Remove 98 unsafe blocks from bun_threading, bun_alloc, the bundler and the transpiler

mordant-baseline.toml

@@ -116,9 +116,6 @@
 "bool_cluster:src/lint/estree/schema.rs" = 1
 "bool_cluster:src/lint/linter/config/flat.rs" = 1
 
-[bun_opaque]
-"unused_pub:src/opaque/lib.rs" = 2
-
 [bun_parsers]
 "generic_body_not_generic:src/parsers/xml.rs" = 1
 "parallel_vecs:src/parsers/xml.rs" = 1
@@ -237,10 +234,6 @@
 [bun_text_diff]
 "generic_body_not_generic:src/text_diff/lib.rs" = 3
 
-[bun_threading]
-"unsafe_send_covers_more_than_pointers:src/threading/Semaphore.rs" = 1
-"unsafe_send_covers_more_than_pointers:src/threading/channel.rs" = 1
-
 [bun_uws_sys]
 "unused_pub:src/uws_sys/Loop.rs" = 2
 

src/brotli/lib.rs

@@ -12,7 +12,7 @@ use c::BrotliDecoder;
 
 #[allow(non_snake_case)]
 pub mod BrotliAllocator {
-    bun_alloc::c_thunks_for_zone!("brotli");
+    bun_alloc::c_thunks_for_zone!(c"brotli");
     pub use malloc_size as alloc;
 }
 

src/bun_alloc/ast_alloc.rs

@@ -519,10 +519,7 @@ impl AstAlloc {
         v
     }
 
-    /// Move `items` element-wise into a fresh AST-heap allocation. Replaces
-    /// both `VecExt::from_owned_slice` (`Box<[T]>` → `Vec`) and
-    /// `VecExt::from_bump_slice` (leaked `&mut [T]` → `Vec`): in either case
-    /// the source storage is on the wrong heap, so a copy is unavoidable.
+    /// Moves the items of `iter` into a fresh AST-heap allocation.
     #[inline]
     pub fn vec_from_iter<T, I: IntoIterator<Item = T>>(iter: I) -> AstVec<T> {
         let iter = iter.into_iter();

src/bun_alloc/heap_breakdown.rs

@@ -1,6 +1,6 @@
+use core::ffi::{CStr, c_void};
 #[cfg(target_os = "macos")]
-use core::ffi::c_uint;
-use core::ffi::{c_char, c_void};
+use core::ffi::{c_char, c_uint};
 
 #[cfg(target_os = "macos")]
 #[allow(non_camel_case_types)]
@@ -25,29 +25,22 @@ bun_opaque::opaque_ffi! {
 // SAFETY: `malloc_zone_t` is internally synchronized by libmalloc; sharing
 // `&Zone` across threads is the documented usage.
 unsafe impl Sync for Zone {}
-// SAFETY: `Zone` is an opaque libmalloc handle with no thread-affine state; the
-// zone API is callable from any thread, so transferring the handle is sound.
-unsafe impl Send for Zone {}
 
 impl Zone {
-    /// # Safety
-    /// `name` must point to a NUL-terminated C string that remains valid for
-    /// the entire process lifetime — `malloc_set_zone_name` stores the pointer
-    /// (does not copy).
+    /// `'static`: `malloc_set_zone_name` may keep the pointer instead of copying.
     #[cfg(target_os = "macos")]
-    pub unsafe fn init(name: *const c_char) -> &'static Zone {
+    pub fn init(name: &'static CStr) -> &'static Zone {
         // SAFETY: malloc_create_zone is safe to call with (0, 0); returns a
-        // process-lifetime zone pointer. Caller guarantees `name` outlives the
+        // process-lifetime zone pointer. `name` is NUL-terminated and outlives the
         // process.
         unsafe {
             let zone = malloc_create_zone(0, 0);
-            malloc_set_zone_name(zone, name);
+            malloc_set_zone_name(zone, name.as_ptr());
             &*zone
         }
     }
     #[cfg(not(target_os = "macos"))]
-    #[allow(clippy::missing_safety_doc)]
-    pub unsafe fn init(_name: *const c_char) -> &'static Zone {
+    pub fn init(_name: &'static CStr) -> &'static Zone {
         unreachable!("heap_breakdown is macOS-only; guard call sites on ENABLED")
     }