resolver: document opaque pointer cast safety gap

b3d179a0c9a5dae8bc77aac7fd370a928af44253e0176b90988804c13f6985e0 
Opaque pointer casts (*opaque as *T) should ideally require unsafe
context, but the allocator returns *opaque and every allocation does
alloc() as *mut T. Wrapping 59+ sites in unsafe {} adds noise without
improving safety -- the allocator is trusted by construction.

This will be properly resolved when generics allow the allocator to
return *mut T directly, eliminating the need for opaque casts at
allocation sites.
Alexis Sellier committed ago 1 parent 1d1204a9
lib/std/lang/resolver.rad +5 -0
5976 5976 
                if self.unsafeDepth == 0 {
5977 5977 
                    throw emitError(self, node, ErrorKind::UnsafeRequired);
5978 5978 
                }
5979 5979 
            }
5980 5980 
        }
5981 + 
        // TODO: Opaque pointer casts (*opaque as *T) should require unsafe
5982 + 
        // context, since they assert the pointer is valid for the target type.
5983 + 
        // Currently exempted because the allocator returns *opaque and every
5984 + 
        // allocation site does `alloc() as *mut T`. This will be resolved
5985 + 
        // when generics allow the allocator to return *mut T directly.
5981 5986 
        // Propagate constant value through the cast, adjusting integer
5982 5987 
        // metadata to match the target type.
5983 5988 
        if let value = constValueEntry(self, expr.value) {
5984 5989 
            if let case ConstValue::Int(i) = value {
5985 5990 
                if let range = integerRange(targetTy) {