1 // Copyright 2012-2013 The Rust Project Developers. See the COPYRIGHT
2 // file at the top-level directory of this distribution and at
3 // http://rust-lang.org/COPYRIGHT.
5 // Licensed under the Apache License, Version 2.0 <LICENSE-APACHE or
6 // http://www.apache.org/licenses/LICENSE-2.0> or the MIT license
7 // <LICENSE-MIT or http://opensource.org/licenses/MIT>, at your
8 // option. This file may not be copied, modified, or distributed
9 // except according to those terms.
11 //! Shareable mutable containers.
13 //! Values of the `Cell` and `RefCell` types may be mutated through
14 //! shared references (i.e. the common `&T` type), whereas most Rust
15 //! types can only be mutated through unique (`&mut T`) references. We
16 //! say that `Cell` and `RefCell` provide *interior mutability*, in
17 //! contrast with typical Rust types that exhibit *inherited
20 //! Cell types come in two flavors: `Cell` and `RefCell`. `Cell`
21 //! provides `get` and `set` methods that change the
22 //! interior value with a single method call. `Cell` though is only
23 //! compatible with types that implement `Copy`. For other types,
24 //! one must use the `RefCell` type, acquiring a write lock before
27 //! `RefCell` uses Rust's lifetimes to implement *dynamic borrowing*,
28 //! a process whereby one can claim temporary, exclusive, mutable
29 //! access to the inner value. Borrows for `RefCell`s are tracked *at
30 //! runtime*, unlike Rust's native reference types which are entirely
31 //! tracked statically, at compile time. Because `RefCell` borrows are
32 //! dynamic it is possible to attempt to borrow a value that is
33 //! already mutably borrowed; when this happens it results in task
36 //! # When to choose interior mutability
38 //! The more common inherited mutability, where one must have unique
39 //! access to mutate a value, is one of the key language elements that
40 //! enables Rust to reason strongly about pointer aliasing, statically
41 //! preventing crash bugs. Because of that, inherited mutability is
42 //! preferred, and interior mutability is something of a last
43 //! resort. Since cell types enable mutation where it would otherwise
44 //! be disallowed though, there are occasions when interior
45 //! mutability might be appropriate, or even *must* be used, e.g.
47 //! * Introducing inherited mutability roots to shared types.
48 //! * Implementation details of logically-immutable methods.
49 //! * Mutating implementations of `clone`.
51 //! ## Introducing inherited mutability roots to shared types
53 //! Shared smart pointer types, including `Rc` and `Arc`, provide
54 //! containers that can be cloned and shared between multiple parties.
55 //! Because the contained values may be multiply-aliased, they can
56 //! only be borrowed as shared references, not mutable references.
57 //! Without cells it would be impossible to mutate data inside of
58 //! shared boxes at all!
60 //! It's very common then to put a `RefCell` inside shared pointer
61 //! types to reintroduce mutability:
64 //! use std::collections::HashMap;
65 //! use std::cell::RefCell;
69 //! let shared_map: Rc<RefCell<_>> = Rc::new(RefCell::new(HashMap::new()));
70 //! shared_map.borrow_mut().insert("africa", 92388i);
71 //! shared_map.borrow_mut().insert("kyoto", 11837i);
72 //! shared_map.borrow_mut().insert("piccadilly", 11826i);
73 //! shared_map.borrow_mut().insert("marbles", 38i);
77 //! ## Implementation details of logically-immutable methods
79 //! Occasionally it may be desirable not to expose in an API that
80 //! there is mutation happening "under the hood". This may be because
81 //! logically the operation is immutable, but e.g. caching forces the
82 //! implementation to perform mutation; or because you must employ
83 //! mutation to implement a trait method that was originally defined
87 //! use std::cell::RefCell;
90 //! edges: Vec<(uint, uint)>,
91 //! span_tree_cache: RefCell<Option<Vec<(uint, uint)>>>
95 //! fn minimum_spanning_tree(&self) -> Vec<(uint, uint)> {
96 //! // Create a new scope to contain the lifetime of the
99 //! // Take a reference to the inside of cache cell
100 //! let mut cache = self.span_tree_cache.borrow_mut();
101 //! if cache.is_some() {
102 //! return cache.as_ref().unwrap().clone();
105 //! let span_tree = self.calc_span_tree();
106 //! *cache = Some(span_tree);
109 //! // Recursive call to return the just-cached value.
