core: remove unnecessary unsafe blocks/functions

src/libcore/comm.rs

@@ -188,16 +188,14 @@ impl<T: Owned> Peekable<T> for Port<T> {
 
 #[inline(always)]
 fn port_peek<T:Owned>(self: &Port<T>) -> bool {
-    unsafe {
+    let mut endp = None;
-        let mut endp = None;
+    endp <-> self.endp;
-        endp <-> self.endp;
+    let peek = match &endp {
-        let peek = match &endp {
+        &Some(ref endp) => peek(endp),
-            &Some(ref endp) => peek(endp),
+        &None => fail!(~"peeking empty stream")
-            &None => fail!(~"peeking empty stream")
+    };
-        };
+    self.endp <-> endp;
-        self.endp <-> endp;
+    peek
-        peek
-    }
 }
 
 impl<T: Owned> Selectable for Port<T> {

src/libcore/io.rs

@@ -1536,11 +1536,8 @@ pub fn with_bytes_writer(f: &fn(@Writer)) -> ~[u8] {
 pub fn with_str_writer(f: &fn(@Writer)) -> ~str {
     let mut v = with_bytes_writer(f);
 
-    // FIXME (#3758): This should not be needed.
+    // Make sure the vector has a trailing null and is proper utf8.
-    unsafe {
+    v.push(0);
-        // Make sure the vector has a trailing null and is proper utf8.
-        v.push(0);
-    }
     assert!(str::is_utf8(v));
 
     unsafe { ::cast::transmute(v) }
@@ -1640,16 +1637,14 @@ pub mod fsync {
     // outer res
     pub fn FILE_res_sync(file: &FILERes, opt_level: Option<Level>,
                          blk: &fn(v: Res<*libc::FILE>)) {
-        unsafe {
+        blk(Res(Arg {
-            blk(Res(Arg {
+            val: file.f, opt_level: opt_level,
-                val: file.f, opt_level: opt_level,
+            fsync_fn: |file, l| {
-                fsync_fn: |file, l| {
+                unsafe {
-                    unsafe {
+                    os::fsync_fd(libc::fileno(file), l) as int
-                        os::fsync_fd(libc::fileno(file), l) as int
-                    }
                 }
-            }));
+            }
-        }
+        }));
     }
 
     // fsync fd after executing blk

src/libcore/managed.rs

@@ -38,13 +38,13 @@ pub mod raw {
 #[inline(always)]
 pub fn ptr_eq<T>(a: @T, b: @T) -> bool {
     //! Determine if two shared boxes point to the same object
-    unsafe { ptr::addr_of(&(*a)) == ptr::addr_of(&(*b)) }
+    ptr::addr_of(&(*a)) == ptr::addr_of(&(*b))
 }
 
 #[inline(always)]
 pub fn mut_ptr_eq<T>(a: @mut T, b: @mut T) -> bool {
     //! Determine if two mutable shared boxes point to the same object
-    unsafe { ptr::addr_of(&(*a)) == ptr::addr_of(&(*b)) }
+    ptr::addr_of(&(*a)) == ptr::addr_of(&(*b))
 }
 
 #[cfg(notest)]

src/libcore/num/float.rs

@@ -369,27 +369,27 @@ pub fn is_NaN(x: float) -> bool { f64::is_NaN(x as f64) }
 
 #[inline(always)]
 pub fn abs(x: float) -> float {
-    unsafe { f64::abs(x as f64) as float }
+    f64::abs(x as f64) as float
 }
 #[inline(always)]
 pub fn sqrt(x: float) -> float {
-    unsafe { f64::sqrt(x as f64) as float }
+    f64::sqrt(x as f64) as float
 }
 #[inline(always)]
 pub fn atan(x: float) -> float {
-    unsafe { f64::atan(x as f64) as float }
+    f64::atan(x as f64) as float
 }
 #[inline(always)]
 pub fn sin(x: float) -> float {
-    unsafe { f64::sin(x as f64) as float }
+    f64::sin(x as f64) as float
 }
 #[inline(always)]
 pub fn cos(x: float) -> float {
-    unsafe { f64::cos(x as f64) as float }
+    f64::cos(x as f64) as float
 }
 #[inline(always)]
 pub fn tan(x: float) -> float {
-    unsafe { f64::tan(x as f64) as float }
+    f64::tan(x as f64) as float
 }
 
