
|
200 | 202 | //! container/wrapper types such as [`Vec<T>`], [`Box<T>`], or [`RefCell<T>`].
|
201 | 203 | //! (This question applies to both mutable and shared references, we just
|
202 | 204 | //! use the more common case of mutable references here for illustration.)
|
203 | 205 | //!
|
204 | 206 | //! It turns out that it is actually up to the author of the data structure
|
205 | 207 | //! to decide whether the pinned projection for a particular field turns
|
206 |
| -//! `Pin<&mut Struct>` into `Pin<&mut Field>` or `&mut Field`. There are some |
| 208 | +//! [`Pin`]`<&mut Struct>` into [`Pin`]`<&mut Field>` or `&mut Field`. There are some |
207 | 209 | //! constraints though, and the most important constraint is *consistency*:
|
208 | 210 | //! every field can be *either* projected to a pinned reference, *or* have
|
209 | 211 | //! pinning removed as part of the projection. If both are done for the same field,
|
|
218 | 220 | //! ## Pinning *is not* structural for `field`
|
219 | 221 | //!
|
220 | 222 | //! It may seem counter-intuitive that the field of a pinned struct might not be pinned,
|
221 |
| -//! but that is actually the easiest choice: if a `Pin<&mut Field>` is never created, |
| 223 | +//! but that is actually the easiest choice: if a [`Pin`]`<&mut Field>` is never created, |
222 | 224 | //! nothing can go wrong! So, if you decide that some field does not have structural pinning,
|
223 | 225 | //! all you have to ensure is that you never create a pinned reference to that field.
|
224 | 226 | //!
|
225 | 227 | //! Fields without structural pinning may have a projection method that turns
|
226 |
| -//! `Pin<&mut Struct>` into `&mut Field`: |
| 228 | +//! [`Pin`]`<&mut Struct>` into `&mut Field`: |
| 229 | +//! |
227 | 230 | //! ```rust,no_run
|
228 | 231 | //! # use std::pin::Pin;
|
229 | 232 | //! # type Field = i32;
|
|
237 | 240 | //! ```
|
238 | 241 | //!
|
239 | 242 | //! You may also `impl Unpin for Struct` *even if* the type of `field`
|
240 |
| -//! is not `Unpin`. What that type thinks about pinning is not relevant |
241 |
| -//! when no `Pin<&mut Field>` is ever created. |
| 243 | +//! is not [`Unpin`]. What that type thinks about pinning is not relevant |
| 244 | +//! when no [`Pin`]`<&mut Field>` is ever created. |
242 | 245 | //!
|
243 | 246 | //! ## Pinning *is* structural for `field`
|
244 | 247 | //!
|
245 | 248 | //! The other option is to decide that pinning is "structural" for `field`,
|
246 | 249 | //! meaning that if the struct is pinned then so is the field.
|
247 | 250 | //!
|
248 |
| -//! This allows writing a projection that creates a `Pin<&mut Field>`, thus |
| 251 | +//! This allows writing a projection that creates a [`Pin`]`<&mut Field>`, thus |
249 | 252 | //! witnessing that the field is pinned:
|
| 253 | +//! |
250 | 254 | //! ```rust,no_run
|
251 | 255 | //! # use std::pin::Pin;
|
252 | 256 | //! # type Field = i32;
|
|
262 | 266 | //! However, structural pinning comes with a few extra requirements:
|
263 | 267 | //!
|
264 | 268 | //! 1. The struct must only be [`Unpin`] if all the structural fields are
|
265 |
| -//! `Unpin`. This is the default, but `Unpin` is a safe trait, so as the author of |
| 269 | +//! [`Unpin`]. This is the default, but [`Unpin`] is a safe trait, so as the author of |
266 | 270 | //! the struct it is your responsibility *not* to add something like
|
267 | 271 | //! `impl<T> Unpin for Struct<T>`. (Notice that adding a projection operation
|
268 |
| -//! requires unsafe code, so the fact that `Unpin` is a safe trait does not break |
| 272 | +//! requires unsafe code, so the fact that [`Unpin`] is a safe trait does not break |
269 | 273 | //! the principle that you only have to worry about any of this if you use `unsafe`.)
|
270 | 274 | //! 2. The destructor of the struct must not move structural fields out of its argument. This
|
271 | 275 | //! is the exact point that was raised in the [previous section][drop-impl]: `drop` takes
|
272 | 276 | //! `&mut self`, but the struct (and hence its fields) might have been pinned before.
