librustc: Disallow "unsafe" for external functions

src/libextra/flate.rs

@@ -25,17 +25,17 @@ pub mod rustrt {
 
     #[link_name = "rustrt"]
     extern {
-        pub unsafe fn tdefl_compress_mem_to_heap(psrc_buf: *const c_void,
+        pub fn tdefl_compress_mem_to_heap(psrc_buf: *const c_void,
-                                                 src_buf_len: size_t,
+                                          src_buf_len: size_t,
-                                                 pout_len: *mut size_t,
+                                          pout_len: *mut size_t,
-                                                 flags: c_int)
+                                          flags: c_int)
-                                                 -> *c_void;
+                                          -> *c_void;
 
-        pub unsafe fn tinfl_decompress_mem_to_heap(psrc_buf: *const c_void,
+        pub fn tinfl_decompress_mem_to_heap(psrc_buf: *const c_void,
-                                                   src_buf_len: size_t,
+                                            src_buf_len: size_t,
-                                                   pout_len: *mut size_t,
+                                            pout_len: *mut size_t,
-                                                   flags: c_int)
+                                            flags: c_int)
-                                                   -> *c_void;
+                                            -> *c_void;
     }
 }
 

src/libextra/rl.rs

@@ -20,13 +20,13 @@ pub mod rustrt {
     use std::libc::{c_char, c_int};
 
     extern {
-        pub unsafe fn linenoise(prompt: *c_char) -> *c_char;
+        pub fn linenoise(prompt: *c_char) -> *c_char;
-        pub unsafe fn linenoiseHistoryAdd(line: *c_char) -> c_int;
+        pub fn linenoiseHistoryAdd(line: *c_char) -> c_int;
-        pub unsafe fn linenoiseHistorySetMaxLen(len: c_int) -> c_int;
+        pub fn linenoiseHistorySetMaxLen(len: c_int) -> c_int;
-        pub unsafe fn linenoiseHistorySave(file: *c_char) -> c_int;
+        pub fn linenoiseHistorySave(file: *c_char) -> c_int;
-        pub unsafe fn linenoiseHistoryLoad(file: *c_char) -> c_int;
+        pub fn linenoiseHistoryLoad(file: *c_char) -> c_int;
-        pub unsafe fn linenoiseSetCompletionCallback(callback: *u8);
+        pub fn linenoiseSetCompletionCallback(callback: *u8);
-        pub unsafe fn linenoiseAddCompletion(completions: *(), line: *c_char);
+        pub fn linenoiseAddCompletion(completions: *(), line: *c_char);
     }
 }
 

src/libextra/time.rs

@@ -23,16 +23,13 @@ pub mod rustrt {
 
     #[abi = "cdecl"]
     extern {
-        pub unsafe fn get_time(sec: &mut i64, nsec: &mut i32);
+        pub fn get_time(sec: &mut i64, nsec: &mut i32);
-
+        pub fn precise_time_ns(ns: &mut u64);
-        pub unsafe fn precise_time_ns(ns: &mut u64);
+        pub fn rust_tzset();
-
+        pub fn rust_gmtime(sec: i64, nsec: i32, result: &mut Tm);
-        pub unsafe fn rust_tzset();
+        pub fn rust_localtime(sec: i64, nsec: i32, result: &mut Tm);
-
+        pub fn rust_timegm(tm: &Tm) -> i64;
-        pub unsafe fn rust_gmtime(sec: i64, nsec: i32, result: &mut Tm);
+        pub fn rust_mktime(tm: &Tm) -> i64;
-        pub unsafe fn rust_localtime(sec: i64, nsec: i32, result: &mut Tm);
-        pub unsafe fn rust_timegm(tm: &Tm) -> i64;
-        pub unsafe fn rust_mktime(tm: &Tm) -> i64;
     }
 }
 

src/libextra/unicode.rs

@@ -162,14 +162,13 @@ pub mod icu {
         #[link_name = "icuuc"]
         #[abi = "cdecl"]
         extern {
-            pub unsafe fn u_hasBinaryProperty(c: UChar32, which: UProperty)
+            pub fn u_hasBinaryProperty(c: UChar32, which: UProperty) -> UBool;
-                                              -> UBool;
+            pub fn u_isdigit(c: UChar32) -> UBool;
-            pub unsafe fn u_isdigit(c: UChar32) -> UBool;
+            pub fn u_islower(c: UChar32) -> UBool;
-            pub unsafe fn u_islower(c: UChar32) -> UBool;
+            pub fn u_isspace(c: UChar32) -> UBool;
-            pub unsafe fn u_isspace(c: UChar32) -> UBool;
+            pub fn u_isupper(c: UChar32) -> UBool;
-            pub unsafe fn u_isupper(c: UChar32) -> UBool;
+            pub fn u_tolower(c: UChar32) -> UChar32;
-            pub unsafe fn u_tolower(c: UChar32) -> UChar32;
+            pub fn u_toupper(c: UChar32) -> UChar32;
-            pub unsafe fn u_toupper(c: UChar32) -> UChar32;
         }
     }
 }

src/librustc/metadata/encoder.rs

@@ -1151,9 +1151,9 @@ fn encode_info_for_foreign_item(ecx: &EncodeContext,
 
     ebml_w.start_tag(tag_items_data_item);
     match nitem.node {
-      foreign_item_fn(_, purity, _) => {
+      foreign_item_fn(*) => {
         encode_def_id(ebml_w, local_def(nitem.id));
-        encode_family(ebml_w, purity_fn_family(purity));
+        encode_family(ebml_w, purity_fn_family(impure_fn));
         encode_bounds_and_type(ebml_w, ecx,
                                &lookup_item_type(ecx.tcx,local_def(nitem.id)));
         encode_name(ecx, ebml_w, nitem.ident);

