looper: Require Send when adding fd event callbacks on ForeignLooper

`ForeignLooper` allows (re)registering callbacks on threads that are not
the `ThreadLooper` (current) thread.  Since these calls will be executed
on that `ThreadLooper` thread when the user calls any of the `poll()`
functions, these closures have to pass a thread boundary which requires
`Send`.

Author: MarijnS95

ndk/CHANGELOG.md

@@ -2,6 +2,7 @@
 
 - Move `MediaFormat` from `media::media_codec` to its own `media::media_format` module. (#442)
 - media_format: Expose `MediaFormat::copy()` and `MediaFormat::clear()` from API level 29. (#449)
+- looper: Require `Send` marker when adding fd event callbacks on `ForeignLooper`. (#469)
 
 # 0.8.0 (2023-10-15)
 

ndk/src/looper.rs

@@ -209,6 +209,71 @@ impl ThreadLooper {
         )
     }
 
+    /// Adds a file descriptor to be polled, with a callback that is invoked when any of the
+    /// [`FdEvent`]s described in `events` is triggered.
+    ///
+    /// The callback receives the file descriptor it is associated with and a bitmask of the poll
+    /// events that were triggered (typically [`FdEvent::INPUT`]).  It should return [`true`] to
+    /// continue receiving callbacks, or [`false`] to have the callback unregistered.
+    ///
+    /// See also [the NDK
+    /// docs](https://developer.android.com/ndk/reference/group/looper.html#alooper_addfd).
+    ///
+    /// Note that this will leak a [`Box`] unless the callback returns [`false`] to unregister
+    /// itself.
+    ///
+    /// # Threading
+    /// This function will be called on the current thread when this [`ThreadLooper`] is
+    /// polled. A callback can also be registered from other threads via the equivalent
+    /// [`ThreadLooper::add_fd_with_callback()`] function, which requires a [`Send`] bound.
+    ///
+    /// # Safety
+    /// The caller should guarantee that this file descriptor stays open until it is removed via
+    /// [`remove_fd()`][Self::remove_fd()] or by returning [`false`] from the callback, and for
+    /// however long the caller wishes to use this file descriptor inside and after the callback.
+    #[doc(alias = "ALooper_addFd")]
+    pub fn add_fd_with_callback<F: FnMut(BorrowedFd<'_>, FdEvent) -> bool>(
+        &self,
+        fd: BorrowedFd<'_>,
+        events: FdEvent,
+        callback: F,
+    ) -> Result<(), LooperError> {
+        // let callback = unsafe { std::mem::transmute(callback) };
+        // self.foreign.add_fd_with_callback(fd, events, callback)
+        extern "C" fn cb_handler<F: FnMut(BorrowedFd<'_>, FdEvent) -> bool>(
+            fd: RawFd,
+            events: i32,
+            data: *mut c_void,
+        ) -> i32 {
+            abort_on_panic(|| unsafe {
+                let mut cb = ManuallyDrop::new(Box::<F>::from_raw(data as *mut _));
+                let events = FdEvent::from_bits_retain(
+                    events.try_into().expect("Unexpected sign bit in `events`"),
+                );
+                let keep_registered = cb(BorrowedFd::borrow_raw(fd), events);
+                if !keep_registered {
+                    ManuallyDrop::into_inner(cb);
+                }
+                keep_registered as i32
+            })
+        }
+        let data = Box::into_raw(Box::new(callback)) as *mut _;
+        match unsafe {
+            ffi::ALooper_addFd(
+                self.as_foreign().ptr.as_ptr(),
+                fd.as_raw_fd(),
+                ffi::ALOOPER_POLL_CALLBACK,
+                events.bits() as i32,
+                Some(cb_handler::<F>),
+                data,
+            )
+        } {
+            1 => Ok(()),
+            -1 => Err(LooperError),
+            _ => unreachable!(),
+        }
+    }
+
     /// Returns a reference to the [`ForeignLooper`] that is associated with the current thread.
     pub fn as_foreign(&self) -> &ForeignLooper {
         &self.foreign
@@ -311,9 +376,11 @@ impl ForeignLooper {
         }
     }
 
-    /// Adds a file descriptor to be polled, with a callback.
+    /// Adds a file descriptor to be polled, with a callback that is invoked when any of the
+    /// [`FdEvent`]s described in `events` is triggered.
     ///
-    /// The callback takes as an argument the file descriptor, and should return [`true`] to
+    /// The callback receives the file descriptor it is associated with and a bitmask of the poll
+    /// events that were triggered (typically [`FdEvent::INPUT`]).  It should return [`true`] to
     /// continue receiving callbacks, or [`false`] to have the callback unregistered.
     ///
     /// See also [the NDK
@@ -322,18 +389,23 @@ impl ForeignLooper {
     /// Note that this will leak a [`Box`] unless the callback returns [`false`] to unregister
     /// itself.
     ///
+    /// # Threading
+    /// This function will be called on the looper thread where and when it is polled.
+    /// For registering callbacks without [`Send`] requirement, call the equivalent
+    /// [`ThreadLooper::add_fd_with_callback()`] function on the Looper thread.
+    ///
     /// # Safety
     /// The caller should guarantee that this file descriptor stays open until it is removed via
     /// [`remove_fd()`][Self::remove_fd()] or by returning [`false`] from the callback, and for
     /// however long the caller wishes to use this file descriptor inside and after the callback.
     #[doc(alias = "ALooper_addFd")]
-    pub fn add_fd_with_callback<F: FnMut(BorrowedFd<'_>, FdEvent) -> bool>(
+    pub fn add_fd_with_callback<F: FnMut(BorrowedFd<'_>, FdEvent) -> bool + Send>(
         &self,
         fd: BorrowedFd<'_>,
         events: FdEvent,
         callback: F,
     ) -> Result<(), LooperError> {
-        extern "C" fn cb_handler<F: FnMut(BorrowedFd<'_>, FdEvent) -> bool>(
+        extern "C" fn cb_handler<F: FnMut(BorrowedFd<'_>, FdEvent) -> bool + Send>(
             fd: RawFd,
             events: i32,
             data: *mut c_void,