src/librustc_mir/transform/check_unsafety.rs

   1 use rustc_data_structures::fx::FxHashSet;
   2 use rustc_data_structures::indexed_vec::IndexVec;
   3 use rustc_data_structures::sync::Lrc;
   4
   5 use rustc::ty::query::Providers;
   6 use rustc::ty::{self, TyCtxt};
   7 use rustc::ty::cast::CastTy;
   8 use rustc::hir;
   9 use rustc::hir::Node;
  10 use rustc::hir::def_id::DefId;
  11 use rustc::lint::builtin::{SAFE_EXTERN_STATICS, SAFE_PACKED_BORROWS, UNUSED_UNSAFE};
  12 use rustc::mir::*;
  13 use rustc::mir::visit::{PlaceContext, Visitor, MutatingUseContext};
  14
  15 use syntax::symbol::Symbol;
  16
  17 use std::ops::Bound;
  18
  19 use crate::util;
  20
  21 pub struct UnsafetyChecker<'a, 'tcx: 'a> {
  22     mir: &'a Mir<'tcx>,
  23     const_context: bool,
  24     min_const_fn: bool,
  25     source_scope_local_data: &'a IndexVec<SourceScope, SourceScopeLocalData>,
  26     violations: Vec<UnsafetyViolation>,
  27     source_info: SourceInfo,
  28     tcx: TyCtxt<'a, 'tcx, 'tcx>,
  29     param_env: ty::ParamEnv<'tcx>,
  30     /// Mark an `unsafe` block as used, so we don't lint it.
  31     used_unsafe: FxHashSet<hir::HirId>,
  32     inherited_blocks: Vec<(hir::HirId, bool)>,
  33 }
  34
  35 impl<'a, 'gcx, 'tcx> UnsafetyChecker<'a, 'tcx> {
  36     fn new(
  37         const_context: bool,
  38         min_const_fn: bool,
  39         mir: &'a Mir<'tcx>,
  40         source_scope_local_data: &'a IndexVec<SourceScope, SourceScopeLocalData>,
  41         tcx: TyCtxt<'a, 'tcx, 'tcx>,
  42         param_env: ty::ParamEnv<'tcx>,
  43     ) -> Self {
  44         // sanity check
  45         if min_const_fn {
  46             assert!(const_context);
  47         }
  48         Self {
  49             mir,
  50             const_context,
  51             min_const_fn,
  52             source_scope_local_data,
  53             violations: vec![],
  54             source_info: SourceInfo {
  55                 span: mir.span,
  56                 scope: OUTERMOST_SOURCE_SCOPE
  57             },
  58             tcx,
  59             param_env,
  60             used_unsafe: Default::default(),
  61             inherited_blocks: vec![],
  62         }
  63     }
  64 }
  65
  66 impl<'a, 'tcx> Visitor<'tcx> for UnsafetyChecker<'a, 'tcx> {
  67     fn visit_terminator(&mut self,
  68                         block: BasicBlock,
  69                         terminator: &Terminator<'tcx>,
  70                         location: Location)
  71     {
  72         self.source_info = terminator.source_info;
  73         match terminator.kind {
  74             TerminatorKind::Goto { .. } |
  75             TerminatorKind::SwitchInt { .. } |
  76             TerminatorKind::Drop { .. } |
  77             TerminatorKind::Yield { .. } |
  78             TerminatorKind::Assert { .. } |
  79             TerminatorKind::DropAndReplace { .. } |
  80             TerminatorKind::GeneratorDrop |
  81             TerminatorKind::Resume |
  82             TerminatorKind::Abort |
  83             TerminatorKind::Return |
  84             TerminatorKind::Unreachable |
  85             TerminatorKind::FalseEdges { .. } |
  86             TerminatorKind::FalseUnwind { .. } => {
  87                 // safe (at least as emitted during MIR construction)
  88             }
  89
  90             TerminatorKind::Call { ref func, .. } => {
  91                 let func_ty = func.ty(self.mir, self.tcx);
  92                 let sig = func_ty.fn_sig(self.tcx);
  93                 if let hir::Unsafety::Unsafe = sig.unsafety() {
  94                     self.require_unsafe("call to unsafe function",
  95                         "consult the function's documentation for information on how to avoid \
  96                          undefined behavior", UnsafetyViolationKind::GeneralAndConstFn)
  97                 }
  98             }
  99         }
 100         self.super_terminator(block, terminator, location);
 101     }
 102
 103     fn visit_statement(&mut self,
 104                        block: BasicBlock,
 105                        statement: &Statement<'tcx>,
 106                        location: Location)
 107     {
 108         self.source_info = statement.source_info;
 109         match statement.kind {
 110             StatementKind::Assign(..) |