src/librustc/middle/lint.rs

@@ -789,7 +789,7 @@ fn check_item_ctypes(cx: &Context, it: &ast::item) {
       ast::item_foreign_mod(ref nmod) if !nmod.abis.is_intrinsic() => {
         foreach ni in nmod.items.iter() {
             match ni.node {
-                ast::foreign_item_fn(ref decl, _, _) => {
+                ast::foreign_item_fn(ref decl, _) => {
                     check_foreign_fn(cx, decl);
                 }
                 ast::foreign_item_static(ref t, _) => { check_ty(cx, t); }

src/librustc/middle/resolve.rs

@@ -1523,7 +1523,7 @@ impl Resolver {
                            foreign_item.span);
 
         match foreign_item.node {
-            foreign_item_fn(_, _, ref generics) => {
+            foreign_item_fn(_, ref generics) => {
                 let def = def_fn(local_def(foreign_item.id), unsafe_fn);
                 name_bindings.define_value(Public, def, foreign_item.span);
 
@@ -3606,7 +3606,7 @@ impl Resolver {
                 do self.with_scope(Some(item.ident)) {
                     foreach foreign_item in foreign_module.items.iter() {
                         match foreign_item.node {
-                            foreign_item_fn(_, _, ref generics) => {
+                            foreign_item_fn(_, ref generics) => {
                                 self.with_type_parameter_rib(
                                     HasTypeParameters(
                                         generics, foreign_item.id, 0,

src/librustc/middle/typeck/collect.rs

@@ -1137,7 +1137,7 @@ pub fn ty_of_foreign_item(ccx: &CrateCtxt,
                           abis: AbiSet) -> ty::ty_param_bounds_and_ty
 {
     match it.node {
-        ast::foreign_item_fn(ref fn_decl, _, ref generics) => {
+        ast::foreign_item_fn(ref fn_decl, ref generics) => {
             ty_of_foreign_fn_decl(ccx,
                                   fn_decl,
                                   local_def(it.id),

src/librustdoc/tystr_pass.rs

@@ -69,13 +69,24 @@ fn get_fn_sig(srv: astsrv::Srv, fn_id: doc::AstId) -> Option<~str> {
             ast_map::node_item(@ast::item {
                 ident: ident,
                 node: ast::item_fn(ref decl, purity, _, ref tys, _), _
-            }, _) |
+            }, _) => {
+                Some(pprust::fun_to_str(decl,
+                                        purity,
+                                        ident,
+                                        None,
+                                        tys,
+                                        token::get_ident_interner()))
+            }
             ast_map::node_foreign_item(@ast::foreign_item {
                 ident: ident,
-                node: ast::foreign_item_fn(ref decl, purity, ref tys), _
+                node: ast::foreign_item_fn(ref decl, ref tys), _
             }, _, _, _) => {
-                Some(pprust::fun_to_str(decl, purity, ident, None, tys,
+                Some(pprust::fun_to_str(decl,
-                                       token::get_ident_interner()))
+                                        ast::impure_fn,
+                                        ident,
+                                        None,
+                                        tys,
+                                        token::get_ident_interner()))
             }
             _ => fail!("get_fn_sig: fn_id not bound to a fn item")
         }

src/libstd/cleanup.rs

@@ -156,6 +156,6 @@ pub mod rustrt {
     extern {
         #[rust_stack]
         // FIXME (#4386): Unable to make following method private.
-        pub unsafe fn rust_get_task() -> *c_void;
+        pub fn rust_get_task() -> *c_void;
     }
 }

src/libstd/gc.rs

@@ -66,10 +66,10 @@ pub mod rustrt {
     #[link_name = "rustrt"]
     extern {
         #[rust_stack]
-        pub unsafe fn rust_gc_metadata() -> *Word;
+        pub fn rust_gc_metadata() -> *Word;
 
-        pub unsafe fn rust_get_stack_segment() -> *StackSegment;
+        pub fn rust_get_stack_segment() -> *StackSegment;
-        pub unsafe fn rust_get_c_stack() -> *StackSegment;
+        pub fn rust_get_c_stack() -> *StackSegment;
     }
 }
 

src/libstd/io.rs

@@ -77,9 +77,9 @@ pub mod rustrt {
     #[abi = "cdecl"]
     #[link_name = "rustrt"]
     extern {
-        pub unsafe fn rust_get_stdin() -> *libc::FILE;
+        pub fn rust_get_stdin() -> *libc::FILE;
-        pub unsafe fn rust_get_stdout() -> *libc::FILE;
+        pub fn rust_get_stdout() -> *libc::FILE;
-        pub unsafe fn rust_get_stderr() -> *libc::FILE;
+        pub fn rust_get_stderr() -> *libc::FILE;
     }
 }
 

src/libstd/logging.rs

@@ -105,10 +105,10 @@ pub mod rustrt {
     use libc;
 
     extern {
-        pub unsafe fn rust_log_console_on();
+        pub fn rust_log_console_on();
-        pub unsafe fn rust_log_console_off();
+        pub fn rust_log_console_off();
-        pub unsafe fn rust_log_str(level: u32,
+        pub fn rust_log_str(level: u32,
-                                   string: *libc::c_char,
+                            string: *libc::c_char,
-                                   size: libc::size_t);
+                            size: libc::size_t);
     }
 }

src/libstd/num/cmath.rs

@@ -22,83 +22,84 @@ pub mod c_double_utils {
     extern {
         // Alpabetically sorted by link_name
 
