Consider checking returned enums for validity

[gkoz]

It might be a good idea to test if the enums we get from the other side have valid values. This could require using newtype c_int wrappers instead of enums in the sys layer and implementing conversions between that and Rust enums.

[EPashkin]

Note: there was long discussion about enums in gtk-rs/gdk#154

[EPashkin]

Problem:
While enum copy with FromGlib implementation was intended to fix this issue,
current implementation
actually don't fix it as wrong ffi-side enum values actually count as one of cases.
Also copying enum introduced enums with different layout from FFI-side enum and even different integer values for same name.

[EPashkin]

Solution 1.
Just rexport enums from FFI-side.
Proposed by @johncf. He even added PR for it #354.

[EPashkin]

Solution 2.
Stay with copy but change implementation to match integers. This way default branch with panic can be added.
Update: @sdroege proposed also add UNKNOWN case to all ffi enums too.

[EPashkin]

Solution 3.
gtk-rs/gdk#154 (comment)
Proposed by @GuillaumeGomez. I don't understand it 😭

[GuillaumeGomez]

🤣

[EPashkin]

@GuillaumeGomez, @sdroege as #354 appeared again, we need decide what to do.

[GuillaumeGomez]

So to put it simply: we have the choice between safety and performance. So I propose we add both (the performance will be _unchecked).

[sdroege]

What exactly is the proposal to do here, the API to be added?

[johncf]

So to put it simply: we have the choice between safety and performance.

If I remember correctly, the status quo right now is no more safer than what remains after the changes in #354.

[GuillaumeGomez]

@johncf: I agree on this, that's why I propose to add both. The "safe" one will use match and the "performant" one will just cast.

[johncf]

@GuillaumeGomez That change can come later after we land these changes.

Basically, this was what you had proposed to do while converting from integers to enums. That would be a pervasive change too with a more profound effect overall.

[johncf]

@GuillaumeGomez Actually it can be done a bit more efficiently like this:

#[repr(C)]
pub enum Test {
   A = 0,
   B = 1,
   C = 2,
   D = 3,
}

fn toTest(v: u32) -> Test {
    match v {
        0..4 => unsafe { std::mem::transmute(v) },
        _ => panic!("Bad!"),
    }
}

Then again, I should remind you that what this would prevent are only rare upstream bugs. Rust users will never need to use this function (even indirectly).