 111             StatementKind::FakeRead(..) |
 112             StatementKind::SetDiscriminant { .. } |
 113             StatementKind::StorageLive(..) |
 114             StatementKind::StorageDead(..) |
 115             StatementKind::Retag { .. } |
 116             StatementKind::AscribeUserType(..) |
 117             StatementKind::Nop => {
 118                 // safe (at least as emitted during MIR construction)
 119             }
 120
 121             StatementKind::InlineAsm { .. } => {
 122                 self.require_unsafe("use of inline assembly",
 123                     "inline assembly is entirely unchecked and can cause undefined behavior",
 124                     UnsafetyViolationKind::General)
 125             },
 126         }
 127         self.super_statement(block, statement, location);
 128     }
 129
 130     fn visit_rvalue(&mut self,
 131                     rvalue: &Rvalue<'tcx>,
 132                     location: Location)
 133     {
 134         match rvalue {
 135             Rvalue::Aggregate(box ref aggregate, _) => {
 136                 match aggregate {
 137                     &AggregateKind::Array(..) |
 138                     &AggregateKind::Tuple => {}
 139                     &AggregateKind::Adt(ref def, ..) => {
 140                         match self.tcx.layout_scalar_valid_range(def.did) {
 141                             (Bound::Unbounded, Bound::Unbounded) => {},
 142                             _ => self.require_unsafe(
 143                                 "initializing type with `rustc_layout_scalar_valid_range` attr",
 144                                 "initializing a layout restricted type's field with a value \
 145                                 outside the valid range is undefined behavior",
 146                                 UnsafetyViolationKind::GeneralAndConstFn,
 147                             ),
 148                         }
 149                     }
 150                     &AggregateKind::Closure(def_id, _) |
 151                     &AggregateKind::Generator(def_id, _, _) => {
 152                         let UnsafetyCheckResult {
 153                             violations, unsafe_blocks
 154                         } = self.tcx.unsafety_check_result(def_id);
 155                         self.register_violations(&violations, &unsafe_blocks);
 156                     }
 157                 }
 158             },
 159             // casting pointers to ints is unsafe in const fn because the const evaluator cannot
 160             // possibly know what the result of various operations like `address / 2` would be
 161             // pointers during const evaluation have no integral address, only an abstract one
 162             Rvalue::Cast(CastKind::Misc, ref operand, cast_ty)
 163             if self.const_context && self.tcx.features().const_raw_ptr_to_usize_cast => {
 164                 let operand_ty = operand.ty(self.mir, self.tcx);
 165                 let cast_in = CastTy::from_ty(operand_ty).expect("bad input type for cast");
 166                 let cast_out = CastTy::from_ty(cast_ty).expect("bad output type for cast");
 167                 match (cast_in, cast_out) {
 168                     (CastTy::Ptr(_), CastTy::Int(_)) |
 169                     (CastTy::FnPtr, CastTy::Int(_)) => {
 170                         self.register_violations(&[UnsafetyViolation {
 171                             source_info: self.source_info,
 172                             description: Symbol::intern("cast of pointer to int").as_interned_str(),
 173                             details: Symbol::intern("casting pointers to integers in constants")
 174                                      .as_interned_str(),
 175                             kind: UnsafetyViolationKind::General,
 176                         }], &[]);
 177                     },
 178                     _ => {},
 179                 }
 180             }
 181             // raw pointer and fn pointer operations are unsafe as it is not clear whether one
 182             // pointer would be "less" or "equal" to another, because we cannot know where llvm
 183             // or the linker will place various statics in memory. Without this information the
 184             // result of a comparison of addresses would differ between runtime and compile-time.
