1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
//! # Marker types for class mutability.
//!
//! Every class must indicate which kind of mutability its instances use:
//! - Is the instance mutable or immutable?
//! - Does it use interior mutability (mutable behind `&self`, like
//!   [`UnsafeCell`])?
//! - Does it access global statics in such a way that the type is only safe
//!   to use from the main thread?
//!
//! The answer to these facts influence the final capabilities the type has,
//! as encoded in [the traits in this module](#traits).
//!
//! Concretely, you set [`ClassType::Mutability`] to [one of the types in this
//! module](#structs) to indicate the properties of class you're dealing with
//! (can be done inside [`extern_class!`] and [`declare_class!`]).
//!
//! Note that precious little of Objective-C follows Rust's usual shared xor
//! unique ownership model, most often objects assume interior mutability, so
//! a safe default is often [`InteriorMutable`], or of you're working with GUI
//! code, [`MainThreadOnly`].
//!
//! [`UnsafeCell`]: core::cell::UnsafeCell
//! [`ClassType::Mutability`]: crate::ClassType::Mutability
//! [`extern_class!`]: crate::extern_class
//! [`declare_class!`]: crate::declare_class
//!
//!
//! # SemVer
//!
//! It is considered a major change to change the [`ClassType::Mutability`] of
//! an object, though it can be done as a minor change in some cases to fix a
//! bug.
use core::marker::PhantomData;

use crate::runtime::{AnyObject, ProtocolObject};
use crate::{ClassType, Message};

mod private_mutability {
    pub trait Sealed {}
}

/// Marker trait for the different types of mutability a class can have.
///
/// This is a sealed trait, and should not need to be implemented. Open an
/// issue if you know a use-case where this restrition should be lifted!
//
// Note: `Sized` is intentionally added to make the trait not object safe.
pub trait Mutability: private_mutability::Sealed + Sized {}

impl private_mutability::Sealed for Root {}
impl Mutability for Root {}

impl private_mutability::Sealed for Immutable {}
impl Mutability for Immutable {}

impl private_mutability::Sealed for Mutable {}
impl Mutability for Mutable {}

impl<MS: ?Sized> private_mutability::Sealed for ImmutableWithMutableSubclass<MS> {}
impl<MS: ?Sized> Mutability for ImmutableWithMutableSubclass<MS> {}

impl<IS: ?Sized> private_mutability::Sealed for MutableWithImmutableSuperclass<IS> {}
impl<IS: ?Sized> Mutability for MutableWithImmutableSuperclass<IS> {}

impl private_mutability::Sealed for InteriorMutable {}
impl Mutability for InteriorMutable {}

impl private_mutability::Sealed for MainThreadOnly {}
impl Mutability for MainThreadOnly {}

/// Helper to make the structs uninhabited, without that being a public fact.
#[derive(Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash, Debug)]
enum Never {}

/// Marker type for root classes.
///
/// This is used for `objc2_foundation::NSObject` and
/// `objc2_foundation::NSProxy`, which are the two fundamental types that
/// all others inherit from.
///
/// Functionality that is provided with this:
/// - [`IsIdCloneable`] -> [`Retained::clone`][crate::rc::Retained#impl-Clone-for-Retained<T>].
/// - [`IsAllocableAnyThread`] -> [`ClassType::alloc`].
/// - [`IsAllowedMutable`].
#[derive(Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash, Debug)]
pub struct Root {
    inner: Never,
}

/// Marker type for immutable classes.
///
/// Note that immutable objects are often both [`Send`] and [`Sync`], though
/// such implementations must be provided manually.
///
/// Functionality that is provided with this:
/// - [`IsRetainable`] -> [`ClassType::retain`].
/// - [`IsIdCloneable`] -> [`Retained::clone`][crate::rc::Retained#impl-Clone-for-Retained<T>].
/// - [`IsAllocableAnyThread`] -> [`ClassType::alloc`].
/// - You are allowed to hand out pointers / references to an instance's
///   internal data, since you know such data will never be mutated.
#[derive(Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash, Debug)]
pub struct Immutable {
    inner: Never,
}

