That depends on what the pattern for what's safe here actually is?

That was mostly concerning false-positives like setIndexType receiving a # Safety comment about bounds-checking, despite taking an enum constant:

madsmtm/objc2-generated@8bb1a3b...a6560b2#diff-480db922f3ee8593666ed843d3933b3111114d631e0458bcff48f66bab106931R475

setVertexFormat for example is marked safe in the same diff.

(Yes both enumerations affect the number of bytes that will be read from a buffer on the GPU, but by that logic pretty much all GPU state is unsafe 😬. Unless Metal validates it before submitting, creating an object from a descriptor, or something like that)

Maybe you could write down some examples of methods that index on the CPU and methods that index on the GPU, and we can try to figure it out?

Sure. Let's take setBuffer:offset:index::

offset is likely only applied to the buffer VA on the GPU (but there could be CPU-side validation);
atIndex likely updates a linear array on the CPU that encodes the descriptor for that virtual address, before later uploading it to the GPU?

resolveCounters receives specific indexes/ranges that are going to be "read" for their values to be written to a buffer, on the GPU. And it has a CPU equivalent.

Btw, in response to:

not sure if Rust's safety model should extend to the GPU, if at least CPU-side encoding is fully safe.

I think we should extend it to that, in part because I suspect that'd be more useful for wgpu, in part because the CPU and the GPU can share memory nowadays, and that makes it increasingly important that code on the GPU is sound too.

If someone can guarantee safety on the shader side, and we can guarantee state-safety on the encoding side (referring back to changing the index type on various acceleration structure descriptors for example), that make sense.

But I think it's likely we either aim for not-bounds-affecting = false, or we change the check itself to have fewer false positives.

So that implies already looking for and listing all .unsafe = true, rather than its opposite set (minus everything that wasn't a false-positive)?

Figure out bounds-safety in objc2-metal #793

Description

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions

Figure out bounds-safety in `objc2-metal` #793