 185             Rvalue::BinaryOp(_, ref lhs, _)
 186             if self.const_context && self.tcx.features().const_compare_raw_pointers => {
 187                 if let ty::RawPtr(_) | ty::FnPtr(..) = lhs.ty(self.mir, self.tcx).sty {
 188                     self.register_violations(&[UnsafetyViolation {
 189                         source_info: self.source_info,
 190                         description: Symbol::intern("pointer operation").as_interned_str(),
 191                         details: Symbol::intern("operations on pointers in constants")
 192                                  .as_interned_str(),
 193                         kind: UnsafetyViolationKind::General,
 194                     }], &[]);
 195                 }
 196             }
 197             _ => {},
 198         }
 199         self.super_rvalue(rvalue, location);
 200     }
 201
 202     fn visit_place(&mut self,
 203                     place: &Place<'tcx>,
 204                     context: PlaceContext<'tcx>,
 205                     location: Location) {
 206         match place {
 207             &Place::Projection(box Projection {
 208                 ref base, ref elem
 209             }) => {
 210                 if context.is_borrow() {
 211                     if util::is_disaligned(self.tcx, self.mir, self.param_env, place) {
 212                         let source_info = self.source_info;
 213                         let lint_root =
 214                             self.source_scope_local_data[source_info.scope].lint_root;
 215                         self.register_violations(&[UnsafetyViolation {
 216                             source_info,
 217                             description: Symbol::intern("borrow of packed field").as_interned_str(),
 218                             details:
 219                                 Symbol::intern("fields of packed structs might be misaligned: \
 220                                                 dereferencing a misaligned pointer or even just \
 221                                                 creating a misaligned reference is undefined \
 222                                                 behavior")
 223                                     .as_interned_str(),
 224                             kind: UnsafetyViolationKind::BorrowPacked(lint_root)
 225                         }], &[]);
 226                     }
 227                 }
 228                 let is_borrow_of_interior_mut = context.is_borrow() && !base
 229                     .ty(self.mir, self.tcx)
 230                     .to_ty(self.tcx)
 231                     .is_freeze(self.tcx, self.param_env, self.source_info.span);
 232                 // prevent
 233                 // * `&mut x.field`
 234                 // * `x.field = y;`
 235                 // * `&x.field` if `field`'s type has interior mutability
 236                 // because either of these would allow modifying the layout constrained field and
 237                 // insert values that violate the layout constraints.
 238                 if context.is_mutating_use() || is_borrow_of_interior_mut {
 239                     self.check_mut_borrowing_layout_constrained_field(
 240                         place, context.is_mutating_use(),
 241                     );
 242                 }
 243                 let old_source_info = self.source_info;
 244                 if let &Place::Base(PlaceBase::Local(local)) = base {
 245                     if self.mir.local_decls[local].internal {
 246                         // Internal locals are used in the `move_val_init` desugaring.
 247                         // We want to check unsafety against the source info of the
 248                         // desugaring, rather than the source info of the RHS.
 249                         self.source_info = self.mir.local_decls[local].source_info;
 250                     }
 251                 }
 252                 let base_ty = base.ty(self.mir, self.tcx).to_ty(self.tcx);
 253                 match base_ty.sty {
 254                     ty::RawPtr(..) => {
 255                         self.require_unsafe("dereference of raw pointer",
 256                             "raw pointers may be NULL, dangling or unaligned; they can violate \
 257                              aliasing rules and cause data races: all of these are undefined \
 258                              behavior", UnsafetyViolationKind::General)
 259                     }
 260                     ty::Adt(adt, _) => {
 261                         if adt.is_union() {
 262                             if context == PlaceContext::MutatingUse(MutatingUseContext::Store) ||
 263                                 context == PlaceContext::MutatingUse(MutatingUseContext::Drop) ||
 264                                 context == PlaceContext::MutatingUse(
 265                                     MutatingUseContext::AsmOutput
 266                                 )
 267                             {
 268                                 let elem_ty = match elem {
 269                                     &ProjectionElem::Field(_, ty) => ty,
 270                                     _ => span_bug!(
 271                                         self.source_info.span,
 272                                         "non-field projection {:?} from union?",
 273                                         place)
 274                                 };
 275                                 if !elem_ty.is_copy_modulo_regions(
 276                                     self.tcx,
 277                                     self.param_env,
 278                                     self.source_info.span,
 279                                 ) {
 280                                     self.require_unsafe(
 281                                         "assignment to non-`Copy` union field",
 282                                         "the previous content of the field will be dropped, which \
