Unsafe C function that changes more than its direct parameter

[Michael-F-Bryan]

@Gnurou

I was also thinking of maybe using Pin to make sure the plane data does not move away (thus invalidating buffer 's inner pointer), but maybe that's overthinking it?

Using Pin might overcomplicate things because the invariants it provides aren't necessarily the invariants that you expect. Pin is... subtle.

I've been playing around with unsafe Rust for several years now and would consider myself quite an advanced user, and even I got tricked by thinking (the equivalent of) Pin<&mut Plane> would guarantee the data doesn't move. To actually guarantee it can't be moved you need to make sure Plane: !Unpin, which is only possible in stable Rust by adding a std::marker::PhantomPinned to the type.

Is this unsafe code to generate 'static lifetimes sound?

I think that's the case here. I've created a shim crate which imports gcode and will export WebAssembly bindings. The #[wasm_bindgen] attribute doesn't allow exported types to have lifetimes (for soundness reasons) or type parameters (WebAssembly doesn't do compile-time generics), hence these unsafe shenanigans. The gcode::Parser is also infected with another type, you just can't see it because there's a default value. This type contains a bunch of associated types for determining how data sho…