Make yielder::pair unsafe

Author: taiki-e

async-stream-impl/src/lib.rs

@@ -227,7 +227,7 @@ pub fn stream_inner(input: TokenStream) -> TokenStream {
     };
 
     quote!({
-        let (mut __yield_tx, __yield_rx) = #crate_path::__private::yielder::pair();
+        let (mut __yield_tx, __yield_rx) = unsafe { #crate_path::__private::yielder::pair() };
         #crate_path::__private::AsyncStream::new(__yield_rx, async move {
             #dummy_yield
             #(#stmts)*
@@ -261,7 +261,7 @@ pub fn try_stream_inner(input: TokenStream) -> TokenStream {
     };
 
     quote!({
-        let (mut __yield_tx, __yield_rx) = #crate_path::__private::yielder::pair();
+        let (mut __yield_tx, __yield_rx) = unsafe { #crate_path::__private::yielder::pair() };
         #crate_path::__private::AsyncStream::new(__yield_rx, async move {
             #dummy_yield
             #(#stmts)*

async-stream/src/yielder.rs

@@ -20,8 +20,12 @@ pub(crate) struct Enter<'a, T> {
     prev: *mut (),
 }
 
+// Note: It is considered unsound for anyone other than our macros to call
+// this function. This is a private API intended only for calls from our
+// macros, and users should never call it, but some people tend to
+// misinterpret it as fine to call unless it is marked unsafe.
 #[doc(hidden)]
-pub fn pair<T>() -> (Sender<T>, Receiver<T>) {
+pub unsafe fn pair<T>() -> (Sender<T>, Receiver<T>) {
     let tx = Sender { _p: PhantomData };
     let rx = Receiver { _p: PhantomData };
     (tx, rx)