1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
// Copyright (c) the JPEG XL Project Authors. All rights reserved.
//
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
use std::{fmt::Debug, marker::PhantomData, mem::MaybeUninit};
use super::{RawImageRectMut, Rect, internal::RawImageBuffer};
#[derive(Debug)]
#[repr(transparent)]
pub struct JxlOutputBuffer<'a> {
// Safety invariant: `self` has exclusive (write) access to the accessible bytes of `inner`.
inner: RawImageBuffer,
_ph: PhantomData<&'a mut u8>,
}
impl<'a> JxlOutputBuffer<'a> {
/// Creates a new JxlOutputBuffer from raw pointers.
/// It is guaranteed that `buf` will never be used to write uninitialized data.
///
/// # Safety
/// - `buf` must be valid for writes for all bytes in the range
/// `buf[i*bytes_between_rows..i*bytes_between_rows+bytes_per_row]` for all values of `i`
/// from `0` to `num_rows-1`.
/// - The bytes in these ranges must not be accessed as long as the returned `Self` is in scope.
/// - All the bytes in those ranges (and in between) must be part of the same allocated object.
pub unsafe fn new_from_ptr(
buf: *mut MaybeUninit<u8>,
num_rows: usize,
bytes_per_row: usize,
bytes_between_rows: usize,
) -> Self {
JxlOutputBuffer {
// SAFETY: the safety conditions on RawImageBuffer::new_from_ptr are strictly weaker.
// We are promised write access to the underlying data, so our own safety invariant is
// respected.
inner: unsafe {
RawImageBuffer::new_from_ptr(buf, num_rows, bytes_per_row, bytes_between_rows)
},
_ph: PhantomData,
}
}
pub fn from_image_rect_mut(raw: RawImageRectMut<'a>) -> Self {
Self {
// Safety note: since `raw` has exclusive access to the data, we are just transferring
// this access.
inner: raw.data,
_ph: PhantomData,
}
}
/// Creates a new JxlOutputBuffer from a slice of uninit data.
/// It is guaranteed that `buf` will never be used to write uninitalized data.
pub fn new_uninit(
buf: &'a mut [MaybeUninit<u8>],
num_rows: usize,
bytes_per_row: usize,
) -> Self {
Self::new_uninit_with_stride(buf, num_rows, bytes_per_row, bytes_per_row)
}
pub fn new(buf: &'a mut [u8], num_rows: usize, bytes_per_row: usize) -> Self {
Self::new_with_stride(buf, num_rows, bytes_per_row, bytes_per_row)
}
/// Creates a new JxlOutputBuffer from a slice of uninit data.
/// It is guaranteed that `buf` will never be used to write uninitalized data.
pub fn new_uninit_with_stride(
buf: &'a mut [MaybeUninit<u8>],
num_rows: usize,
bytes_per_row: usize,
byte_stride: usize,
) -> Self {
assert_ne!(num_rows, 0);
assert!(
buf.len()
>= byte_stride
.checked_mul(num_rows - 1)
.unwrap()
.checked_add(bytes_per_row)
.unwrap()
);
// SAFETY: The assert above guarantees that `buf` has enough space to satisfy the first
// safety requirement, and the rest follow from borrowing from a &mut [].
unsafe { Self::new_from_ptr(buf.as_mut_ptr(), num_rows, bytes_per_row, byte_stride) }
}
pub fn new_with_stride(
buf: &'a mut [u8],
num_rows: usize,
bytes_per_row: usize,
byte_stride: usize,
) -> Self {
Self::new_uninit_with_stride(
// SAFETY: `new_uninit` guarantees that no uninit data is ever written to the passed-in
// slice. Moreover, `T` and `MaybeUninit<T>` have the same memory layout.
unsafe { std::slice::from_raw_parts_mut(buf.as_mut_ptr().cast(), buf.len()) },
num_rows,
bytes_per_row,
byte_stride,
)
}
pub(crate) fn reborrow(lender: &'a mut JxlOutputBuffer<'_>) -> JxlOutputBuffer<'a> {
// Safety note: this is effectively equivalent to a reborrow.
Self {
_ph: PhantomData,
..*lender
}
}
/// # Safety
/// The caller must guarantee that the returned slice is not used for writing uninit data.
pub(crate) unsafe fn row_mut(&mut self, row: usize) -> &mut [MaybeUninit<u8>] {
// SAFETY: caller guarantees no uninit data is written, and we have write access to the
// data due to safety invariant.
unsafe { self.inner.row_mut(row) }
}
#[inline]
pub fn write_bytes(&mut self, row: usize, col: usize, bytes: &[u8]) {
// SAFETY: We never use the returned slice to write uninit data, and we have write access
// to the data.
let slice = unsafe { self.inner.row_mut(row) };
for (w, s) in slice.iter_mut().skip(col).zip(bytes.iter().copied()) {
w.write(s);
}
}
pub fn byte_size(&self) -> (usize, usize) {
self.inner.byte_size()
}
pub fn rect(&mut self, rect: Rect) -> JxlOutputBuffer<'_> {
// Safety note: the return value borrows from `self`, so we are lending our memory to the
// returned JxlOutputBuffer.
Self {
inner: self.inner.rect(rect),
_ph: PhantomData,
}
}
}