/// Marker type for mutable classes.
///
/// Note that mutable objects are often both [`Send`] and [`Sync`], though
/// such implementations must be provided manually (and are usually only safe
/// if all mutation happens behind `&mut self`).
///
/// Functionality that is provided with this:
/// - [`IsAllocableAnyThread`] -> [`ClassType::alloc`].
/// - [`IsAllowedMutable`].
/// - [`IsMutable`] -> [`impl DerefMut for Retained`][crate::rc::Retained#impl-DerefMut-for-Retained<T>].
/// - You are allowed to hand out pointers / references to an instance's
///   internal data, since you know such data will never be mutated without
///   the borrowchecker catching it.
///
///
/// # Safety notice
///
/// - (Safe) methods that mutate the object (without synchronization) are
///   required to use `&mut self`.
/// - The `retain` selector is not generally safe to use on classes `T` that
///   specify this, since `Retained<T>` allows having `&mut T` references,
///   which Rust assume are unique.
/// - As a special case of that, `-[NSCopying copy]` and
///   `-[NSMutableCopying mutableCopy]`, if implemented, must return a new
///   instance (e.g. cannot be implemented by just `retain`-ing the instance).
#[derive(Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash, Debug)]
pub struct Mutable {
    inner: Never,
}

/// Marker type for immutable classes that have a mutable counterpart.
///
/// This is effectively the same as [`Immutable`], except for the fact that
/// classes that specify this does not implement [`IsRetainable`], meaning
/// that [`ClassType::retain`] does not work (see that for details on why).
///
/// The mutable counterpart must be specified as the type parameter `MS` to
/// allow `NSCopying` and `NSMutableCopying` to return the correct type.
///
/// Functionality that is provided with this:
/// - [`IsIdCloneable`].
/// - [`IsAllocableAnyThread`].
/// - [`IsAllowedMutable`].
/// - You are allowed to hand out pointers / references to an instance's
///   internal data, since you know such data will never be mutated.
///
///
/// # Example
///
/// ```ignore
/// unsafe impl ClassType for NSString {
///     type Super = NSObject;
///     type Mutability = ImmutableWithMutableSubclass<NSMutableString>;
///     // ...
/// }
///
/// unsafe impl ClassType for NSMutableString {
///     type Super = NSString;
///     type Mutability = MutableWithImmutableSubclass<NSString>;
///     // ...
/// }
/// ```
#[derive(Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash, Debug)]
pub struct ImmutableWithMutableSubclass<MS: ?Sized> {
    inner: Never,
    mutable_subclass: PhantomData<MS>,
}

/// Marker type for mutable classes that have a immutable counterpart.
///
/// This is effectively the same as [`Mutable`], except for the immutable
/// counterpart being be specified as the type parameter `IS` to allow
/// `NSCopying` and `NSMutableCopying` to return the correct type.
///
/// Functionality that is provided with this:
/// - [`IsAllocableAnyThread`] -> [`ClassType::alloc`].
/// - [`IsAllowedMutable`].
/// - [`IsMutable`] -> [`impl DerefMut for Retained`][crate::rc::Retained#impl-DerefMut-for-Retained<T>].
/// - You are allowed to hand out pointers / references to an instance's
///   internal data, since you know such data will never be mutated without
///   the borrowchecker catching it.
///
///
/// # Example
///
/// ```ignore
/// unsafe impl ClassType for NSData {
///     type Super = NSObject;
///     type Mutability = ImmutableWithMutableSubclass<NSMutableData>;
///     // ...
/// }
///
/// unsafe impl ClassType for NSMutableData {
///     type Super = NSData;
///     type Mutability = MutableWithImmutableSubclass<NSData>;
///     // ...
/// }
/// ```
#[derive(Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash, Debug)]
pub struct MutableWithImmutableSuperclass<IS: ?Sized> {
    inner: Never,
    immutable_superclass: PhantomData<IS>,
}