|
273 |
| -//! You have to guarantee that you do not move a field inside your `Drop` implementation. |
| 277 | +//! You have to guarantee that you do not move a field inside your [`Drop`] implementation. |
274 | 278 | //! In particular, as explained previously, this means that your struct must *not*
|
275 | 279 | //! be `#[repr(packed)]`.
|
276 |
| -//! See that section for how to write `drop` in a way that the compiler can help you |
| 280 | +//! See that section for how to write [`drop`] in a way that the compiler can help you |
277 | 281 | //! not accidentally break pinning.
|
278 | 282 | //! 3. You must make sure that you uphold the [`Drop` guarantee][drop-guarantee]:
|
279 | 283 | //! once your struct is pinned, the memory that contains the
|
280 | 284 | //! content is not overwritten or deallocated without calling the content's destructors.
|
281 |
| -//! This can be tricky, as witnessed by [`VecDeque<T>`]: the destructor of `VecDeque<T>` |
282 |
| -//! can fail to call `drop` on all elements if one of the destructors panics. This violates the |
283 |
| -//! `Drop` guarantee, because it can lead to elements being deallocated without |
284 |
| -//! their destructor being called. (`VecDeque` has no pinning projections, so this |
| 285 | +//! This can be tricky, as witnessed by [`VecDeque<T>`]: the destructor of [`VecDeque<T>`] |
| 286 | +//! can fail to call [`drop`] on all elements if one of the destructors panics. This violates |
| 287 | +//! the [`Drop`] guarantee, because it can lead to elements being deallocated without |
| 288 | +//! their destructor being called. ([`VecDeque<T>`] has no pinning projections, so this |
285 | 289 | //! does not cause unsoundness.)
|
286 | 290 | //! 4. You must not offer any other operations that could lead to data being moved out of
|
287 | 291 | //! the structural fields when your type is pinned. For example, if the struct contains an
|
288 |
| -//! `Option<T>` and there is a `take`-like operation with type |
| 292 | +//! [`Option<T>`] and there is a `take`-like operation with type |
289 | 293 | //! `fn(Pin<&mut Struct<T>>) -> Option<T>`,
|
290 | 294 | //! that operation can be used to move a `T` out of a pinned `Struct<T>` -- which means
|
291 | 295 | //! pinning cannot be structural for the field holding this data.
|
|
301 | 305 | //! let content = &mut *b; // And here we have `&mut T` to the same data.
|
302 | 306 | //! }
|
303 | 307 | //! ```
|
304 |
| -//! This is catastrophic, it means we can first pin the content of the `RefCell<T>` |
| 308 | +//! This is catastrophic, it means we can first pin the content of the [`RefCell<T>`] |
305 | 309 | //! (using `RefCell::get_pin_mut`) and then move that content using the mutable
|
306 | 310 | //! reference we got later.
|
307 | 311 | //!
|
308 | 312 | //! ## Examples
|
309 | 313 | //!
|
310 | 314 | //! For a type like [`Vec<T>`], both possibilites (structural pinning or not) make sense.
|
311 |
| -//! A `Vec<T>` with structural pinning could have `get_pin`/`get_pin_mut` methods to get |
| 315 | +//! A [`Vec<T>`] with structural pinning could have `get_pin`/`get_pin_mut` methods to get |
312 | 316 | //! pinned references to elements. However, it could *not* allow calling
|
313 |
| -//! `pop` on a pinned `Vec<T>` because that would move the (structurally pinned) contents! |
314 |
| -//! Nor could it allow `push`, which might reallocate and thus also move the contents. |
315 |
| -//! A `Vec<T>` without structural pinning could `impl<T> Unpin for Vec<T>`, because the contents |
316 |
| -//! are never pinned and the `Vec<T>` itself is fine with being moved as well. |
| 317 | +//! [`pop`][Vec::pop] on a pinned [`Vec<T>`] because that would move the (structurally pinned) |
| 318 | +//! contents! Nor could it allow [`push`][Vec::push], which might reallocate and thus also move the |
| 319 | +//! contents. |
| 320 | +//! |
| 321 | +//! A [`Vec<T>`] without structural pinning could `impl<T> Unpin for Vec<T>`, because the contents |
| 322 | +//! are never pinned and the [`Vec<T>`] itself is fine with being moved as well. |
317 | 323 | //! At that point pinning just has no effect on the vector at all.
|
318 | 324 | //!
|
319 | 325 | //! In the standard library, pointer types generally do not have structural pinning,
|
320 | 326 | //! and thus they do not offer pinning projections. This is why `Box<T>: Unpin` holds for all `T`.
