e.g. I could envision a fn upholds_invariants() -> bool method that could be debug_assert!ed on all methods that use unsafe, thereby allowing us to fuzz-check for mistakes we may have made w.r.t. memory safety. Alas, there are some invariants we cannot check for now (namely around uninitialized memory), but we could at least document them.
We could also add more comments describing why what we do really should be safe, so others can understand – and try to poke holes into – our thinking.
e.g. I could envision a
fn upholds_invariants() -> boolmethod that could bedebug_assert!ed on all methods that useunsafe, thereby allowing us to fuzz-check for mistakes we may have made w.r.t. memory safety. Alas, there are some invariants we cannot check for now (namely around uninitialized memory), but we could at least document them.We could also add more comments describing why what we do really should be safe, so others can understand – and try to poke holes into – our thinking.