Merge pull request #82192 from tshortli/safe-stdlib

stdlib: Fix missing `unsafe` operators in more places

Author: tshortli

stdlib/public/Cxx/std/String.swift

@@ -26,7 +26,7 @@ extension std.string {
       // Use the 2 parameter constructor.
       // The MSVC standard library has a enable_if template guard
       // on the 3 parameter constructor, and thus it's not imported into Swift.
-      std.string(buffer, string.utf8.count)
+      unsafe std.string(buffer, string.utf8.count)
 #else
       unsafe std.string(buffer, string.utf8.count, .init())
 #endif
@@ -40,7 +40,7 @@ extension std.string {
       // Use the 2 parameter constructor.
       // The MSVC standard library has a enable_if template guard
       // on the 3 parameter constructor, and thus it's not imported into Swift.
-      self.init(str, UTF8._nullCodeUnitOffset(in: str))
+      unsafe self.init(str, UTF8._nullCodeUnitOffset(in: str))
 #else
       unsafe self.init(str, UTF8._nullCodeUnitOffset(in: str), .init())
 #endif

stdlib/public/Distributed/LocalTestingDistributedActorSystem.swift

@@ -260,7 +260,7 @@ fileprivate class _Lock {
     #elseif os(WASI)
     // WASI environment has only a single thread
     #else
-    self.underlying = UnsafeMutablePointer.allocate(capacity: 1)
+    unsafe self.underlying = UnsafeMutablePointer.allocate(capacity: 1)
     guard unsafe pthread_mutex_init(self.underlying, nil) == 0 else {
       fatalError("pthread_mutex_init failed")
     }

stdlib/public/Synchronization/Mutex/LinuxImpl.swift

@@ -23,19 +23,19 @@ extension Atomic where Value == UInt32 {
   // This returns 'false' on success and 'true' on error. Check 'errno' for the
   // specific error value.
   internal borrowing func _futexLock() -> UInt32 {
-    _swift_stdlib_futex_lock(.init(_rawAddress))
+    unsafe _swift_stdlib_futex_lock(.init(_rawAddress))
   }
 
   // This returns 'false' on success and 'true' on error. Check 'errno' for the
   // specific error value.
   internal borrowing func _futexTryLock() -> UInt32 {
-    _swift_stdlib_futex_trylock(.init(_rawAddress))
+    unsafe _swift_stdlib_futex_trylock(.init(_rawAddress))
   }
 
   // This returns 'false' on success and 'true' on error. Check 'errno' for the
   // specific error value.
   internal borrowing func _futexUnlock() -> UInt32 {
-    _swift_stdlib_futex_unlock(.init(_rawAddress))
+    unsafe _swift_stdlib_futex_unlock(.init(_rawAddress))
   }
 }
 

stdlib/public/Synchronization/Mutex/WasmImpl.swift

@@ -26,7 +26,7 @@ internal func _swift_stdlib_wake(on: UnsafePointer<UInt32>, count: UInt32) -> UI
 extension Atomic where Value == _MutexHandle.State {
   internal borrowing func _wait(expected: _MutexHandle.State) {
     #if _runtime(_multithreaded)
-    _ = _swift_stdlib_wait(
+    _ = unsafe _swift_stdlib_wait(
       on: .init(_rawAddress),
       expected: expected.rawValue,
 
@@ -39,7 +39,7 @@ extension Atomic where Value == _MutexHandle.State {
   internal borrowing func _wake() {
     #if _runtime(_multithreaded)
     // Only wake up 1 thread
-    _ = _swift_stdlib_wake(on: .init(_rawAddress), count: 1)
+    _ = unsafe _swift_stdlib_wake(on: .init(_rawAddress), count: 1)
     #endif
   }
 }

stdlib/public/Synchronization/Mutex/WindowsImpl.swift

@@ -14,6 +14,7 @@ import WinSDK.core.synch
 
 @available(SwiftStdlib 6.0, *)
 @frozen
+@safe
 @_staticExclusiveOnly
 public struct _MutexHandle: ~Copyable {
   @usableFromInline
@@ -23,28 +24,28 @@ public struct _MutexHandle: ~Copyable {
   @_alwaysEmitIntoClient
   @_transparent
   public init() {
-    value = _Cell(SRWLOCK())
+    unsafe value = _Cell(SRWLOCK())
   }
 
