An example of vanilla Rust code that falls into a "deadlock" footgun in scope based drop and impossible to happen in ASAP drop out of the box. Scope based drop : use std::sync::{Arc, Mutex}; use std::thread; use std::time::Duration; fn main() { let raw_data = Arc::new(Mutex::new(0)); let resource_b = Arc::new(Mutex::new(false)); let t1_data = Arc::clone(&raw_data); let t1_res = Arc::clone(&resource_b); let handle = thread::spawn(move || { let mut data = t1_data.lock().unwrap(); *data += 1; thread::sleep(Duration::from_millis(50)); let ready = t1_res.lock().unwrap(); if *ready { println!("Thread 1 finish"); } }); thread::sleep(Duration::from_millis(10)); let mut ready = resource_b.lock().unwrap(); *ready = true; let data = raw_data.lock().unwrap(); println!("Main thread read: {}", *data); handle.join().unwrap(); } ASAP drop (using a manual drop call to simulate an ASAP drop, as the ASAP drop feature is not yet available) : use std::sync::{Arc, Mutex}; use std::thread; use std::time::Duration; fn main() { let raw_data = Arc::new(Mutex::new(0)); let resource_b = Arc::new(Mutex::new(false)); let t1_data = Arc::clone(&raw_data); let t1_res = Arc::clone(&resource_b); let handle = thread::spawn(move || { let mut data = t1_data.lock().unwrap(); *data += 1; drop(data); thread::sleep(Duration::from_millis(50)); let ready = t1_res.lock().unwrap(); if *ready { println!("Thread 1 finish"); } drop(ready); }); thread::sleep(Duration::from_millis(10)); let mut ready = resource_b.lock().unwrap(); *ready = true; drop(ready); let data = raw_data.lock().unwrap(); println!("Main thread read: {}", *data); drop(data); handle.join().unwrap(); }

lordan: > And no, "one can simply replace `Mutex` with `ASAP_Mutex` in every case and things work every time" would be incorrect and insufficient, as @ProgramCrafter's Rust Playground counter-example still stands (and yes, INB4: I did read your answer to that). Practically speaking, “replace all” is a breaking change. Is it legally speaking? The documentation says that `Mutex` protects its payload, which it does even in this example. With the new semantics, no data is protected for the entire duration of its usage (none). With the old semantics, it protects no data until the end of the scope. I understand that it’s tempting to piggyback on the payload-independent locking behaviour, but per documentation, is this a valid use case? Let’s assume we had a weird magic OS locking primitive that is based on address ranges. Basically, blocking doesn’t happen when acquiring the lock, but only when accessing the locked memory (maybe the memory is only mapped when the lock is held). Once the (basically deferred) lock request succeeds, memory accesses are unblocked. Now, anything between locking and the first access to the protected data can still freely run concurrently. Would this be a valid primitive to implement `Mutex` with? I think my main issue is that the documentation clarifies the duration of locking, but is not crystal clear on the (side) effects of locking. Off-topic ramble: `drop` has been compared to `free`, which ergonomically speaking is somewhat true. However, most of the time, _when_ an object is freed does not really matter. Considering critical sections should basically always be best-effort minimal, locks are a special case to me. RAII really doesn’t sit right with me, because `drop` is optional and doesn’t directly correspond to `lock`. The lock’s scope can range from the middle of a block to its end, which is not very nice to model mentally. I feel like my personal preference is that either there are traditional `lock` and `unlock` operations (where implicit drops would yield a build error), where the scope is actively bounded in _both_ directions the same way, or something like a `with_lock` method that invokes a closure, with the scope implicitly bounded by the closure’s. I know that closures can introduce their own limitations and ergonomic issues, but this is a ramble after all…