-        pub unsafe fn acos(n: c_double) -> c_double;
+        pub fn acos(n: c_double) -> c_double;
-        pub unsafe fn asin(n: c_double) -> c_double;
+        pub fn asin(n: c_double) -> c_double;
-        pub unsafe fn atan(n: c_double) -> c_double;
+        pub fn atan(n: c_double) -> c_double;
-        pub unsafe fn atan2(a: c_double, b: c_double) -> c_double;
+        pub fn atan2(a: c_double, b: c_double) -> c_double;
-        pub unsafe fn cbrt(n: c_double) -> c_double;
+        pub fn cbrt(n: c_double) -> c_double;
-        pub unsafe fn ceil(n: c_double) -> c_double;
+        pub fn ceil(n: c_double) -> c_double;
-        pub unsafe fn copysign(x: c_double, y: c_double) -> c_double;
+        pub fn copysign(x: c_double, y: c_double) -> c_double;
-        pub unsafe fn cos(n: c_double) -> c_double;
+        pub fn cos(n: c_double) -> c_double;
-        pub unsafe fn cosh(n: c_double) -> c_double;
+        pub fn cosh(n: c_double) -> c_double;
-        pub unsafe fn erf(n: c_double) -> c_double;
+        pub fn erf(n: c_double) -> c_double;
-        pub unsafe fn erfc(n: c_double) -> c_double;
+        pub fn erfc(n: c_double) -> c_double;
-        pub unsafe fn exp(n: c_double) -> c_double;
+        pub fn exp(n: c_double) -> c_double;
         // rename: for consistency with underscore usage elsewhere
-        #[link_name="expm1"] unsafe fn exp_m1(n: c_double) -> c_double;
+        #[link_name="expm1"]
-        pub unsafe fn exp2(n: c_double) -> c_double;
+        fn exp_m1(n: c_double) -> c_double;
-        #[link_name="fabs"] unsafe fn abs(n: c_double) -> c_double;
+        pub fn exp2(n: c_double) -> c_double;
+        #[link_name="fabs"]
+        fn abs(n: c_double) -> c_double;
         // rename: for clarity and consistency with add/sub/mul/div
         #[link_name="fdim"]
-        pub unsafe fn abs_sub(a: c_double, b: c_double) -> c_double;
+        pub fn abs_sub(a: c_double, b: c_double) -> c_double;
-        pub unsafe fn floor(n: c_double) -> c_double;
+        pub fn floor(n: c_double) -> c_double;
         // rename: for clarity and consistency with add/sub/mul/div
         #[link_name="fma"]
-        pub unsafe fn mul_add(a: c_double, b: c_double, c: c_double)
+        pub fn mul_add(a: c_double, b: c_double, c: c_double) -> c_double;
-                              -> c_double;
         #[link_name="fmax"]
-        pub unsafe fn fmax(a: c_double, b: c_double) -> c_double;
+        pub fn fmax(a: c_double, b: c_double) -> c_double;
         #[link_name="fmin"]
-        pub unsafe fn fmin(a: c_double, b: c_double) -> c_double;
+        pub fn fmin(a: c_double, b: c_double) -> c_double;
         #[link_name="nextafter"]
-        pub unsafe fn next_after(x: c_double, y: c_double) -> c_double;
+        pub fn next_after(x: c_double, y: c_double) -> c_double;
-        pub unsafe fn frexp(n: c_double, value: &mut c_int) -> c_double;
+        pub fn frexp(n: c_double, value: &mut c_int) -> c_double;
-        pub unsafe fn hypot(x: c_double, y: c_double) -> c_double;
+        pub fn hypot(x: c_double, y: c_double) -> c_double;
-        pub unsafe fn ldexp(x: c_double, n: c_int) -> c_double;
+        pub fn ldexp(x: c_double, n: c_int) -> c_double;
         #[cfg(unix)]
         #[link_name="lgamma_r"]
-        pub unsafe fn lgamma(n: c_double, sign: &mut c_int) -> c_double;
+        pub fn lgamma(n: c_double, sign: &mut c_int) -> c_double;
         #[cfg(windows)]
         #[link_name="__lgamma_r"]
-        pub unsafe fn lgamma(n: c_double, sign: &mut c_int) -> c_double;
+        pub fn lgamma(n: c_double, sign: &mut c_int) -> c_double;
         // renamed: ln seems more natural
         #[link_name="log"]
-        pub unsafe fn ln(n: c_double) -> c_double;
+        pub fn ln(n: c_double) -> c_double;
         // renamed: "logb" /often/ is confused for log2 by beginners
         #[link_name="logb"]
-        pub unsafe fn log_radix(n: c_double) -> c_double;
+        pub fn log_radix(n: c_double) -> c_double;
         // renamed: to be consitent with log as ln
         #[link_name="log1p"]
-        pub unsafe fn ln_1p(n: c_double) -> c_double;
+        pub fn ln_1p(n: c_double) -> c_double;
-        pub unsafe fn log10(n: c_double) -> c_double;
+        pub fn log10(n: c_double) -> c_double;
-        pub unsafe fn log2(n: c_double) -> c_double;
+        pub fn log2(n: c_double) -> c_double;
         #[link_name="ilogb"]
-        pub unsafe fn ilog_radix(n: c_double) -> c_int;
+        pub fn ilog_radix(n: c_double) -> c_int;
-        pub unsafe fn modf(n: c_double, iptr: &mut c_double) -> c_double;
+        pub fn modf(n: c_double, iptr: &mut c_double) -> c_double;
-        pub unsafe fn pow(n: c_double, e: c_double) -> c_double;
+        pub fn pow(n: c_double, e: c_double) -> c_double;
     // FIXME (#1379): enable when rounding modes become available
-    //    unsafe fn rint(n: c_double) -> c_double;
+    //    fn rint(n: c_double) -> c_double;
-        pub unsafe fn round(n: c_double) -> c_double;
+        pub fn round(n: c_double) -> c_double;
         // rename: for consistency with logradix
         #[link_name="scalbn"]
-        pub unsafe fn ldexp_radix(n: c_double, i: c_int) -> c_double;
+        pub fn ldexp_radix(n: c_double, i: c_int) -> c_double;
-        pub unsafe fn sin(n: c_double) -> c_double;
+        pub fn sin(n: c_double) -> c_double;
-        pub unsafe fn sinh(n: c_double) -> c_double;
+        pub fn sinh(n: c_double) -> c_double;
-        pub unsafe fn sqrt(n: c_double) -> c_double;
+        pub fn sqrt(n: c_double) -> c_double;
-        pub unsafe fn tan(n: c_double) -> c_double;
+        pub fn tan(n: c_double) -> c_double;
-        pub unsafe fn tanh(n: c_double) -> c_double;
+        pub fn tanh(n: c_double) -> c_double;
-        pub unsafe fn tgamma(n: c_double) -> c_double;
+        pub fn tgamma(n: c_double) -> c_double;
-        pub unsafe fn trunc(n: c_double) -> c_double;
+        pub fn trunc(n: c_double) -> c_double;
 
