allow accessing the contents of UnsafeCell without going through get by RalfJung · Pull Request #159730 · rust-lang/rust

RalfJung · 2026-07-22T16:57:04Z

This has been FCP'd by @rust-lang/opsem in rust-lang/unsafe-code-guidelines#281.
@rust-lang/lang since this is a change very deep in the details of the aliasing model, I assume it's fine to just FYI you here, but please stop me if that is not right.

The first commit attempts to clarify some potentially-confusing parts of the docs. @jethrogb I hope this helps somewhat resolve the confusion that these docs previously caused.

Closes rust-lang/unsafe-code-guidelines#281

rustbot · 2026-07-22T16:57:08Z

r? @jhpratt

rustbot has assigned @jhpratt.
They will have a look at your PR within the next two weeks and either review your PR or reassign to another reviewer.

Use r? to explicitly pick a reviewer

Why was this reviewer chosen?

The reviewer was selected based on:

Owners of files modified in this PR: libs
libs expanded to 12 candidates
Random selection from 6 candidates

RalfJung · 2026-07-22T17:38:08Z

+/// /// # Safety
+/// /// The caller must not call `get_mut_unchecked` again (on any alias of `ptr`) until
+/// /// the returned reference is no longer used.
+/// # #[allow(invalid_reference_casting)] // FIXME should the lint really fire here?


We should probably stop this lint from firing here since the code is legal. But that doesn't have to happen in the same PR.

View changes since the review

Filed a diagnostics issue: #159915

…/ raw_get

jhpratt · 2026-07-25T08:46:56Z

My reading of the RFC introducing opsem is that this type of detail has been handed off by lang, so procedurally I opsem signing off is sufficient.

@bors r+ rollup

rust-bors · 2026-07-25T08:46:59Z

📌 Commit 678de5f has been approved by jhpratt

It is now in the queue for this repository.

@jethrogb

allow accessing the contents of UnsafeCell without going through get This has been FCP'd by @rust-lang/opsem in rust-lang/unsafe-code-guidelines#281. @rust-lang/lang since this is a change very deep in the details of the aliasing model, I assume it's fine to just FYI you here, but please stop me if that is not right. The first commit attempts to clarify some potentially-confusing parts of the docs. @jethrogb I hope this helps somewhat resolve the confusion that these docs previously caused. Closes rust-lang/unsafe-code-guidelines#281

Rollup of 20 pull requests Successful merges: - #138618 (Support using const pointers in asm `const` operand) - #157962 (Lower paths to functions in const args as ConstKind::Error) - #158404 (trait_solver: normalize next-gen region constraints) - #158709 (rustdoc: warn on improperly interleaved HTML/MD) - #159720 (document #[global_allocator] constraints) - #159732 (optimization: don't look for diagnostic/canonical items without rustc_attrs enabled) - #159738 (implement `CovariantUnsafeCell`) - #159740 (reuse regular exported_non_generic_symbols logic in Miri) - #159780 (check `extern "custom"` function pointers) - #159786 (rustdoc-js: ignore editor temp files in test folder discovery) - #159819 (std::sync::poison: disable auto_cfg on PoisonError::new) - #155388 (stepping into where-clauses during normalization may be productive) - #155914 (when bailing on ambiguity, don't force other results to ambig) - #159439 (Fix(lib/fs/win): Fall back on Win32 delete for `Dir::remove_file`) - #159676 (Update wasm-component-ld to 0.5.27) - #159730 (allow accessing the contents of UnsafeCell without going through get) - #159809 (Avoid `#[target_features]`) - #159826 (Remove redundant `#[rustc_paren_sugar]` feature gate) - #159853 (Updated expect messages for `CString` struct and method documentation) - #159877 (Revert "Export `derive` at `core::derive` and `std::derive`")