 #[cfg(notest)]

src/libcore/path.rs

@@ -389,13 +389,11 @@ impl GenericPath for PosixPath {
     }
 
     fn dirname(&self) -> ~str {
-        unsafe {
+        let s = self.dir_path().to_str();
-            let s = self.dir_path().to_str();
+        if s.len() == 0 {
-            if s.len() == 0 {
+            ~"."
-                ~"."
+        } else {
-            } else {
+            s
-                s
-            }
         }
     }
 
@@ -439,10 +437,8 @@ impl GenericPath for PosixPath {
     }
 
     fn with_filename(&self, f: &str) -> PosixPath {
-        unsafe {
+        assert!(! str::any(f, |c| windows::is_sep(c as u8)));
-            assert!(! str::any(f, |c| windows::is_sep(c as u8)));
+        self.dir_path().push(f)
-            self.dir_path().push(f)
-        }
     }
 
     fn with_filestem(&self, s: &str) -> PosixPath {
@@ -509,7 +505,7 @@ impl GenericPath for PosixPath {
             for str::each_split_nonempty(*e, |c| windows::is_sep(c as u8)) |s| {
                 ss.push(s.to_owned())
             }
-            unsafe { v.push_all_move(ss); }
+            v.push_all_move(ss);
         }
         PosixPath { is_absolute: self.is_absolute,
                     components: v }
@@ -521,14 +517,14 @@ impl GenericPath for PosixPath {
         for str::each_split_nonempty(s, |c| windows::is_sep(c as u8)) |s| {
             ss.push(s.to_owned())
         }
-        unsafe { v.push_all_move(ss); }
+        v.push_all_move(ss);
         PosixPath { components: v, ..copy *self }
     }
 
     fn pop(&self) -> PosixPath {
         let mut cs = copy self.components;
         if cs.len() != 0 {
-            unsafe { cs.pop(); }
+            cs.pop();
         }
         return PosixPath {
             is_absolute: self.is_absolute,
@@ -607,13 +603,11 @@ impl GenericPath for WindowsPath {
     }
 
     fn dirname(&self) -> ~str {
-        unsafe {
+        let s = self.dir_path().to_str();
-            let s = self.dir_path().to_str();
+        if s.len() == 0 {
-            if s.len() == 0 {
+            ~"."
-                ~"."
+        } else {
-            } else {
+            s
-                s
-            }
         }
     }
 
@@ -770,7 +764,7 @@ impl GenericPath for WindowsPath {
             for str::each_split_nonempty(*e, |c| windows::is_sep(c as u8)) |s| {
                 ss.push(s.to_owned())
             }
-            unsafe { v.push_all_move(ss); }
+            v.push_all_move(ss);
         }
         // tedious, but as-is, we can't use ..self
         return WindowsPath {
@@ -787,14 +781,14 @@ impl GenericPath for WindowsPath {
         for str::each_split_nonempty(s, |c| windows::is_sep(c as u8)) |s| {
             ss.push(s.to_owned())
         }
-        unsafe { v.push_all_move(ss); }
+        v.push_all_move(ss);
         return WindowsPath { components: v, ..copy *self }
     }
 
     fn pop(&self) -> WindowsPath {
         let mut cs = copy self.components;
         if cs.len() != 0 {
-            unsafe { cs.pop(); }
+            cs.pop();
         }
         return WindowsPath {
             host: copy self.host,
@@ -820,18 +814,14 @@ impl GenericPath for WindowsPath {
 