         // These are commonly only available for doubles
 
-        pub unsafe fn j0(n: c_double) -> c_double;
+        pub fn j0(n: c_double) -> c_double;
-        pub unsafe fn j1(n: c_double) -> c_double;
+        pub fn j1(n: c_double) -> c_double;
-        pub unsafe fn jn(i: c_int, n: c_double) -> c_double;
+        pub fn jn(i: c_int, n: c_double) -> c_double;
 
-        pub unsafe fn y0(n: c_double) -> c_double;
+        pub fn y0(n: c_double) -> c_double;
-        pub unsafe fn y1(n: c_double) -> c_double;
+        pub fn y1(n: c_double) -> c_double;
-        pub unsafe fn yn(i: c_int, n: c_double) -> c_double;
+        pub fn yn(i: c_int, n: c_double) -> c_double;
     }
 }
 
@@ -111,98 +112,98 @@ pub mod c_float_utils {
         // Alpabetically sorted by link_name
 
         #[link_name="acosf"]
-        pub unsafe fn acos(n: c_float) -> c_float;
+        pub fn acos(n: c_float) -> c_float;
         #[link_name="asinf"]
-        pub unsafe fn asin(n: c_float) -> c_float;
+        pub fn asin(n: c_float) -> c_float;
         #[link_name="atanf"]
-        pub unsafe fn atan(n: c_float) -> c_float;
+        pub fn atan(n: c_float) -> c_float;
         #[link_name="atan2f"]
-        pub unsafe fn atan2(a: c_float, b: c_float) -> c_float;
+        pub fn atan2(a: c_float, b: c_float) -> c_float;
         #[link_name="cbrtf"]
-        pub unsafe fn cbrt(n: c_float) -> c_float;
+        pub fn cbrt(n: c_float) -> c_float;
         #[link_name="ceilf"]
-        pub unsafe fn ceil(n: c_float) -> c_float;
+        pub fn ceil(n: c_float) -> c_float;
         #[link_name="copysignf"]
-        pub unsafe fn copysign(x: c_float, y: c_float) -> c_float;
+        pub fn copysign(x: c_float, y: c_float) -> c_float;
         #[link_name="cosf"]
-        pub unsafe fn cos(n: c_float) -> c_float;
+        pub fn cos(n: c_float) -> c_float;
         #[link_name="coshf"]
-        pub unsafe fn cosh(n: c_float) -> c_float;
+        pub fn cosh(n: c_float) -> c_float;
         #[link_name="erff"]
-        pub unsafe fn erf(n: c_float) -> c_float;
+        pub fn erf(n: c_float) -> c_float;
         #[link_name="erfcf"]
-        pub unsafe fn erfc(n: c_float) -> c_float;
+        pub fn erfc(n: c_float) -> c_float;
         #[link_name="expf"]
-        pub unsafe fn exp(n: c_float) -> c_float;
+        pub fn exp(n: c_float) -> c_float;
         #[link_name="expm1f"]
-        pub unsafe fn exp_m1(n: c_float) -> c_float;
+        pub fn exp_m1(n: c_float) -> c_float;
         #[link_name="exp2f"]
-        pub unsafe fn exp2(n: c_float) -> c_float;
+        pub fn exp2(n: c_float) -> c_float;
         #[link_name="fabsf"]
-        pub unsafe fn abs(n: c_float) -> c_float;
+        pub fn abs(n: c_float) -> c_float;
         #[link_name="fdimf"]
-        pub unsafe fn abs_sub(a: c_float, b: c_float) -> c_float;
+        pub fn abs_sub(a: c_float, b: c_float) -> c_float;
         #[link_name="floorf"]
-        pub unsafe fn floor(n: c_float) -> c_float;
+        pub fn floor(n: c_float) -> c_float;
         #[link_name="frexpf"]
-        pub unsafe fn frexp(n: c_float, value: &mut c_int) -> c_float;
+        pub fn frexp(n: c_float, value: &mut c_int) -> c_float;
         #[link_name="fmaf"]
-        pub unsafe fn mul_add(a: c_float, b: c_float, c: c_float) -> c_float;
+        pub fn mul_add(a: c_float, b: c_float, c: c_float) -> c_float;
         #[link_name="fmaxf"]
-        pub unsafe fn fmax(a: c_float, b: c_float) -> c_float;
+        pub fn fmax(a: c_float, b: c_float) -> c_float;
         #[link_name="fminf"]
-        pub unsafe fn fmin(a: c_float, b: c_float) -> c_float;
+        pub fn fmin(a: c_float, b: c_float) -> c_float;
         #[link_name="nextafterf"]
-        pub unsafe fn next_after(x: c_float, y: c_float) -> c_float;
+        pub fn next_after(x: c_float, y: c_float) -> c_float;
         #[link_name="hypotf"]
-        pub unsafe fn hypot(x: c_float, y: c_float) -> c_float;
+        pub fn hypot(x: c_float, y: c_float) -> c_float;
         #[link_name="ldexpf"]
-        pub unsafe fn ldexp(x: c_float, n: c_int) -> c_float;
+        pub fn ldexp(x: c_float, n: c_int) -> c_float;
 