   @available(SwiftStdlib 6.0, *)
   @_alwaysEmitIntoClient
   @_transparent
   internal borrowing func _lock() {
-    AcquireSRWLockExclusive(value._address)
+    unsafe AcquireSRWLockExclusive(value._address)
   }
 
   @available(SwiftStdlib 6.0, *)
   @_alwaysEmitIntoClient
   @_transparent
   internal borrowing func _tryLock() -> Bool {
     // Windows BOOLEAN gets imported as 'UInt8'...
-    TryAcquireSRWLockExclusive(value._address) != 0
+    unsafe TryAcquireSRWLockExclusive(value._address) != 0
   }
 
   @available(SwiftStdlib 6.0, *)
   @_alwaysEmitIntoClient
   @_transparent
   internal borrowing func _unlock() {
-    ReleaseSRWLockExclusive(value._address)
+    unsafe ReleaseSRWLockExclusive(value._address)
   }
 }

stdlib/public/core/CTypes.swift

@@ -314,19 +314,19 @@ public struct CVaListPointer {
        __vr_top: UnsafeMutablePointer<Int>?,
        __gr_off: Int32,
        __vr_off: Int32) {
-    _value = (__stack, __gr_top, __vr_top, __gr_off, __vr_off)
+    unsafe _value = (__stack, __gr_top, __vr_top, __gr_off, __vr_off)
   }
 }
 
 @_unavailableInEmbedded
 extension CVaListPointer: CustomDebugStringConvertible {
   @safe
   public var debugDescription: String {
-    return "(\(_value.__stack.debugDescription), " +
-           "\(_value.__gr_top.debugDescription), " +
-           "\(_value.__vr_top.debugDescription), " +
-           "\(_value.__gr_off), " +
-           "\(_value.__vr_off))"
+    return "(\(unsafe _value.__stack.debugDescription), " +
+           "\(unsafe _value.__gr_top.debugDescription), " +
+           "\(unsafe _value.__vr_top.debugDescription), " +
+           "\(unsafe _value.__gr_off), " +
+           "\(unsafe _value.__vr_off))"
   }
 }
 

stdlib/public/core/KeyPath.swift

@@ -3120,7 +3120,7 @@ internal func _resolveRelativeIndirectableAddress(_ base: UnsafeRawPointer,
 internal func _resolveCompactFunctionPointer(_ base: UnsafeRawPointer, _ offset: Int32)
     -> UnsafeRawPointer {
 #if SWIFT_COMPACT_ABSOLUTE_FUNCTION_POINTER
-  return UnsafeRawPointer(bitPattern: Int(offset))._unsafelyUnwrappedUnchecked
+  return unsafe UnsafeRawPointer(bitPattern: Int(offset))._unsafelyUnwrappedUnchecked
 #else
   return unsafe _resolveRelativeAddress(base, offset)
 #endif

stdlib/public/core/StaticPrint.swift

@@ -47,7 +47,7 @@ extension ConstantVPrintFInterpolation {
   public mutating func appendInterpolation(
     _ pointer: @autoclosure @escaping () -> UnsafeRawBufferPointer
   ) {
-    appendInterpolation(pointer().baseAddress!)
+    unsafe appendInterpolation(pointer().baseAddress!)
   }
 
   /// Defines interpolation for UnsafeRawPointer.
@@ -64,7 +64,7 @@ extension ConstantVPrintFInterpolation {
     _ pointer: @autoclosure @escaping () -> UnsafeRawPointer
   ) {
     formatString += "%p"
-    arguments.append(pointer)
+    unsafe arguments.append(pointer)
   }
 }
 
