Clean up pointer use in BundleSpawner/BundleInserter

[james7132]

Objective

Following #10756, we're now using raw pointers in BundleInserter and BundleSpawner. This is primarily to get around the need to split the borrow on the World, but it leaves a lot to be desired in terms of safety guarantees. There's no type level guarantee the code can't dereference a null pointer, and it's restoring them to borrows fairly liberally within the associated functions.

Solution

• Replace the pointers with NonNull and a new bevy_ptr::ConstNonNull that only allows conversion back to read-only borrows
• Remove the closure to avoid potentially aliasing through the closure by restructuring the match expression.
• Move all conversions back into borrows as far up as possible to ensure that the borrow checker is at least locally followed.

[github-actions]

You added a new example but didn't add metadata for it. Please update the root Cargo.toml file.

[james-j-obrien]

Looks reasonable to me.

[JoJoJet]

Definitely seems like an improvement

I wonder if it would make more sense for bevy_ptr's non-null API to look more like a typed version of bevy_ptr::Ptr

pub struct NonNull<'a, T> {
    ptr: NonNull<T>,
    _ref: PhantomData<&'a T>,
}
pub struct NonNullMut<'a, T> {
    ptr: NonNull<T>,
    _ref: PhantomData<&'a mut T>,
}

This should allow us to enforce at compile time that the data is initialized and aligned and valid for reads/writes, so to dereference it you'd just need to guarantee there's no aliasing

[james7132]

I wonder if it would make more sense for bevy_ptr's non-null API to look more like a typed version of bevy_ptr::Ptr

Isn't that just &'a T and &'a mut T? The way I view it is that borrows are lifetimed, mutability-locked, aligned, and strongly typed pointers, and bevy_ptr tries to fill the gap between *mut () and &'a T by dropping one or more of the constraints on borrows.

[JoJoJet]

Isn't that just &'a T and &'a mut T?

I see it as an &'a mut T with the aliasing requirement lifted -- but I guess that's just &'a UnsafeCell<T>

[alice-i-cecile]

CI is failing still <3