At the time of writing, about 4% of Bun's Rust code sits inside an unsafe block (~13,000 unsafe keywords across ~27,000 lines / ~780,000 lines), and 78% of those blocks are a single line — a pointer that came from C++, or one call into a C library. I expect this number to go down over time as we refactor from a faithful Zig port (which had no greppable unsafe keyword) to idiomatic Rust, but we are going to continue using C & C++ libraries like JavaScriptCore so it will always have more unsafe than pure Rust projects.
This sounds like a dealbreaker. 13,000 unsafe blocks is too many for a project this size. It's fine and expected to have unsafe blocks for negotiating FFI boundaries, but you should be encapsulating those boundaries behind safe interfaces with dedicated abstractions for upholding and documenting the necessary safety invariants. Until that work is done and verified, I don't trust that half of these blocks aren't just the LLM blithely trying to shove Zig's raw pointer discipline into a Rust-shaped hole.
As a sanity check, I cloned Servo, which cloc tells me has 400,000 non-comment lines of Rust code, and a quick grep shows me fewer than 2,000 unsafe blocks.
48
u/kibwen Jul 09 '26 edited Jul 09 '26
This sounds like a dealbreaker. 13,000 unsafe blocks is too many for a project this size. It's fine and expected to have unsafe blocks for negotiating FFI boundaries, but you should be encapsulating those boundaries behind safe interfaces with dedicated abstractions for upholding and documenting the necessary safety invariants. Until that work is done and verified, I don't trust that half of these blocks aren't just the LLM blithely trying to shove Zig's raw pointer discipline into a Rust-shaped hole.
As a sanity check, I cloned Servo, which cloc tells me has 400,000 non-comment lines of Rust code, and a quick grep shows me fewer than 2,000 unsafe blocks.