/// Marker type for classes that use interior mutability.
///
/// This is usually not `Send + Sync`, unless the class is guaranteed to use
/// thread-safe operations.
///
/// Functionality that is provided with this:
/// - [`IsRetainable`] -> [`ClassType::retain`].
/// - [`IsIdCloneable`] -> [`Retained::clone`][crate::rc::Retained#impl-Clone-for-Retained<T>].
/// - [`IsAllocableAnyThread`] -> [`ClassType::alloc`].
///
///
/// # Safety notice
///
/// When declaring classes, it is recommended that you wrap your instance
/// variables in [`Cell`], [`RefCell`], atomics or other similar interior
/// mutability abstractions to allow mutating your instance variables through
/// `&self`.
///
/// Declared classes that use this cannot take `&mut self`, except in
/// initializers.
///
/// [`Cell`]: core::cell::Cell
/// [`RefCell`]: core::cell::RefCell
#[derive(Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash, Debug)]
pub struct InteriorMutable {
    inner: Never,
}

/// Marker type for classes that are only safe to use from the main thread.
///
/// This is effectively the same as [`InteriorMutable`], except that classes
/// that specify this are only allowed to be used from the main thread, and
/// hence are not [`IsAllocableAnyThread`].
///
/// This is commonly used in GUI code like `AppKit` and `UIKit`, e.g.
/// `UIWindow` is only usable from the application's main thread.
///
/// It is unsound to implement [`Send`] or [`Sync`] on a type with this
/// mutability.
///
/// Functionality that is provided with this:
/// - [`IsRetainable`] -> [`ClassType::retain`].
/// - [`IsIdCloneable`] -> [`Retained::clone`][crate::rc::Retained#impl-Clone-for-Retained<T>].
/// - [`IsMainThreadOnly`] -> `MainThreadMarker::from`.
//
// While Xcode's Main Thread Checker doesn't report `alloc` and `dealloc` as
// unsafe from other threads, things like `NSView` and `NSWindow` still do a
// non-trivial amount of stuff on `dealloc`, even if the object is freshly
// `alloc`'d - so let's disallow that to be sure.
//
// This also has the nice property that `Allocated<T>` is guaranteed to be
// allowed to initialize on the current thread.
#[derive(Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash, Debug)]
pub struct MainThreadOnly {
    inner: Never,
}

mod private_traits {
    pub trait Sealed {}
}

impl<T: ?Sized + ClassType> private_traits::Sealed for T {}
impl<P: ?Sized> private_traits::Sealed for ProtocolObject<P> {}
impl private_traits::Sealed for AnyObject {}

/// Marker trait for classes where [`Retained::clone`] / [`Id::clone`] is safe.
///
/// Since the `Foundation` collection types (`NSArray<T>`,
/// `NSDictionary<K, V>`, ...) act as if they store [`Retained`]s, this also
/// makes certain functionality on those types possible.
///
/// This is implemented for classes whose [`ClassType::Mutability`] is one of:
/// - [`Root`].
/// - [`Immutable`].
/// - [`ImmutableWithMutableSubclass`].
/// - [`InteriorMutable`].
/// - [`MainThreadOnly`].
///
/// [`Retained`]: crate::rc::Retained
/// [`Retained::clone`]: crate::rc::Retained#impl-Clone-for-Retained<T>
/// [`Id::clone`]: crate::rc::Retained#impl-Clone-for-Retained<T>
///
///
/// # Safety
///
/// This is a sealed trait, and should not need to be implemented. Open an
/// issue if you know a use-case where this restrition should be lifted!
pub unsafe trait IsIdCloneable: private_traits::Sealed {}

