Deny unsafe operations in unsafe fns in libstd/sync/

src/libstd/sync/mod.rs

@@ -149,6 +149,7 @@
 //! [`Once`]: crate::sync::Once
 //! [`RwLock`]: crate::sync::RwLock
 
+#![deny(unsafe_op_in_unsafe_fn)]
 #![stable(feature = "rust1", since = "1.0.0")]
 
 #[stable(feature = "rust1", since = "1.0.0")]

src/libstd/sync/mpsc/blocking.rs

@@ -47,14 +47,18 @@ impl SignalToken {
     /// flag.
     #[inline]
     pub unsafe fn cast_to_usize(self) -> usize {
-        mem::transmute(self.inner)
+        // SAFETY: this ok because of the internal represention of Arc, which
+        // is a pointer and phantom data (so the size of a pointer -> a usize).
+        unsafe { mem::transmute(self.inner) }
     }
 
     /// Converts from an unsafe usize value. Useful for retrieving a pipe's state
     /// flag.
     #[inline]
     pub unsafe fn cast_from_usize(signal_ptr: usize) -> SignalToken {
-        SignalToken { inner: mem::transmute(signal_ptr) }
+        // SAFETY: this ok because of the internal represention of Arc, which
+        // is a pointer and phantom data (so the size of a pointer -> a usize).
+        SignalToken { inner: unsafe { mem::transmute(signal_ptr) } }
     }
 }
 

src/libstd/sync/mpsc/mod.rs

@@ -648,10 +648,18 @@ enum Flavor<T> {
 trait UnsafeFlavor<T> {
     fn inner_unsafe(&self) -> &UnsafeCell<Flavor<T>>;
     unsafe fn inner_mut(&self) -> &mut Flavor<T> {
-        &mut *self.inner_unsafe().get()
+        // SAFETY: We are sure the inner value will never be NUL when this is
+        // called, the invariants of the module make it so.
+        //
+        // It is also ensured that no other (mutable) reference will be handed
+        // out while the one returned here is in action.
+        unsafe { &mut *self.inner_unsafe().get() }
     }
     unsafe fn inner(&self) -> &Flavor<T> {
-        &*self.inner_unsafe().get()
+        // SAFETY: We are sure the inner value will never be NUL when this is
+        // called, the invariants of the module make it so nor will any mutable
+        // reference be active while this one is.
+        unsafe { &*self.inner_unsafe().get() }
     }
 }
 impl<T> UnsafeFlavor<T> for Sender<T> {

src/libstd/sync/mpsc/spsc_queue.rs

@@ -99,7 +99,9 @@ impl<T, ProducerAddition, ConsumerAddition> Queue<T, ProducerAddition, ConsumerA
     ) -> Self {
         let n1 = Node::new();
         let n2 = Node::new();
-        (*n1).next.store(n2, Ordering::Relaxed);
+        // SAFETY: At this point we know the pointer is not NUL since it was
+        // build just above.
+        unsafe { (*n1).next.store(n2, Ordering::Relaxed) }
         Queue {
             consumer: CacheAligned::new(Consumer {
                 tail: UnsafeCell::new(n2),
@@ -134,18 +136,25 @@ impl<T, ProducerAddition, ConsumerAddition> Queue<T, ProducerAddition, ConsumerA
 
     unsafe fn alloc(&self) -> *mut Node<T> {
         // First try to see if we can consume the 'first' node for our uses.
-        if *self.producer.first.get() != *self.producer.tail_copy.get() {
-            let ret = *self.producer.first.get();
-            *self.producer.0.first.get() = (*ret).next.load(Ordering::Relaxed);
-            return ret;
-        }
-        // If the above fails, then update our copy of the tail and try
-        // again.
-        *self.producer.0.tail_copy.get() = self.consumer.tail_prev.load(Ordering::Acquire);
-        if *self.producer.first.get() != *self.producer.tail_copy.get() {
-            let ret = *self.producer.first.get();
-            *self.producer.0.first.get() = (*ret).next.load(Ordering::Relaxed);
-            return ret;
+        // SAFEY: Since `self` is a valid reference, accessing its inner values
+        // can be considered safe (without checking for NUL pointers).
+        //
+        // Dereferencing of `ret` are safe too because the pointer comes from
+        // `self` once again.
+        unsafe {
+            if *self.producer.first.get() != *self.producer.tail_copy.get() {
+                let ret = *self.producer.first.get();
+                *self.producer.0.first.get() = (*ret).next.load(Ordering::Relaxed);
+                return ret;
+            }
+            // If the above fails, then update our copy of the tail and try
+            // again.
+            *self.producer.0.tail_copy.get() = self.consumer.tail_prev.load(Ordering::Acquire);
+            if *self.producer.first.get() != *self.producer.tail_copy.get() {
+                let ret = *self.producer.first.get();
+                *self.producer.0.first.get() = (*ret).next.load(Ordering::Relaxed);
+                return ret;
+            }
         }
         // If all of that fails, then we have to allocate a new node
         // (there's nothing in the node cache).