         #[cfg(unix)]
         #[link_name="lgammaf_r"]
-        pub unsafe fn lgamma(n: c_float, sign: &mut c_int) -> c_float;
+        pub fn lgamma(n: c_float, sign: &mut c_int) -> c_float;
 
         #[cfg(windows)]
         #[link_name="__lgammaf_r"]
-        pub unsafe fn lgamma(n: c_float, sign: &mut c_int) -> c_float;
+        pub fn lgamma(n: c_float, sign: &mut c_int) -> c_float;
 
         #[link_name="logf"]
-        pub unsafe fn ln(n: c_float) -> c_float;
+        pub fn ln(n: c_float) -> c_float;
         #[link_name="logbf"]
-        pub unsafe fn log_radix(n: c_float) -> c_float;
+        pub fn log_radix(n: c_float) -> c_float;
         #[link_name="log1pf"]
-        pub unsafe fn ln_1p(n: c_float) -> c_float;
+        pub fn ln_1p(n: c_float) -> c_float;
         #[link_name="log2f"]
-        pub unsafe fn log2(n: c_float) -> c_float;
+        pub fn log2(n: c_float) -> c_float;
         #[link_name="log10f"]
-        pub unsafe fn log10(n: c_float) -> c_float;
+        pub fn log10(n: c_float) -> c_float;
         #[link_name="ilogbf"]
-        pub unsafe fn ilog_radix(n: c_float) -> c_int;
+        pub fn ilog_radix(n: c_float) -> c_int;
         #[link_name="modff"]
-        pub unsafe fn modf(n: c_float, iptr: &mut c_float) -> c_float;
+        pub fn modf(n: c_float, iptr: &mut c_float) -> c_float;
         #[link_name="powf"]
-        pub unsafe fn pow(n: c_float, e: c_float) -> c_float;
+        pub fn pow(n: c_float, e: c_float) -> c_float;
     // FIXME (#1379): enable when rounding modes become available
-    //    #[link_name="rintf"] unsafe fn rint(n: c_float) -> c_float;
+    //    #[link_name="rintf"] fn rint(n: c_float) -> c_float;
         #[link_name="roundf"]
-        pub unsafe fn round(n: c_float) -> c_float;
+        pub fn round(n: c_float) -> c_float;
         #[link_name="scalbnf"]
-        pub unsafe fn ldexp_radix(n: c_float, i: c_int) -> c_float;
+        pub fn ldexp_radix(n: c_float, i: c_int) -> c_float;
         #[link_name="sinf"]
-        pub unsafe fn sin(n: c_float) -> c_float;
+        pub fn sin(n: c_float) -> c_float;
         #[link_name="sinhf"]
-        pub unsafe fn sinh(n: c_float) -> c_float;
+        pub fn sinh(n: c_float) -> c_float;
         #[link_name="sqrtf"]
-        pub unsafe fn sqrt(n: c_float) -> c_float;
+        pub fn sqrt(n: c_float) -> c_float;
         #[link_name="tanf"]
-        pub unsafe fn tan(n: c_float) -> c_float;
+        pub fn tan(n: c_float) -> c_float;
         #[link_name="tanhf"]
-        pub unsafe fn tanh(n: c_float) -> c_float;
+        pub fn tanh(n: c_float) -> c_float;
         #[link_name="tgammaf"]
-        pub unsafe fn tgamma(n: c_float) -> c_float;
+        pub fn tgamma(n: c_float) -> c_float;
         #[link_name="truncf"]
-        pub unsafe fn trunc(n: c_float) -> c_float;
+        pub fn trunc(n: c_float) -> c_float;
     }
 }
 

src/libstd/os.rs

@@ -61,11 +61,11 @@ pub mod rustrt {
     use libc;
 
     extern {
-        pub unsafe fn rust_get_argc() -> c_int;
+        pub fn rust_get_argc() -> c_int;
-        pub unsafe fn rust_get_argv() -> **c_char;
+        pub fn rust_get_argv() -> **c_char;
-        pub unsafe fn rust_path_is_dir(path: *libc::c_char) -> c_int;
+        pub fn rust_path_is_dir(path: *libc::c_char) -> c_int;
-        pub unsafe fn rust_path_exists(path: *libc::c_char) -> c_int;
+        pub fn rust_path_exists(path: *libc::c_char) -> c_int;
-        pub unsafe fn rust_set_exit_status(code: libc::intptr_t);
+        pub fn rust_set_exit_status(code: libc::intptr_t);
     }
 }
 
@@ -201,7 +201,7 @@ pub fn env() -> ~[(~str,~str)] {
         #[cfg(unix)]
         unsafe fn get_env_pairs() -> ~[~str] {
             extern {
-                unsafe fn rust_env_pairs() -> **libc::c_char;
+                fn rust_env_pairs() -> **libc::c_char;
             }
             let environ = rust_env_pairs();
             if (environ as uint == 0) {
@@ -694,7 +694,7 @@ pub fn list_dir(p: &Path) -> ~[~str] {
             use libc::{dirent_t};
             use libc::{opendir, readdir, closedir};
             extern {
-                unsafe fn rust_list_dir_val(ptr: *dirent_t) -> *libc::c_char;
+                fn rust_list_dir_val(ptr: *dirent_t) -> *libc::c_char;
             }
             let input = p.to_str();
             let mut strings = ~[];
@@ -735,9 +735,8 @@ pub fn list_dir(p: &Path) -> ~[~str] {
 
