diff options
| author | Alfie John <alfiej@fastmail.fm> | 2014-11-19 12:43:13 +0000 |
|---|---|---|
| committer | Alfie John <alfiej@fastmail.fm> | 2014-11-19 12:43:13 +0000 |
| commit | e0b0c83138236ba1b2d532f79647ee45f7824741 (patch) | |
| tree | 77eba8da9a733be93928691655406fcadab97f03 | |
| parent | cf7df1e6382e239619a8447719c3c19787d7b60d (diff) | |
| download | rust-e0b0c83138236ba1b2d532f79647ee45f7824741.tar.gz rust-e0b0c83138236ba1b2d532f79647ee45f7824741.zip | |
doc: clarifying unsafe code vs undefined behavior
| -rw-r--r-- | src/doc/reference.md | 17 |
1 files changed, 8 insertions, 9 deletions
diff --git a/src/doc/reference.md b/src/doc/reference.md index 62e0f5e4f1f..8f0516aca18 100644 --- a/src/doc/reference.md +++ b/src/doc/reference.md @@ -1117,13 +1117,13 @@ Rust: ##### Unsafe functions Unsafe functions are functions that are not safe in all contexts and/or for all -possible inputs. Such a function must be prefixed with the keyword `unsafe`. +possible inputs. Such a function must be prefixed with the keyword `unsafe` and +can only be called from an `unsafe` block or another `unsafe` function. ##### Unsafe blocks -A block of code can also be prefixed with the `unsafe` keyword, to permit -calling `unsafe` functions or dereferencing raw pointers within a safe -function. +A block of code can be prefixed with the `unsafe` keyword, to permit calling +`unsafe` functions or dereferencing raw pointers within a safe function. When a programmer has sufficient conviction that a sequence of potentially unsafe operations is actually safe, they can encapsulate that sequence (taken @@ -1143,12 +1143,11 @@ represented with reference-counted pointers in safe code. By using `unsafe` blocks to represent the reverse links as raw pointers, it can be implemented with only boxes. -##### Behavior considered unsafe +##### Behavior considered undefined -This is a list of behavior which is forbidden in all Rust code. Type checking -provides the guarantee that these issues are never caused by safe code. An -`unsafe` block or function is responsible for never invoking this behaviour or -exposing an API making it possible for it to occur in safe code. +The following is a list of behavior which is forbidden in all Rust code, +including within `unsafe` blocks and `unsafe` functions. Type checking provides +the guarantee that these issues are never caused by safe code. * Data races * Dereferencing a null/dangling raw pointer |