 pub fn normalize(components: &[~str]) -> ~[~str] {
     let mut cs = ~[];
-    unsafe {
+    for components.each |c| {
-        for components.each |c| {
+        if *c == ~"." && components.len() > 1 { loop; }
-            unsafe {
+        if *c == ~"" { loop; }
-                if *c == ~"." && components.len() > 1 { loop; }
+        if *c == ~".." && cs.len() != 0 {
-                if *c == ~"" { loop; }
+            cs.pop();
-                if *c == ~".." && cs.len() != 0 {
+            loop;
-                    cs.pop();
-                    loop;
-                }
-                cs.push(copy *c);
-            }
         }
+        cs.push(copy *c);
     }
     cs
 }

src/libcore/ptr.rs

@@ -55,17 +55,13 @@ pub fn addr_of<T>(val: &T) -> *T { unsafe { rusti::addr_of(*val) } }
 /// Calculate the offset from a pointer
 #[inline(always)]
 pub fn offset<T>(ptr: *T, count: uint) -> *T {
-    unsafe {
+    (ptr as uint + count * sys::size_of::<T>()) as *T
-        (ptr as uint + count * sys::size_of::<T>()) as *T
-    }
 }
 
 /// Calculate the offset from a const pointer
 #[inline(always)]
 pub fn const_offset<T>(ptr: *const T, count: uint) -> *const T {
-    unsafe {
+    (ptr as uint + count * sys::size_of::<T>()) as *T
-        (ptr as uint + count * sys::size_of::<T>()) as *T
-    }
 }
 
 /// Calculate the offset from a mut pointer

src/libcore/rt/context.rs

@@ -205,8 +205,6 @@ fn align_down(sp: *mut uint) -> *mut uint {
 #[inline(always)]
 pub fn mut_offset<T>(ptr: *mut T, count: int) -> *mut T {
     use core::sys::size_of;
-    unsafe {
+    (ptr as int + count * (size_of::<T>() as int)) as *mut T
-        (ptr as int + count * (size_of::<T>() as int)) as *mut T
-    }
 }
 

src/libcore/rt/thread_local_storage.rs

@@ -21,17 +21,17 @@ pub type Key = pthread_key_t;
 
 #[cfg(unix)]
 pub unsafe fn create(key: &mut Key) {
-    unsafe { assert!(0 == pthread_key_create(key, null())); }
+    assert!(0 == pthread_key_create(key, null()));
 }
 
 #[cfg(unix)]
 pub unsafe fn set(key: Key, value: *mut c_void) {
-    unsafe { assert!(0 == pthread_setspecific(key, value)); }
+    assert!(0 == pthread_setspecific(key, value));
 }
 
 #[cfg(unix)]
 pub unsafe fn get(key: Key) -> *mut c_void {
-    unsafe { pthread_getspecific(key) }
+    pthread_getspecific(key)
 }
 
 #[cfg(target_os="macos")]

src/libcore/run.rs

@@ -382,64 +382,62 @@ pub struct ProgramOutput {status: int, out: ~str, err: ~str}
  * the contents of stdout and the contents of stderr.
  */
 pub fn program_output(prog: &str, args: &[~str]) -> ProgramOutput {
-    unsafe {
+    let pipe_in = os::pipe();
-        let pipe_in = os::pipe();
+    let pipe_out = os::pipe();
-        let pipe_out = os::pipe();
+    let pipe_err = os::pipe();
-        let pipe_err = os::pipe();
+    let pid = spawn_process(prog, args, &None, &None,
-        let pid = spawn_process(prog, args, &None, &None,
+                            pipe_in.in, pipe_out.out, pipe_err.out);
-                                pipe_in.in, pipe_out.out, pipe_err.out);
-
-        os::close(pipe_in.in);
-        os::close(pipe_out.out);
-        os::close(pipe_err.out);
-        if pid == -1i32 {
-            os::close(pipe_in.out);
-            os::close(pipe_out.in);
-            os::close(pipe_err.in);
-            fail!();
-        }
 
