Systems Programming · Cluster
Unsafe Code
Invariants the compiler cannot check.
- 01 What the Unsafe Keyword Actually Disables The unsafe marker gates a short, enumerable list of operations rather than switching off the type system, and the obligations it transfers reach past the block that names it.
- 02 Undefined Behaviour as a Compiler Permission Why the optimiser treats undefined behaviour as a promise about what never happens, and how that promise lets it delete checks, fold comparisons, and reorder loads.
- 03 Pointer Provenance and the Cost of Integer Round-Trips A pointer carries more than an address, and converting it to an integer and back can discard the derivation the optimiser needs to justify its transformations.
- 04 Strict Aliasing and the Cases Where Type Punning Is Legal The effective type rules permit far more access through differing types than the folklore suggests, and the sanctioned escape hatches are narrower than the compiler flags that disable the analysis.
- 05 Aliasing Rules for References and the Role of UnsafeCell A shared reference is a promise of immutability that the optimiser acts on, and UnsafeCell is the single opt-out that makes interior mutability representable without lying to the compiler.
- 06 Uninitialised Memory, Padding, and the Cost of Assuming Zero Uninitialised bytes are not merely arbitrary values, they are a distinct state the optimiser tracks, and the distinction changes what a byte copy, a comparison, and a length assignment may legally do.
- 07 What Makes a Safe Wrapper Around Unsafe Code Sound A safe function that can cause undefined behaviour from any call site destroys the guarantee for the entire crate graph, and the obligations that prevent it are structural rather than local.
- 08 Ownership Across the FFI Boundary and Who Frees What Two runtimes with two allocators meet at a foreign function call, and every pointer that crosses must have an unambiguous owner, layout, and deallocation routine.
- 09 Inline Assembly Constraints and What a Clobber List Does Not Say A compiler knows nothing about the instructions inside an assembly block, so every register, flag, and memory effect has to be declared, and an undeclared effect is silently miscompiled.
- 10 What Sanitizers and Miri Cannot Prove Instrumentation detects violations on the paths an execution took, and an interpreter sees only the code it can run, so both produce evidence of bugs rather than evidence of their absence.