Re: [PATCH 03/10] rust/irq: Add a helper to convert [InterruptSource] to [*mut IRQState]

[Zhao Liu <zhao1.liu@intel.com>]

On Wed, Jan 29, 2025 at 11:51:02AM +0100, Paolo Bonzini wrote:
> Date: Wed, 29 Jan 2025 11:51:02 +0100
> From: Paolo Bonzini <pbonzini@redhat.com>
> Subject: Re: [PATCH 03/10] rust/irq: Add a helper to convert
>  [InterruptSource] to [*mut IRQState]
> 
> On Sat, Jan 25, 2025 at 1:32 PM Zhao Liu <zhao1.liu@intel.com> wrote:
> > 
> > This is useful to hanlde InterruptSource slice and pass it to C
> > bindings.
> > 
> > Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
> 
> This may be a bad suggestion, after all. clippy complains that you're
> casting &[*mut IRQState] to mutable (https://rust-lang.github.io/rust-
> clippy/master/#as_ptr_cast_mut).
> 
> I can think of two solutions:
> 
> 1) add #[allow(clippy::as_ptr_cast_mut)] and explain with a comment
> 
>     // Casting to *mut *mut IRQState is valid, because
>     // the source slice `pins` uses interior mutability.
> 
> 2) drop as_slice_of_qemu_irq() and replace it with something like
> 
>     pub(crate) const fn slice_as_ptr(slice: &[Self]) -> *mut *mut IRQState {
>         slice[0].as_ptr()
>     }
> 
> You choose.
>

:) I choose the second way, which goes back to the initial codes.

Though an empty slice w/o any check would cause a runtime error like:

"thread '<unnamed>' panicked at 'index out of bounds: the len is 0 but the index is 0'"

Adding an assert to ensure a non-empty slice is better.

Thanks,
Zhao