Document unsafe contracts and stop reusing poisoned state

compositor/src/render/corner_tests.rs

@@ -197,7 +197,11 @@ fn renderer() -> GlesRenderer {
         .into_iter()
         .find(|device| device.is_software() == software)
         .expect("the requested EGL device");
+    // SAFETY: The native display comes from a live enumerated EGLDevice and its lifetime is
+    // retained by the EGL objects created here.
     let display = unsafe { EGLDisplay::new(device).unwrap() };
+    // SAFETY: The fresh EGL context is exclusively owned by this renderer; this test issues GL
+    // work only through its renderer methods.
     unsafe { GlesRenderer::new(EGLContext::new(&display).unwrap()).unwrap() }
 }
 
@@ -207,6 +211,8 @@ fn window_corner_shader_timing_sample() {
     let mut renderer = renderer();
     let driver = renderer
         .with_context(|gl| {
+            // SAFETY: The current renderer context returns a live NUL-terminated GL_RENDERER
+            // string, copied before leaving with_context.
             unsafe { std::ffi::CStr::from_ptr(gl.GetString(0x1f01).cast()) }
                 .to_string_lossy()
                 .into_owned()

compositor/src/render/mod.rs

@@ -282,6 +282,9 @@ impl RenderElement<GlesRenderer> for BlurRenderElement {
         // clean captured scene. Recapturing a partly repainted framebuffer
         // would feed previous blurred pixels back into the blur.
         if self.capture_dirty.load(Ordering::Relaxed) {
+            // SAFETY: with_context makes this frame context current. GL writes into live local
+            // scalars, and the capture texture belongs to this renderer with the allocated
+            // framebuffer bounds.
             let error = frame.with_context(|gl| unsafe {
                 gl.GetError();
                 let mut framebuffer = 0;
@@ -690,8 +693,12 @@ mod tests {
             .unwrap()
             .last()
             .expect("an EGL device");
+        // SAFETY: The native display comes from a live enumerated EGLDevice and its lifetime is
+        // retained by the EGL objects created here.
         let display = unsafe { EGLDisplay::new(device).unwrap() };
         let context = EGLContext::new(&display).unwrap();
+        // SAFETY: The fresh EGL context is exclusively owned by this renderer; this test issues
+        // GL work only through its renderer methods.
         let mut renderer = unsafe { GlesRenderer::new(context).unwrap() };
         let program = renderer
             .compile_custom_pixel_shader(
@@ -755,8 +762,12 @@ mod tests {
             .unwrap()
             .last()
             .expect("an EGL device");
+        // SAFETY: The native display comes from a live enumerated EGLDevice and its lifetime is
+        // retained by the EGL objects created here.
         let display = unsafe { EGLDisplay::new(device).unwrap() };
         let context = EGLContext::new(&display).unwrap();
+        // SAFETY: The fresh EGL context is exclusively owned by this renderer; this test issues
+        // GL work only through its renderer methods.
         let mut renderer = unsafe { GlesRenderer::new(context).unwrap() };
         for source in [super::ROUNDED_TEXTURE_SHADER, super::BLUR_SHADER] {
             renderer
@@ -789,8 +800,12 @@ mod tests {
             .unwrap()
             .last()
             .expect("an EGL device");
+        // SAFETY: The native display comes from a live enumerated EGLDevice and its lifetime is
+        // retained by the EGL objects created here.
         let display = unsafe { EGLDisplay::new(device).unwrap() };
         let context = EGLContext::new(&display).unwrap();
+        // SAFETY: The fresh EGL context is exclusively owned by this renderer; this test issues
+        // GL work only through its renderer methods.
         let mut renderer = unsafe { GlesRenderer::new(context).unwrap() };
         let program = renderer
             .compile_custom_texture_shader(

compositor/src/render/resources.rs

@@ -258,8 +258,14 @@ mod tests {
             .unwrap()
             .last()
             .expect("an EGL device");
+        // SAFETY: The native display comes from a live enumerated EGLDevice and its lifetime is
+        // retained by the EGL objects created here.
         let display = unsafe { EGLDisplay::new(device).unwrap() };
+        // SAFETY: The fresh EGL context is exclusively owned by this renderer; this test issues
+        // GL work only through its renderer methods.
         let mut first = unsafe { GlesRenderer::new(EGLContext::new(&display).unwrap()).unwrap() };
+        // SAFETY: The fresh EGL context is exclusively owned by this renderer; this test issues
+        // GL work only through its renderer methods.
         let mut second = unsafe { GlesRenderer::new(EGLContext::new(&display).unwrap()).unwrap() };
         let first_id = first.context_id().erased();
         let second_id = second.context_id().erased();

compositor/src/render/shader.rs

@@ -175,8 +175,12 @@ mod tests {
             .unwrap()
             .last()
             .expect("an EGL device");
+        // SAFETY: The native display comes from a live enumerated EGLDevice and its lifetime is
+        // retained by the EGL objects created here.
         let display = unsafe { EGLDisplay::new(device).unwrap() };
         let mut renderer =
+            // SAFETY: The fresh EGL context is exclusively owned by this renderer; this test
+            // issues GL work only through its renderer methods.
             unsafe { GlesRenderer::new(EGLContext::new(&display).unwrap()).unwrap() };
         let program = renderer
             .compile_custom_pixel_shader(

compositor/src/render/window_content.rs

@@ -99,8 +99,12 @@ mod tests {
         use smithay::backend::egl::{EGLContext, EGLDevice, EGLDisplay};
         use smithay::output::{Mode, PhysicalProperties, Subpixel};
         let device = EGLDevice::enumerate().unwrap().last().expect("EGL device");
+        // SAFETY: The native display comes from a live enumerated EGLDevice and its lifetime is
+        // retained by the EGL objects created here.
         let display = unsafe { EGLDisplay::new(device).unwrap() };
         let context = EGLContext::new(&display).unwrap();
+        // SAFETY: The fresh EGL context is exclusively owned by this renderer; this test issues
+        // GL work only through its renderer methods.
         let mut renderer = unsafe { GlesRenderer::new(context).unwrap() };
         let output = Output::new(
             "snapshot-test".into(),