|
321 | 327 | //! It makes sense to do this for pointer types, because moving the `Box<T>`
|
322 |
| -//! does not actually move the `T`: the `Box<T>` can be freely movable (aka `Unpin`) even if the `T` |
323 |
| -//! is not. In fact, even `Pin<Box<T>>` and `Pin<&mut T>` are always `Unpin` themselves, |
324 |
| -//! for the same reason: their contents (the `T`) are pinned, but the pointers themselves |
325 |
| -//! can be moved without moving the pinned data. For both `Box<T>` and `Pin<Box<T>>`, |
326 |
| -//! whether the content is pinned is entirely independent of whether the pointer is |
327 |
| -//! pinned, meaning pinning is *not* structural. |
| 328 | +//! does not actually move the `T`: the [`Box<T>`] can be freely movable (aka `Unpin`) even if |
| 329 | +//! the `T` is not. In fact, even [`Pin`]`<`[`Box`]`<T>>` and [`Pin`]`<&mut T>` are always |
| 330 | +//! [`Unpin`] themselves, for the same reason: their contents (the `T`) are pinned, but the |
| 331 | +//! pointers themselves can be moved without moving the pinned data. For both [`Box<T>`] and |
| 332 | +//! [`Pin`]`<`[`Box`]`<T>>`, whether the content is pinned is entirely independent of whether the |
| 333 | +//! pointer is pinned, meaning pinning is *not* structural. |
328 | 334 | //!
|
329 | 335 | //! When implementing a [`Future`] combinator, you will usually need structural pinning
|
330 |
| -//! for the nested futures, as you need to get pinned references to them to call `poll`. |
| 336 | +//! for the nested futures, as you need to get pinned references to them to call [`poll`]. |
331 | 337 | //! But if your combinator contains any other data that does not need to be pinned,
|
332 | 338 | //! you can make those fields not structural and hence freely access them with a
|
333 |
| -//! mutable reference even when you just have `Pin<&mut Self>` (such as in your own |
334 |
| -//! `poll` implementation). |
| 339 | +//! mutable reference even when you just have [`Pin`]`<&mut Self>` (such as in your own |
| 340 | +//! [`poll`] implementation). |
335 | 341 | //!
|
336 | 342 | //! [`Pin<P>`]: struct.Pin.html
|
337 | 343 | //! [`Unpin`]: ../marker/trait.Unpin.html
|
|
342 | 348 | //! [`Box<T>`]: ../../std/boxed/struct.Box.html
|
343 | 349 | //! [`Vec<T>`]: ../../std/vec/struct.Vec.html
|
344 | 350 | //! [`Vec::set_len`]: ../../std/vec/struct.Vec.html#method.set_len
|
| 351 | +//! [`Pin`]: struct.Pin.html |
| 352 | +//! [`Box`]: ../../std/boxed/struct.Box.html |
| 353 | +//! [Vec::pop]: ../../std/vec/struct.Vec.html#method.pop |
| 354 | +//! [Vec::push]: ../../std/vec/struct.Vec.html#method.push |
| 355 | +//! [`Rc`]: ../../std/rc/struct.Rc.html |
| 356 | +//! [`RefCell<T>`]: ../../std/cell/struct.RefCell.html |
| 357 | +//! [`Drop`]: ../../std/ops/trait.Drop.html |
| 358 | +//! [`drop`]: ../../std/ops/trait.Drop.html#tymethod.drop |
| 359 | +//! [`VecDeque<T>`]: ../../std/collections/struct.VecDeque.html |
| 360 | +//! [`Option<T>`]: ../../std/option/enum.Option.html |
345 | 361 | //! [`VecDeque<T>`]: ../../std/collections/struct.VecDeque.html
|
346 | 362 | //! [`RefCell<T>`]: ../cell/struct.RefCell.html
|
347 | 363 | //! [`None`]: ../option/enum.Option.html#variant.None
|
|
350 | 366 | //! [`Future`]: ../future/trait.Future.html
|
351 | 367 | //! [drop-impl]: #drop-implementation
|
352 | 368 | //! [drop-guarantee]: #drop-guarantee
|
| 369 | +//! [`poll`]: ../../std/future/trait.Future.html#tymethod.poll |
| 370 | +//! [`Pin::get_unchecked_mut`]: struct.Pin.html#method.get_unchecked_mut |
353 | 371 |
|
354 | 372 | #![stable(feature = "pin", since = "1.33.0")]
|
355 | 373 |
|
|
0 commit comments