             #[nolink]
             extern {
-                unsafe fn rust_list_dir_wfd_size() -> libc::size_t;
+                fn rust_list_dir_wfd_size() -> libc::size_t;
-                unsafe fn rust_list_dir_wfd_fp_buf(wfd: *libc::c_void)
+                fn rust_list_dir_wfd_fp_buf(wfd: *libc::c_void) -> *u16;
-                    -> *u16;
             }
             fn star(p: &Path) -> Path { p.push("*") }
             do as_utf16_p(star(p).to_str()) |path_ptr| {
@@ -964,7 +963,7 @@ pub fn errno() -> int {
     fn errno_location() -> *c_int {
         #[nolink]
         extern {
-            unsafe fn __error() -> *c_int;
+            fn __error() -> *c_int;
         }
         unsafe {
             __error()
@@ -976,7 +975,7 @@ pub fn errno() -> int {
     fn errno_location() -> *c_int {
         #[nolink]
         extern {
-            unsafe fn __errno_location() -> *c_int;
+            fn __errno_location() -> *c_int;
         }
         unsafe {
             __errno_location()
@@ -996,7 +995,7 @@ pub fn errno() -> uint {
     #[link_name = "kernel32"]
     #[abi = "stdcall"]
     extern "stdcall" {
-        unsafe fn GetLastError() -> DWORD;
+        fn GetLastError() -> DWORD;
     }
 
     unsafe {
@@ -1011,11 +1010,12 @@ pub fn last_os_error() -> ~str {
         #[cfg(target_os = "macos")]
         #[cfg(target_os = "android")]
         #[cfg(target_os = "freebsd")]
-        fn strerror_r(errnum: c_int, buf: *mut c_char, buflen: size_t) -> c_int {
+        fn strerror_r(errnum: c_int, buf: *mut c_char, buflen: size_t)
+                      -> c_int {
             #[nolink]
             extern {
-                unsafe fn strerror_r(errnum: c_int, buf: *mut c_char,
+                fn strerror_r(errnum: c_int, buf: *mut c_char, buflen: size_t)
-                                     buflen: size_t) -> c_int;
+                              -> c_int;
             }
             unsafe {
                 strerror_r(errnum, buf, buflen)
@@ -1029,8 +1029,10 @@ pub fn last_os_error() -> ~str {
         fn strerror_r(errnum: c_int, buf: *mut c_char, buflen: size_t) -> c_int {
             #[nolink]
             extern {
-                unsafe fn __xpg_strerror_r(errnum: c_int, buf: *mut c_char,
+                fn __xpg_strerror_r(errnum: c_int,
-                                           buflen: size_t) -> c_int;
+                                    buf: *mut c_char,
+                                    buflen: size_t)
+                                    -> c_int;
             }
             unsafe {
                 __xpg_strerror_r(errnum, buf, buflen)
@@ -1058,10 +1060,14 @@ pub fn last_os_error() -> ~str {
         #[link_name = "kernel32"]
         #[abi = "stdcall"]
         extern "stdcall" {
-            unsafe fn FormatMessageA(flags: DWORD, lpSrc: LPVOID,
+            fn FormatMessageA(flags: DWORD,
-                                     msgId: DWORD, langId: DWORD,
+                              lpSrc: LPVOID,
-                                     buf: LPSTR, nsize: DWORD,
+                              msgId: DWORD,
-                                     args: *c_void) -> DWORD;
+                              langId: DWORD,
+                              buf: LPSTR,
+                              nsize: DWORD,
+                              args: *c_void)
+                              -> DWORD;
         }
 
         static FORMAT_MESSAGE_FROM_SYSTEM: DWORD = 0x00001000;

src/libstd/pipes.rs

@@ -258,19 +258,17 @@ pub mod rustrt {
 
     extern {
         #[rust_stack]
-        pub unsafe fn rust_get_task() -> *rust_task;
+        pub fn rust_get_task() -> *rust_task;
         #[rust_stack]
-        pub unsafe fn rust_task_ref(task: *rust_task);
+        pub fn rust_task_ref(task: *rust_task);
-        pub unsafe fn rust_task_deref(task: *rust_task);
+        pub fn rust_task_deref(task: *rust_task);
 
         #[rust_stack]
-        pub unsafe fn task_clear_event_reject(task: *rust_task);
+        pub fn task_clear_event_reject(task: *rust_task);
 
-        pub unsafe fn task_wait_event(this: *rust_task,
+        pub fn task_wait_event(this: *rust_task, killed: &mut *libc::c_void)
-                                      killed: &mut *libc::c_void)
+                               -> bool;
-                                   -> bool;
+        pub fn task_signal_event(target: *rust_task, event: *libc::c_void);
-        pub unsafe fn task_signal_event(target: *rust_task,
-                                        event: *libc::c_void);
     }
 }
 

src/libstd/rand.rs

@@ -252,8 +252,8 @@ pub mod rustrt {
     use libc::size_t;
 
     extern {
-        pub unsafe fn rand_seed_size() -> size_t;
+        pub fn rand_seed_size() -> size_t;
-        pub unsafe fn rand_gen_seed(buf: *mut u8, sz: size_t);
+        pub fn rand_gen_seed(buf: *mut u8, sz: size_t);
     }
 }
 
