Make message Muts Send

protobuf-github-bot · copybara-github · commit 8bff944735fb · 2025-09-03T14:40:16.000-07:00
This was previously held back due to concerns about difficulty in supporting `mut splitting` apis, where an API could hand out simultaneous muts to 'disjoint' submessages, which is problematic.

We don't have mut splitting APIs today but now believe we could find a way to safely support it when we add it while allowing Muts to be Send, and so this does so now.

PiperOrigin-RevId: 802712451
diff --git a/rust/test/shared/BUILD b/rust/test/shared/BUILD
@@ -606,3 +606,31 @@ rust_test(
         "@crate_index//:googletest",
     ],
 )
+
+rust_test(
+    name = "threading_test_cpp",
+    srcs = ["threading_test.rs"],
+    aliases = {
+        "//rust:protobuf_cpp_export": "protobuf",
+    },
+    rustc_flags = ["--cfg=bzl"],
+    deps = [
+        "//rust:protobuf_cpp_export",
+        "//rust/test:unittest_cpp_rust_proto",
+        "@crate_index//:googletest",
+    ],
+)
+
+rust_test(
+    name = "threading_test_upb",
+    srcs = ["threading_test.rs"],
+    aliases = {
+        "//rust:protobuf_upb_export": "protobuf",
+    },
+    rustc_flags = ["--cfg=bzl"],
+    deps = [
+        "//rust:protobuf_upb_export",
+        "//rust/test:unittest_upb_rust_proto",
+        "@crate_index//:googletest",
+    ],
+)
diff --git a/rust/test/shared/threading_test.rs b/rust/test/shared/threading_test.rs
@@ -0,0 +1,45 @@
+// Protocol Buffers - Google's data interchange format
+// Copyright 2023 Google LLC.  All rights reserved.
+//
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file or at
+// https://developers.google.com/open-source/licenses/bsd
+
+#[cfg(not(bzl))]
+mod protos;
+#[cfg(not(bzl))]
+use protos::*;
+
+use googletest::prelude::*;
+
+use std::sync::{Arc, Mutex};
+use unittest_rust_proto::TestAllTypes;
+
+#[gtest]
+fn test_sending_owned_arc() {
+    let msg = Arc::new(Mutex::new(TestAllTypes::default()));
+
+    let msg_clone = Arc::clone(&msg);
+    let handle = std::thread::spawn(move || {
+        let mut locked_msg = msg_clone.lock().unwrap();
+        locked_msg.set_optional_int32(123);
+    });
+    handle.join().unwrap();
+
+    let locked_msg = msg.lock().unwrap();
+    assert_eq!(locked_msg.optional_int32(), 123);
+}
+
+#[gtest]
+fn test_sending_mut_scoped() {
+    let mut msg = TestAllTypes::default();
+
+    std::thread::scope(|scope| {
+        let mut child_mut = msg.optional_nested_message_mut();
+        scope.spawn(move || {
+            child_mut.set_bb(123);
+        });
+    });
+
+    assert_eq!(msg.optional_nested_message().bb(), 123);
+}
diff --git a/src/google/protobuf/compiler/rust/message.cc b/src/google/protobuf/compiler/rust/message.cc
@@ -741,10 +741,16 @@ void GenerateRs(Context& ctx, const Descriptor& msg, const upb::DefPool& pool) {
           $accessor_fns_for_muts$
         }
 
+        //~ Note that upb Arenas are not threadsafe but we mark `$Msg$Mut` as
+        //~ both Send and Sync.
+        //~ We currently ensure safety by designing the API to ensure that no two
+        //~ threads can hold a reference to MsgMuts with the same arena.
+        // SAFETY:
+        // - `$Msg$Mut` does not perform any shared mutation.
+        unsafe impl Send for $Msg$Mut<'_> {}
+
         // SAFETY:
         // - `$Msg$Mut` does not perform any shared mutation.
-        // - `$Msg$Mut` is not `Send`, and so even in the presence of mutator
-        //   splitting, synchronous access of an arena is impossible.
         unsafe impl Sync for $Msg$Mut<'_> {}
 
         impl<'msg> $pb$::Proxy<'msg> for $Msg$Mut<'msg> {}