trait MutabilityIsIdCloneable: Mutability {}
impl MutabilityIsIdCloneable for Root {}
impl MutabilityIsIdCloneable for Immutable {}
impl<MS: ?Sized> MutabilityIsIdCloneable for ImmutableWithMutableSubclass<MS> {}
impl MutabilityIsIdCloneable for InteriorMutable {}
impl MutabilityIsIdCloneable for MainThreadOnly {}

unsafe impl<T: ?Sized + ClassType> IsIdCloneable for T where T::Mutability: MutabilityIsIdCloneable {}
unsafe impl<P: ?Sized + IsIdCloneable> IsIdCloneable for ProtocolObject<P> {}
// SAFETY: Same as for root classes.
unsafe impl IsIdCloneable for AnyObject {}

/// Marker trait for classes where the `retain` selector is always safe.
///
/// [`Retained::clone`] takes `&Retained<T>`, while [`ClassType::retain`] only
/// takes `&T`; the difference between these two is that in the former case,
/// you know that there are no live mutable subclasses.
///
/// This is implemented for classes whose [`ClassType::Mutability`] is one of:
/// - [`Immutable`].
/// - [`InteriorMutable`].
/// - [`MainThreadOnly`].
///
/// This trait inherits [`IsIdCloneable`], so if a function is bound by this,
/// functionality given with that trait is available.
///
/// [`Retained::clone`]: crate::rc::Retained#impl-Clone-for-Retained<T>
///
///
/// # Safety
///
/// This is a sealed trait, and should not need to be implemented. Open an
/// issue if you know a use-case where this restrition should be lifted!
pub unsafe trait IsRetainable: private_traits::Sealed + IsIdCloneable {}

trait MutabilityIsRetainable: MutabilityIsIdCloneable {}
impl MutabilityIsRetainable for Immutable {}
impl MutabilityIsRetainable for InteriorMutable {}
impl MutabilityIsRetainable for MainThreadOnly {}

unsafe impl<T: ?Sized + ClassType> IsRetainable for T where T::Mutability: MutabilityIsRetainable {}
unsafe impl<P: ?Sized + IsRetainable> IsRetainable for ProtocolObject<P> {}

/// Marker trait for classes that can be allocated from any thread.
///
/// This is implemented for classes whose [`ClassType::Mutability`] is one of:
/// - [`Root`].
/// - [`Immutable`].
/// - [`Mutable`].
/// - [`ImmutableWithMutableSubclass`].
/// - [`MutableWithImmutableSuperclass`].
/// - [`InteriorMutable`].
///
///
/// # Safety
///
/// This is a sealed trait, and should not need to be implemented. Open an
/// issue if you know a use-case where this restrition should be lifted!
pub unsafe trait IsAllocableAnyThread: private_traits::Sealed {}

trait MutabilityIsAllocableAnyThread: Mutability {}
impl MutabilityIsAllocableAnyThread for Root {}
impl MutabilityIsAllocableAnyThread for Immutable {}
impl MutabilityIsAllocableAnyThread for Mutable {}
impl<MS: ?Sized> MutabilityIsAllocableAnyThread for ImmutableWithMutableSubclass<MS> {}
impl<IS: ?Sized> MutabilityIsAllocableAnyThread for MutableWithImmutableSuperclass<IS> {}
impl MutabilityIsAllocableAnyThread for InteriorMutable {}

unsafe impl<T: ?Sized + ClassType> IsAllocableAnyThread for T where
    T::Mutability: MutabilityIsAllocableAnyThread
{
}
unsafe impl<P: ?Sized + IsAllocableAnyThread> IsAllocableAnyThread for ProtocolObject<P> {}

