libredox: Fd::ftruncate and Fd::futimens take &self, not self

POSIX ftruncate(2) and futimens(2) do not close the file descriptor.
The previous 'self' (by-value) signature consumed the Fd on call, which
would trigger Fd::drop and close the fd as a side effect. After a
successful ftruncate the user could no longer use the fd, which is
the opposite of the intended semantics.

Change to '&self' to match the surrounding methods (fsync, fdatasync
both already use &self) and to match POSIX behaviour. The drop-on-
failure semantics is preserved by Rust's normal borrow checker: if
ftruncate returns Err, the caller's borrow is still valid and the
fd stays open.

src/lib.rs

@@ -447,11 +447,11 @@ impl Fd {
         call::fdatasync(self.raw())
     }
     #[inline]
-    pub fn ftruncate(self, len: usize) -> Result<()> {
+    pub fn ftruncate(&self, len: usize) -> Result<()> {
         call::ftruncate(self.raw(), len)
     }
     #[inline]
-    pub fn futimens(self, times: &[data::TimeSpec; 2]) -> Result<()> {
+    pub fn futimens(&self, times: &[data::TimeSpec; 2]) -> Result<()> {
         call::futimens(self.raw(), times)
     }
     /* TODO: Support unlinkat using std_fs_call