+    os::close(pipe_in.in);
+    os::close(pipe_out.out);
+    os::close(pipe_err.out);
+    if pid == -1i32 {
         os::close(pipe_in.out);
-
+        os::close(pipe_out.in);
-        // Spawn two entire schedulers to read both stdout and sterr
+        os::close(pipe_err.in);
-        // in parallel so we don't deadlock while blocking on one
+        fail!();
-        // or the other. FIXME (#2625): Surely there's a much more
-        // clever way to do this.
-        let (p, ch) = stream();
-        let ch = SharedChan(ch);
-        let ch_clone = ch.clone();
-        do task::spawn_sched(task::SingleThreaded) {
-            let errput = readclose(pipe_err.in);
-            ch.send((2, errput));
-        };
-        do task::spawn_sched(task::SingleThreaded) {
-            let output = readclose(pipe_out.in);
-            ch_clone.send((1, output));
-        };
-        let status = run::waitpid(pid);
-        let mut errs = ~"";
-        let mut outs = ~"";
-        let mut count = 2;
-        while count > 0 {
-            let stream = p.recv();
-            match stream {
-                (1, copy s) => {
-                    outs = s;
-                }
-                (2, copy s) => {
-                    errs = s;
-                }
-                (n, _) => {
-                    fail!(fmt!("program_output received an unexpected file \
-                               number: %u", n));
-                }
-            };
-            count -= 1;
-        };
-        return ProgramOutput {status: status,
-                              out: outs,
-                              err: errs};
     }
+
+    os::close(pipe_in.out);
+
+    // Spawn two entire schedulers to read both stdout and sterr
+    // in parallel so we don't deadlock while blocking on one
+    // or the other. FIXME (#2625): Surely there's a much more
+    // clever way to do this.
+    let (p, ch) = stream();
+    let ch = SharedChan(ch);
+    let ch_clone = ch.clone();
+    do task::spawn_sched(task::SingleThreaded) {
+        let errput = readclose(pipe_err.in);
+        ch.send((2, errput));
+    };
+    do task::spawn_sched(task::SingleThreaded) {
+        let output = readclose(pipe_out.in);
+        ch_clone.send((1, output));
+    };
+    let status = run::waitpid(pid);
+    let mut errs = ~"";
+    let mut outs = ~"";
+    let mut count = 2;
+    while count > 0 {
+        let stream = p.recv();
+        match stream {
+            (1, copy s) => {
+                outs = s;
+            }
+            (2, copy s) => {
+                errs = s;
+            }
+            (n, _) => {
+                fail!(fmt!("program_output received an unexpected file \
+                           number: %u", n));
+            }
+        };
+        count -= 1;
+    };
+    return ProgramOutput {status: status,
+                          out: outs,
+                          err: errs};
 }
 
 pub fn writeclose(fd: c_int, s: ~str) {

src/libcore/str.rs

@@ -170,18 +170,16 @@ pub fn push_char(s: &mut ~str, ch: char) {
 /// Convert a char to a string
 pub fn from_char(ch: char) -> ~str {
     let mut buf = ~"";
-    unsafe { push_char(&mut buf, ch); }
+    push_char(&mut buf, ch);
     buf
 }
 
 /// Convert a vector of chars to a string
 pub fn from_chars(chs: &[char]) -> ~str {
     let mut buf = ~"";
-    unsafe {
+    reserve(&mut buf, chs.len());
-        reserve(&mut buf, chs.len());
+    for vec::each(chs) |ch| {
-        for vec::each(chs) |ch| {
+        push_char(&mut buf, *ch);
-            push_char(&mut buf, *ch);
-        }
     }
     buf
 }
@@ -226,9 +224,7 @@ pub fn push_str(lhs: &mut ~str, rhs: &str) {
 #[inline(always)]
 pub fn append(lhs: ~str, rhs: &str) -> ~str {
     let mut v = lhs;
-    unsafe {
+    push_str_no_overallocate(&mut v, rhs);
-        push_str_no_overallocate(&mut v, rhs);
-    }
     v
 }
 
