...Guard::new should be unsafe and leak should not be about winsafe HOT 2 CLOSED

The unsafe markings on the new (introduced in commit 06fc8d3) and leak (introduced in commit 38a8884) methods for the ...Guard structs (e.g. in gdi/guard.rs and macros/handles.rs) are backwards from what they should be, as far as I can tell.

For example, doing this requires no unsafe block but causes a double-free:

let handle: GdiObject = …;
drop(GdiObjectGuard::new(handle));
drop(GdiObjectGuard::new(handle));

As far as I remember, the handles that can be wrapped in guards cannot be created at will (at least not safely), as shown in the first line. They are returned from functions already in guards. Can you show me a concrete example where this double free will happen?

In contrast, resource leaks are not considered unsafe: https://github.com/rust-lang/rfcs/blob/master/text/1066-safe-mem-forget.md, https://stackoverflow.com/questions/56107324/why-does-rust-consider-it-safe-to-leak-memory, https://stackoverflow.com/questions/55553048/is-it-possible-to-cause-a-memory-leak-in-rust, https://brson.github.io/rust-anthology/1/memory-leaks-are-memory-safe.html, https://doc.rust-lang.org/nomicon/leaking.html, https://www.reddit.com/r/rust/comments/xd1ial/im_i_the_only_one_who_doesnt_like_boxleak_being/, https://cglab.ca/%7Eabeinges/blah/everyone-poops/

Now this is very unsettling:^source

Memory leaks do not trigger Undefined Behavior, and therefore are safe.

I must say I'm baffled, but I must abide. I will remove all the unsafe notations from the leak methods (it will hurt).

from winsafe.

As far as I remember, the handles that can be wrapped in guards cannot be created at will (at least not safely), as shown in the first line. They are returned from functions already in guards.

Yeah, it looks like every function that returns a handle either wraps it in a guard or is marked unsafe, so I guess that should be fine then. I didn't think to check for that.

Now this is very unsettling:^source

Memory leaks do not trigger Undefined Behavior, and therefore are safe.

I must say I'm baffled, but I must abide. I will remove all the unsafe notations from the leak methods (it will hurt).

Yeah, sorry to break the bad news.

from winsafe.