@jethrogb

allow accessing the contents of UnsafeCell without going through get This has been FCP'd by @rust-lang/opsem in rust-lang/unsafe-code-guidelines#281. @rust-lang/lang since this is a change very deep in the details of the aliasing model, I assume it's fine to just FYI you here, but please stop me if that is not right. The first commit attempts to clarify some potentially-confusing parts of the docs. @jethrogb I hope this helps somewhat resolve the confusion that these docs previously caused. Closes rust-lang/unsafe-code-guidelines#281

Rollup of 23 pull requests Successful merges: - #159720 (document #[global_allocator] constraints) - #159732 (optimization: don't look for diagnostic/canonical items without rustc_attrs enabled) - #159738 (implement `CovariantUnsafeCell`) - #159740 (reuse regular exported_non_generic_symbols logic in Miri) - #159780 (check `extern "custom"` function pointers) - #159786 (rustdoc-js: ignore editor temp files in test folder discovery) - #159819 (std::sync::poison: disable auto_cfg on PoisonError::new) - #155388 (stepping into where-clauses during normalization may be productive) - #155914 (when bailing on ambiguity, don't force other results to ambig) - #159204 (Add support to caller_location to rustc_public) - #159411 ([rustdoc] Correctly handle output options with --show-coverage) - #159439 (Fix(lib/fs/win): Fall back on Win32 delete for `Dir::remove_file`) - #159676 (Update wasm-component-ld to 0.5.27) - #159730 (allow accessing the contents of UnsafeCell without going through get) - #159809 (Avoid `#[target_features]`) - #159810 (Add tuple never coercion collection regression test) - #159826 (Remove redundant `#[rustc_paren_sugar]` feature gate) - #159853 (Updated expect messages for `CString` struct and method documentation) - #159877 (Revert "Export `derive` at `core::derive` and `std::derive`") - #159878 (bootstrap: Remove obsolete option `build.compiletest-use-stage0-libtest`) - #159882 (Update expect messages in library/alloc/boxed.rs and library/alloc/string.rs to follow the style guide) - #159891 (Split multiline derives into std/rustc macros) - #159895 (rustc-dev-guide subtree update)

@jethrogb

allow accessing the contents of UnsafeCell without going through get This has been FCP'd by @rust-lang/opsem in rust-lang/unsafe-code-guidelines#281. @rust-lang/lang since this is a change very deep in the details of the aliasing model, I assume it's fine to just FYI you here, but please stop me if that is not right. The first commit attempts to clarify some potentially-confusing parts of the docs. @jethrogb I hope this helps somewhat resolve the confusion that these docs previously caused. Closes rust-lang/unsafe-code-guidelines#281

Rollup of 23 pull requests Successful merges: - #159673 (bootstrap: forward -fdebug-prefix-map when using cc) - #159720 (document #[global_allocator] constraints) - #159732 (optimization: don't look for diagnostic/canonical items without rustc_attrs enabled) - #159738 (implement `CovariantUnsafeCell`) - #159740 (reuse regular exported_non_generic_symbols logic in Miri) - #159780 (check `extern "custom"` function pointers) - #159786 (rustdoc-js: ignore editor temp files in test folder discovery) - #159819 (std::sync::poison: disable auto_cfg on PoisonError::new) - #155388 (stepping into where-clauses during normalization may be productive) - #155914 (when bailing on ambiguity, don't force other results to ambig) - #159204 (Add support to caller_location to rustc_public) - #159411 ([rustdoc] Correctly handle output options with --show-coverage) - #159439 (Fix(lib/fs/win): Fall back on Win32 delete for `Dir::remove_file`) - #159676 (Update wasm-component-ld to 0.5.27) - #159730 (allow accessing the contents of UnsafeCell without going through get) - #159809 (Avoid `#[target_features]`) - #159810 (Add tuple never coercion collection regression test) - #159826 (Remove redundant `#[rustc_paren_sugar]` feature gate) - #159853 (Updated expect messages for `CString` struct and method documentation) - #159878 (bootstrap: Remove obsolete option `build.compiletest-use-stage0-libtest`) - #159882 (Update expect messages in library/alloc/boxed.rs and library/alloc/string.rs to follow the style guide) - #159891 (Split multiline derives into std/rustc macros) - #159895 (rustc-dev-guide subtree update)