lordan: > And no, "one can simply replace `Mutex` with `ASAP_Mutex` in every case and things work every time" would be incorrect and insufficient, as @ProgramCrafter's Rust Playground counter-example still stands (and yes, INB4: I did read your answer to that). Practically speaking, “replace all” is a breaking change. Is it legally speaking? The documentation says that `Mutex` protects its payload, which it does even in this example. With the new semantics, no data is protected for the entire duration of its usage (none). With the old semantics, it protects no data until the end of the scope. I understand that it’s tempting to piggyback on the payload-independent locking behaviour, but per documentation, is this a valid use case? Let’s assume we had a weird magic OS locking primitive that is based on address ranges. Basically, blocking doesn’t happen when acquiring the lock, but only when accessing the locked memory (maybe the memory is only mapped when the lock is held). Once the (basically deferred) lock request succeeds, memory accesses are unblocked. Now, anything between locking and the first access to the protected data can still freely run concurrently. Would this be a valid primitive to implement `Mutex` with? I think my main issue is that the documentation clarifies the duration of locking, but is not crystal clear on the (side) effects of locking. Off-topic ramble: `drop` has been compared to `free`, which ergonomically speaking is somewhat true. However, most of the time, _when_ an object is freed does not really matter. Considering critical sections should basically always be best-effort minimal, locks are a special case to me. RAII really doesn’t sit right with me, because `drop` is optional and doesn’t directly correspond to `lock`. The lock’s scope can range from the middle of a block to its end, which is not very nice to model mentally. I feel like my personal preference is that either there are traditional `lock` and `unlock` operations (where implicit drops would yield a build error), where the scope is actively bounded in _both_ directions the same way, or something like a `with_lock` method that invokes a closure, with the scope implicitly bounded by the closure’s. I know that closures can introduce their own limitations and ergonomic issues, but this is a ramble after all…

lordan: > And no, "one can simply replace `Mutex` with `ASAP_Mutex` in every case and things work every time" would be incorrect and insufficient, as @ProgramCrafter's Rust Playground counter-example still stands (and yes, INB4: I did read your answer to that). Practically speaking, “replace all” is a breaking change. Is it legally speaking? The documentation says that `Mutex` protects its payload, which it does even in this example. With the new semantics, no data is protected for the entire duration of its usage (none). With the old semantics, it protects no data until the end of the scope. I understand that it’s tempting to piggyback on the payload-independent locking behaviour, but per documentation, is this a valid use case? Let’s assume we had a weird magic OS locking primitive that is based on address ranges. Basically, blocking doesn’t happen when acquiring the lock, but only when accessing the locked memory (maybe the memory is only mapped when the lock is held). Once the (basically deferred) lock request succeeds, memory accesses are unblocked. Now, anything between locking and the first access to the protected data can still freely run concurrently. Would this be a valid primitive to implement `Mutex` with? I think my main issue is that the documentation clarifies the duration of locking, but is not crystal clear on the (side) effects of locking. Off-topic ramble: `drop` has been compared to `free`, which ergonomically speaking is somewhat true. However, most of the time, _when_ an object is freed does not really matter. Considering critical sections should basically always be best-effort minimal, locks are a special case to me. RAII really doesn’t sit right with me, because `drop` is optional and doesn’t directly correspond to `lock`. The lock’s scope can range from the middle of a block to its end, which is not very nice to model mentally. I feel like my personal preference is that either there are traditional `lock` and `unlock` operations (where implicit drops would yield a build error), where the scope is actively bounded in _both_ directions the same way, or something like a `with_lock` method that invokes a closure, with the scope implicitly bounded by the closure’s. I know that closures can introduce their own limitations and ergonomic issues, but this is a ramble after all…

lordan: > And no, "one can simply replace `Mutex` with `ASAP_Mutex` in every case and things work every time" would be incorrect and insufficient, as @ProgramCrafter's Rust Playground counter-example still stands (and yes, INB4: I did read your answer to that). Practically speaking, “replace all” is a breaking change. Is it legally speaking? The documentation says that `Mutex` protects its payload, which it does even in this example. With the new semantics, no data is protected for the entire duration of its usage (none). With the old semantics, it protects no data until the end of the scope. I understand that it’s tempting to piggyback on the payload-independent locking behaviour, but per documentation, is this a valid use case? Let’s assume we had a weird magic OS locking primitive that is based on address ranges. Basically, blocking doesn’t happen when acquiring the lock, but only when accessing the locked memory (maybe the memory is only mapped when the lock is held). Once the (basically deferred) lock request succeeds, memory accesses are unblocked. Now, anything between locking and the first access to the protected data can still freely run concurrently. Would this be a valid primitive to implement `Mutex` with? I think my main issue is that the documentation clarifies the duration of locking, but is not crystal clear on the (side) effects of locking. Off-topic ramble: `drop` has been compared to `free`, which ergonomically speaking is somewhat true. However, most of the time, _when_ an object is freed does not really matter. Considering critical sections should basically always be best-effort minimal, locks are a special case to me. RAII really doesn’t sit right with me, because `drop` is optional and doesn’t directly correspond to `lock`, and the lock’s scope can range from the middle of a block to its end, which is not a very nice to model mentally. I feel like my personal preference is that either there are traditional `lock` and `unlock` operations (where implicit drops would yield a build error), where the scope is is actively bounded in _both_ directions the same way, or something like a `with_lock` method that invokes a closure, with the scope implicitly bounded by the closure’s. I know that closures can introduce their own limitations and ergonomic issues, but this is a ramble after all…