110 //! // Note that if we had not let the previous borrow
111 //! // of the cache fall out of scope then the subsequent
112 //! // recursive borrow would cause a dynamic task panic.
113 //! // This is the major hazard of using `RefCell`.
114 //! self.minimum_spanning_tree()
116 //! # fn calc_span_tree(&self) -> Vec<(uint, uint)> { vec![] }
121 //! ## Mutating implementations of `clone`
123 //! This is simply a special - but common - case of the previous:
124 //! hiding mutability for operations that appear to be immutable.
125 //! The `clone` method is expected to not change the source value, and
126 //! is declared to take `&self`, not `&mut self`. Therefore any
127 //! mutation that happens in the `clone` method must use cell
128 //! types. For example, `Rc` maintains its reference counts within a
132 //! use std::cell::Cell;
135 //! ptr: *mut RcBox<T>
138 //! struct RcBox<T> {
140 //! refcount: Cell<uint>
143 //! impl<T> Clone for Rc<T> {
144 //! fn clone(&self) -> Rc<T> {
146 //! (*self.ptr).refcount.set((*self.ptr).refcount.get() + 1);
147 //! Rc { ptr: self.ptr }
153 // FIXME: Explain difference between Cell and RefCell
154 // FIXME: Downsides to interior mutability
155 // FIXME: Can't be shared between threads. Dynamic borrows
156 // FIXME: Relationship to Atomic types and RWLock
162 use default::Default
;
163 use marker
::{Copy, Send}
;
164 use ops
::{Deref, DerefMut, Drop}
;
166 use option
::Option
::{None, Some}
;
168 /// A mutable memory location that admits only `Copy` data.
171 value
: UnsafeCell
<T
>,
174 impl<T
:Copy
> Cell
<T
> {
175 /// Creates a new `Cell` containing the given value.
177 pub fn new(value
: T
) -> Cell
<T
> {
179 value
: UnsafeCell
::new(value
),
183 /// Returns a copy of the contained value.
186 pub fn get(&self) -> T
{
187 unsafe{ *self.value.get() }
190 /// Sets the contained value.
193 pub fn set(&self, value
: T
) {
195 *self.value
.get() = value
;
199 /// Get a reference to the underlying `UnsafeCell`.
201 /// This can be used to circumvent `Cell`'s safety checks.
203 /// This function is `unsafe` because `UnsafeCell`'s field is public.
206 pub unsafe fn as_unsafe_cell
<'a
>(&'a
self) -> &'a UnsafeCell
<T
> {
212 unsafe impl<T
> Send
for Cell
<T
> where T
: Send {}
215 impl<T
:Copy
> Clone
for Cell
<T
> {
216 fn clone(&self) -> Cell
<T
> {
217 Cell
::new(self.get())
222 impl<T
:Default
+ Copy
> Default
for Cell
<T
> {
224 fn default() -> Cell
<T
> {
225 Cell
::new(Default
::default())
230 impl<T
:PartialEq
+ Copy
> PartialEq
for Cell
<T
> {
231 fn eq(&self, other
: &Cell
<T
>) -> bool
{
232 self.get() == other
.get()
236 /// A mutable memory location with dynamically checked borrow rules
238 pub struct RefCell
<T
> {
239 value
: UnsafeCell
<T
>,
240 borrow
: Cell
<BorrowFlag
>,
243 // Values [1, MAX-1] represent the number of `Ref` active
244 // (will not outgrow its range since `uint` is the size of the address space)
245 type BorrowFlag
= uint
;
246 const UNUSED
: BorrowFlag
= 0;
247 const WRITING
: BorrowFlag
= -1;
250 /// Create a new `RefCell` containing `value`
252 pub fn new(value
: T
) -> RefCell
<T
> {
254 value
: UnsafeCell
::new(value
),
255 borrow
: Cell
::new(UNUSED
),
259 /// Consumes the `RefCell`, returning the wrapped value.
261 pub fn into_inner(self) -> T
{
262 // Since this function takes `self` (the `RefCell`) by value, the
263 // compiler statically verifies that it is not currently borrowed.
264 // Therefore the following assertion is just a `debug_assert!`.