@@ -236,7 +232,7 @@ pub fn append(lhs: ~str, rhs: &str) -> ~str {
 pub fn concat(v: &[~str]) -> ~str {
     let mut s: ~str = ~"";
     for vec::each(v) |ss| {
-        unsafe { push_str(&mut s, *ss) };
+        push_str(&mut s, *ss);
     }
     s
 }
@@ -245,8 +241,8 @@ pub fn concat(v: &[~str]) -> ~str {
 pub fn connect(v: &[~str], sep: &str) -> ~str {
     let mut s = ~"", first = true;
     for vec::each(v) |ss| {
-        if first { first = false; } else { unsafe { push_str(&mut s, sep); } }
+        if first { first = false; } else { push_str(&mut s, sep); }
-        unsafe { push_str(&mut s, *ss) };
+        push_str(&mut s, *ss);
     }
     s
 }
@@ -255,8 +251,8 @@ pub fn connect(v: &[~str], sep: &str) -> ~str {
 pub fn connect_slices(v: &[&str], sep: &str) -> ~str {
     let mut s = ~"", first = true;
     for vec::each(v) |ss| {
-        if first { first = false; } else { unsafe { push_str(&mut s, sep); } }
+        if first { first = false; } else { push_str(&mut s, sep); }
-        unsafe { push_str(&mut s, *ss) };
+        push_str(&mut s, *ss);
     }
     s
 }
@@ -2251,16 +2247,14 @@ pub mod raw {
             assert!((end <= n));
 
             let mut v = vec::with_capacity(end - begin + 1u);
-            unsafe {
+            do vec::as_imm_buf(v) |vbuf, _vlen| {
-                do vec::as_imm_buf(v) |vbuf, _vlen| {
+                let vbuf = ::cast::transmute_mut_unsafe(vbuf);
-                    let vbuf = ::cast::transmute_mut_unsafe(vbuf);
+                let src = ptr::offset(sbuf, begin);
-                    let src = ptr::offset(sbuf, begin);
+                ptr::copy_memory(vbuf, src, end - begin);
-                    ptr::copy_memory(vbuf, src, end - begin);
-                }
-                vec::raw::set_len(&mut v, end - begin);
-                v.push(0u8);
-                ::cast::transmute(v)
             }
+            vec::raw::set_len(&mut v, end - begin);
+            v.push(0u8);
+            ::cast::transmute(v)
         }
     }
 
@@ -2304,7 +2298,7 @@ pub mod raw {
     }
 
     /// Removes the last byte from a string and returns it. (Not UTF-8 safe).
-    pub unsafe fn pop_byte(s: &mut ~str) -> u8 {
+    pub fn pop_byte(s: &mut ~str) -> u8 {
         let len = len(*s);
         assert!((len > 0u));
         let b = s[len - 1u];
@@ -2313,7 +2307,7 @@ pub mod raw {
     }
 
     /// Removes the first byte from a string and returns it. (Not UTF-8 safe).
-    pub unsafe fn shift_byte(s: &mut ~str) -> u8 {
+    pub fn shift_byte(s: &mut ~str) -> u8 {
         let len = len(*s);
         assert!((len > 0u));
         let b = s[0];

src/libcore/sys.rs

@@ -127,10 +127,8 @@ pub fn refcount<T>(t: @T) -> uint {
 }
 
 pub fn log_str<T>(t: &T) -> ~str {
-    unsafe {
+    do io::with_str_writer |wr| {
-        do io::with_str_writer |wr| {
+        repr::write_repr(wr, t)
-            repr::write_repr(wr, t)
-        }
     }
 }
 
@@ -157,10 +155,8 @@ pub fn begin_unwind_(msg: *c_char, file: *c_char, line: size_t) -> ! {
 }
 
 pub fn fail_assert(msg: &str, file: &str, line: uint) -> ! {
-    unsafe {
+    let (msg, file) = (msg.to_owned(), file.to_owned());
-        let (msg, file) = (msg.to_owned(), file.to_owned());
+    begin_unwind(~"assertion failed: " + msg, file, line)
-        begin_unwind(~"assertion failed: " + msg, file, line)
-    }
 }
 
