@@ -52,8 +52,9 @@ about *defining* obligations. The fact that the body of an `unsafe fn` is also
52
52
implicitly treated like a block has made it hard to realize this duality
53
53
[ even for experienced Rust developers] [ unsafe-dual ] . (Completing the picture,
54
54
` unsafe Trait ` also defines an obligation, that is discharged by ` unsafe impl ` .
55
- Curiously, ` unsafe impl ` does * not* implicitly make all bodies of this ` impl `
56
- unsafe blocks, which is somewhat inconsistent with ` unsafe fn ` .)
55
+ Curiously, ` unsafe trait ` does * not* implicitly make all bodies of default
56
+ functions defined inside this trait unsafe blocks, which is somewhat
57
+ inconsistent with ` unsafe fn ` when viewed through this lens.)
57
58
58
59
[ unsafe-dual ] : https://github.com/rust-lang/rfcs/pull/2585#issuecomment-577852430
59
60
@@ -156,6 +157,11 @@ The alternative is to not do anything, and live with the current situation.
156
157
157
158
We could bikeshed the lint name.
158
159
160
+ We could avoid using ` unsafe ` for dual purpose, and instead have `unsafe_to_call
161
+ fn` for functions that are "unsafe to call" but do not implicitly have an
162
+ ` unsafe {} ` block in their body. For consistency, we might want `unsafe_to_impl
163
+ trait` for traits, though the behavior would be the same as ` unsafe trait`.
164
+
159
165
We could introduce named proof obligations (proposed by @Centril ) such that the
160
166
compiler can be be told (to some extend) if the assumptions made by the `unsafe
161
167
fn` are sufficient to discharge the requirements of the unsafe operations.
@@ -164,10 +170,6 @@ We could restrict this requirement to use `unsafe` blocks in `unsafe fn` to
164
170
those ` unsafe fn ` that contain at least one ` unsafe ` block, meaning short
165
171
` unsafe fn ` would keep compiling like they do now.
166
172
167
- We could have separate marker for ` unsafe fn ` with and without an implicitly
168
- unsafe body, e.g. ` unsafe unsafe fn ` has an unsafe body, or `unsafe fn foo(...)
169
- -> ... unsafe { }` has an unsafe body, or ` unsafe_to_call fn` has a safe body.
170
-
171
173
# Prior art
172
174
[ prior-art ] : #prior-art
173
175
0 commit comments