Update objects ABI to match 0.28.0

SafeHandle is used to manage ownership of the Rust object. When
SafeHandle goes out of scope, the underlying Rust reference is
decremented. Method calls and lowering increment ("clone") object
reference, and Rust is responsible for decrementing the reference. This
means, it's not necessary to use SafeHandle directly for method calls
and lowering, since Rust will take care of decrementing the reference.

However, it's still necessary to use SafeHandle for "cloning" the
reference, since CG may choose to collect the object itself and run the
finalizer, in turn decrementing Rust reference and causing
use-after-free during "clone" native call. (See SafeHandle
documentation).

bindgen/src/gen_cs/mod.rs

@@ -367,7 +367,7 @@ impl CsCodeOracle {
             FfiType::UInt8 => "byte".to_string(),
             FfiType::Float32 => "float".to_string(),
             FfiType::Float64 => "double".to_string(),
-            FfiType::RustArcPtr(name) => format!("{}SafeHandle", name),
+            FfiType::RustArcPtr(_) => "IntPtr".to_string(),
             FfiType::RustBuffer(_) => "RustBuffer".to_string(),
             FfiType::ForeignBytes => "ForeignBytes".to_string(),
             FfiType::Callback(name) => self.ffi_callback_name(name),

bindgen/templates/ObjectRuntime.cs

@@ -6,6 +6,16 @@
 // method will only be called once, once all outstanding native calls have completed.
 // https://github.com/mozilla/uniffi-rs/blob/0dc031132d9493ca812c3af6e7dd60ad2ea95bf0/uniffi_bindgen/src/bindings/kotlin/templates/ObjectRuntime.kt#L31
 // https://learn.microsoft.com/en-us/dotnet/api/system.runtime.interopservices.criticalhandle
+//
+// SafeHandle is used to manage ownership of the Rust object. When SafeHandle goes out of scope,
+// the underlying Rust reference is decremented. Method calls and lowering increment ("clone")
+// object reference, and Rust is responsible for decrementing the reference. This means, it's not
+// necessary to use SafeHandle directly for method calls and lowering, since Rust will take care
+// of decrementing the reference.
+//
+// However, it's still necessary to use SafeHandle for "cloning" the reference, since CG may choose
+// to collect the object itself and run the finalizer, in turn decrementing Rust reference and
+// causing use-after-free during "clone" native call. (See SafeHandle documentation).
 
 {{ config.access_modifier() }} abstract class FFIObject<THandle>: IDisposable where THandle : FFISafeHandle {
     private THandle handle;
@@ -36,18 +46,6 @@ public override bool IsInvalid {
             return handle.ToInt64() == 0;
         }
     }
-
-    // TODO(CS) this completely breaks any guarantees offered by SafeHandle.. Extracting
-    // raw value from SafeHandle puts responsiblity on the consumer of this function to
-    // ensure that SafeHandle outlives the stream, and anyone who might have read the raw
-    // value from the stream and are holding onto it. Otherwise, the result might be a use
-    // after free, or free while method calls are still in flight.
-    //
-    // This is also relevant for Kotlin.
-    //
-    public IntPtr DangerousGetRawFfiValue() {
-        return handle;
-    }
 }
 
 static class FFIObjectUtil {

bindgen/templates/ObjectTemplate.cs

@@ -30,7 +30,7 @@ override protected bool ReleaseHandle() {
 
 {%- call cs::docstring(obj, 0) %}
 {{ config.access_modifier() }} class {{ type_name }}: FFIObject<{{ safe_handle_type }}>, I{{ type_name }} {
-    public {{ type_name }}({{ safe_handle_type }} pointer): base(pointer) {}
+    public {{ type_name }}(IntPtr pointer): base(new {{ safe_handle_type }}(pointer)) {}
 
     {%- match obj.primary_constructor() %}
     {%- when Some with (cons) %}
@@ -47,12 +47,12 @@ override protected bool ReleaseHandle() {
 
     {%- when Some with (return_type) %}
     public {{ return_type|type_name(ci) }} {{ meth.name()|fn_name }}({% call cs::arg_list_decl(meth) %}) {
-        return {{ return_type|lift_fn }}({%- call cs::to_ffi_call_with_prefix("this.GetHandle()", meth) %});
+        return {{ return_type|lift_fn }}({%- call cs::to_ffi_call_with_prefix("this._uniffiClonePointer()", meth) %});
     }
 
     {%- when None %}
     public void {{ meth.name()|fn_name }}({% call cs::arg_list_decl(meth) %}) {
-        {%- call cs::to_ffi_call_with_prefix("this.GetHandle()", meth) %};
+        {%- call cs::to_ffi_call_with_prefix("this._uniffiClonePointer()", meth) %};
     }
     {% endmatch %}
     {% endfor %}
@@ -61,7 +61,7 @@ override protected bool ReleaseHandle() {
     {%- match tm %}
     {%- when UniffiTrait::Display { fmt } %}
     public override string ToString() {
-        return {{ Type::String.borrow()|lift_fn }}({%- call cs::to_ffi_call_with_prefix("this.GetHandle()", fmt) %});
+        return {{ Type::String.borrow()|lift_fn }}({%- call cs::to_ffi_call_with_prefix("this._uniffiClonePointer()", fmt) %});
     }
     {%- else %}
     {%- endmatch %}
@@ -76,28 +76,34 @@ public override string ToString() {
     }
     {% endfor %}
     {% endif %}
+
+    public IntPtr _uniffiClonePointer() {
+        return _UniffiHelpers.RustCall((ref UniffiRustCallStatus status) => {
+            return _UniFFILib.{{ obj.ffi_object_clone().name() }}(this.GetHandle(), ref status);
+        });
+    }
 }
 
-class {{ obj|ffi_converter_name }}: FfiConverter<{{ type_name }}, {{ safe_handle_type }}> {
+class {{ obj|ffi_converter_name }}: FfiConverter<{{ type_name }}, IntPtr> {
     public static {{ obj|ffi_converter_name }} INSTANCE = new {{ obj|ffi_converter_name }}();
 
-    public override {{ safe_handle_type }} Lower({{ type_name }} value) {
-        return value.GetHandle();
+    public override IntPtr Lower({{ type_name }} value) {
+        return value._uniffiClonePointer();
     }
 
-    public override {{ type_name }} Lift({{ safe_handle_type }} value) {
+    public override {{ type_name }} Lift(IntPtr value) {
         return new {{ type_name }}(value);
     }
 
     public override {{ type_name }} Read(BigEndianStream stream) {
-        return Lift(new {{ safe_handle_type }}(new IntPtr(stream.ReadLong())));
+        return Lift(new IntPtr(stream.ReadLong()));
     }
 
     public override int AllocationSize({{ type_name }} value) {
         return 8;
     }
 
     public override void Write({{ type_name }} value, BigEndianStream stream) {
-        stream.WriteLong(Lower(value).DangerousGetRawFfiValue().ToInt64());
+        stream.WriteLong(Lower(value).ToInt64());
     }
 }

bindgen/templates/macros.cs

@@ -65,8 +65,8 @@
 // Note unfiltered name but ffi_type_name filters.
 -#}
 {%- macro arg_list_ffi_decl(func) %}
-    {%- if func.is_object_free_function() %}
-    IntPtr ptr,
+    {%- if func.is_object_clone_function() %}
+    SafeHandle ptr,
     {%- if func.has_rust_call_status_arg() %}ref UniffiRustCallStatus _uniffi_out_err{% endif %}
     {%- else %}
     {%- call arg_list_ffi_decl_xx(func) %}