 #[cfg(test)]

src/libcore/task/mod.rs

@@ -39,10 +39,9 @@ use result::Result;
 use comm::{stream, Chan, GenericChan, GenericPort, Port};
 use prelude::*;
 use result;
-use task::rt::{task_id, sched_id};
+use task::rt::{task_id, sched_id, rust_task};
 use util;
 use util::replace;
-use unstable::finally::Finally;
 
 #[cfg(test)] use comm::SharedChan;
 
@@ -566,28 +565,48 @@ pub fn get_scheduler() -> Scheduler {
  * ~~~
  */
 pub unsafe fn unkillable<U>(f: &fn() -> U) -> U {
-    unsafe {
+    struct AllowFailure {
-        let t = rt::rust_get_task();
+        t: *rust_task,
-        rt::rust_task_inhibit_kill(t);
+        drop {
-        do (|| {
+            unsafe {
-            f()
+                rt::rust_task_allow_kill(self.t);
-        }).finally {
+            }
-            rt::rust_task_allow_kill(t);
         }
     }
+
+    fn AllowFailure(t: *rust_task) -> AllowFailure{
+        AllowFailure {
+            t: t
+        }
+    }
+
+    let t = rt::rust_get_task();
+    let _allow_failure = AllowFailure(t);
+    rt::rust_task_inhibit_kill(t);
+    f()
 }
 
 /// The inverse of unkillable. Only ever to be used nested in unkillable().
 pub unsafe fn rekillable<U>(f: &fn() -> U) -> U {
-    unsafe {
+    struct DisallowFailure {
-        let t = rt::rust_get_task();
+        t: *rust_task,
-        rt::rust_task_allow_kill(t);
+        drop {
-        do (|| {
+            unsafe {
-            f()
+                rt::rust_task_inhibit_kill(self.t);
-        }).finally {
+            }
-            rt::rust_task_inhibit_kill(t);
         }
     }
+
+    fn DisallowFailure(t: *rust_task) -> DisallowFailure {
+        DisallowFailure {
+            t: t
+        }
+    }
+
+    let t = rt::rust_get_task();
+    let _allow_failure = DisallowFailure(t);
+    rt::rust_task_allow_kill(t);
+    f()
 }
 
 /**
@@ -595,17 +614,27 @@ pub unsafe fn rekillable<U>(f: &fn() -> U) -> U {
  * For use with exclusive ARCs, which use pthread mutexes directly.
  */
 pub unsafe fn atomically<U>(f: &fn() -> U) -> U {
-    unsafe {
+    struct DeferInterrupts {
-        let t = rt::rust_get_task();
+        t: *rust_task,
-        rt::rust_task_inhibit_kill(t);
+        drop {
-        rt::rust_task_inhibit_yield(t);
+            unsafe {
-        do (|| {
+                rt::rust_task_allow_yield(self.t);
-            f()
+                rt::rust_task_allow_kill(self.t);
-        }).finally {
+            }
-            rt::rust_task_allow_yield(t);
-            rt::rust_task_allow_kill(t);
         }
     }
+
+    fn DeferInterrupts(t: *rust_task) -> DeferInterrupts {
+        DeferInterrupts {
+            t: t
+        }
+    }
+
+    let t = rt::rust_get_task();
+    let _interrupts = DeferInterrupts(t);
+    rt::rust_task_inhibit_kill(t);
+    rt::rust_task_inhibit_yield(t);
+    f()
 }
 
 #[test] #[should_fail] #[ignore(cfg(windows))]

src/libcore/task/spawn.rs

@@ -157,13 +157,13 @@ struct AncestorList(Option<unstable::Exclusive<AncestorNode>>);
 // Accessors for taskgroup arcs and ancestor arcs that wrap the unsafety.
 #[inline(always)]
 fn access_group<U>(x: &TaskGroupArc, blk: &fn(TaskGroupInner) -> U) -> U {
-    unsafe { x.with(blk) }
+    x.with(blk)
 }
 
 #[inline(always)]
 fn access_ancestors<U>(x: &unstable::Exclusive<AncestorNode>,