/// Marker trait for classes that may feasibly be used behind a mutable
/// reference.
///
/// This trait exist mostly to disallow using `&mut self` when declaring
/// classes, since that would be a huge footgun.
///
/// This is implemented for classes whose [`ClassType::Mutability`] is one of:
/// - [`Root`]
/// - [`Mutable`]
/// - [`ImmutableWithMutableSubclass`]
/// - [`MutableWithImmutableSuperclass`]
///
///
/// # Safety
///
/// This is a sealed trait, and should not need to be implemented. Open an
/// issue if you know a use-case where this restrition should be lifted!
pub unsafe trait IsAllowedMutable: private_traits::Sealed {}

trait MutabilityIsAllowedMutable: Mutability {}
impl MutabilityIsAllowedMutable for Root {}
impl MutabilityIsAllowedMutable for Mutable {}
impl<MS: ?Sized> MutabilityIsAllowedMutable for ImmutableWithMutableSubclass<MS> {}
impl<IS: ?Sized> MutabilityIsAllowedMutable for MutableWithImmutableSuperclass<IS> {}

unsafe impl<T: ?Sized + ClassType> IsAllowedMutable for T where
    T::Mutability: MutabilityIsAllowedMutable
{
}
unsafe impl<P: ?Sized + IsAllowedMutable> IsAllowedMutable for ProtocolObject<P> {}
// SAFETY: Same as for root classes.
unsafe impl IsAllowedMutable for AnyObject {}

/// Marker trait for classes that are only mutable through `&mut`.
///
/// This is implemented for classes whose [`ClassType::Mutability`] is one of:
/// - [`Mutable`]
/// - [`MutableWithImmutableSuperclass`]
///
/// Notably, [`InteriorMutable`] does not implement this (though it is
/// technically mutable), since it is allowed to mutate through shared
/// references.
///
/// This trait inherits [`IsAllowedMutable`], so if a function is bound by
/// this, functionality given with that trait is available.
///
///
/// # Safety
///
/// This is a sealed trait, and should not need to be implemented. Open an
/// issue if you know a use-case where this restrition should be lifted!
pub unsafe trait IsMutable: private_traits::Sealed + IsAllowedMutable {}

trait MutabilityIsMutable: MutabilityIsAllowedMutable {}
impl MutabilityIsMutable for Mutable {}
impl<IS: ?Sized> MutabilityIsMutable for MutableWithImmutableSuperclass<IS> {}

unsafe impl<T: ?Sized + ClassType> IsMutable for T where T::Mutability: MutabilityIsMutable {}
unsafe impl<P: ?Sized + IsMutable> IsMutable for ProtocolObject<P> {}

/// Marker trait for classes that are only available on the main thread.
///
/// This is implemented for classes whose [`ClassType::Mutability`] is one of:
/// - [`MainThreadOnly`].
///
/// Since `MainThreadOnly` types must be `!Send` and `!Sync`, if you hold a
/// type that implements this trait, then you're guaranteed to be on the main
/// thread (and can get a `MainThreadMarker` using `MainThreadMarker::from`).
///
///
/// # Safety
///
/// This is a sealed trait, and should not need to be implemented. Open an
/// issue if you know a use-case where this restrition should be lifted!
pub unsafe trait IsMainThreadOnly: private_traits::Sealed {}

trait MutabilityIsMainThreadOnly: Mutability {}
impl MutabilityIsMainThreadOnly for MainThreadOnly {}

unsafe impl<T: ?Sized + ClassType> IsMainThreadOnly for T where
    T::Mutability: MutabilityIsMainThreadOnly
{
}
unsafe impl<P: ?Sized + IsMainThreadOnly> IsMainThreadOnly for ProtocolObject<P> {}

