Migrate the rest of the engine to UnsafeWorldCell

[joseph-gio]

Objective

Follow-up to #6404 and #8292.

Mutating the world through a shared reference is surprising, and it makes the meaning of &World unclear: sometimes it gives read-only access to the entire world, and sometimes it gives interior mutable access to only part of it.

This is an up-to-date version of #6972.

Solution

Use UnsafeWorldCell for all interior mutability. Now, &World always gives you read-only access to the entire world.

---

Changelog

TODO - do we still care about changelogs?

Migration Guide

Mutating any world data using &World is now considered unsound -- the type UnsafeWorldCell must be used to achieve interior mutability. The following methods now accept UnsafeWorldCell instead of &World:

• QueryState: get_unchecked, iter_unchecked, iter_combinations_unchecked, for_each_unchecked, get_single_unchecked, get_single_unchecked_manual.
• SystemState: get_unchecked_manual

let mut world = World::new();
let mut query = world.query::<&mut T>();

// Before:
let t1 = query.get_unchecked(&world, entity_1);
let t2 = query.get_unchecked(&world, entity_2);

// After:
let world_cell = world.as_unsafe_world_cell();
let t1 = query.get_unchecked(world_cell, entity_1);
let t2 = query.get_unchecked(world_cell, entity_2);

The methods QueryState::validate_world and SystemState::matches_world now take a WorldId instead of &World:

// Before:
query_state.validate_world(&world);

// After:
query_state.validate_world(world.id());

The methods QueryState::update_archetypes and SystemState::update_archetypes now take UnsafeWorldCell instead of &World:

// Before:
query_state.update_archetypes(&world);

// After:
query_state.update_archetypes(world.as_unsafe_world_cell_readonly());

[alice-i-cecile]

Each of these commits makes sense to me. Pretty mechanical stuff.

Very happy to see validate_world get a more sensible API, and even happier to finally purge our code base of this pattern.

[jakobhellermann]

The changes look good to me.

I do wonder how we should balance the tradeoff between not having similar copies of methods for &World and UnsafeWorldCell vs not exposing people to implementation details.
For example in the render code, self.cameras.update_archetypes(world.as_unsafe_world_cell()) is unfortunate because it is actually used in a few places outside of just bevy_ecs internals.

Maybe it would be worth it to have update_archetypes(&World) and update_archetypes_unsafe_world_cell(UnsafeWorldCell<'_>) here?

Anyways, thanks for actually finishing the migration, I hope we can get this into 0.11.

[joseph-gio]

Maybe it would be worth it to have update_archetypes(&World) and update_archetypes_unsafe_world_cell(UnsafeWorldCell\u003C'_>) here?

IMO the ideal way of doing this would be to have World deref to UnsafeWorldCell, that way &World could implicitly coerce to &UnsafeWorldCell -- although we'd have to change the definition of UWC which may not be worth the churn at this point.

You're right though, just adding update_archetypes_unsafe_world_cell is probably the simplest way of improving this.