@jethrogb

allow accessing the contents of UnsafeCell without going through get This has been FCP'd by @rust-lang/opsem in rust-lang/unsafe-code-guidelines#281. @rust-lang/lang since this is a change very deep in the details of the aliasing model, I assume it's fine to just FYI you here, but please stop me if that is not right. The first commit attempts to clarify some potentially-confusing parts of the docs. @jethrogb I hope this helps somewhat resolve the confusion that these docs previously caused. Closes rust-lang/unsafe-code-guidelines#281

…uwer Rollup of 25 pull requests Successful merges: - #138618 (Support using const pointers in asm `const` operand) - #157962 (Lower paths to functions in const args as ConstKind::Error) - #158404 (trait_solver: normalize next-gen region constraints) - #158709 (rustdoc: warn on improperly interleaved HTML/MD) - #159174 (Fix implicit_provenance_casts warnings on Xous) - #159179 (enable `unreachable_cfg_select_predicates` lint as part of `unused` lint group) - #159518 (iter: extend step_by specialization to cover StepBy<RangeIter<{integer}>>) - #159673 (bootstrap: forward -fdebug-prefix-map when using cc) - #159700 (Split non-local `semicolon_in_expressions_from_macros` into a separate lint) - #159720 (document #[global_allocator] constraints) - #159732 (optimization: don't look for diagnostic/canonical items without rustc_attrs enabled) - #159738 (implement `CovariantUnsafeCell`) - #159740 (reuse regular exported_non_generic_symbols logic in Miri) - #159780 (check `extern "custom"` function pointers) - #159785 (Share _Unwind_Exception definition between native and wasm) - #159786 (rustdoc-js: ignore editor temp files in test folder discovery) - #159819 (std::sync::poison: disable auto_cfg on PoisonError::new) - #155388 (stepping into where-clauses during normalization may be productive) - #155914 (when bailing on ambiguity, don't force other results to ambig) - #159204 (Add support to caller_location to rustc_public) - #159439 (Fix(lib/fs/win): Fall back on Win32 delete for `Dir::remove_file`) - #159676 (Update wasm-component-ld to 0.5.27) - #159695 (proc_macro: Fix cfg_attr inner attrs in file modules) - #159730 (allow accessing the contents of UnsafeCell without going through get) - #159809 (Avoid `#[target_features]`)

@jethrogb

allow accessing the contents of UnsafeCell without going through get This has been FCP'd by @rust-lang/opsem in rust-lang/unsafe-code-guidelines#281. @rust-lang/lang since this is a change very deep in the details of the aliasing model, I assume it's fine to just FYI you here, but please stop me if that is not right. The first commit attempts to clarify some potentially-confusing parts of the docs. @jethrogb I hope this helps somewhat resolve the confusion that these docs previously caused. Closes rust-lang/unsafe-code-guidelines#281

