unwind safety fixes

[Mirko-A]

Adds unwind-safety fixes to in-place initialization helpers so partially initialized values are dropped on both errors and panics. Changes:

• Add __internal::ArrayInit guard type that safely initializes an array by running an initializer on each element, keeping track of the number of initialized elements. When dropped, if the initialization was partially successful, the guard drops the initialized portion of the array. Use the guard in [pin_]init_array_from_fn.
• Use __internal::DropGuard in [pin_]chain so a panic/error in the chained closure drops the value initialized in the first stage; mem::forget the guard on success.
• Add regression tests.

Closes: #136

---

The approach taken here was suggested in the issue itself, thus I added a Suggested-by tag. I hope that is okay.

Edits:
v1 -> v2:

• rename ArrayInitGuard to ArrayInit
• implement [Pin]Init for ArrayInit instead of wrapping it in [pin_]init_from_closure

v2 -> v3:

• do not mem::forget the ArrayInit guard on success; state that the guard will only drop initialized elements on partial success

[nbdd0121]

I cannot review diff of diffs. Please always squash your changes to individually meaningful commits.

[Mirko-A]

I see, everything has been squashed to the original three commits.

When reviewing, I prefer having diffs that do exactly what each of the comments suggests and squashing after the review. I will squash future fixups immediately.

[nbdd0121]

For GitHub-centric workflow that's indeed convenient, but for this project as the commits are synced to the kernel I need to review each commit individually so it's up to kernel's quality requirement.

Honestly the actual issue is that GitHub does not provide a good way to visualize the diff, despite that it has all the needed information to render as such. The "Compare" button sometimes does the job, but it breaks when you rebase and fixup commits in a single push. Longer term, either we can wait until GitHub implements it (which is quite unlikely given the slop), or we can adopt what the Rust Project's triagebot does by automatically generates a range diff like this.

[Mirko-A]

I understand and fully agree. Unfortunately, looking at recent trends at GitHub, I don't expect much in terms of improvements to the platform.

Thank you for taking the time to explain your reasoning. :)

[nbdd0121]

Thanks for working on this. Some further feedbacks.

Also, could you move the ArrayInit to lib.rs just before init_array_from_fn? The __internal module is supposed to only host items that need to be public due to the use of generated code from pin-init-internal (yes, we have a few pub(crate) there, but that's for historical reasons and I'm working on moving them).

[Mirko-A]

Apologies for the delay.

Thanks for working on this.

Thank you! I really appreciate the level of detail in your review/feedback. It is rare to come by these days and I'm really glad to work with people that care this much about the code they maintain.

could you move the ArrayInit to lib.rs

Done. Also thank you for the clarification on what should go where, I tried to guess based on types like __internal::InitClosure.

I will respond to individual comments for the rest of your feedback.

[nbdd0121]

Yeah, InitClosure is a bad example, I'm moving it out as well in #153.

[nbdd0121]

kernel's checkpatch.pl gives the following warnings:

WARNING: Reported-by: should be immediately followed by Closes: with a URL to the report

[Mirko-A]

kernel's checkpatch.pl gives the following warnings:

WARNING: Reported-by: should be immediately followed by Closes: with a URL to the report

I could not find any report from LKML to use in the Closes tag so I used the GitHub issue link. Hope that's fine.

[nbdd0121]

Closes can be any bug-report URL, doesn't need to be a LKML thread.

[nbdd0121]

Clippy 1.85.0 reports an false-positive:

warning: unsafe block missing a safety comment
   --> rust/pin-init/src/lib.rs:969:13
    |
969 |             unsafe { __internal::Slot::<__internal::Pinned, _>::new(slot) }.init(self.0)?;
    |             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    |
    = help: consider adding a safety comment on the preceding line
    = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#undocumented_unsafe_blocks
    = note: requested on the command line with `-W clippy::undocumented-unsafe-blocks`

warning: unsafe block missing a safety comment
    --> rust/pin-init/src/lib.rs:1074:13
     |
1074 |             unsafe { __internal::Slot::<__internal::Unpinned, _>::new(slot) }.init(self.0)?;
     |             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
     |
     = help: consider adding a safety comment on the preceding line
     = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#undocumented_unsafe_blocks

[Mirko-A]

Thank you for the feedback.

I am very sorry about the delay, last week was very busy for me. I will do my best to have an update here this week.

[nbdd0121]

Thank you for the feedback.

I am very sorry about the delay, last week was very busy for me. I will do my best to have an update here this week.

No rush! Thank you for working on this.

[nbdd0121]

@Mirko-A are you still interested in working on this? If not, I can also finish it off myself building on top of yours.

[Mirko-A]

@nbdd0121 Please finish it off, I couldn't find enough spare time. I hope the work I did was of some help at least.