 283                                          causes undefined behavior if the field was not properly \
 284                                          initialized", UnsafetyViolationKind::General)
 285                                 } else {
 286                                     // write to non-move union, safe
 287                                 }
 288                             } else {
 289                                 self.require_unsafe("access to union field",
 290                                     "the field may not be properly initialized: using \
 291                                      uninitialized data will cause undefined behavior",
 292                                      UnsafetyViolationKind::General)
 293                             }
 294                         }
 295                     }
 296                     _ => {}
 297                 }
 298                 self.source_info = old_source_info;
 299             }
 300             &Place::Base(PlaceBase::Local(..)) => {
 301                 // locals are safe
 302             }
 303             &Place::Base(PlaceBase::Promoted(_)) => {
 304                 bug!("unsafety checking should happen before promotion")
 305             }
 306             &Place::Base(PlaceBase::Static(box Static { def_id, ty: _ })) => {
 307                 if self.tcx.is_static(def_id) == Some(hir::Mutability::MutMutable) {
 308                     self.require_unsafe("use of mutable static",
 309                         "mutable statics can be mutated by multiple threads: aliasing violations \
 310                          or data races will cause undefined behavior",
 311                          UnsafetyViolationKind::General);
 312                 } else if self.tcx.is_foreign_item(def_id) {
 313                     let source_info = self.source_info;
 314                     let lint_root =
 315                         self.source_scope_local_data[source_info.scope].lint_root;
 316                     self.register_violations(&[UnsafetyViolation {
 317                         source_info,
 318                         description: Symbol::intern("use of extern static").as_interned_str(),
 319                         details:
 320                             Symbol::intern("extern statics are not controlled by the Rust type \
 321                                             system: invalid data, aliasing violations or data \
 322                                             races will cause undefined behavior")
 323                                 .as_interned_str(),
 324                         kind: UnsafetyViolationKind::ExternStatic(lint_root)
 325                     }], &[]);
 326                 }
 327             }
 328         };
 329         self.super_place(place, context, location);
 330     }
 331 }
 332
 333 impl<'a, 'tcx> UnsafetyChecker<'a, 'tcx> {
 334     fn require_unsafe(
 335         &mut self,
 336         description: &'static str,
 337         details: &'static str,
 338         kind: UnsafetyViolationKind,
 339     ) {
 340         let source_info = self.source_info;
 341         self.register_violations(&[UnsafetyViolation {
 342             source_info,
 343             description: Symbol::intern(description).as_interned_str(),
 344             details: Symbol::intern(details).as_interned_str(),
 345             kind,
 346         }], &[]);
 347     }
 348
 349     fn register_violations(&mut self,
 350                            violations: &[UnsafetyViolation],
 351                            unsafe_blocks: &[(hir::HirId, bool)]) {
 352         let safety = self.source_scope_local_data[self.source_info.scope].safety;
 353         let within_unsafe = match safety {
 354             // `unsafe` blocks are required in safe code
 355             Safety::Safe => {
 356                 for violation in violations {
 357                     let mut violation = violation.clone();
 358                     match violation.kind {
 359                         UnsafetyViolationKind::GeneralAndConstFn |
 360                         UnsafetyViolationKind::General => {},
 361                         UnsafetyViolationKind::BorrowPacked(_) |
 362                         UnsafetyViolationKind::ExternStatic(_) => if self.min_const_fn {
 363                             // const fns don't need to be backwards compatible and can
 364                             // emit these violations as a hard error instead of a backwards
 365                             // compat lint
 366                             violation.kind = UnsafetyViolationKind::General;
 367                         },
 368                     }
 369                     if !self.violations.contains(&violation) {
 370                         self.violations.push(violation)
 371                     }
 372                 }
 373                 false
 374             }
 375             // `unsafe` function bodies allow unsafe without additional unsafe blocks
 376             Safety::BuiltinUnsafe | Safety::FnUnsafe => true,
 377             Safety::ExplicitUnsafe(hir_id) => {
 378                 // mark unsafe block as used if there are any unsafe operations inside
 379                 if !violations.is_empty() {
 380                     self.used_unsafe.insert(hir_id);
 381                 }
 382                 // only some unsafety is allowed in const fn
 383                 if self.min_const_fn {
 384                     for violation in violations {
 385                         match violation.kind {
 386                             // these unsafe things are stable in const fn
 387                             UnsafetyViolationKind::GeneralAndConstFn => {},
 388                             // these things are forbidden in const fns
 389                             UnsafetyViolationKind::General |
 390                             UnsafetyViolationKind::BorrowPacked(_) |
