OpenFX: remove reachable panics across the C ABI, null-check host GPU pointers, declare render InstanceSafe

[Mldphotohraphie]

Context

DaVinci Resolve Studio 21.0.2 (macOS arm64, Apple M-series) crashed with SIGSEGV while using Gyroflow OFX v2.1.1 during Color page playback, right after an Edit -> Color page switch. Crash dump excerpt (from Resolve's ResolveDebug.txt):

3   Metal            -[_MTLCommandQueue commitCommandBuffer:wake:] + 268
5   IOGPU            -[IOGPUMetalCommandBuffer commit] + 228
6   AGXMetalG15X_M1  -[AGXG15XFamilyCommandBuffer commit] + 880
7   Gyroflow.ofx     OfxGetPlugin + 9231056
...
Signal Number = 11

While auditing the OpenFX plugin code around this crash, I found several robustness issues that this PR addresses. It does not claim to fix the root cause of the crash above (which likely involves the lifetime of the host's Metal command queue retained by the cached wgpu wrapper in gyroflow-core), but it removes several ways the plugin can take the host down and reduces concurrent access to the shared render state.

Changes

1. Remove reachable panics/unwraps from render and param paths. The plugin is loaded across the OpenFX C ABI; main_entry has no catch_unwind, so any Rust panic unwinding out of an action is undefined behavior in the host process. Replaced reachable panic!/unwrap() in frame_from_timetype, get_bool_at_time, set_string and thread join with logged fallbacks or error returns.

2. Null-check host GPU pointers before handing them to the backend. The OpenCL/Metal/CUDA render paths passed raw host pointers (command queue, source/output buffers) straight to the GPU backend, where a null would be UB (Retained::retain(...).unwrap() on the Metal side). The render action now fails cleanly instead.

3. Avoid unwrap on missing fuscript executable.

4. Declare render as InstanceSafe instead of FullySafe. The Render action takes &mut InstanceData and mutates per-instance state (stabilization manager cache, timeline size, parameters). FullySafe allows the host to call Render concurrently on the same instance, which aliases that &mut (UB) and races those mutations. InstanceSafe still allows concurrent rendering of different instances.

Notes

Two further issues were identified but need changes in gyroflow-core rather than this repo, so they are not part of this PR:

• std::env::set_var (NO_OPENCL in disable_opencl) is called on the render path while gyroflow-core reads these variables from render threads; setenv/getenv racing is UB on Unix. A shared atomic flag would be safer.
• The wgpu wrapper caches (and retains) the host's MTLCommandQueue across renders; if the host tears down its GPU pipeline (e.g. Resolve page switches), a later commit on that queue can crash. Happy to file a separate issue with the full crash dump if useful.

Tested: cargo check / cargo build --release clean on macOS arm64 (rustc 1.94.1); the resulting build loads and renders correctly in Resolve Studio 21.0.2.

🤖 Generated with Claude Code

https://claude.ai/code/session_01NnShHBDs8UYxcRKSAaZzEF

[CLAassistant]

All committers have signed the CLA.