Skip to content

Commit c36badf

Browse files
authored
Rollup merge of rust-lang#63793 - oli-obk:🧹, r=dtolnay
Have tidy ensure that we document all `unsafe` blocks in libcore cc @rust-lang/libs I documented a few and added ignore flags on the other files. We can incrementally document the files, but won't regress any files this way.
2 parents 50f8aad + e28287b commit c36badf

File tree

46 files changed

+180
-42
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

46 files changed

+180
-42
lines changed

‎src/libcore/alloc.rs

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
//! Memory allocation APIs
22
3+
// ignore-tidy-undocumented-unsafe
4+
35
#![stable(feature = "alloc_module", since = "1.28.0")]
46

57
use crate::cmp;

‎src/libcore/any.rs

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -182,6 +182,7 @@ impl dyn Any {
182182
#[inline]
183183
pub fn downcast_ref<T: Any>(&self) -> Option<&T> {
184184
if self.is::<T>() {
185+
// SAFETY: just checked whether we are pointing to the correct type
185186
unsafe {
186187
Some(&*(self as *const dyn Any as *const T))
187188
}
@@ -217,6 +218,7 @@ impl dyn Any {
217218
#[inline]
218219
pub fn downcast_mut<T: Any>(&mut self) -> Option<&mut T> {
219220
if self.is::<T>() {
221+
// SAFETY: just checked whether we are pointing to the correct type
220222
unsafe {
221223
Some(&mut *(self as *mut dyn Any as *mut T))
222224
}
@@ -424,7 +426,11 @@ impl TypeId {
424426
#[rustc_const_unstable(feature="const_type_id")]
425427
pub const fn of<T: ?Sized + 'static>() -> TypeId {
426428
TypeId {
429+
#[cfg(bootstrap)]
430+
// SAFETY: going away soon
427431
t: unsafe { intrinsics::type_id::<T>() },
432+
#[cfg(not(bootstrap))]
433+
t: intrinsics::type_id::<T>(),
428434
}
429435
}
430436
}

‎src/libcore/array/iter.rs

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ where
5151
/// iterator (either via `IntoIterator` for arrays or via another way).
5252
#[unstable(feature = "array_value_iter", issue = "65798")]
5353
pub fn new(array: [T; N]) -> Self {
54-
// The transmute here is actually safe. The docs of `MaybeUninit`
54+
// SAFETY: The transmute here is actually safe. The docs of `MaybeUninit`
5555
// promise:
5656
//
5757
// > `MaybeUninit<T>` is guaranteed to have the same size and alignment
@@ -84,10 +84,10 @@ where
8484
/// Returns an immutable slice of all elements that have not been yielded
8585
/// yet.
8686
fn as_slice(&self) -> &[T] {
87-
// This transmute is safe. As mentioned in `new`, `MaybeUninit` retains
87+
let slice = &self.data[self.alive.clone()];
88+
// SAFETY: This transmute is safe. As mentioned in `new`, `MaybeUninit` retains
8889
// the size and alignment of `T`. Furthermore, we know that all
8990
// elements within `alive` are properly initialized.
90-
let slice = &self.data[self.alive.clone()];
9191
unsafe {
9292
mem::transmute::<&[MaybeUninit<T>], &[T]>(slice)
9393
}
@@ -117,7 +117,8 @@ where
117117
let idx = self.alive.start;
118118
self.alive.start += 1;
119119

120-
// Read the element from the array. This is safe: `idx` is an index
120+
// Read the element from the array.
121+
// SAFETY: This is safe: `idx` is an index
121122
// into the "alive" region of the array. Reading this element means
122123
// that `data[idx]` is regarded as dead now (i.e. do not touch). As
123124
// `idx` was the start of the alive-zone, the alive zone is now
@@ -163,7 +164,8 @@ where
163164
// + 1]`.
164165
self.alive.end -= 1;
165166

166-
// Read the element from the array. This is safe: `alive.end` is an
167+
// Read the element from the array.
168+
// SAFETY: This is safe: `alive.end` is an
167169
// index into the "alive" region of the array. Compare the previous
168170
// comment that states that the alive region is
169171
// `data[alive.start..alive.end + 1]`. Reading this element means that
@@ -226,6 +228,7 @@ where
226228
[T; N]: LengthAtMost32,
227229
{
228230
fn clone(&self) -> Self {
231+
// SAFETY: each point of unsafety is documented inside the unsafe block
229232
unsafe {
230233
// This creates a new uninitialized array. Note that the `assume_init`
231234
// refers to the array, not the individual elements. And it is Ok if