@@ -1085,10 +1085,9 @@ mod test {
             pub enum rust_rng {}
 
             extern {
-                pub unsafe fn rand_new_seeded(buf: *u8, sz: size_t)
+                pub fn rand_new_seeded(buf: *u8, sz: size_t) -> *rust_rng;
-                                              -> *rust_rng;
+                pub fn rand_next(rng: *rust_rng) -> u32;
-                pub unsafe fn rand_next(rng: *rust_rng) -> u32;
+                pub fn rand_free(rng: *rust_rng);
-                pub unsafe fn rand_free(rng: *rust_rng);
             }
         }
 

src/libstd/rt/local_heap.rs

@@ -92,7 +92,7 @@ pub unsafe fn local_free(ptr: *libc::c_char) {
 
             extern {
                 #[fast_ffi]
-                unsafe fn rust_upcall_free_noswitch(ptr: *libc::c_char);
+                fn rust_upcall_free_noswitch(ptr: *libc::c_char);
             }
         }
         _ => {

src/libstd/rt/thread.rs

@@ -49,7 +49,7 @@ impl Drop for Thread {
 }
 
 extern {
-    pub unsafe fn rust_raw_thread_start(f: &(~fn())) -> *raw_thread;
+    pub fn rust_raw_thread_start(f: &(~fn())) -> *raw_thread;
-    pub unsafe fn rust_raw_thread_join(thread: *raw_thread);
+    pub fn rust_raw_thread_join(thread: *raw_thread);
-    pub unsafe fn rust_raw_thread_delete(thread: *raw_thread);
+    pub fn rust_raw_thread_delete(thread: *raw_thread);
 }

src/libstd/run.rs

@@ -639,8 +639,8 @@ fn spawn_process_os(prog: &str, args: &[~str],
 
         #[abi = "cdecl"]
         extern {
-            pub unsafe fn rust_unset_sigprocmask();
+            pub fn rust_unset_sigprocmask();
-            pub unsafe fn rust_set_environ(envp: *c_void);
+            pub fn rust_set_environ(envp: *c_void);
         }
     }
 

src/libstd/sys.rs

@@ -27,9 +27,7 @@ pub mod rustrt {
 
     extern {
         #[rust_stack]
-        pub unsafe fn rust_upcall_fail(expr: *c_char,
+        pub fn rust_upcall_fail(expr: *c_char, file: *c_char, line: size_t);
-                                       file: *c_char,
-                                       line: size_t);
     }
 }
 

src/libstd/task/mod.rs

@@ -1078,12 +1078,12 @@ mod testrt {
 
     #[nolink]
     extern {
-        pub unsafe fn rust_dbg_lock_create() -> *libc::c_void;
+        pub fn rust_dbg_lock_create() -> *libc::c_void;
-        pub unsafe fn rust_dbg_lock_destroy(lock: *libc::c_void);
+        pub fn rust_dbg_lock_destroy(lock: *libc::c_void);
-        pub unsafe fn rust_dbg_lock_lock(lock: *libc::c_void);
+        pub fn rust_dbg_lock_lock(lock: *libc::c_void);
-        pub unsafe fn rust_dbg_lock_unlock(lock: *libc::c_void);
+        pub fn rust_dbg_lock_unlock(lock: *libc::c_void);
-        pub unsafe fn rust_dbg_lock_wait(lock: *libc::c_void);
+        pub fn rust_dbg_lock_wait(lock: *libc::c_void);
-        pub unsafe fn rust_dbg_lock_signal(lock: *libc::c_void);
+        pub fn rust_dbg_lock_signal(lock: *libc::c_void);
     }
 }
 

src/libstd/unstable/intrinsics.rs

@@ -296,16 +296,16 @@ extern "rust-intrinsic" {
     /// `init` is unsafe because it returns a zeroed-out datum,
     /// which is unsafe unless T is POD. We don't have a POD
     /// kind yet. (See #4074).
-    pub unsafe fn init<T>() -> T;
+    pub fn init<T>() -> T;
 
     /// Create an uninitialized value.
-    pub unsafe fn uninit<T>() -> T;
+    pub fn uninit<T>() -> T;
 
     /// Move a value out of scope without running drop glue.
     ///
     /// `forget` is unsafe because the caller is responsible for
     /// ensuring the argument is deallocated already.
-    pub unsafe fn forget<T>(_: T) -> ();
+    pub fn forget<T>(_: T) -> ();
     pub fn transmute<T,U>(e: T) -> U;
 
     /// Returns `true` if a type requires drop glue.

src/libstd/unstable/lang.rs

@@ -28,17 +28,12 @@ pub mod rustrt {
 
     extern {
         #[rust_stack]
-        pub unsafe fn rust_upcall_malloc(td: *c_char, size: uintptr_t)
+        pub fn rust_upcall_malloc(td: *c_char, size: uintptr_t) -> *c_char;
-                                         -> *c_char;
-
         #[rust_stack]
-        pub unsafe fn rust_upcall_free(ptr: *c_char);
+        pub fn rust_upcall_free(ptr: *c_char);
-
         #[fast_ffi]
-        pub unsafe fn rust_upcall_malloc_noswitch(td: *c_char,
+        pub fn rust_upcall_malloc_noswitch(td: *c_char, size: uintptr_t)
-                                                  size: uintptr_t)
+                                           -> *c_char;
-                                                  -> *c_char;
-
         #[rust_stack]
         pub fn rust_try_get_task() -> *rust_task;
     }

src/libsyntax/ast.rs

@@ -1077,7 +1077,7 @@ pub struct foreign_item {
 
 #[deriving(Eq, Encodable, Decodable,IterBytes)]
 pub enum foreign_item_ {
-    foreign_item_fn(fn_decl, purity, Generics),
+    foreign_item_fn(fn_decl, Generics),
     foreign_item_static(Ty, /* is_mutbl */ bool),
 }
 