265 debug_assert
!(self.borrow
.get() == UNUSED
);
266 unsafe { self.value.into_inner() }
269 /// Attempts to immutably borrow the wrapped value.
271 /// The borrow lasts until the returned `Ref` exits scope. Multiple
272 /// immutable borrows can be taken out at the same time.
274 /// Returns `None` if the value is currently mutably borrowed.
275 #[unstable = "may be renamed or removed"]
276 pub fn try_borrow
<'a
>(&'a
self) -> Option
<Ref
<'a
, T
>> {
277 match BorrowRef
::new(&self.borrow
) {
278 Some(b
) => Some(Ref { _value: unsafe { &*self.value.get() }
, _borrow
: b
}),
283 /// Immutably borrows the wrapped value.
285 /// The borrow lasts until the returned `Ref` exits scope. Multiple
286 /// immutable borrows can be taken out at the same time.
290 /// Panics if the value is currently mutably borrowed.
292 pub fn borrow
<'a
>(&'a
self) -> Ref
<'a
, T
> {
293 match self.try_borrow() {
295 None
=> panic
!("RefCell<T> already mutably borrowed")
299 /// Mutably borrows the wrapped value.
301 /// The borrow lasts until the returned `RefMut` exits scope. The value
302 /// cannot be borrowed while this borrow is active.
304 /// Returns `None` if the value is currently borrowed.
305 #[unstable = "may be renamed or removed"]
306 pub fn try_borrow_mut
<'a
>(&'a
self) -> Option
<RefMut
<'a
, T
>> {
307 match BorrowRefMut
::new(&self.borrow
) {
308 Some(b
) => Some(RefMut { _value: unsafe { &mut *self.value.get() }
, _borrow
: b
}),
313 /// Mutably borrows the wrapped value.
315 /// The borrow lasts until the returned `RefMut` exits scope. The value
316 /// cannot be borrowed while this borrow is active.
320 /// Panics if the value is currently borrowed.
322 pub fn borrow_mut
<'a
>(&'a
self) -> RefMut
<'a
, T
> {
323 match self.try_borrow_mut() {
325 None
=> panic
!("RefCell<T> already borrowed")
329 /// Get a reference to the underlying `UnsafeCell`.
331 /// This can be used to circumvent `RefCell`'s safety checks.
333 /// This function is `unsafe` because `UnsafeCell`'s field is public.
336 pub unsafe fn as_unsafe_cell
<'a
>(&'a
self) -> &'a UnsafeCell
<T
> {
342 unsafe impl<T
> Send
for RefCell
<T
> where T
: Send {}
345 impl<T
: Clone
> Clone
for RefCell
<T
> {
346 fn clone(&self) -> RefCell
<T
> {
347 RefCell
::new(self.borrow().clone())
352 impl<T
:Default
> Default
for RefCell
<T
> {
354 fn default() -> RefCell
<T
> {
355 RefCell
::new(Default
::default())
360 impl<T
: PartialEq
> PartialEq
for RefCell
<T
> {
361 fn eq(&self, other
: &RefCell
<T
>) -> bool
{
362 *self.borrow() == *other
.borrow()
366 struct BorrowRef
<'b
> {
367 _borrow
: &'b Cell
<BorrowFlag
>,
370 impl<'b
> BorrowRef
<'b
> {
371 fn new(borrow
: &'b Cell
<BorrowFlag
>) -> Option
<BorrowRef
<'b
>> {
376 Some(BorrowRef { _borrow: borrow }
)
383 impl<'b
> Drop
for BorrowRef
<'b
> {
385 let borrow
= self._borrow
.get();
386 debug_assert
!(borrow
!= WRITING
&& borrow
!= UNUSED
);
387 self._borrow
.set(borrow
- 1);
391 impl<'b
> Clone
for BorrowRef
<'b
> {
392 fn clone(&self) -> BorrowRef
<'b
> {
393 // Since this Ref exists, we know the borrow flag
394 // is not set to WRITING.
395 let borrow
= self._borrow
.get();
396 debug_assert
!(borrow
!= WRITING
&& borrow
!= UNUSED
);
397 self._borrow
.set(borrow
+ 1);
398 BorrowRef { _borrow: self._borrow }
402 /// Wraps a borrowed reference to a value in a `RefCell` box.
