Remove unsafe from hal::BufferBinding::new_unchecked

wgpu-core/src/command/bundle.rs

@@ -964,11 +964,9 @@ impl RenderBundle {
                     size,
                 } => {
                     let buffer = buffer.try_raw(snatch_guard)?;
-                    let bb = unsafe {
+                    // SAFETY: The binding size was checked against the buffer size
-                        // SAFETY: The binding size was checked against the buffer size
+                    // in `set_index_buffer` and again in `IndexState::flush`.
-                        // in `set_index_buffer` and again in `IndexState::flush`.
+                    let bb = hal::BufferBinding::new_unchecked(buffer, *offset, *size);
-                        hal::BufferBinding::new_unchecked(buffer, *offset, *size)
-                    };
                     unsafe { raw.set_index_buffer(bb, *index_format) };
                 }
                 Cmd::SetVertexBuffer {
@@ -978,11 +976,9 @@ impl RenderBundle {
                     size,
                 } => {
                     let buffer = buffer.try_raw(snatch_guard)?;
-                    let bb = unsafe {
+                    // SAFETY: The binding size was checked against the buffer size
-                        // SAFETY: The binding size was checked against the buffer size
+                    // in `set_vertex_buffer` and again in `VertexState::flush`.
-                        // in `set_vertex_buffer` and again in `VertexState::flush`.
+                    let bb = hal::BufferBinding::new_unchecked(buffer, *offset, *size);
-                        hal::BufferBinding::new_unchecked(buffer, *offset, *size)
-                    };
                     unsafe { raw.set_vertex_buffer(*slot, bb) };
                 }
                 Cmd::SetPushConstant {

wgpu-core/src/indirect_validation/dispatch.rs

@@ -232,10 +232,12 @@ impl Dispatch {
                 resource_index: 0,
                 count: 1,
             }],
-            buffers: &[unsafe {
+            // SAFETY: We just created the buffer with this size.
-                // SAFETY: We just created the buffer with this size.
+            buffers: &[hal::BufferBinding::new_unchecked(
-                hal::BufferBinding::new_unchecked(dst_buffer.as_ref(), 0, Some(DST_BUFFER_SIZE))
+                dst_buffer.as_ref(),
-            }],
+                0,
+                Some(DST_BUFFER_SIZE),
+            )],
             samplers: &[],
             textures: &[],
             acceleration_structures: &[],
@@ -277,10 +279,8 @@ impl Dispatch {
                 resource_index: 0,
                 count: 1,
             }],
-            buffers: &[unsafe {
+            // SAFETY: We calculated the binding size to fit within the buffer.
-                // SAFETY: We calculated the binding size to fit within the buffer.
+            buffers: &[hal::BufferBinding::new_unchecked(buffer, 0, binding_size)],
-                hal::BufferBinding::new_unchecked(buffer, 0, binding_size)
-            }],
             samplers: &[],
             textures: &[],
             acceleration_structures: &[],

wgpu-core/src/indirect_validation/draw.rs

@@ -135,10 +135,8 @@ impl Draw {
                 resource_index: 0,
                 count: 1,
             }],
-            buffers: &[unsafe {
+            // SAFETY: We calculated the binding size to fit within the buffer.
-                // SAFETY: We calculated the binding size to fit within the buffer.
+            buffers: &[hal::BufferBinding::new_unchecked(buffer, 0, binding_size)],
-                hal::BufferBinding::new_unchecked(buffer, 0, binding_size)
-            }],
             samplers: &[],
             textures: &[],
             acceleration_structures: &[],
@@ -683,10 +681,12 @@ fn create_buffer_and_bind_group(
             resource_index: 0,
             count: 1,
         }],
-        buffers: &[unsafe {
+        // SAFETY: We just created the buffer with this size.
-            // SAFETY: We just created the buffer with this size.
+        buffers: &[hal::BufferBinding::new_unchecked(
-            hal::BufferBinding::new_unchecked(buffer.as_ref(), 0, BUFFER_SIZE)
+            buffer.as_ref(),
-        }],
+            0,
+            BUFFER_SIZE,
+        )],
         samplers: &[],
         textures: &[],
         acceleration_structures: &[],

wgpu-core/src/resource.rs

@@ -562,14 +562,12 @@ impl Buffer {
     ) -> Result<(hal::BufferBinding<'a, dyn hal::DynBuffer>, u64), BindingError> {
         let buf_raw = self.try_raw(snatch_guard)?;
         let resolved_size = self.resolve_binding_size(offset, binding_size)?;
-        unsafe {
+        // SAFETY: The offset and size passed to hal::BufferBinding::new_unchecked must
-            // SAFETY: The offset and size passed to hal::BufferBinding::new_unchecked must
+        // define a binding contained within the buffer.
-            // define a binding contained within the buffer.
+        Ok((
-            Ok((
+            hal::BufferBinding::new_unchecked(buf_raw, offset, binding_size),
-                hal::BufferBinding::new_unchecked(buf_raw, offset, binding_size),
+            resolved_size,
-                resolved_size,
+        ))
-            ))
-        }
     }
 
     /// Returns the mapping callback in case of error so that the callback can be fired outside

wgpu-hal/examples/halmark/main.rs

@@ -447,14 +447,12 @@ impl<A: hal::Api> Example<A> {
         let texture_view = unsafe { device.create_texture_view(&texture, &view_desc).unwrap() };
 
         let global_group = {
-            let global_buffer_binding = unsafe {
+            // SAFETY: This is the same size that was specified for buffer creation.
-                // SAFETY: This is the same size that was specified for buffer creation.
+            let global_buffer_binding = hal::BufferBinding::new_unchecked(
-                hal::BufferBinding::new_unchecked(
+                &global_buffer,
-                    &global_buffer,
+                0,
-                    0,
+                NonZeroU64::new(global_buffer_desc.size),
-                    NonZeroU64::new(global_buffer_desc.size),
+            );
-                )
-            };
             let texture_binding = hal::TextureBinding {
                 view: &texture_view,
                 usage: wgpu_types::TextureUses::RESOURCE,
@@ -488,14 +486,12 @@ impl<A: hal::Api> Example<A> {
         };
 
         let local_group = {
-            let local_buffer_binding = unsafe {
+            // SAFETY: The size must fit within the buffer.
-                // SAFETY: The size must fit within the buffer.
+            let local_buffer_binding = hal::BufferBinding::new_unchecked(
-                hal::BufferBinding::new_unchecked(
+                &local_buffer,
-                    &local_buffer,
+                0,
-                    0,
+                wgpu_types::BufferSize::new(size_of::<Locals>() as _),
-                    wgpu_types::BufferSize::new(size_of::<Locals>() as _),
+            );
-                )
-            };
             let local_group_desc = hal::BindGroupDescriptor {
                 label: Some("local"),
                 layout: &local_group_layout,

wgpu-hal/src/lib.rs

@@ -2098,7 +2098,7 @@ impl<'a, B: DynBuffer + ?Sized> BufferBinding<'a, B> {
     /// pass a zero size. When the zero-size binding issue is resolved, the
     /// argument should just match the type of the member.
     /// TODO(<https://github.com/gfx-rs/wgpu/issues/3170>): remove the parameter
-    pub unsafe fn new_unchecked<S: Into<Option<NonZeroU64>>>(
+    pub fn new_unchecked<S: Into<Option<NonZeroU64>>>(
         buffer: &'a B,
         offset: wgt::BufferAddress,
         size: S,