…uwer Rollup of 25 pull requests Successful merges: - #159825 (codegen: handle OperandValue::Uninit in codegen_return_terminator) - #138618 (Support using const pointers in asm `const` operand) - #157962 (Lower paths to functions in const args as ConstKind::Error) - #158404 (trait_solver: normalize next-gen region constraints) - #158709 (rustdoc: warn on improperly interleaved HTML/MD) - #159174 (Fix implicit_provenance_casts warnings on Xous) - #159179 (enable `unreachable_cfg_select_predicates` lint as part of `unused` lint group) - #159518 (iter: extend step_by specialization to cover StepBy<RangeIter<{integer}>>) - #159673 (bootstrap: forward -fdebug-prefix-map when using cc) - #159700 (Split non-local `semicolon_in_expressions_from_macros` into a separate lint) - #159720 (document #[global_allocator] constraints) - #159732 (optimization: don't look for diagnostic/canonical items without rustc_attrs enabled) - #159738 (implement `CovariantUnsafeCell`) - #159740 (reuse regular exported_non_generic_symbols logic in Miri) - #159780 (check `extern "custom"` function pointers) - #159786 (rustdoc-js: ignore editor temp files in test folder discovery) - #159819 (std::sync::poison: disable auto_cfg on PoisonError::new) - #155388 (stepping into where-clauses during normalization may be productive) - #155914 (when bailing on ambiguity, don't force other results to ambig) - #159204 (Add support to caller_location to rustc_public) - #159439 (Fix(lib/fs/win): Fall back on Win32 delete for `Dir::remove_file`) - #159676 (Update wasm-component-ld to 0.5.27) - #159695 (proc_macro: Fix cfg_attr inner attrs in file modules) - #159730 (allow accessing the contents of UnsafeCell without going through get) - #159809 (Avoid `#[target_features]`)

@jethrogb

allow accessing the contents of UnsafeCell without going through get This has been FCP'd by @rust-lang/opsem in rust-lang/unsafe-code-guidelines#281. @rust-lang/lang since this is a change very deep in the details of the aliasing model, I assume it's fine to just FYI you here, but please stop me if that is not right. The first commit attempts to clarify some potentially-confusing parts of the docs. @jethrogb I hope this helps somewhat resolve the confusion that these docs previously caused. Closes rust-lang/unsafe-code-guidelines#281

Rollup of 25 pull requests Successful merges: - #138618 (Support using const pointers in asm `const` operand) - #157962 (Lower paths to functions in const args as ConstKind::Error) - #158709 (rustdoc: warn on improperly interleaved HTML/MD) - #159174 (Fix implicit_provenance_casts warnings on Xous) - #159179 (enable `unreachable_cfg_select_predicates` lint as part of `unused` lint group) - #159518 (iter: extend step_by specialization to cover StepBy<RangeIter<{integer}>>) - #159673 (bootstrap: forward -fdebug-prefix-map when using cc) - #159700 (Split non-local `semicolon_in_expressions_from_macros` into a separate lint) - #159720 (document #[global_allocator] constraints) - #159732 (optimization: don't look for diagnostic/canonical items without rustc_attrs enabled) - #159738 (implement `CovariantUnsafeCell`) - #159740 (reuse regular exported_non_generic_symbols logic in Miri) - #159780 (check `extern "custom"` function pointers) - #159786 (rustdoc-js: ignore editor temp files in test folder discovery) - #159819 (std::sync::poison: disable auto_cfg on PoisonError::new) - #152439 (Fix typos and grammar in library documentation) - #155388 (stepping into where-clauses during normalization may be productive) - #155914 (when bailing on ambiguity, don't force other results to ambig) - #159204 (Add support to caller_location to rustc_public) - #159439 (Fix(lib/fs/win): Fall back on Win32 delete for `Dir::remove_file`) - #159676 (Update wasm-component-ld to 0.5.27) - #159695 (proc_macro: Fix cfg_attr inner attrs in file modules) - #159730 (allow accessing the contents of UnsafeCell without going through get) - #159809 (Avoid `#[target_features]`) - #159878 (bootstrap: Remove obsolete option `build.compiletest-use-stage0-libtest`)

@jethrogb

Rollup merge of #159730 - RalfJung:unsafe-cell, r=jhpratt allow accessing the contents of UnsafeCell without going through get This has been FCP'd by @rust-lang/opsem in rust-lang/unsafe-code-guidelines#281. @rust-lang/lang since this is a change very deep in the details of the aliasing model, I assume it's fine to just FYI you here, but please stop me if that is not right. The first commit attempts to clarify some potentially-confusing parts of the docs. @jethrogb I hope this helps somewhat resolve the confusion that these docs previously caused. Closes rust-lang/unsafe-code-guidelines#281

rustbot assigned jhpratt Jul 22, 2026

rustbot added S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. T-libs Relevant to the library team, which will review and decide on the PR/issue. labels Jul 22, 2026

