Coroutine/Future `Send` bounds are too restrictive when taking references to `!Sync` values

[ds84182]

I tried this code:

fn main() {
    let foo: &dyn Send = &async {
        let cell = &std::cell::Cell::new(1234);
        async {}.await;
        cell.set(5678);
    };
}

I expected to see this happen: Should compile successfully, like it does without the reference to Cell.

Instead, this happened: Compilation fails. Removing the intermediate reference to the Cell allows this to compile.

---

This is a fundamental limitation between Send and coroutine yield points. A Cell owned by a coroutine will not observe any data races as references to that Cell cannot (soundly) escape the coroutine across yield points. Yield points could use an alternative autotrait that represents "thread pinning".

[ds84182]

btw this also happens with coroutines (as expected):

#![feature(coroutines)]
#![feature(stmt_expr_attributes)]
fn main() {
    let foo: &dyn Send = &#[coroutine] static || {
        let cell = &std::cell::Cell::new(1234);
        yield ();
        cell.set(5678);
    };
}

imo this should be a showstopper for generators.

---

A theoretical thread pinning auto trait relies on the following to hold:

• Coroutine captures must be Send (owned by coroutine).
• Statics must be Send + Sync (owned by program, therefore references are Send).
• Owned coroutine values across a yield point must be Send (owned by coroutine).
• Leaked allocations (Box::leak) are Sync (owned by "program", therefore references are Send).

Therefore, all references within a coroutine must derive from these four sources. Two of these sources are from the coroutine itself (self-referential), and the other two are from statics.

We can then assert that all self-referential references are implicitly Send-ish. But I may be missing something.

[ds84182]

An attempt at a suitable auto trait. Definitely need some compiler intervention to impl !UnpinThread for all !Send since adding that blanket impl effectively disables the auto trait.

#![feature(negative_impls)]
#![feature(auto_traits)]
#![feature(marker_trait_attr)]
#![feature(negative_bounds)]

// Marker to decide whether a coroutine becomes `!Send` when owned `!Send` 
// values are used across yield points. References to `!Sync` values owned by
// the coroutine do not affect the sendability of the coroutine.
//
// This could be a trait alias for `!Send`, since the manual impls of `!Send`
// coincide with types that are _definitely not sendable_.
#[marker] auto trait UnpinThread {}

// This would be implied by !Send, if it were possible to do so.
impl<T: ?Sized> !UnpinThread for *const T {}
impl<T: ?Sized> !UnpinThread for *mut T {}
impl<T: ?Sized> !UnpinThread for std::sync::MutexGuard<'_, T> {}

// Represents a coroutine capture, which pins the thread when the capture isn't
// `Send`.
struct Capture<T: ?Sized>(T);
impl<T: ?Sized + Send> UnpinThread for Capture<T> {}

fn is_unpin<T>(_: T) where T: UnpinThread {}

fn fail_non_send() {
    let mutex = std::sync::Mutex::new(true);
    is_unpin(mutex.lock().unwrap()); // !Send
}

fn ok_basic_tests() {
    is_unpin(true);
    is_unpin(&std::cell::Cell::new(true));
}

fn ok_self_ref_to_non_sync_across_yield() {
    // OK: Thread is not pinned across await.
    is_unpin(async move {
        let cell = &std::cell::Cell::new(1234);
        async {}.await;
        cell.set(5678);
    });
}

fn fail_owned_non_send_across_yield() {
    is_unpin(async move {
        let mutex = std::sync::Mutex::new(1234);
        async {}.await;
        let mut guard = mutex.lock().unwrap();
        // ERR: Future cannot be sent between threads safely.
        async {}.await;
        *guard = 5678;
    });
}

fn fail_capture_non_send() {
    // Future does not impl UnpinThread. Cell is captured by-ref.
    let cell = std::cell::Cell::new(1234);
    let cell_ref = Capture(&cell);
    is_unpin(async move {
        let cell_ref = { cell_ref };
        cell_ref.0.set(5678);
    });
}