Unsafe, FFI & Performance Mindset

Overview

unsafe is not a module-wide off switch and it is not a security flag by itself. It is the list of operations whose invariants you uphold. Performance work starts in safe Rust on a release binary. FFI is the case where the other language forces the boundary.

Comparative

flowchart TB
  A["Step 1 Measure first - profile with perf or criterion Ready"]
  B["Step 2 Can safe code meet the target Ready"]
  C["Step 3a Stay safe - better algorithm or fewer allocations Ready"]
  D["Step 3b Small unsafe block inside a safe API Ready"]
  E["Step 4 SAFETY comment lists the invariants Ready"]
  F["Step 5 FFI - extern C, repr(C), CString keeps the buffer alive Ready"]
  G["Step 6 Test under Miri and sanitizers Ready"]
  X["Failure path - undefined behavior, not a panic Ready"]
  A -->|continues| B
  B -->|yes| C
  B -->|no| D
  D -->|continues| E
  E -->|continues| F
  F -->|continues| G
  D -->|invariant broken - aliasing or dangling pointer| X

Press Run. Snippets must be self-contained — no network, files, or native modules.

Rosetta — a raw pointer kept inside a wrapper

The public function is safe. The unsafe block is the only dereference, and only after the wrapper proved the pointer is in range. This is a sketch of the shape, not an invitation to skip the proof.

fn read_first(buf: &[u8]) -> Option<u8> {
    if buf.is_empty() {
        return None;
    }
    // SAFETY: the empty check means index 0 is in range for this slice.
    Some(unsafe { *buf.as_ptr() })
}

function readFirst(buf: number[]): number | undefined {
  return buf[0];
}

def read_first(buf: bytes) -> int | None:
    return buf[0] if buf else None

TypeScript and Python cannot express undefined behavior for this read. The Rust sketch is only sound because the length check matches the dereference. A safe buf.first().copied() is the better version. That is the point of profiling and deleting unsafe.

Rosetta — FFI sketch

unsafe extern "C" {
    fn abs(n: i32) -> i32;
}

fn abs_safe(n: i32) -> i32 {
    // SAFETY: abs is a pure C function of one int and does not retain the argument.
    unsafe { abs(n) }
}

function absSafe(n: number): number {
  return Math.abs(n);
}

def abs_safe(n: int) -> int:
    return abs(n)

If C allocates and Rust frees, say so once. If C keeps the pointer, Rust must not call free. The extern block syntax here matches edition 2024.

Rosetta — allocation awareness

fn join_owned(parts: &[String]) -> String {
    parts.iter().map(String::as_str).collect::<Vec<_>>().join(",")
}

Prefer borrowing when the caller still owns the strings. parts.join is not on &[String] the way it is on a string slice of pieces you already own as &str. The lesson is the extra Vec, not a raw pointer.

function joinOwned(parts: string[]): string {
  return parts.join(",");
}

def join_owned(parts: list[str]) -> str:
    return ",".join(parts)

JavaScript and Python allocate the result too. They do not make the intermediate collection a type error. In Rust, building a Vec<&str> you immediately join is the kind of cost a release profile should confirm before anyone mentions unsafe.

no_std

no_std drops the standard library for firmware and kernels. A no_std binary needs a panic handler (a no_std library does not). It is not how you speed up a Tokio service. The embedded book is the map if you are actually on a microcontroller.

Interview Q&A

Pitfalls

• Raw pointers to quiet a borrow error.
• Profiling only debug builds.
• A safe wrapper whose SAFETY comment is wishful.
• Two owners of free.
• Flipping no_std to chase a benchmark.

Go Deeper

• The Rustonomicon
• The Rustonomicon — FFI
• The Embedded Rust Book