RalfJung mentioned this pull request Jul 22, 2026

Can a pointer obtained by casting &UnsafeCell<T> to *mut T be written to? rust-lang/unsafe-code-guidelines#281

Open

RalfJung force-pushed the unsafe-cell branch from ecc674a to 7e9e8dd Compare July 22, 2026 17:35

RalfJung commented Jul 22, 2026

View reviewed changes

ymleung314 reviewed Jul 22, 2026

View reviewed changes

Comment thread library/core/src/cell.rs Outdated

clarify some potentially-confusing parts of the UnsafeCell docs

b7973ab

RalfJung force-pushed the unsafe-cell branch from 7e9e8dd to 6c764ba Compare July 23, 2026 09:20

ymleung314 reviewed Jul 23, 2026

View reviewed changes

Comment thread library/core/src/cell.rs Outdated

allow accessing the contents of UnsafeCell without going through get …

678de5f

…/ raw_get

RalfJung force-pushed the unsafe-cell branch from 6c764ba to 678de5f Compare July 23, 2026 11:34

rust-bors Bot added S-waiting-on-bors Status: Waiting on bors to run and complete tests. Bors will change the label on completion. and removed S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. labels Jul 25, 2026

jhpratt mentioned this pull request Jul 25, 2026

Rollup of 20 pull requests #159888

Closed

GuillaumeGomez mentioned this pull request Jul 25, 2026

Rollup of 23 pull requests #159903

Closed

GuillaumeGomez mentioned this pull request Jul 25, 2026

Rollup of 23 pull requests #159905

Closed

RalfJung mentioned this pull request Jul 25, 2026

invalid_reference_casting fires for correct usage of UnsafeCell #159915

Open

JonathanBrouwer mentioned this pull request Jul 25, 2026

Rollup of 25 pull requests #159920

Closed

JonathanBrouwer mentioned this pull request Jul 25, 2026

Rollup of 25 pull requests #159926

Closed

This was referenced Jul 26, 2026

Rollup of 25 pull requests #159941

Closed

Rollup of 25 pull requests #159942

Merged

rust-bors Bot merged commit cc13d77 into rust-lang:main Jul 26, 2026
13 checks passed

rustbot added this to the 1.99.0 milestone Jul 26, 2026

Urgau mentioned this pull request Jul 26, 2026

Allow UnsafeCell content access without get in invalid_reference_casting lint #159960

Open

RalfJung deleted the unsafe-cell branch July 26, 2026 12:45

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

allow accessing the contents of UnsafeCell without going through get#159730

allow accessing the contents of UnsafeCell without going through get#159730
rust-bors[bot] merged 2 commits into
rust-lang:mainfrom
RalfJung:unsafe-cell

RalfJung commented Jul 22, 2026 •

edited

Loading

Uh oh!

rustbot commented Jul 22, 2026

Uh oh!

RalfJung Jul 22, 2026 •

edited by rustbot

Loading

Uh oh!

RalfJung Jul 25, 2026

Uh oh!

Uh oh!

Uh oh!

jhpratt commented Jul 25, 2026

Uh oh!

rust-bors Bot commented Jul 25, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Uh oh!

Conversation

RalfJung commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rustbot commented Jul 22, 2026

Uh oh!

RalfJung Jul 22, 2026 • edited by rustbot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

RalfJung Jul 25, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

jhpratt commented Jul 25, 2026

Uh oh!

rust-bors Bot commented Jul 25, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

RalfJung commented Jul 22, 2026 •

edited

Loading

RalfJung Jul 22, 2026 •

edited by rustbot

Loading