/// Marker trait for classes whose `hash` and `isEqual:` methods are stable.
///
/// This is useful for hashing collection types like `NSDictionary` and
/// `NSSet` which require that their keys never change.
///
/// This is implemented for classes whose [`ClassType::Mutability`] is one of:
/// - [`Immutable`].
/// - [`Mutable`].
/// - [`ImmutableWithMutableSubclass`].
/// - [`MutableWithImmutableSuperclass`].
///
/// Since all of these do not use interior mutability, and since the `hash`
/// and `isEqual:` methods are required to not use external sources like
/// thread locals or randomness to determine their result, we can guarantee
/// that the hash is stable for these types.
///
///
/// # Safety
///
/// This is a sealed trait, and should not need to be implemented. Open an
/// issue if you know a use-case where this restrition should be lifted!
//
// TODO: Exclude generic types like `NSArray<NSView>` from this!
pub unsafe trait HasStableHash: private_traits::Sealed {}

trait MutabilityHashIsStable: Mutability {}
impl MutabilityHashIsStable for Immutable {}
impl MutabilityHashIsStable for Mutable {}
impl<MS: ?Sized> MutabilityHashIsStable for ImmutableWithMutableSubclass<MS> {}
impl<IS: ?Sized> MutabilityHashIsStable for MutableWithImmutableSuperclass<IS> {}

unsafe impl<T: ?Sized + ClassType> HasStableHash for T where T::Mutability: MutabilityHashIsStable {}
unsafe impl<P: ?Sized + HasStableHash> HasStableHash for ProtocolObject<P> {}

/// Retrieve the immutable/mutable counterpart class, and fall back to `Self`
/// if not applicable.
///
/// This is used for describing the return type of `NSCopying` and
/// `NSMutableCopying`, since due to Rust trait limitations, those two can't
/// have associated types themselves (since we want to use them in
/// `ProtocolObject<dyn NSCopying>`).
///
///
/// # Usage notes
///
/// You may not rely on this being implemented entirely correctly for protocol
/// objects, since we have less type-information available there.
///
/// In particular, the immutable counterpart of a mutable object converted to
/// `ProtocolObject<dyn AProtocol>` may not itself implement the protocol, and
/// invalidly assuming it does is unsound.
///
/// All of this is to say: Do not use this trait in isolation, either require
/// `NSCopying` or `ClassType` along with it.
///
///
/// # Safety
///
/// This is a sealed trait, and should not need to be implemented. Open an
/// issue if you know a use-case where this restrition should be lifted!
pub unsafe trait CounterpartOrSelf: private_traits::Sealed {
    /// The immutable counterpart of the type, or `Self` if the type has no
    /// immutable counterpart.
    ///
    /// The implementation for `NSString` has itself (`NSString`) here, while
    /// `NSMutableString` instead has `NSString`.
    type Immutable: ?Sized + Message;

    /// The mutable counterpart of the type, or `Self` if the type has no
    /// mutable counterpart.
    ///
    /// The implementation for `NSString` has `NSMutableString` here, while
    /// `NSMutableString` has itself (`NSMutableString`).
    type Mutable: ?Sized + Message;
}

mod private_counterpart {
    use super::*;

    pub trait MutabilityCounterpartOrSelf<T: ?Sized>: Mutability {
        type Immutable: ?Sized + Message;
        type Mutable: ?Sized + Message;
    }
    impl<T: ClassType<Mutability = Root>> MutabilityCounterpartOrSelf<T> for Root {
        type Immutable = T;
        type Mutable = T;
    }
    impl<T: ClassType<Mutability = Immutable>> MutabilityCounterpartOrSelf<T> for Immutable {
        type Immutable = T;
        type Mutable = T;
    }
    impl<T: ClassType<Mutability = Mutable>> MutabilityCounterpartOrSelf<T> for Mutable {
        type Immutable = T;
        type Mutable = T;
    }
    impl<T, MS> MutabilityCounterpartOrSelf<T> for ImmutableWithMutableSubclass<MS>
    where
        T: ClassType<Mutability = ImmutableWithMutableSubclass<MS>>,
        MS: ClassType<Mutability = MutableWithImmutableSuperclass<T>>,
    {
        type Immutable = T;
        type Mutable = MS;
    }
    impl<T, IS> MutabilityCounterpartOrSelf<T> for MutableWithImmutableSuperclass<IS>
    where
        T: ClassType<Mutability = MutableWithImmutableSuperclass<IS>>,
        IS: ClassType<Mutability = ImmutableWithMutableSubclass<T>>,
    {
        type Immutable = IS;
        type Mutable = T;
    }
    impl<T: ClassType<Mutability = InteriorMutable>> MutabilityCounterpartOrSelf<T>
        for InteriorMutable
    {
        type Immutable = T;
        type Mutable = T;
    }
    impl<T: ClassType<Mutability = MainThreadOnly>> MutabilityCounterpartOrSelf<T> for MainThreadOnly {
        type Immutable = T;
        type Mutable = T;
    }
}

