Rust: Add validation to decode

mojo/public/rust/src/bindings/run_loop.rs

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 //! This module contains a thread-local run-loop.
 //!
 //! The run-loop may have handles and handlers pre-registers
 //! (and in fact, must) in order to keep running. The run-loop
 //! executes until it has no more handles or handlers on itself,
 //! or until it is told to quit via stop().
@@ skipping 186 matching lines @@
     if deadline <= max_time_ticks {
         let now = core::get_time_ticks_now();
         if deadline <= (max_time_ticks - (now as u64)) {
             converted = (deadline as system::MojoTimeTicks) + now
         }
     }
     converted
 }
 
 /// Convert an absolute deadline to a mojo deadline which is relative to some
 /// notion of "now".

[mknyszek, 2016/08/08 22:47:25]

Oops, this was an accident. Running rustfmt apparently "fixed" the formatting in
the RunLoop implementation. This can be safely ignored, it's just cosmetic.

 ///
 /// If the deadline is earlier than "now", this routine rounds up to "now".
-fn relative_deadline(deadline: system::MojoTimeTicks, now: system::MojoTimeTicks) -> system::MojoDeadline {
+fn relative_deadline(deadline: system::MojoTimeTicks,
+                     now: system::MojoTimeTicks)
+                     -> system::MojoDeadline {
     if deadline == MOJO_INDEFINITE_ABSOLUTE {
         MOJO_INDEFINITE
     } else if now >= deadline {
         0
     } else {
         (deadline - now) as system::MojoDeadline
     }
 }
 
 /// This structure contains all information necessary to wait on handles
@@ skipping 59 matching lines @@
     {
 
         let token = self.generate_token();
         let abs_deadline = absolute_deadline(deadline);
         self.handle_set.add(handle, signals, token.as_cookie(), wsflags!(Add::None));
         self.deadlines.push(DeadlineInfo {
             token: token.clone(),
             deadline: abs_deadline,
         });
         debug_assert!(!self.handlers.contains_key(&token));
-        self.handlers.insert(token.clone(), HandlerInfo {
-            handle: handle.get_native_handle(),
-            handler: Some(Box::new(handler)),
-            deadline: abs_deadline,
-        });
+        self.handlers.insert(token.clone(),
+                             HandlerInfo {
+                                 handle: handle.get_native_handle(),
+                                 handler: Some(Box::new(handler)),
+                                 deadline: abs_deadline,
+                             });
         token
     }
 
     /// Updates the signals and deadline of an existing handler in the
     /// runloop via token. The token remains unchanged and valid.
     ///
     /// Returns true on a successful update and false if the token was not
     /// found.
     pub fn reregister(&mut self,
                       token: &Token,
@@ skipping 16 matching lines @@
                 });
                 // Acquire the raw handle held by the HandlerInfo in order to
                 // call the wait_set's add method. Invalidate it immediately after
                 // in order to prevent the handle from being closed.
                 //
                 // It's perfectly okay for the handle to be invalid, so although this
                 // is all unsafe, the whole system should just call the handler with an
                 // error.
                 let mut dummy = unsafe { system::acquire(info.handle()) };
                 self.handle_set.add(&dummy, signals, token.as_cookie(), wsflags!(Add::None));
-                unsafe { dummy.invalidate(); }
+                unsafe {
+                    dummy.invalidate();
+                }
                 true
-            },
+            }
             None => false,
         }
     }
 
     /// Removes an entry from the runloop.
     ///
     /// Since we cannot remove from the deadlines heap, we just leave the deadline
     /// in there as "stale", and we handle those when trying to find the next closest
     /// deadline.
     pub fn deregister(&mut self, token: Token) -> bool {
         match self.handlers.remove(&token) {
             Some(_) => {
                 let _result = self.handle_set.remove(token.as_cookie());
                 debug_assert_eq!(_result, MojoResult::Okay);
                 true
-            },
+            }
             None => false,
         }
     }
 
     /// Uses the binary heap to get the next closest deadline.
     ///
     /// Removes stale deadline entries as they are found, but
     /// does not otherwise modify the heap of deadlines.
     fn get_next_deadline(&mut self) -> system::MojoTimeTicks {
         debug_assert!(!self.handlers.is_empty());
@@ skipping 10 matching lines @@
         }
         top.deadline()
     }
 
     /// Gets a handler by token to be manipulated in a consistent environment.
     ///
     /// This method provides a method of accessing a handler in order to manipulate
     /// it in a manner that avoids a borrow cycle, that is, it take()s the handler
     /// out of the HashMap, and returns it when manipulation has completed.
     fn get_handler_with<F>(&mut self, token: &Token, invoker: F)
-        where F: FnOnce(&mut Self, &mut Box<Handler + 'h>, Token, system::MojoTimeTicks)
+        where F: FnOnce(&mut Self,
+                        &mut Box<Handler + 'h>,
+                        Token,
+                        system::MojoTimeTicks)
     {
         // Logic for pulling out the handler as well as its current deadline.
         //
         // Unfortunately, pulling out the handler value here and "onto the stack"
         // (it probably won't actually end up on the stack thanks to optimizations)
         // is necessary since otherwise the borrow checker complains that we pass
         // a mutable reference to the RunLoop and the handler (as &mut self) to
         // the callbacks at the same time. This is understandably unsafe since
         // modifying the hashmap with register and deregister can invalidate the
         // reference to self in the callback. In the C++ bindings and in other Rust
         // event loops this is exactly what happens, but I avoided this. The downside
         // is that we can no longer nest event loop run() calls. Once we put a handler
         // onto the stack here, we can no longer call its callback in a nested manner
         // from the RunLoop. I could just enable nesting with this one restriction, that
         // the handler calling run() will always be ignored, but this is unintuitive.
         let (mut handler, deadline) = match self.handlers.get_mut(&token) {
-            Some(ref_info) => (match ref_info.take() {
-                Some(handler) => handler,
-                None => return,
-            }, ref_info.deadline()),
+            Some(ref_info) => {
+                (match ref_info.take() {
+                    Some(handler) => handler,
+                    None => return,
+                },
+                 ref_info.deadline())
+            }
             None => return,
         };
         // Call the closure that will invoke the callbacks.
         invoker(self, &mut handler, token.clone(), deadline);
         // Restore the handler to its location in the HashMap
         if let Some(ref_info) = self.handlers.get_mut(&token) {
             ref_info.give(handler);
         }
     }
 