                        blk: &fn(x: &mut AncestorNode) -> U) -> U {
-    unsafe { x.with(blk) }
+    x.with(blk)
 }
 
 // Iterates over an ancestor list.

src/libcore/unstable.rs

@@ -152,45 +152,37 @@ pub type SharedMutableState<T> = ArcDestruct<T>;
 pub unsafe fn shared_mutable_state<T:Owned>(data: T) ->
         SharedMutableState<T> {
     let data = ~ArcData { count: 1, data: Some(data) };
-    unsafe {
+    let ptr = cast::transmute(data);
-        let ptr = cast::transmute(data);
+    ArcDestruct(ptr)
-        ArcDestruct(ptr)
-    }
 }
 
 #[inline(always)]
 pub unsafe fn get_shared_mutable_state<T:Owned>(
     rc: *SharedMutableState<T>) -> *mut T
 {
-    unsafe {
+    let ptr: ~ArcData<T> = cast::reinterpret_cast(&(*rc).data);
-        let ptr: ~ArcData<T> = cast::reinterpret_cast(&(*rc).data);
+    assert!(ptr.count > 0);
-        assert!(ptr.count > 0);
+    let r = cast::transmute(ptr.data.get_ref());
-        let r = cast::transmute(ptr.data.get_ref());
+    cast::forget(ptr);
-        cast::forget(ptr);
+    return r;
-        return r;
-    }
 }
 #[inline(always)]
 pub unsafe fn get_shared_immutable_state<'a,T:Owned>(
         rc: &'a SharedMutableState<T>) -> &'a T {
-    unsafe {
+    let ptr: ~ArcData<T> = cast::reinterpret_cast(&(*rc).data);
-        let ptr: ~ArcData<T> = cast::reinterpret_cast(&(*rc).data);
+    assert!(ptr.count > 0);
-        assert!(ptr.count > 0);
+    // Cast us back into the correct region
-        // Cast us back into the correct region
+    let r = cast::transmute_region(ptr.data.get_ref());
-        let r = cast::transmute_region(ptr.data.get_ref());
+    cast::forget(ptr);
-        cast::forget(ptr);
+    return r;
-        return r;
-    }
 }
 
 pub unsafe fn clone_shared_mutable_state<T:Owned>(rc: &SharedMutableState<T>)
         -> SharedMutableState<T> {
-    unsafe {
+    let mut ptr: ~ArcData<T> = cast::reinterpret_cast(&(*rc).data);
-        let mut ptr: ~ArcData<T> = cast::reinterpret_cast(&(*rc).data);
+    let new_count = intrinsics::atomic_xadd(&mut ptr.count, 1) + 1;
-        let new_count = intrinsics::atomic_xadd(&mut ptr.count, 1) + 1;
+    assert!(new_count >= 2);
-        assert!(new_count >= 2);
+    cast::forget(ptr);
-        cast::forget(ptr);
-    }
     ArcDestruct((*rc).data)
 }
 

src/libcore/unstable/exchange_alloc.rs

@@ -19,27 +19,25 @@ use ptr::null;
 use intrinsic::TyDesc;
 
 pub unsafe fn malloc(td: *TypeDesc, size: uint) -> *c_void {
-    unsafe {
+    assert!(td.is_not_null());
-        assert!(td.is_not_null());
 
-        let total_size = get_box_size(size, (*td).align);
+    let total_size = get_box_size(size, (*td).align);
-        let p = c_malloc(total_size as size_t);
+    let p = c_malloc(total_size as size_t);
-        assert!(p.is_not_null());
+    assert!(p.is_not_null());
 
-        // FIXME #3475: Converting between our two different tydesc types
+    // FIXME #3475: Converting between our two different tydesc types
-        let td: *TyDesc = transmute(td);
+    let td: *TyDesc = transmute(td);
 
-        let box: &mut BoxRepr = transmute(p);
+    let box: &mut BoxRepr = transmute(p);
-        box.header.ref_count = -1; // Exchange values not ref counted
+    box.header.ref_count = -1; // Exchange values not ref counted