lordan: > And no, "one can simply replace `Mutex` with `ASAP_Mutex` in every case and things work every time" would be incorrect and insufficient, as @ProgramCrafter's Rust Playground counter-example still stands (and yes, INB4: I did read your answer to that). Practically speaking, “replace all” is a breaking change. Is it legally speaking? The documentation says that `Mutex` protects its payload, which it does even in this example. With the new semantics, no data is protected for the entire duration of its usage (none). With the old semantics, it protects no data until the end of the scope. I understand that it’s tempting to piggyback on the payload-independent locking behaviour, but per documentation, is this a valid use case? Let’s assume we had a weird magic OS locking primitive that is based on address ranges. Basically, blocking doesn’t happen when acquiring the lock, but only when accessing the locked memory (maybe the memory is only mapped when the lock is held). Once the (basically deferred) lock request succeeds, memory accesses are unblocked. Now, anything between locking and the first access to the protected data can still freely run concurrently. Would this be a valid primitive to implement `Mutex` with? I think my main issue is that the documentation clarifies the duration of locking, but is not crystal clear on the (side) effects of locking. Off-topic ramble: `drop` has been compared to `free`, which ergonomically speaking is somewhat true. However, most of the time, _when_ an object is freed does not really matter. Considering critical sections should basically always be best-effort minimal, locks are a special case to me. RAII really doesn’t sit right with me, because `drop` is optional and doesn’t directly correspond to `lock`, and the lock’s scope can range from the middle of a block to its end, which is not a very nice to model mentally. I feel like my personal preference is that either there are traditional `lock` and `unlock` operations (where implicit drops would yield a build error), where the scope is is actively bounded in _both_ directions the same way, or something like a `with_lock` method that invokes a closure, with the scope implicitly bounded by the closure’s. I know that closures can introduce their own limitations and ergonomic issues, but this is a ramble after all…

lordan: > And no, "one can simply replace `Mutex` with `ASAP_Mutex` in every case and things work every time" would be incorrect and insufficient, as @ProgramCrafter's Rust Playground counter-example still stands (and yes, INB4: I did read your answer to that). Practically speaking, “replace all” is a breaking change. Is it legally speaking? The documentation says that `Mutex` protects its payload, which it does even in this example. With the new semantics, no data is protected for the entire duration of its usage (none). With the old semantics, it protects no data until the end of the scope. I understand that it’s tempting to piggyback on the payload-independent locking behaviour, but per documentation, is this a valid use case? Let’s assume we had a weird magic OS locking primitive that is based on address ranges. Basically, blocking doesn’t happen when acquiring the lock, but only when accessing the locked memory (maybe the memory is only mapped when the lock is held). Once the (basically deferred) lock request succeeds, memory accesses are unblocked. Now, anything between locking and the first access to the protected data can still freely run concurrently. Would this be a valid primitive to implement `Mutex` with? I think my main issue is that the documentation clarifies the duration of locking, but is not crystal clear on the (side) effects of locking. Off-topic ramble: `drop` has been compared to `free`, which ergonomically speaking is somewhat true. However, most of the time, _when_ an object is freed does not really matter. Considering critical sections should basically always be best-effort minimal, locks are a special case to me. RAII really doesn’t sit right with me, because `drop` is optional and doesn’t directly correspond to `lock`, and the lock’s scope can range from the middle of a block to its end, which is not a very nice to model mentally. I feel like my personal preference is that either there are traditional `lock` and `unlock` operations (where implicit drops would yield a build error), where the scope is is actively bounded in _both_ directions the same way, or something like a `with_lock` method that invokes a closure, with the scope implicitly bounded by the closure’s. I know that closures can introduce their own limitations and ergonomic issues, but this is a ramble after all…

