-
Notifications
You must be signed in to change notification settings - Fork 15
/
unsafe.h
79 lines (69 loc) · 2.66 KB
/
unsafe.h
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
// Copyright 2022 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// https://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
// IWYU pragma: private, include "sus/prelude.h"
// IWYU pragma: friend "sus/.*"
#pragma once
#include "fmt/core.h"
#include "sus/string/__private/format_to_stream.h"
namespace sus {
/// Marker types, such as for accessing unsafe APIs, for overload resolution,
/// or type elision.
namespace marker {}
} // namespace sus
namespace sus::marker {
/// A marker that designates a function as unsafe, or containing Undefined
/// Behaviour if its preconditions are not met.
///
/// Use of an unsafe function should require a comment documenting how the
/// required preconditions are met in the form:
///
/// ```
/// // SAFETY: This is known to be true because of that which we checked there.
/// do_risky_thing(unsafe_fn);
/// ```
///
/// Input conditions of the unsafe function should be well encapsulated so that
/// it is even possible to reason about how they are met and to maintain that
/// over time.
///
/// To call such an unsafe function, pass it the global [`unsafe_fn`](
/// $sus::marker::unsafe_fn) object, which is brought into the global namespace
/// by `#include "sus/prelude.h"`.
struct UnsafeFnMarker {
/// `explicit` prevents `{}` or `{any values...}` from being used to construct
/// an `UnsafeFnMarker`. The marker should only be used as [`unsafe_fn`](
/// $sus::marker::unsafe_fn).
/// #[doc.hidden]
explicit consteval UnsafeFnMarker() {}
};
/// The global [`UnsafeFnMarker`]($sus::marker::UnsafeFnMarker) which can be
/// passed to unsafe functions. See the [`UnsafeFnMarker`](
/// $sus::marker::UnsafeFnMarker) type for an explanation.
constexpr inline auto unsafe_fn = UnsafeFnMarker();
} // namespace sus::marker
// fmt support.
template <class Char>
struct fmt::formatter<::sus::marker::UnsafeFnMarker, Char> {
template <class ParseContext>
constexpr auto parse(ParseContext& ctx) {
return ctx.begin();
}
template <class FormatContext>
constexpr auto format(const ::sus::marker::UnsafeFnMarker&,
FormatContext& ctx) const {
return fmt::format_to(ctx.out(), "unsafe_fn");
}
};
// Stream support.
_sus_format_to_stream(sus::marker, UnsafeFnMarker);