 391                             UnsafetyViolationKind::ExternStatic(_) => {
 392                                 let mut violation = violation.clone();
 393                                 // const fns don't need to be backwards compatible and can
 394                                 // emit these violations as a hard error instead of a backwards
 395                                 // compat lint
 396                                 violation.kind = UnsafetyViolationKind::General;
 397                                 if !self.violations.contains(&violation) {
 398                                     self.violations.push(violation)
 399                                 }
 400                             },
 401                         }
 402                     }
 403                 }
 404                 true
 405             }
 406         };
 407         self.inherited_blocks.extend(unsafe_blocks.iter().map(|&(hir_id, is_used)| {
 408             (hir_id, is_used && !within_unsafe)
 409         }));
 410     }
 411     fn check_mut_borrowing_layout_constrained_field(
 412         &mut self,
 413         mut place: &Place<'tcx>,
 414         is_mut_use: bool,
 415     ) {
 416         while let &Place::Projection(box Projection {
 417             ref base, ref elem
 418         }) = place {
 419             match *elem {
 420                 ProjectionElem::Field(..) => {
 421                     let ty = base.ty(&self.mir.local_decls, self.tcx).to_ty(self.tcx);
 422                     match ty.sty {
 423                         ty::Adt(def, _) => match self.tcx.layout_scalar_valid_range(def.did) {
 424                             (Bound::Unbounded, Bound::Unbounded) => {},
 425                             _ => {
 426                                 let (description, details) = if is_mut_use {
 427                                     (
 428                                         "mutation of layout constrained field",
 429                                         "mutating layout constrained fields cannot statically be \
 430                                         checked for valid values",
 431                                     )
 432                                 } else {
 433                                     (
 434                                         "borrow of layout constrained field with interior \
 435                                         mutability",
 436                                         "references to fields of layout constrained fields \
 437                                         lose the constraints. Coupled with interior mutability, \
 438                                         the field can be changed to invalid values",
 439                                     )
 440                                 };
 441                                 let source_info = self.source_info;
 442                                 self.register_violations(&[UnsafetyViolation {
 443                                     source_info,
 444                                     description: Symbol::intern(description).as_interned_str(),
 445                                     details: Symbol::intern(details).as_interned_str(),
 446                                     kind: UnsafetyViolationKind::GeneralAndConstFn,
 447                                 }], &[]);
 448                             }
 449                         },
 450                         _ => {}
 451                     }
 452                 }
 453                 _ => {}
 454             }
 455             place = base;
 456         }
 457     }
 458 }
 459
 460 pub(crate) fn provide(providers: &mut Providers<'_>) {
 461     *providers = Providers {
 462         unsafety_check_result,
 463         unsafe_derive_on_repr_packed,
 464         ..*providers
 465     };
 466 }
 467
 468 struct UnusedUnsafeVisitor<'a> {
 469     used_unsafe: &'a FxHashSet<hir::HirId>,
 470     unsafe_blocks: &'a mut Vec<(hir::HirId, bool)>,
 471 }
 472
 473 impl<'a, 'tcx> hir::intravisit::Visitor<'tcx> for UnusedUnsafeVisitor<'a> {
 474     fn nested_visit_map<'this>(&'this mut self) ->
 475         hir::intravisit::NestedVisitorMap<'this, 'tcx>
 476     {
 477         hir::intravisit::NestedVisitorMap::None
 478     }
 479
 480     fn visit_block(&mut self, block: &'tcx hir::Block) {
 481         hir::intravisit::walk_block(self, block);
 482
 483         if let hir::UnsafeBlock(hir::UserProvided) = block.rules {
 484             self.unsafe_blocks.push((block.hir_id, self.used_unsafe.contains(&block.hir_id)));
 485         }
 486     }
 487 }
 488
 489 fn check_unused_unsafe<'a, 'tcx>(tcx: TyCtxt<'a, 'tcx, 'tcx>,
 490                                  def_id: DefId,
 491                                  used_unsafe: &FxHashSet<hir::HirId>,
 492                                  unsafe_blocks: &'a mut Vec<(hir::HirId, bool)>)
 493 {
 494     let body_id =
 495         tcx.hir().as_local_hir_id(def_id).and_then(|hir_id| {
 496             tcx.hir().maybe_body_owned_by_by_hir_id(hir_id)
 497         });
 498
 499     let body_id = match body_id {
 500         Some(body) => body,
 501         None => {
 502             debug!("check_unused_unsafe({:?}) - no body found", def_id);
 503             return
 504         }
 505     };
 506     let body = tcx.hir().body(body_id);
 507     debug!("check_unused_unsafe({:?}, body={:?}, used_unsafe={:?})",
 508            def_id, body, used_unsafe);
 509
 510     let mut visitor =  UnusedUnsafeVisitor { used_unsafe, unsafe_blocks };
 511     hir::intravisit::Visitor::visit_body(&mut visitor, body);
 512 }
 513
 514 fn unsafety_check_result<'a, 'tcx>(tcx: TyCtxt<'a, 'tcx, 'tcx>, def_id: DefId)
 515                                    -> UnsafetyCheckResult
 516 {
 517     debug!("unsafety_violations({:?})", def_id);
 518
 519     // N.B., this borrow is valid because all the consumers of
 520     // `mir_built` force this.
