Restrict `unsafe` blocks to single statements where possible. by Cryoris · Pull Request #15806 · Qiskit/qiskit

Cryoris · 2026-03-13T12:52:34Z

Summary

Following up on #15106 (comment) by reducing the sizes of unsafe statements in the codebase.

Details and comments

To see which part of the code is unsafe, it is good to restrict unsafe blocks to the smallest sensible code unit. Clippy also has a feature to check this, cargo clippy -- -W clippy::multiple_unsafe_ops_per_block. This commit reduces some pretty large unsafe blocks to smaller ones to improve our code structure. Clippy actually flags any snippet that has more than a single statement, but I left unsafe blocks in place where every single statement was actually unsafe.

To see which part of the code is unsafe, it is good to restrict `unsafe` blocks to the smallest sensible code unit. Clippy also has a feature to check this, `cargo clippy -- -W clippy::multiple_unsafe_ops_per_block`. This commit reduces some pretty large unsafe blocks to smaller ones to improve our code structure. Clippy actually flags _any_ snippet that has more than a single statement, but I left unsafe blocks in place where every single statement was actually unsafe.

qiskit-bot · 2026-03-13T12:52:39Z

One or more of the following people are relevant to this code:

@Qiskit/terra-core

gadial

Overall looks good to me. Left minor comments.

gadial · 2026-03-15T09:16:05Z

@@ -1569,26 +1568,22 @@ pub unsafe extern "C" fn qk_target_op_clear(op: *mut CTargetOp) {

    // SAFETY: As per documentation, data from pointers contained in CTargetOp
    // originates from rust code and are constructed internally with vecs and CStrings.


Does this cover the mut_ptr_as_ref(op) operation?

It does not! Let me adjust 🙂

Reduce unsafe scopes further.

… into unsafe-surgeon-mode

coveralls · 2026-04-29T10:00:36Z

Coverage Report for CI Build 27691072097

Warning

Build has drifted: This PR's base is out of sync with its target branch, so coverage data may include unrelated changes.
Quick fix: rebase this PR. Learn more →

Coverage increased (+0.03%) to 87.559%

Details

Coverage increased (+0.03%) from the base build.
Patch coverage: 26 uncovered changes across 2 files (1008 of 1034 lines covered, 97.49%).
46 coverage regressions across 7 files.

Uncovered Changes

File	Changed	Covered	%
crates/cext/src/transpiler/transpile_function.rs	24	0	0.0%
crates/cext/src/dag.rs	24	22	91.67%
Total (9 files)	1034	1008	97.49%

Coverage Regressions

46 previously-covered lines in 7 files lost coverage.

File	Lines Losing Coverage	Coverage
crates/transpiler/src/passes/sabre/route.rs	21	95.02%
crates/qasm2/src/parse.rs	12	97.15%
crates/circuit/src/parameter/symbol_expr.rs	4	74.1%
crates/qasm2/src/lex.rs	4	91.77%
crates/transpiler/src/passes/sabre/layer.rs	3	97.89%
crates/cext/src/transpiler/target.rs	1	89.44%
crates/qasm2/src/expr.rs	1	93.88%

Coverage Stats


Relevant Lines:	127300
Covered Lines:	111462
Line Coverage:	87.56%
Coverage Strength:	1009044.54 hits per line

💛 - Coveralls

mtreinish · 2026-04-29T09:41:38Z

-        let _ = unsafe { CString::from_raw(inst.name) };
-        inst.name = std::ptr::null_mut();
-    }
+    inst.name = std::ptr::null_mut();


Isn't this causing a memory leak now because we're no longer dropping the existing string pointer? Don't we need rust to take ownership of the string again so it frees the allocation?

Oh this looks like a merge gone wrong, I didn't mean to remove that... thanks for catching that!

Now, you definitely want to address this comment.

Addressed in 17d41e5.

mtreinish · 2026-04-29T09:49:12Z

+    let target = if target.is_null() {
+        None
+    } else {
+        Some(unsafe { const_ptr_as_ref(target) })


On the other places you moved the safety comment inside the else body to be with the reduced scope unsafe calls.

@Cryoris, a reminder to address this comment.

