[hal] Do not expose dependency on metal and objc crates

Author: madsmtm

wgpu-core/src/instance.rs

@@ -303,34 +303,28 @@ impl Instance {
         }
     }
 
+    /// Construct a surface from a pointer to a `CAMetalLayer`.
+    ///
     /// # Safety
     ///
-    /// `layer` must be a valid pointer.
+    /// The given layer pointer must point to a valid, non-NULL, initialized
+    /// instance of `CAMetalLayer`.
     #[cfg(metal)]
     pub unsafe fn create_surface_metal(
         &self,
         layer: *mut core::ffi::c_void,
     ) -> Result<Surface, CreateSurfaceError> {
+        use core::ptr::NonNull;
+
         profiling::scope!("Instance::create_surface_metal");
 
-        let instance = unsafe { self.as_hal::<hal::api::Metal>() }
+        let _instance = unsafe { self.as_hal::<hal::api::Metal>() }
             .ok_or(CreateSurfaceError::BackendNotEnabled(Backend::Metal))?;
 
-        let layer = layer.cast();
-        // SAFETY: We do this cast and deref. (rather than using `metal` to get the
-        // object we want) to avoid direct coupling on the `metal` crate.
-        //
-        // To wit, this pointer…
-        //
-        // - …is properly aligned.
-        // - …is dereferenceable to a `MetalLayerRef` as an invariant of the `metal`
-        //   field.
-        // - …points to an _initialized_ `MetalLayerRef`.
-        // - …is only ever aliased via an immutable reference that lives within this
-        //   lexical scope.
-        let layer = unsafe { &*layer };
-        let raw_surface: Box<dyn hal::DynSurface> =
-            Box::new(instance.create_surface_from_layer(layer));
+        let layer = NonNull::new(layer).expect("layer pointer must not be NULL");
+        // SAFETY: Upheld by caller.
+        let raw_surface = unsafe { hal::metal::Surface::from_layer(layer) };
+        let raw_surface: Box<dyn hal::DynSurface> = Box::new(raw_surface);
 
         let surface = Surface {
             presentation: Mutex::new(rank::SURFACE_PRESENTATION, None),

wgpu-hal/src/metal/mod.rs

@@ -103,12 +103,6 @@ crate::impl_dyn_resource!(
 
 pub struct Instance {}
 
-impl Instance {
-    pub fn create_surface_from_layer(&self, layer: &metal::MetalLayerRef) -> Surface {
-        unsafe { Surface::from_layer(layer) }
-    }
-}
-
 impl crate::Instance for Instance {
     type A = Api;
 
@@ -127,11 +121,11 @@ impl crate::Instance for Instance {
         match window_handle {
             #[cfg(any(target_os = "ios", target_os = "visionos"))]
             raw_window_handle::RawWindowHandle::UiKit(handle) => {
-                Ok(unsafe { Surface::from_view(handle.ui_view.cast()) })
+                Ok(unsafe { Surface::from_ui_view(handle.ui_view) })
             }
             #[cfg(target_os = "macos")]
             raw_window_handle::RawWindowHandle::AppKit(handle) => {
-                Ok(unsafe { Surface::from_view(handle.ns_view.cast()) })
+                Ok(unsafe { Surface::from_ns_view(handle.ns_view) })
             }
             _ => Err(crate::InstanceError::new(format!(
                 "window handle {window_handle:?} is not a Metal-compatible handle"

wgpu-hal/src/metal/surface.rs

@@ -1,8 +1,8 @@
 #![allow(clippy::let_unit_value)] // `let () =` being used to constrain result type
 
 use alloc::borrow::ToOwned as _;
-use core::mem::ManuallyDrop;
 use core::ptr::NonNull;
+use core::{ffi::c_void, mem::ManuallyDrop};
 use std::thread;
 
 use core_graphics_types::{
@@ -34,20 +34,57 @@ impl super::Surface {
         }
     }
 
-    /// If not called on the main thread, this will panic.
-    #[allow(clippy::transmute_ptr_to_ref)]
-    pub unsafe fn from_view(view: NonNull<Object>) -> Self {
-        let layer = unsafe { Self::get_metal_layer(view) };
+    /// Construct a surface from a pointer to a `NSView`.
+    ///
+    /// # Panics
+    ///
+    /// Panics if called from a thread that is not the main thread.
+    ///
+    /// # Safety
+    ///
+    /// The given view pointer must be a valid instance of `NSView`.
+    pub unsafe fn from_ns_view(view: NonNull<c_void>) -> Self {
+        // SAFETY: Upheld by caller.
+        let layer = unsafe { Self::get_metal_layer(view.cast()) };
         let layer = ManuallyDrop::new(layer);
         // SAFETY: The layer is an initialized instance of `CAMetalLayer`, and
         // we transfer the retain count to `MetalLayer` using `ManuallyDrop`.
         let layer = unsafe { metal::MetalLayer::from_ptr(layer.cast()) };
         Self::new(layer)
     }
 
-    pub unsafe fn from_layer(layer: &metal::MetalLayerRef) -> Self {
+    /// Construct a surface from a pointer to a `UIView`.
+    ///
+    /// # Panics
+    ///
+    /// Panics if called from a thread that is not the main thread.
+    ///
+    /// # Safety
+    ///
+    /// The given view pointer must be a valid instance of `UIView`.
+    pub unsafe fn from_ui_view(view: NonNull<c_void>) -> Self {
+        // SAFETY: Upheld by caller.
+        let layer = unsafe { Self::get_metal_layer(view.cast()) };
+        let layer = ManuallyDrop::new(layer);
+        // SAFETY: The layer is an initialized instance of `CAMetalLayer`, and
+        // we transfer the retain count to `MetalLayer` using `ManuallyDrop`.
+        let layer = unsafe { metal::MetalLayer::from_ptr(layer.cast()) };
+        Self::new(layer)
+    }
+
+    /// Construct a surface from a pointer to a `CAMetalLayer`.
+    ///
+    /// # Safety
+    ///
+    /// The given view pointer must be a valid instance of `CAMetalLayer`.
+    pub unsafe fn from_layer(layer: NonNull<c_void>) -> Self {
+        // SAFETY: Validity of the pointer is upheld by the caller.
+        //
+        // We extend the lifetime of the layer with `to_owned` below.
+        let layer = unsafe { layer.cast::<metal::MetalLayerRef>().as_ref() };
+
         let class = class!(CAMetalLayer);
-        let proper_kind: BOOL = msg_send![layer, isKindOfClass: class];
+        let proper_kind: BOOL = unsafe { msg_send![layer, isKindOfClass: class] };
         assert_eq!(proper_kind, YES);
         Self::new(layer.to_owned())
     }