This is an idea which I previously brought up in rust-lang/rust#29625 (the
Fn* traits tracking issue) but completely forgot about until reading @RalfJung’s recent post, Two Kinds of Invariants: Safety and Validity.
The issue is that it’s not currently possible to specify (in a generic way) that a function can only be called from an
This is useful in libraries like
inkwell where you routinely produce function pointers that need to be cast to the correct signature and calling convention (see
ExecutionEngine::get_function() and TheDan64/inkwell#36). These functions are innately
unsafe to call because there’s no guarantee that they have the correct signature, calling convention, or even still exist (e.g. the JIT could be destroyed or dynamic library unloaded from memory), but the type system doesn’t currently have any mechanism for specifying this constraint.
Would it be useful to propose some sort of
UnsafeFn trait for functions which are only callable from
unsafe code? Also, is there any way to specify something like calling convention via the type system?