@@ -734,7 +734,7 @@ extension UnsafeRawPointer: CVarArg {
   /// appropriately interpreted by C varargs.
   @inlinable // c-abi
   public var _cVarArgEncoding: [Int] {
-    return _encodeBitsAsWords(self)
+    return unsafe _encodeBitsAsWords(self)
   }
 }
 
@@ -758,8 +758,8 @@ extension ConstantVPrintFArguments {
   @_optimize(none)
   internal mutating func append(_ value: @escaping () -> String) {
     argumentClosures.append({ continuation in
-      value().withCString { str in
-        continuation(str._cVarArgEncoding)
+      unsafe value().withCString { str in
+        unsafe continuation(str._cVarArgEncoding)
       }
     })
   }
@@ -817,15 +817,15 @@ internal func constant_vprintf_backend_recurse(
   if let closure = argumentClosures.first {
     closure { newArg in
       args.append(contentsOf: newArg)
-      constant_vprintf_backend_recurse(
+      unsafe constant_vprintf_backend_recurse(
         fmt: fmt,
         argumentClosures: argumentClosures.dropFirst(),
         args: &args
       )
     }
   } else {
-    _ = withVaList(args) { valist in
-      _swift_stdlib_vprintf(fmt, valist)
+    _ = unsafe withVaList(args) { valist in
+      unsafe _swift_stdlib_vprintf(fmt, valist)
     }
   }
 }
@@ -839,14 +839,14 @@ internal func constant_vprintf_backend(
   if let closure = argumentClosures.first {
     closure { newArg in
       args.append(contentsOf: newArg)
-      constant_vprintf_backend_recurse(
+      unsafe constant_vprintf_backend_recurse(
         fmt: fmt,
         argumentClosures: argumentClosures.dropFirst(),
         args: &args
       )
     }
   } else {
-    constant_vprintf_backend_recurse(
+    unsafe constant_vprintf_backend_recurse(
       fmt: fmt,
       argumentClosures: ArraySlice(argumentClosures),
       args: &args
@@ -864,7 +864,7 @@ public func print(_ message: ConstantVPrintFMessage) {
   let argumentClosures = message.interpolation.arguments.argumentClosures
   if Bool(_builtinBooleanLiteral: Builtin.ifdef_SWIFT_STDLIB_PRINT_DISABLED()) { return }
   let formatStringPointer = _getGlobalStringTablePointer(formatString)
-  constant_vprintf_backend(
+  unsafe constant_vprintf_backend(
     fmt: formatStringPointer,
     argumentClosures: argumentClosures
   )

stdlib/public/core/StringObject.swift

@@ -1005,7 +1005,7 @@ extension _StringObject {
       _internalInvariantFailure()
     }
     #if !$Embedded
-    return _unsafeUncheckedDowncast(storage, to: __StringStorage.self)
+    return unsafe _unsafeUncheckedDowncast(storage, to: __StringStorage.self)
     #else
     return Builtin.castFromNativeObject(storage)
     #endif
@@ -1044,7 +1044,7 @@ extension _StringObject {
       _internalInvariantFailure()
     }
     #if !$Embedded
-    return _unsafeUncheckedDowncast(storage, to: __SharedStringStorage.self)
+    return unsafe _unsafeUncheckedDowncast(storage, to: __SharedStringStorage.self)
     #else
     return Builtin.castFromNativeObject(storage)
     #endif

stdlib/public/core/UInt128.swift

@@ -47,7 +47,7 @@ public struct UInt128: Sendable {
 #if _endian(little)
     self = unsafe unsafeBitCast((_low, _high), to: Self.self)
 #else
-    self = unsafeBitCast((_high, _low), to: Self.self)
+    self = unsafe unsafeBitCast((_high, _low), to: Self.self)
 #endif
   }