lordan: > And no, "one can simply replace `Mutex` with `ASAP_Mutex` in every case and things work every time" would be incorrect and insufficient, as @ProgramCrafter's Rust Playground counter-example still stands (and yes, INB4: I did read your answer to that). Practically speaking, “replace all” is a breaking change. Is it legally speaking? The documentation says that `Mutex` protects its payload, which it does even in this example. With the new semantics, no data is protected for the entire duration of its usage (none). With the old semantics, it protects no data until the end of the scope. I understand that it’s tempting to piggyback on the payload-independent locking behaviour, but per documentation, is this a valid use case? Let’s assume we had a weird magic OS locking primitive that is based on address ranges. Basically, blocking doesn’t happen when acquiring the lock, but only when accessing the locked memory (maybe the memory is only mapped when the lock is held). Once the (basically deferred) lock request succeeds, memory accesses are unblocked. Now, anything between locking and the first access to the protected data can still freely run concurrently. Would this be a valid primitive to implement `Mutex` with? I think my main issue is that the documentation clarifies the duration of locking, but is not crystal clear on the (side) effects of locking. Off-topic ramble: `drop` has been compared to `free`, which ergonomically speaking is somewhat true. However, most of the time, _when_ an object is freed does not really matter. Considering critical sections should basically always be best-effort minimal, locks are a special case to me. RAII really doesn’t sit right with me, because `drop` is optional and doesn’t directly correspond to `lock`, and the lock’s scope can range from the middle of a block to its end, which is not a very nice to model mentally. I feel like my personal preference is that either there are traditional `lock` and `unlock` operations (where implicit drops would yield a build error), where the scope is is actively bounded in _both_ directions the same way, or something like a `with_lock` method that invokes a closure, with the scope implicitly bounded by the closure’s. I know that closures can introduce their own limitations and ergonomic issues, but this is a ramble after all…

@fuji-184 it seems to me you're try to change the semantics of existing code, which is a breaking change. You're then trying to fix _specific cases_ where this change would be breaking, by creating _very complex and ad-hoc_ solutions for them. My opinion is that this approach will only lead to suboptimal and incomplete solutions. For example: you are focusing on the case where the contents of the `Mutex` are converted to a raw pointer, but have you considered the case where the `Mutex` is used to logically protect some data that is _outside of it_? How would the compiler ever detect that? This might not even require `unsafe` code, e.g. if you use atomics and the correctness of the algorithm depends on one particular operation never being executed concurrently with itself. There are so many ways this can go wrong that trying to ad-hoc fix them one by one is a lost battle.

TechFeed

It turns out that RAII can lead to performance "footguns", not just regarding memory, but also with multithreading locks. The "holding a mutex longer than necessary" footgun. It’s easy to fall into this trap : { let data = data.lock() data.update(10) // ...lots of other code... } Oops, the mutex remains locked for the entire duration of the scope, even though it only needed to be held until the final write to the `data` variable. This degrades performance because other threads are forced to wait longer than they should. The performance hit, latency and throughput, scales linearly with the amount of code executed after the last write, the longer that code takes to reach the end of the scope, the more severe the latency increase and throughput drop become. This footgun appears frequently in real world code, as many developers write "vanilla" Rust without manually managing the lifetime of these locks. One might suggest calling `drop` explicitly or wrapping the logic in an inner scope, but neither is a robust or reliable solution. Why? Because both require manual awareness, in other words, they rely on the developer's skill to do so. By definition, a "footgun" is something that catches users off guard, often without them even realizing it. So, what is the solution? As it turns out, "ASAP drop" (dropping as soon as possible) can resolve not only memory related footguns but also performance issues stemming from multithreading locks. Visualization : let data = data.lock().unwrap() // `data` becomes a `MutexGuard<T>` data.update(10) data.update(20) // The compiler analyzes when the `MutexGuard<data>` is last used. // If the code above represents the final access, the compiler automatically inserts an unlock operation immediately afterward. // This allows other threads to take their turn without any unnecessary, prolonged waiting. data.unlock() // Inserted by the compiler As a further implementation guide, since read access is safe to perform from multiple threads, the unlock operation is inserted immediately after the final write, detected via `&mut` references, interior mutability, and raw mutable pointers (`*mut`). The final read access, using `&` and `*const`, does not extend the lifetime of the `MutexGuard`. This ensures that other threads get their turn as soon as possible, eliminating wasted time, resulting in low latency and high throughput right out of the box.

Having a dedicated `ASAP_Mutex` type is also acceptable, I mentioned that earlier, too. It’s the correct approach because it won’t break existing code that already uses a mutex as a token, nor does it lock the Rust language into the shortcomings of the past indefinitely, new Rust code can begin to reap the benefits of ASAP drop.

TechFeed

Having a dedicated `ASAP_Mutex` type is also acceptable, I mentioned that earlier, too. It’s the correct approach because it won’t break existing code that already uses a mutex as a token, nor does it lock the Rust language into the shortcomings of the past indefinitely, new Rust code can begin to reap the benefits of ASAP drop.