Mark extern blocks as unsafe

Author: compiler-errors

library/alloc/src/alloc.rs

@@ -10,7 +10,7 @@ use core::hint;
 #[cfg(not(test))]
 use core::ptr::{self, NonNull};
 
-extern "Rust" {
+unsafe extern "Rust" {
     // These are the magic symbols to call the global allocator. rustc generates
     // them to call `__rg_alloc` etc. if there is a `#[global_allocator]` attribute
     // (the code expanding that attribute macro generates those functions), or to call
@@ -355,7 +355,7 @@ unsafe fn exchange_malloc(size: usize, align: usize) -> *mut u8 {
 // # Allocation error handler
 
 #[cfg(not(no_global_oom_handling))]
-extern "Rust" {
+unsafe extern "Rust" {
     // This is the magic symbol to call the global alloc error handler. rustc generates
     // it to call `__rg_oom` if there is a `#[alloc_error_handler]`, or to call the
     // default implementations below (`__rdl_oom`) otherwise.
@@ -426,7 +426,7 @@ pub mod __alloc_error_handler {
     // `#[alloc_error_handler]`.
     #[rustc_std_internal_symbol]
     pub unsafe fn __rdl_oom(size: usize, _align: usize) -> ! {
-        extern "Rust" {
+        unsafe extern "Rust" {
             // This symbol is emitted by rustc next to __rust_alloc_error_handler.
             // Its value depends on the -Zoom={panic,abort} compiler option.
             static __rust_alloc_error_handler_should_panic: u8;

library/alloc/src/ffi/c_str.rs

@@ -397,7 +397,7 @@ impl CString {
         // information about the size of the allocation is correct on Rust's
         // side.
         unsafe {
-            extern "C" {
+            unsafe extern "C" {
                 /// Provided by libc or compiler_builtins.
                 fn strlen(s: *const c_char) -> usize;
             }

library/core/src/ffi/c_str.rs

@@ -731,7 +731,7 @@ const unsafe fn strlen(ptr: *const c_char) -> usize {
 
             len
         } else {
-            extern "C" {
+            unsafe extern "C" {
                 /// Provided by libc or compiler_builtins.
                 fn strlen(s: *const c_char) -> usize;
             }

library/core/src/ffi/mod.rs

@@ -90,4 +90,4 @@ impl fmt::Debug for c_void {
     cfg(not(target_feature = "crt-static"))
 )]
 #[link(name = "/defaultlib:libcmt", modifiers = "+verbatim", cfg(target_feature = "crt-static"))]
-extern "C" {}
+unsafe extern "C" {}

library/core/src/intrinsics/mod.rs

@@ -4855,7 +4855,7 @@ pub const unsafe fn copysignf128(_x: f128, _y: f128) -> f128 {
 #[cfg(miri)]
 #[rustc_allow_const_fn_unstable(const_eval_select)]
 pub(crate) const fn miri_promise_symbolic_alignment(ptr: *const (), align: usize) {
-    extern "Rust" {
+    unsafe extern "Rust" {
         /// Miri-provided extern function to promise that a given pointer is properly aligned for
         /// "symbolic" alignment checks. Will fail if the pointer is not actually aligned or `align` is
         /// not a power of two. Has no effect when alignment checks are concrete (which is the default).

library/core/src/panicking.rs

@@ -59,7 +59,7 @@ pub const fn panic_fmt(fmt: fmt::Arguments<'_>) -> ! {
 
     // NOTE This function never crosses the FFI boundary; it's a Rust-to-Rust call
     // that gets resolved to the `#[panic_handler]` function.
-    extern "Rust" {
+    unsafe extern "Rust" {
         #[lang = "panic_impl"]
         fn panic_impl(pi: &PanicInfo<'_>) -> !;
     }
@@ -100,7 +100,7 @@ pub const fn panic_nounwind_fmt(fmt: fmt::Arguments<'_>, force_no_backtrace: boo
 
             // NOTE This function never crosses the FFI boundary; it's a Rust-to-Rust call
             // that gets resolved to the `#[panic_handler]` function.
-            extern "Rust" {
+            unsafe extern "Rust" {
                 #[lang = "panic_impl"]
                 fn panic_impl(pi: &PanicInfo<'_>) -> !;
             }

library/core/src/ptr/metadata.rs

@@ -155,7 +155,7 @@ pub struct DynMetadata<Dyn: ?Sized> {
     _phantom: crate::marker::PhantomData<Dyn>,
 }
 
-extern "C" {
+unsafe extern "C" {
     /// Opaque type for accessing vtables.
     ///
     /// Private implementation detail of `DynMetadata::size_of` etc.

library/coretests/tests/mem.rs

@@ -648,7 +648,7 @@ fn offset_of_dst() {
         z: dyn Trait,
     }
 
-    extern "C" {
+    unsafe extern "C" {
         type Extern;
     }
 

library/coretests/tests/num/flt2dec/mod.rs

@@ -80,7 +80,7 @@ fn ldexp_f32(a: f32, b: i32) -> f32 {
 }
 
 fn ldexp_f64(a: f64, b: i32) -> f64 {
-    extern "C" {
+    unsafe extern "C" {
         fn ldexp(x: f64, n: i32) -> f64;
     }
     // SAFETY: assuming a correct `ldexp` has been supplied, the given arguments cannot possibly

library/coretests/tests/ptr.rs

@@ -97,7 +97,7 @@ fn test_is_null() {
     let nmi: *mut dyn ToString = null_mut::<isize>();
     assert!(nmi.is_null());
 
-    extern "C" {
+    unsafe extern "C" {
         type Extern;
     }
     let ec: *const Extern = null::<Extern>();
@@ -308,7 +308,7 @@ fn test_const_nonnull_new() {
 pub fn test_variadic_fnptr() {
     use core::ffi;
     use core::hash::{Hash, SipHasher};
-    extern "C" {
+    unsafe extern "C" {
         // This needs to use the correct function signature even though it isn't called as some
         // codegen backends make it UB to declare a function with multiple conflicting signatures
         // (like LLVM) while others straight up return an error (like Cranelift).
@@ -506,7 +506,7 @@ fn offset_from() {
 fn ptr_metadata() {
     struct Unit;
     struct Pair<A, B: ?Sized>(A, B);
-    extern "C" {
+    unsafe extern "C" {
         type Extern;
     }
     let () = metadata(&());