 521     let mir = &tcx.mir_built(def_id).borrow();
 522
 523     let source_scope_local_data = match mir.source_scope_local_data {
 524         ClearCrossCrate::Set(ref data) => data,
 525         ClearCrossCrate::Clear => {
 526             debug!("unsafety_violations: {:?} - remote, skipping", def_id);
 527             return UnsafetyCheckResult {
 528                 violations: Lrc::new([]),
 529                 unsafe_blocks: Lrc::new([])
 530             }
 531         }
 532     };
 533
 534     let param_env = tcx.param_env(def_id);
 535
 536     let id = tcx.hir().as_local_node_id(def_id).unwrap();
 537     let (const_context, min_const_fn) = match tcx.hir().body_owner_kind(id) {
 538         hir::BodyOwnerKind::Closure => (false, false),
 539         hir::BodyOwnerKind::Fn => (tcx.is_const_fn(def_id), tcx.is_min_const_fn(def_id)),
 540         hir::BodyOwnerKind::Const |
 541         hir::BodyOwnerKind::Static(_) => (true, false),
 542     };
 543     let mut checker = UnsafetyChecker::new(
 544         const_context, min_const_fn,
 545         mir, source_scope_local_data, tcx, param_env);
 546     checker.visit_mir(mir);
 547
 548     check_unused_unsafe(tcx, def_id, &checker.used_unsafe, &mut checker.inherited_blocks);
 549     UnsafetyCheckResult {
 550         violations: checker.violations.into(),
 551         unsafe_blocks: checker.inherited_blocks.into()
 552     }
 553 }
 554
 555 fn unsafe_derive_on_repr_packed<'a, 'tcx>(tcx: TyCtxt<'a, 'tcx, 'tcx>, def_id: DefId) {
 556     let lint_hir_id = tcx.hir().as_local_hir_id(def_id).unwrap_or_else(||
 557         bug!("checking unsafety for non-local def id {:?}", def_id));
 558
 559     // FIXME: when we make this a hard error, this should have its
 560     // own error code.
 561     let counts = tcx.generics_of(def_id).own_counts();
 562     let message = if counts.types + counts.consts != 0 {
 563         "#[derive] can't be used on a #[repr(packed)] struct with \
 564          type or const parameters (error E0133)".to_string()
 565     } else {
 566         "#[derive] can't be used on a #[repr(packed)] struct that \
 567          does not derive Copy (error E0133)".to_string()
 568     };
 569     tcx.lint_hir(SAFE_PACKED_BORROWS,
 570                  lint_hir_id,
 571                  tcx.def_span(def_id),
 572                  &message);
 573 }
 574
 575 /// Returns the `HirId` for an enclosing scope that is also `unsafe`.
 576 fn is_enclosed(tcx: TyCtxt<'_, '_, '_>,
 577                used_unsafe: &FxHashSet<hir::HirId>,
 578                id: hir::HirId) -> Option<(String, hir::HirId)> {
 579     let parent_id = tcx.hir().get_parent_node_by_hir_id(id);
 580     if parent_id != id {
 581         if used_unsafe.contains(&parent_id) {
 582             Some(("block".to_string(), parent_id))
 583         } else if let Some(Node::Item(&hir::Item {
 584             node: hir::ItemKind::Fn(_, header, _, _),
 585             ..