     /// For all the results we received, we notify the respective handle
     /// owners of the results by calling their given callbacks.
     ///
     /// We do NOT dequeue notified handles.
     fn notify_of_results(&mut self, results: &Vec<system::WaitSetResult>) {
         debug_assert!(!self.handlers.is_empty());
         for wsr in results.iter() {
             let token = Token(wsr.cookie());
             self.get_handler_with(&token, move |runloop, boxed_handler, token, _dl| {
                 let handler = boxed_handler.as_mut();
                 match wsr.result() {
-                    MojoResult::Okay => {
-                        handler.on_ready(runloop, token)
-                    },
+                    MojoResult::Okay => handler.on_ready(runloop, token),
                     MojoResult::Cancelled => {
                         handler.on_error(runloop, token, WaitError::HandleClosed)
-                    },
-                    MojoResult::Busy => {
-                        handler.on_error(runloop, token, WaitError::HandleBusy)
-                    },
+                    }
+                    MojoResult::Busy => handler.on_error(runloop, token, WaitError::HandleBusy),
                     MojoResult::FailedPrecondition => {
                         handler.on_error(runloop, token, WaitError::Unsatisfiable)
-                    },
+                    }
                     other => panic!("Unexpected result received after waiting: {}", other),
                 }
             });
             // In order to quit as soon as possible, we should check to quit after every
             // potential handler call, as any of them could have signaled to quit.
             if self.should_quit {
                 break;
             }
         }
     }
 
     /// Since the deadline expired, we notify the relevant handle
     /// owners of the expiration by calling their given callbacks.
     ///
     /// We do NOT dequeue notified handles.
     fn notify_of_expired(&mut self, expired_deadline: system::MojoTimeTicks) {
         debug_assert!(!self.handlers.is_empty());
         let mut top = match self.deadlines.peek() {
             Some(info) => info.clone(),
             None => panic!("Should not be in notify_of_expired without at least one deadline!"),
         };
         while expired_deadline >= top.deadline() {
             let next_deadline = top.deadline();
-            self.get_handler_with(top.token(), move |runloop, boxed_handler, token, expected_dl| {
-                let handler = boxed_handler.as_mut();
-                if next_deadline == expected_dl {
-                    handler.on_timeout(runloop, token);
-                }
-            });
+            self.get_handler_with(top.token(),
+                                  move |runloop, boxed_handler, token, expected_dl| {
+                                      let handler = boxed_handler.as_mut();
+                                      if next_deadline == expected_dl {
+                                          handler.on_timeout(runloop, token);
+                                      }
+                                  });
             // In order to quit as soon as possible, we should check to quit after every
             // potential handler call, as any of them could have signaled to quit.
             if self.should_quit {
                 break;
             }
             // Remove the deadline
             self.deadlines.pop();
             // Break if the next deadline has not yet expired.
             top = match self.deadlines.peek() {
                 Some(info) => info.clone(),
@@ skipping 19 matching lines @@
                 self.notify_of_results(results_buffer);
                 // Clear the buffer since we don't need the results anymore.
                 // Helps prevent a copy if we resize the buffer.
                 results_buffer.clear();
                 // Increase the size of the buffer if there are more results
                 // we could be holding.
                 let capacity = results_buffer.capacity();
                 if capacity < MAXIMUM_WAIT_SET_NUM_RESULTS && capacity < (max_results) as usize {
                     results_buffer.reserve(capacity);
                 }
-            },
+            }
             Err(result) => {
                 assert_eq!(result, MojoResult::DeadlineExceeded);
                 self.notify_of_expired(deadline);
-            },
+            }
         }
     }
 
     /// Loop forever until a callback tells us to quit.
     pub fn run(&mut self) {
         // It's an error it already be running...
         if self.running {
             panic!("RunLoop is already running!");
         }
         self.running = true;
         self.should_quit = false;
-        let mut buffer: Vec<system::WaitSetResult> = Vec::with_capacity(INITIAL_WAIT_SET_NUM_RESULTS);
+        let mut buffer: Vec<system::WaitSetResult> =
+            Vec::with_capacity(INITIAL_WAIT_SET_NUM_RESULTS);
         // Loop while we haven't been signaled to quit, and there's something to wait on.
         while !self.should_quit && !self.handlers.is_empty() {
             self.wait(&mut buffer)
         }
         self.running = false;
     }
 
     /// Set a flag to quit at the next available moment.
     pub fn quit(&mut self) {
         self.should_quit = true;
     }
 }
 
 /// Provides a scope to modify the current thread's runloop.
 pub fn with_current<F>(modifier: F)
     where F: FnOnce(&mut RunLoop)
 {
     TL_RUN_LOOP.with(|ref_runloop| {
         let mut runloop = ref_runloop.borrow_mut();
         modifier(&mut *runloop);
     });
 }