Private unsafe fields are a poorly motivated feature

language design Unsafe Code Guidelines
114

Isn't this the rule today?

Note that this rule only forces you to mark a function unsafe if the safety requirement is needed to prevent UB. It doesn't force you to keep the function safe otherwise.

In particular, if your library has a correctness invariant that is not yet used for safety, you still have 2 options when providing unchecked functions:

  • Mark the functions unsafe: You reserve yourself the right to use correctness for safety in the future, but you force your users to use an unsafe block today.
  • Keep the functions safe: Users can call the functions without burden today, but you can't use correctness for safety until you bump your major version.

Note that in both cases, your users can use the correctness invariant for safety. It's only you who can't (when the unchecked functions are safe). It sounds counter-intuitive (and it is), but it's the ecosystem convention.

1 Like