librustc: Disallow "unsafe" for external functions

src/libstd/unstable/intrinsics.rs

@@ -296,16 +296,16 @@ extern "rust-intrinsic" {
     /// `init` is unsafe because it returns a zeroed-out datum,
     /// which is unsafe unless T is POD. We don't have a POD
     /// kind yet. (See #4074).
-    pub unsafe fn init<T>() -> T;
+    pub fn init<T>() -> T;
 
     /// Create an uninitialized value.
-    pub unsafe fn uninit<T>() -> T;
+    pub fn uninit<T>() -> T;
 
     /// Move a value out of scope without running drop glue.
     ///
     /// `forget` is unsafe because the caller is responsible for
     /// ensuring the argument is deallocated already.
-    pub unsafe fn forget<T>(_: T) -> ();
+    pub fn forget<T>(_: T) -> ();
     pub fn transmute<T,U>(e: T) -> U;
 
     /// Returns `true` if a type requires drop glue.

src/libstd/unstable/lang.rs

@@ -28,17 +28,12 @@ pub mod rustrt {
 
     extern {
         #[rust_stack]
-        pub unsafe fn rust_upcall_malloc(td: *c_char, size: uintptr_t)
-                                         -> *c_char;
-
+        pub fn rust_upcall_malloc(td: *c_char, size: uintptr_t) -> *c_char;
         #[rust_stack]
-        pub unsafe fn rust_upcall_free(ptr: *c_char);
-
+        pub fn rust_upcall_free(ptr: *c_char);
         #[fast_ffi]
-        pub unsafe fn rust_upcall_malloc_noswitch(td: *c_char,
-                                                  size: uintptr_t)
-                                                  -> *c_char;
-
+        pub fn rust_upcall_malloc_noswitch(td: *c_char, size: uintptr_t)
+                                           -> *c_char;
         #[rust_stack]
         pub fn rust_try_get_task() -> *rust_task;
     }