404 pub struct Ref
<'b
, T
:'b
> {
405 // FIXME #12808: strange name to try to avoid interfering with
406 // field accesses of the contained type via Deref
408 _borrow
: BorrowRef
<'b
>,
412 impl<'b
, T
> Deref
for Ref
<'b
, T
> {
416 fn deref
<'a
>(&'a
self) -> &'a T
{
423 /// The `RefCell` is already immutably borrowed, so this cannot fail.
425 /// A `Clone` implementation would interfere with the widespread
426 /// use of `r.borrow().clone()` to clone the contents of a `RefCell`.
427 #[unstable = "likely to be moved to a method, pending language changes"]
428 pub fn clone_ref
<'b
, T
:Clone
>(orig
: &Ref
<'b
, T
>) -> Ref
<'b
, T
> {
431 _borrow
: orig
._borrow
.clone(),
435 struct BorrowRefMut
<'b
> {
436 _borrow
: &'b Cell
<BorrowFlag
>,
440 impl<'b
> Drop
for BorrowRefMut
<'b
> {
442 let borrow
= self._borrow
.get();
443 debug_assert
!(borrow
== WRITING
);
444 self._borrow
.set(UNUSED
);
448 impl<'b
> BorrowRefMut
<'b
> {
449 fn new(borrow
: &'b Cell
<BorrowFlag
>) -> Option
<BorrowRefMut
<'b
>> {
453 Some(BorrowRefMut { _borrow: borrow }
)
460 /// Wraps a mutable borrowed reference to a value in a `RefCell` box.
462 pub struct RefMut
<'b
, T
:'b
> {
463 // FIXME #12808: strange name to try to avoid interfering with
464 // field accesses of the contained type via Deref
466 _borrow
: BorrowRefMut
<'b
>,
470 impl<'b
, T
> Deref
for RefMut
<'b
, T
> {
474 fn deref
<'a
>(&'a
self) -> &'a T
{
480 impl<'b
, T
> DerefMut
for RefMut
<'b
, T
> {
482 fn deref_mut
<'a
>(&'a
mut self) -> &'a
mut T
{
487 /// The core primitive for interior mutability in Rust.
489 /// `UnsafeCell` type that wraps a type T and indicates unsafe interior
490 /// operations on the wrapped type. Types with an `UnsafeCell<T>` field are
491 /// considered to have an *unsafe interior*. The `UnsafeCell` type is the only
492 /// legal way to obtain aliasable data that is considered mutable. In general,
493 /// transmuting an &T type into an &mut T is considered undefined behavior.
495 /// Although it is possible to put an `UnsafeCell<T>` into static item, it is
496 /// not permitted to take the address of the static item if the item is not
497 /// declared as mutable. This rule exists because immutable static items are
498 /// stored in read-only memory, and thus any attempt to mutate their interior
499 /// can cause segfaults. Immutable static items containing `UnsafeCell<T>`
500 /// instances are still useful as read-only initializers, however, so we do not
501 /// forbid them altogether.
503 /// Types like `Cell` and `RefCell` use this type to wrap their internal data.
505 /// `UnsafeCell` doesn't opt-out from any kind, instead, types with an
506 /// `UnsafeCell` interior are expected to opt-out from kinds themselves.
511 /// use std::cell::UnsafeCell;
514 /// struct NotThreadSafe<T> {
515 /// value: UnsafeCell<T>,
516 /// marker: marker::NoSync
520 /// **NOTE:** `UnsafeCell<T>` fields are public to allow static initializers. It
521 /// is not recommended to access its fields directly, `get` should be used
525 pub struct UnsafeCell
<T
> {
528 /// This field should not be accessed directly, it is made public for static
534 impl<T
> UnsafeCell
<T
> {
535 /// Construct a new instance of `UnsafeCell` which will wrap the specified
538 /// All access to the inner value through methods is `unsafe`, and it is
539 /// highly discouraged to access the fields directly.
541 pub fn new(value
: T
) -> UnsafeCell
<T
> {
542 UnsafeCell { value: value }
545 /// Gets a mutable pointer to the wrapped value.
548 pub fn get(&self) -> *mut T { &self.value as *const T as *mut T }
550 /// Unwraps the value
552 /// This function is unsafe because there is no guarantee that this or other
553 /// tasks are currently inspecting the inner value.
556 pub unsafe fn into_inner(self) -> T { self.value }