unsafe impl<T: ?Sized + ClassType> CounterpartOrSelf for T
where
    T::Mutability: private_counterpart::MutabilityCounterpartOrSelf<T>,
{
    type Immutable =
        <T::Mutability as private_counterpart::MutabilityCounterpartOrSelf<T>>::Immutable;
    type Mutable = <T::Mutability as private_counterpart::MutabilityCounterpartOrSelf<T>>::Mutable;
}

unsafe impl<P: ?Sized> CounterpartOrSelf for ProtocolObject<P> {
    // SAFETY: The only place where this would differ from `Self` is for
    // classes with `MutableWithImmutableSuperclass<IS>`.
    //
    // Superclasses are not in general required to implement the same traits
    // as their subclasses, but we're not dealing with normal classes, we're
    // dealing with with immutable/mutable class counterparts!
    //
    // We could probably get away with requiring that mutable classes
    // only implement the same protocols as their immutable counterparts, but
    // for now we relax the requirements of `CounterpartOrSelf`.
    type Immutable = Self;
    // SAFETY: The only place where this would differ from `Self` is for
    // classes with `ImmutableWithMutableSubclass<MS>`.
    //
    // But subclasses are required to always implement the same traits as
    // their superclasses, so a mutable subclass is required to implement the
    // same traits too.
    type Mutable = Self;
}

#[cfg(test)]
mod tests {
    use crate::runtime::NSObject;

    use super::*;

    use core::any::TypeId;
    use core::fmt;
    use core::hash;

    #[test]
    fn generic_traits() {
        fn assert_traits<T>()
        where
            T: Sync + Send,
            T: Clone + Copy + PartialEq + Eq + PartialOrd + Ord + hash::Hash + fmt::Debug,
        {
        }

        assert_traits::<Root>();
        assert_traits::<Immutable>();
        assert_traits::<Mutable>();
        assert_traits::<ImmutableWithMutableSubclass<()>>();
        assert_traits::<MutableWithImmutableSuperclass<()>>();
        assert_traits::<InteriorMutable>();
        assert_traits::<MainThreadOnly>();

        #[allow(unused)]
        fn test_mutability_implies_sized<M: ?Sized + Mutability>() {
            fn assert_sized<T: Sized>() {}
            assert_sized::<M>();
        }
    }

    #[test]
    fn counterpart_root() {
        assert_eq!(
            TypeId::of::<NSObject>(),
            TypeId::of::<<NSObject as CounterpartOrSelf>::Immutable>(),
        );
        assert_eq!(
            TypeId::of::<NSObject>(),
            TypeId::of::<<NSObject as CounterpartOrSelf>::Mutable>(),
        );
    }

    #[allow(unused, clippy::too_many_arguments)]
    fn object_safe(
        _: &dyn IsIdCloneable,
        _: &dyn IsRetainable,
        _: &dyn IsAllocableAnyThread,
        _: &dyn IsAllowedMutable,
        _: &dyn IsMutable,
        _: &dyn IsMainThreadOnly,
        _: &dyn HasStableHash,
        _: &dyn CounterpartOrSelf<Immutable = (), Mutable = ()>,
    ) {
    }
}