safe doc(hidden) APIs (async_stream::AsyncStream::new, async_stream::Sender::send, async_stream::pair) allow UB

[tokio-rs]

safe doc(hidden) APIs (async_stream::AsyncStream::new, async_stream::Sender::send, async_stream::pair) allow UB

[taiki-e]

Thanks for the report. Those types are marked doc(hidden) and are not considered public API.

async-stream/async-stream/src/lib.rs

Lines 164 to 166 in ac3fa6b

	// Used by the macro, but not intended to be accessed publicly.
	#[doc(hidden)]
	pub use crate::async_stream::AsyncStream;

Is it possible to reproduce this using only the public API?

[ewilden]

Thanks for the response! I agree that these being doc(hidden) communicates that they are not intended to be part of the public API, and that actually trying to write code invoking them myself would constitute "abuse" rather than "use" -- apologies that the original issue title came across more strongly than intended.

I don't know of a way to produce this UB using only the doc-visible public API. I'm not able to find any reference for how unsafe conventions interact with doc(hidden), but my perspective as someone who would potentially review code using this crate is that, in the context of a code review, I don't expect to have to check whether we're referencing a doc(hidden) symbol in order to audit for potential UB (even if, as a reviewer, I would be very reluctant to let someone use a module path that included __private...). To me, marking these functions as unsafe is more in the spirit of how unsafe serves to highlight contracts you have to avoid violating in order to avoid UB -- please correct me if I'm off-base here, though!

[taiki-e]

Addressed by #84.