core: Make intrinsics::init unsafe

src/libcore/unstable/intrinsics.rs

@@ -42,12 +42,17 @@ pub extern "rust-intrinsic" {
 
     pub fn get_tydesc<T>() -> *();
 
-    pub fn init<T>() -> T;
+    /// init is unsafe because it returns a zeroed-out datum,
+    /// which is unsafe unless T is POD. We don't have a POD
+    /// kind yet. (See #4074)
+    pub unsafe fn init<T>() -> T;
 
     #[cfg(not(stage0))]
     pub unsafe fn uninit<T>() -> T;
 
-    pub fn forget<T>(_: T) -> ();
+    /// forget is unsafe because the caller is responsible for
+    /// ensuring the argument is deallocated already
+    pub unsafe fn forget<T>(_: T) -> ();
 
     pub fn needs_drop<T>() -> bool;
 

src/test/compile-fail/forget-init-unsafe.rs

@@ -0,0 +1,17 @@
+// Copyright 2013 The Rust Project Developers. See the COPYRIGHT
+// file at the top-level directory of this distribution and at
+// http://rust-lang.org/COPYRIGHT.
+//
+// Licensed under the Apache License, Version 2.0 <LICENSE-APACHE or
+// http://www.apache.org/licenses/LICENSE-2.0> or the MIT license
+// <LICENSE-MIT or http://opensource.org/licenses/MIT>, at your
+// option. This file may not be copied, modified, or distributed
+// except according to those terms.
+
+use core::unstable::intrinsics::{init, forget};
+
+// Test that the `forget` and `init` intrinsics are really unsafe
+pub fn main() {
+    let stuff = init::<int>(); //~ ERROR access to unsafe function requires unsafe
+    forget(stuff);             //~ ERROR access to unsafe function requires unsafe
+}