Skip to content

cxx-qt-gen: do not forward unsafe extern "RustQt" to methods - #1500

Open
wehrwolfmann wants to merge 2 commits into
KDAB:mainfrom
wehrwolfmann:rustqt-unsafe-consistent
Open

wehrwolfmann wants to merge 2 commits into
KDAB:mainfrom
wehrwolfmann:rustqt-unsafe-consistent

Conversation

@wehrwolfmann

Copy link
Copy Markdown
Contributor

As discussed in #1490, methods and invokables in an extern "RustQt" block
now follow the same rules as an extern "Rust" block in CXX: only the
unsafe on the fn itself is used. Previously a safe method inside an
unsafe extern "RustQt" block was declared as an unsafe fn for CXX
(unsafe_call in generator/rust/method.rs, from #1199), which silently
skipped the CXX check that a method taking a raw pointer must be unsafe.

The unsafe of the block is still used where it means something:
safe-to-call #[inherit] methods and #[inherit] signals, as they call into
the C++ base class (same as unsafe extern "C++" in CXX). The generation of
signals and inherit is unchanged.

Changes:

  • cxx-qt-gen: remove ParsedMethod::unsafe_block and the forwarding in
    generate_rust_methods, update the expected outputs, and add an
    unsafe fn invokable taking a raw pointer to the invokables test
  • book: new "Safety" section in extern_rustqt.md and a note in
    inheritance.md
  • CHANGELOG: entry under Unreleased / Changed

This is a breaking change, only for safe methods in an
unsafe extern "RustQt" block:

  • a method taking a raw pointer now fails with
    error[cxx]: pointer argument requires that the function be marked unsafe
  • a method whose implementation is an unsafe fn now fails with
    error[E0133]: call to unsafe function ... is unsafe

To migrate, declare these methods as unsafe fn in the bridge. No example or
test in this repository needed changes, the existing methods taking raw
pointers (e.g. CustomParentClass::paint) are already unsafe fn.

@codecov

codecov Bot commented Oct 28, 2026 •

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (066d425) to head (d2f90bd).

Additional details and impacted files
@@            Coverage Diff            @@
##              main     #1500   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           75        75           
  Lines        13929     13921    -8     
=========================================
- Hits         13929     13921    -8     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@ahayzen-kdab

Copy link
Copy Markdown
Collaborator

Are you able to rebase these changes when you have a chance :-)

An extern "RustQt" block becomes an extern "Rust" block for CXX, where
the unsafe of the block is not forwarded to the functions and CXX
rejects an unsafe extern "Rust" block. Follow the same rule for methods
and invokables, so only the unsafe on the fn itself is used and methods
taking a raw pointer need to be an unsafe fn.

The unsafe of the block is still used for #[inherit] methods and
signals, as they are C++ functions in a generated extern "C++" block.
Methods follow the rules of extern "Rust" in CXX, so only the unsafe on
the fn itself is used, while #[inherit] methods and signals follow the
rules of extern "C++" and need an unsafe extern "RustQt" block when
they are safe to call.
@wehrwolfmann
wehrwolfmann force-pushed the rustqt-unsafe-consistent branch from 821dcef to d2f90bd Compare October 29, 2026 21:44

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants