>>105882887
But, unless the bindings are 100% autogenerated and never have any bugs and thus do not require manual validation, then it may require an even higher level of expertise of both Rust, C++, and Rust-C++-interaction than otherwise, since Rust's memory (un)safety goes out the window when FFI is involved, and often requires a lot of "unsafe". And, lo and behold, one of the Rust files in that commit has 97 text occurrences of "unsafe". Look for instance at this
unsafe {
if array.is_null() {
return &[];
}
let elements: &[*mut RawGeckoElement] = &**array;
// NOTE(emilio): We rely on the in-memory representation of
// GeckoElement<'ld> and *mut RawGeckoElement being the same.
#[allow(dead_code)]
unsafe fn static_assert() {
mem::transmute::<*mut RawGeckoElement, GeckoElement<'static>>(0xbadc0de as *mut _);
}
mem::transmute(elements)
}
Why did they let this unsafe-block span this many lines? Not that many comments either.
And some of the changes in the commit touches "unsafe" code.
It is even worse than I first thought.