‎src/libcore/array/mod.rs

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -156,6 +156,7 @@ where
156156
fn try_from(slice: &[T]) -> Result<&[T; N], TryFromSliceError> {
157157
if slice.len() == N {
158158
let ptr = slice.as_ptr() as *const [T; N];
159+
// SAFETY: ok because we just checked that the length fits
159160
unsafe { Ok(&*ptr) }
160161
} else {
161162
Err(TryFromSliceError(()))
@@ -173,6 +174,7 @@ where
173174
fn try_from(slice: &mut [T]) -> Result<&mut [T; N], TryFromSliceError> {
174175
if slice.len() == N {
175176
let ptr = slice.as_mut_ptr() as *mut [T; N];
177+
// SAFETY: ok because we just checked that the length fits
176178
unsafe { Ok(&mut *ptr) }
177179
} else {
178180
Err(TryFromSliceError(()))

‎src/libcore/ascii.rs

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -135,6 +135,7 @@ impl FusedIterator for EscapeDefault {}
135135
#[stable(feature = "ascii_escape_display", since = "1.39.0")]
136136
impl fmt::Display for EscapeDefault {
137137
fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
138+
// SAFETY: ok because `escape_default` created only valid utf-8 data
138139
f.write_str(unsafe { from_utf8_unchecked(&self.data[self.range.clone()]) })
139140
}
140141
}

‎src/libcore/benches/ascii.rs

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -118,6 +118,7 @@ benches! {
118118
}
119119

120120
fn case07_fake_simd_u32(bytes: &mut [u8]) {
121+
// SAFETY: transmuting a sequence of `u8` to `u32` is always fine
121122
let (before, aligned, after) = unsafe {
122123
bytes.align_to_mut::<u32>()
123124
};
@@ -142,6 +143,7 @@ benches! {
142143
}
143144

144145
fn case08_fake_simd_u64(bytes: &mut [u8]) {
146+
// SAFETY: transmuting a sequence of `u8` to `u64` is always fine
145147
let (before, aligned, after) = unsafe {
146148
bytes.align_to_mut::<u64>()
147149
};

‎src/libcore/cell.rs

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -187,6 +187,8 @@
187187
//! ```
188188
//!
189189
190+
// ignore-tidy-undocumented-unsafe
191+
190192
#![stable(feature = "rust1", since = "1.0.0")]
191193

192194
use crate::cmp::Ordering;

‎src/libcore/char/convert.rs

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -224,6 +224,7 @@ impl TryFrom<u32> for char {
224224
if (i > MAX as u32) || (i >= 0xD800 && i <= 0xDFFF) {
225225
Err(CharTryFromError(()))
226226
} else {
227+
// SAFETY: checked that it's a legal unicode value
227228
Ok(unsafe { from_u32_unchecked(i) })
228229
}
229230
}

‎src/libcore/char/decode.rs

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -87,7 +87,7 @@ impl<I: Iterator<Item = u16>> Iterator for DecodeUtf16<I> {
8787
};
8888

8989
if u < 0xD800 || 0xDFFF < u {
90-
// not a surrogate
90+
// SAFETY: not a surrogate
9191
Some(Ok(unsafe { from_u32_unchecked(u as u32) }))
9292
} else if u >= 0xDC00 {
9393
// a trailing surrogate
@@ -107,6 +107,7 @@ impl<I: Iterator<Item = u16>> Iterator for DecodeUtf16<I> {
107107

108108
// all ok, so lets decode it.
109109
let c = (((u - 0xD800) as u32) << 10 | (u2 - 0xDC00) as u32) + 0x1_0000;
110+
// SAFETY: we checked that it's a legal unicode value
110111
Some(Ok(unsafe { from_u32_unchecked(c) }))
111112
}
112113
}

‎src/libcore/char/methods.rs

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -438,6 +438,7 @@ impl char {
438438
#[inline]
439439
pub fn encode_utf8(self, dst: &mut [u8]) -> &mut str {
440440
let code = self as u32;
441+
// SAFETY: each arm checks the size of the slice and only uses `get_unchecked` unsafe ops
441442
unsafe {
442443
let len = if code < MAX_ONE_B && !dst.is_empty() {
443444
*dst.get_unchecked_mut(0) = code as u8;
@@ -507,6 +508,7 @@ impl char {
507508
#[inline]
508509
pub fn encode_utf16(self, dst: &mut [u16]) -> &mut [u16] {
509510
let mut code = self as u32;
511+
// SAFETY: each arm checks whether there are enough bits to write into
510512
unsafe {
511513
if (code & 0xFFFF) == code && !dst.is_empty() {
512514
// The BMP falls through (assuming non-surrogate, as it should)

0 commit comments

Comments
 (0)