Objective

Fix unsoundness introduced by #15858. QueryLens::query() would hand out a Query with the full 'w lifetime, and the new _inner methods would let the results outlive the Query. This could be used to create aliasing mutable references, like

fn bad<'w>(mut lens: QueryLens<'w, EntityMut>, entity: Entity) {
    let one: EntityMut<'w> = lens.query().get_inner(entity).unwrap();
    let two: EntityMut<'w> = lens.query().get_inner(entity).unwrap();
    assert!(one.entity() == two.entity());
}

Fixes #17693

Solution

Restrict the 'world lifetime in the Query returned by QueryLens::query() to '_, the lifetime of the borrow of the QueryLens.

The model here is that Query<'w, 's, D, F> and QueryLens<'w, D, F> have permission to access their components for the lifetime 'w. So going from &'a mut QueryLens<'w> to Query<'w, 'a> would borrow the permission only for the 'a lifetime, but incorrectly give it out for the full 'w lifetime.

To handle any cases where users were calling get_inner() or iter_inner() on the Query and expecting the full 'w lifetime, we introduce a new QueryLens::query_inner() method. This is only valid for ReadOnlyQueryData, so it may safely hand out a copy of the permission for the full 'w lifetime. Since get_inner() and iter_inner() were only valid on ReadOnlyQueryData prior to #15858, that should cover any uses that relied on the longer lifetime.

Migration Guide

Users of QueryLens::query() who were calling get_inner() or iter_inner() will need to replace the call with QueryLens::query_inner().