RAII for `Limits.max_alloc` about image HOT 4 OPEN

I'll work on adding limits to animation decoders such as GIF using the existing API, then see if there's any benefit to changing it once we have more internal use of the Limits.reserve() API.

from image.

So I've prototyped the .reserved() design and I can't say it's particularly great: https://github.com/Shnatsel/image/tree/raii-limits

There seems to be no way to put #[must_use] on the returned Limits. So it's easy to assume the method mutates the instance of the Limits that you have when it actually doesn't. And I don't want to introduce a confusing API.

It is possible to put #[must_use] on Limits and enforce the use of the return value that way!

from image.

On Discord, moulins suggested enforcing stacking of Limits using a lifetime:

struct Limits<'a>(...);

impl<'a> Limit<'a> {
  #[must_use]
  pub fn reserved(&mut self, bytes: usize) -> ImageResult<Limits<'_>>;
}

from image.

I think it would be easier to think about this in the context of a specific decoder's use of the Limits object. For some decoders, all the actual allocations happen in a dependency and we simply use the value in limits to set the relevant parameter for that crate. In other cases, the allocation might happen in this crate but be on the heap and outlive the specific function that does the allocation.

One other thing from looking at the Limits struct is that I'm not particular sure why its methods are public in the first place? The main place you'd want to call them are from the implementations of decoders. But because decoders are generally either implemented within this crate or imported as dependencies (and thus would cause circular dependencies if their tried to use types from this crate) that doesn't really help.

from image.