 586         })) = tcx.hir().find_by_hir_id(parent_id) {
 587             match header.unsafety {
 588                 hir::Unsafety::Unsafe => Some(("fn".to_string(), parent_id)),
 589                 hir::Unsafety::Normal => None,
 590             }
 591         } else {
 592             is_enclosed(tcx, used_unsafe, parent_id)
 593         }
 594     } else {
 595         None
 596     }
 597 }
 598
 599 fn report_unused_unsafe(tcx: TyCtxt<'_, '_, '_>,
 600                         used_unsafe: &FxHashSet<hir::HirId>,
 601                         id: hir::HirId) {
 602     let span = tcx.sess.source_map().def_span(tcx.hir().span_by_hir_id(id));
 603     let msg = "unnecessary `unsafe` block";
 604     let mut db = tcx.struct_span_lint_hir(UNUSED_UNSAFE, id, span, msg);
 605     db.span_label(span, msg);
 606     if let Some((kind, id)) = is_enclosed(tcx, used_unsafe, id) {
 607         db.span_label(tcx.sess.source_map().def_span(tcx.hir().span_by_hir_id(id)),
 608                       format!("because it's nested under this `unsafe` {}", kind));
 609     }
 610     db.emit();
 611 }
 612
 613 fn builtin_derive_def_id<'a, 'tcx>(tcx: TyCtxt<'a, 'tcx, 'tcx>, def_id: DefId) -> Option<DefId> {
 614     debug!("builtin_derive_def_id({:?})", def_id);
 615     if let Some(impl_def_id) = tcx.impl_of_method(def_id) {
 616         if tcx.has_attr(impl_def_id, "automatically_derived") {
 617             debug!("builtin_derive_def_id({:?}) - is {:?}", def_id, impl_def_id);
 618             Some(impl_def_id)
 619         } else {
 620             debug!("builtin_derive_def_id({:?}) - not automatically derived", def_id);
 621             None
 622         }
 623     } else {
 624         debug!("builtin_derive_def_id({:?}) - not a method", def_id);
 625         None
 626     }
 627 }
 628
 629 pub fn check_unsafety<'a, 'tcx>(tcx: TyCtxt<'a, 'tcx, 'tcx>, def_id: DefId) {
 630     debug!("check_unsafety({:?})", def_id);
 631
 632     // closures are handled by their parent fn.
 633     if tcx.is_closure(def_id) {
 634         return;
 635     }
 636
 637     let UnsafetyCheckResult {
 638         violations,
 639         unsafe_blocks
 640     } = tcx.unsafety_check_result(def_id);
 641
 642     for &UnsafetyViolation {
 643         source_info, description, details, kind
 644     } in violations.iter() {
 645         // Report an error.
 646         match kind {
 647             UnsafetyViolationKind::GeneralAndConstFn |
 648             UnsafetyViolationKind::General => {
 649                 struct_span_err!(
 650                     tcx.sess, source_info.span, E0133,
 651                     "{} is unsafe and requires unsafe function or block", description)
 652                     .span_label(source_info.span, &description.as_str()[..])
 653                     .note(&details.as_str()[..])
 654                     .emit();
 655             }
 656             UnsafetyViolationKind::ExternStatic(lint_hir_id) => {
 657                 tcx.lint_node_note(SAFE_EXTERN_STATICS,
 658                               lint_hir_id,
 659                               source_info.span,
 660                               &format!("{} is unsafe and requires unsafe function or block \
 661                                         (error E0133)", &description.as_str()[..]),
 662                               &details.as_str()[..]);
 663             }
 664             UnsafetyViolationKind::BorrowPacked(lint_hir_id) => {
 665                 if let Some(impl_def_id) = builtin_derive_def_id(tcx, def_id) {
 666                     tcx.unsafe_derive_on_repr_packed(impl_def_id);
 667                 } else {
 668                     tcx.lint_node_note(SAFE_PACKED_BORROWS,
 669                                   lint_hir_id,
 670                                   source_info.span,
 671                                   &format!("{} is unsafe and requires unsafe function or block \
 672                                             (error E0133)", &description.as_str()[..]),
 673                                   &details.as_str()[..]);
 674                 }
 675             }
 676         }
 677     }
 678
 679     let mut unsafe_blocks: Vec<_> = unsafe_blocks.into_iter().collect();
 680     unsafe_blocks.sort_by_cached_key(|(hir_id, _)| tcx.hir().hir_to_node_id(*hir_id));
 681     let used_unsafe: FxHashSet<_> = unsafe_blocks.iter()
 682         .flat_map(|&&(id, used)| if used { Some(id) } else { None })
 683         .collect();
 684     for &(block_id, is_used) in unsafe_blocks {
 685         if !is_used {
 686             report_unused_unsafe(tcx, &used_unsafe, block_id);
 687         }
 688     }
 689 }