Tracking issue for APIs that are incorrectly marked safe

[madsmtm]

There's a lot of APIs in the framework crates, and unfortunately, some of them are incorrectly marked as safe, which means they're unsound.

I will keep this up to date with comments below for each known API that is safe but shouldn't be, and mark these comments as resolved once a new release with the fix has been released.

Feel free to comment yourself if you find an API that might be incorrectly marked safe, I would love to know about it! For other soundness issues, please open a new issue.

[madsmtm]

The NSView::window property is marked unsafe_unretained in the header, which might mean that there are ways that views could get detached from their window, have the window deallocated, and then return a dangling pointer here? Unsure.

[madsmtm]

CFPreferencesCopyMultiple takes an untyped &CFArray, it should take &CFArray<CFString>.

[madsmtm]

CFPlugIn::register_factory_function takes an unsafe fn (CFPlugInFactoryFunction) which could be written in safe Rust to return a dangling pointer.

[madsmtm]

Several functions in dispatch2 takes a raw pointer NonNull<dispatch_object_s> (dispatch_get_context, dispatch_activate, dispatch_suspend, dispatch_resume).

[madsmtm]

The methods SCNetworkInterface::media_sub_types, SCNetworkInterface::media_sub_type_options and SCNetworkInterface::set_media_options take an untyped &CFArray, they should take &CFArray<CFString>.

[madsmtm]

Some Metal APIs might not be bounds-checked, see #773.

EDIT: See #792 instead, this documents which APIs might be wrong in its translation-config.toml (search for "TODO(breaking)").

[madsmtm]

NSWindow::delegate/NSWindow::setDelegate may be unsound if using an NSSavePanel, especially since NSOpenSavePanelDelegate is not a sub-protocol of NSWindowDelegate (so you can break type-safety and convert ProtocolObject<dyn NSOpenSavePanelDelegate> to ProtocolObject<dyn NSWindowDelegate>, or vice-versa).