src/libsyntax/fold.rs

@@ -223,7 +223,7 @@ fn noop_fold_foreign_item(ni: @foreign_item, fld: @ast_fold)
         attrs: ni.attrs.map(|x| fold_attribute(*x)),
         node:
             match ni.node {
-                foreign_item_fn(ref fdec, purity, ref generics) => {
+                foreign_item_fn(ref fdec, ref generics) => {
                     foreign_item_fn(
                         ast::fn_decl {
                             inputs: fdec.inputs.map(|a|
@@ -231,7 +231,6 @@ fn noop_fold_foreign_item(ni: @foreign_item, fld: @ast_fold)
                             output: fld.fold_ty(&fdec.output),
                             cf: fdec.cf,
                         },
-                        purity,
                         fold_generics(generics, fld))
                 }
                 foreign_item_static(ref t, m) => {

src/libsyntax/oldvisit.rs

@@ -339,7 +339,7 @@ pub fn visit_pat<E:Clone>(p: &pat, (e, v): (E, vt<E>)) {
 
 pub fn visit_foreign_item<E:Clone>(ni: &foreign_item, (e, v): (E, vt<E>)) {
     match ni.node {
-        foreign_item_fn(ref fd, _, ref generics) => {
+        foreign_item_fn(ref fd, ref generics) => {
             visit_fn_decl(fd, (e.clone(), v));
             (v.visit_generics)(generics, (e, v));
         }

src/libsyntax/parse/obsolete.rs

@@ -63,6 +63,7 @@ pub enum ObsoleteSyntax {
     ObsoleteMultipleLocalDecl,
     ObsoleteMutWithMultipleBindings,
     ObsoleteExternVisibility,
+    ObsoleteUnsafeExternFn,
 }
 
 impl to_bytes::IterBytes for ObsoleteSyntax {
@@ -246,7 +247,12 @@ impl ParserObsoleteMethods for Parser {
                 "`pub extern` or `priv extern`",
                 "place the `pub` or `priv` on the individual external items \
                  instead"
-            )
+            ),
+            ObsoleteUnsafeExternFn => (
+                "unsafe external function",
+                "external functions are always unsafe; remove the `unsafe` \
+                 keyword"
+            ),
         };
 
         self.report(sp, kind, kind_str, desc);

src/libsyntax/parse/parser.rs

@@ -84,7 +84,8 @@ use parse::obsolete::{ObsoletePurity, ObsoleteStaticMethod};
 use parse::obsolete::{ObsoleteConstItem, ObsoleteFixedLengthVectorType};
 use parse::obsolete::{ObsoleteNamedExternModule, ObsoleteMultipleLocalDecl};
 use parse::obsolete::{ObsoleteMutWithMultipleBindings};
-use parse::obsolete::{ObsoleteExternVisibility, ParserObsoleteMethods};
+use parse::obsolete::{ObsoleteExternVisibility, ObsoleteUnsafeExternFn};
+use parse::obsolete::{ParserObsoleteMethods};
 use parse::token::{can_begin_expr, get_ident_interner, ident_to_str, is_ident};
 use parse::token::{is_ident_or_path};
 use parse::token::{is_plain_ident, INTERPOLATED, keywords, special_idents};
@@ -4066,14 +4067,20 @@ impl Parser {
     fn parse_item_foreign_fn(&self,  attrs: ~[Attribute]) -> @foreign_item {
         let lo = self.span.lo;
         let vis = self.parse_visibility();
+
+        // Parse obsolete purity.
         let purity = self.parse_fn_purity();
+        if purity != impure_fn {
+            self.obsolete(*self.last_span, ObsoleteUnsafeExternFn);
+        }
+
         let (ident, generics) = self.parse_fn_header();
         let decl = self.parse_fn_decl();
         let hi = self.span.hi;
         self.expect(&token::SEMI);
         @ast::foreign_item { ident: ident,
                              attrs: attrs,
-                             node: foreign_item_fn(decl, purity, generics),
+                             node: foreign_item_fn(decl, generics),
                              id: self.get_id(),
                              span: mk_sp(lo, hi),
                              vis: vis }

src/libsyntax/print/pprust.rs

@@ -454,8 +454,8 @@ pub fn print_foreign_item(s: @ps, item: &ast::foreign_item) {
     maybe_print_comment(s, item.span.lo);
     print_outer_attributes(s, item.attrs);
     match item.node {
-      ast::foreign_item_fn(ref decl, purity, ref generics) => {
+      ast::foreign_item_fn(ref decl, ref generics) => {
-        print_fn(s, decl, Some(purity), AbiSet::Rust(), item.ident, generics, None,
+        print_fn(s, decl, None, AbiSet::Rust(), item.ident, generics, None,
                  item.vis);
         end(s); // end head-ibox
         word(s.s, ";");

src/libsyntax/visit.rs

@@ -317,7 +317,7 @@ pub fn visit_foreign_item<E:Clone>(visitor: @Visitor<E>,
                                    foreign_item: &foreign_item,
                                    env: E) {
     match foreign_item.node {
-        foreign_item_fn(ref function_declaration, _, ref generics) => {
+        foreign_item_fn(ref function_declaration, ref generics) => {
             visit_fn_decl(visitor, function_declaration, env.clone());
             visitor.visit_generics(generics, env)
         }

src/test/bench/noise.rs

@@ -119,7 +119,7 @@ fn main() {
 
     foreach y in range(0, 256) {
         foreach x in range(0, 256) {
-            print((symbols[pixels[y*256+x] / 0.2f32) as int]);
+            print(symbols[(pixels[y*256+x] / 0.2f32) as int]);
         }
         println("");
     }

src/test/compile-fail/foreign-unsafe-fn-called.rs

@@ -13,7 +13,7 @@
 mod test {
     #[abi = "cdecl"]
     extern {
-        pub unsafe fn free();
+        pub fn free();
     }
 }
 

src/test/run-pass/extern-pub.rs

@@ -1,5 +1,5 @@
 extern {
-    pub unsafe fn free(p: *u8);
+    pub fn free(p: *u8);
 }
 
 pub fn main() {