Safety annotations in core.stdc. #261
Conversation
|
Now green everywhere (previous failures were unrelated). |
|
Nice. You made a lot of decision why certain functions are not marked |
|
OK, I'll go over and add more comments about safety decisions to the code later today. |
|
I've rebased with some comments on the annotations. Generally, I consider anything that mutates processor state or operates on unsafe stuff like C strings |
Minor change to core.thread since some internal functions were made private.
| int fclose(FILE* stream); | ||
| int fflush(FILE* stream); | ||
| // No unsafe pointer manipulation. | ||
| @trusted |
There was a problem hiding this comment.
Nonono, fclose isn't trusted. It invalidates memory pointed to by stream.
There was a problem hiding this comment.
Good catch. Will mark it @system.
| // We don't mark these @trusted. Given that they return a void*, one has | ||
| // to do a pointer cast to do anything sensible with the result. Thus, | ||
| // functions using these already have to be @trusted, allowing them to | ||
| // call @system stuff anyway. | ||
| void* malloc(size_t size); |
There was a problem hiding this comment.
I think we can provide a simple @trusted interface for malloc and calloc that work with a category of types (e.g. numeric types) and return a T[]. Of course this is not the place...
There was a problem hiding this comment.
I figured something like that would probably fit better in the allocators design.
|
Looks ready except as noted. |
Safety annotations in core.stdc.
|
|
|
@d-random-contributor thanks for the note. Here "trusted" has a restricted meaning - it's only about memory safety, not general security. |
|
Fields of |
Minor change to core.thread since some internal functions were made private.
This marks almost everything in
core.stdcas@trusted. I also added somenothrowannotations while I was there.