New lints: Safe items inside `unsafe extern`

[obi1kenobi]

A new feature in Rust 1.82+ is the ability to define safe items inside an unsafe extern block:
https://blog.rust-lang.org/2024/10/17/Rust-1.82.0.html#safe-items-with-unsafe-extern

unsafe extern {
    pub safe static TAU: f64;
    pub safe fn sqrt(x: f64) -> f64;
    pub unsafe fn strlen(p: *const u8) -> usize;
}

Making a previously-safe item become unsafe is a major breaking change, since it now requires unsafe at the point of use.

At least two lints, and possibly more:

• safe extern static became unsafe
• safe extern fn became unsafe

I believe we'll also need additional schema in the adapter to model extern items and show which items are safe vs unsafe. This shouldn't be too difficult to add, though it's an extra step compared to "just writing a lint." For folks new to contributing to Trustfall, I'd recommend first writing another lint that doesn't need this extra step before moving to this issue.

[aDotInTheVoid]

rustdoc-json doesn't model functions declared in extern blocks differently to normal functions: rust-lang/rust#131517. If you handle functions changing safety, then you handle extern functions as-well.

[aDotInTheVoid]

Relatedly, you probably want a lint for changing pub static X: i32 = 0; to pub static mut X: i32 = 0, as the latter is unsafe to access.

[obi1kenobi]

rustdoc-json doesn't model functions declared in extern blocks differently to normal functions: rust-lang/rust#131517. If you handle functions changing safety, then you handle extern functions as-well.

Neat, TIL -- thank you!

We might still want a separate lint for the two cases so we can offer a more specific diagnostic message in each case. I'll make a test crate and see what happens currently, and go from there.

Relatedly, you probably want a lint for changing pub static X: i32 = 0; to pub static mut X: i32 = 0, as the latter is unsafe to access.

Nice catch! I think it might already be on a to-do list somewhere, but I'll make sure of it :)

[obi1kenobi]

I decided the current lint for safe -> unsafe fn is fine here, and just added test cases here and in the adapter:
#1003
obi1kenobi/trustfall-rustdoc-adapter#611

Leaving this issue open until we can lint for safe -> unsafe transitions in extern static.

Thanks again @aDotInTheVoid!

[aDotInTheVoid]

For the extern static case, you'll need the (not yet merged) rust-lang/rust#133715 for rustdoc-json to have safety information for statics.

Also worth noting: static's are safe by default, so going from static X: i32 to extern { static X: i32 } is much more likely than unsafe extern { safe static X: i32 } to unsafe extern { unsafe static X: i32 }

[obi1kenobi]

Awesome, thanks for putting the PR together! I'll hold the next cargo-semver-checks release until that's merged and available in rustdoc-types so the new release can support the new format.

Also worth noting: static's are safe by default, so going from static X: i32 to extern { static X: i32 } is much more likely than unsafe extern { safe static X: i32 } to unsafe extern { unsafe static X: i32 }

Oh good call! We definitely want to lint for that.

[Frank-III]

Since we have this in the rustdoc-apdapter obi1kenobi/trustfall-rustdoc-adapter#725, we are ready for safe extern static became unsafe this lint? I would like to work on this!

[obi1kenobi]

Yes, and I believe I updated the adapter versions so you can use the newly-added field. Go for it!

[obi1kenobi]

The final missing part has been completed by #1090.