-        box.header.type_desc = td;
+    box.header.type_desc = td;
-        box.header.prev = null();
+    box.header.prev = null();
-        box.header.next = null();
+    box.header.next = null();
 
-        let exchange_count = &mut *rust_get_exchange_count_ptr();
+    let exchange_count = &mut *rust_get_exchange_count_ptr();
-        atomic_xadd(exchange_count, 1);
+    atomic_xadd(exchange_count, 1);
 
-        return transmute(box);
+    return transmute(box);
-    }
 }
 /**
 Thin wrapper around libc::malloc, none of the box header

src/libcore/unstable/extfmt.rs

@@ -512,7 +512,7 @@ pub mod rt {
                 None
             }
         } else { Some('-') };
-        unsafe { pad(cv, s, head, PadSigned, buf) };
+        pad(cv, s, head, PadSigned, buf);
     }
     pub fn conv_uint(cv: Conv, u: uint, buf: &mut ~str) {
         let prec = get_int_precision(cv);
@@ -524,7 +524,7 @@ pub mod rt {
               TyBits => uint_to_str_prec(u, 2, prec),
               TyOctal => uint_to_str_prec(u, 8, prec)
             };
-        unsafe { pad(cv, rs, None, PadUnsigned, buf) };
+        pad(cv, rs, None, PadUnsigned, buf);
     }
     pub fn conv_bool(cv: Conv, b: bool, buf: &mut ~str) {
         let s = if b { "true" } else { "false" };
@@ -533,7 +533,7 @@ pub mod rt {
         conv_str(cv, s, buf);
     }
     pub fn conv_char(cv: Conv, c: char, buf: &mut ~str) {
-        unsafe { pad(cv, "", Some(c), PadNozero, buf) };
+        pad(cv, "", Some(c), PadNozero, buf);
     }
     pub fn conv_str(cv: Conv, s: &str, buf: &mut ~str) {
         // For strings, precision is the maximum characters
@@ -546,14 +546,14 @@ pub mod rt {
             s
           }
         };
-        unsafe { pad(cv, unpadded, None, PadNozero, buf) };
+        pad(cv, unpadded, None, PadNozero, buf);
     }
     pub fn conv_float(cv: Conv, f: float, buf: &mut ~str) {
         let (to_str, digits) = match cv.precision {
               CountIs(c) => (float::to_str_exact, c as uint),
               CountImplied => (float::to_str_digits, 6u)
         };
-        let mut s = unsafe { to_str(f, digits) };
+        let mut s = to_str(f, digits);
         let head = if 0.0 <= f {
             if have_flag(cv.flags, flag_sign_always) {
                 Some('+')
@@ -563,7 +563,7 @@ pub mod rt {
                 None
             }
         } else { None };
-        unsafe { pad(cv, s, head, PadFloat, buf) };
+        pad(cv, s, head, PadFloat, buf);
     }
     pub fn conv_poly<T>(cv: Conv, v: &T, buf: &mut ~str) {
         let s = sys::log_str(v);

src/libcore/unstable/lang.rs

@@ -44,7 +44,7 @@ pub fn fail_(expr: *c_char, file: *c_char, line: size_t) -> ! {
 }
 
 #[lang="fail_bounds_check"]
-pub unsafe fn fail_bounds_check(file: *c_char, line: size_t,
+pub fn fail_bounds_check(file: *c_char, line: size_t,
                                 index: size_t, len: size_t) {
     let msg = fmt!("index out of bounds: the len is %d but the index is %d",
                     len as int, index as int);
@@ -53,7 +53,7 @@ pub unsafe fn fail_bounds_check(file: *c_char, line: size_t,
     }
 }
 
-pub unsafe fn fail_borrowed() {
+pub fn fail_borrowed() {
     let msg = "borrowed";
     do str::as_buf(msg) |msg_p, _| {
         do str::as_buf("???") |file_p, _| {