Addressed in 17d41e5.

mtreinish · 2026-04-29T09:56:35Z

 pub unsafe extern "C" fn qk_neighbors_is_all_to_all(neighbors: *const CNeighbors) -> bool {
    // SAFETY: per documentation, `neighbors` points to a valid initialized `CNeighbors`.
-    unsafe { (*neighbors).neighbors.is_null() && (*neighbors).partition.is_null() }
+    let neighbors = unsafe { const_ptr_as_ref(neighbors) };


Doesn't this change the requirements for neighbors? This function asserts alignment while it is not documented as being required for this function.

Hmm.. isn't that an oversight from before, though? I thought that the pointer needed to be aligned to be dereferenced safely.

alexanderivrii

Thanks Julien! Please address Matthew's comments, especially the one about memory leak (with the merge gone wrong).

Running cargo clippy -- -W clippy::multiple_unsafe_ops_per_block (as you suggest in the PR summary) flags other potential spots for improvement, but we can handle them in a follow-up.

alexanderivrii · 2026-06-12T08:22:39Z

+    if gate.num_params() == 0 {
+        // if there's no parameters, params is NULL and it is not safe to call from_raw_parts
+        smallvec![]
+    } else {
+        // SAFETY: Per the documentation, params is readable for num_params elements of f64
+        unsafe { ::std::slice::from_raw_parts(params, gate.num_params() as usize) }
+            .iter()
+            .map(|p| Param::Float(*p))
+            .collect()


Nice! (Arguably, slightly outside of the original scope of the PR, but I am fine with this).

alexanderivrii · 2026-06-12T08:24:49Z

+    let target = if target.is_null() {
+        None
+    } else {
+        Some(unsafe { const_ptr_as_ref(target) })


@Cryoris, a reminder to address this comment.

alexanderivrii · 2026-06-12T08:35:41Z

+    // SAFETY: Per documentation, the params points is compatible with the gate and safe to read.
+    let params = unsafe { parse_params(gate, params) };


I like this refactoring of the params code, using an already existing function instead. But just pointing out that this technically more than a 1-line change which you promised before I agreed to review :).

alexanderivrii · 2026-06-12T08:38:47Z

-        let _ = unsafe { CString::from_raw(inst.name) };
-        inst.name = std::ptr::null_mut();
-    }
+    inst.name = std::ptr::null_mut();


Now, you definitely want to address this comment.

Co-authored-by: gadial <gadial@gmail.com>

Cryoris added this to the 2.5.0 milestone Mar 13, 2026

Cryoris requested a review from a team as a code owner March 13, 2026 12:52

Cryoris added type: qa Issues and PRs that relate to testing and code quality Changelog: None Do not include in the GitHub Release changelog. labels Mar 13, 2026

Cryoris added this to Qiskit 2.5 Mar 13, 2026

github-project-automation Bot moved this to Ready in Qiskit 2.5 Mar 13, 2026

gadial reviewed Mar 15, 2026

View reviewed changes

raynelfss and others added 5 commits April 28, 2026 10:21

Reduce unsafe scopes further.

3e58fda

Merge pull request #44 from raynelfss/cryoris-contrib-unsafe

7fd5489

Reduce unsafe scopes further.

Merge branch 'main' into unsafe-surgeon-mode

72033f6

Merge branch 'unsafe-surgeon-mode' of github.com:Cryoris/qiskit-terra…

19d5a1f

… into unsafe-surgeon-mode

More precise safety docs

3d9fe91

mtreinish reviewed Apr 29, 2026

View reviewed changes

ShellyGarion assigned alexanderivrii and gadial Jun 11, 2026

alexanderivrii reviewed Jun 12, 2026

View reviewed changes

alexanderivrii and others added 2 commits June 17, 2026 11:49

Update crates/cext/src/dag.rs

9d51a73

Co-authored-by: gadial <gadial@gmail.com>

Addressing Matthew's comments from code review

17d41e5

alexanderivrii requested a review from mtreinish June 17, 2026 09:07

alexanderivrii added 2 commits June 17, 2026 14:22

Merge branch 'main' into unsafe-surgeon-mode

15f0c60

Fixing qargs computations for qubitless gates

26de0b4

		@@ -1569,26 +1568,22 @@ pub unsafe extern "C" fn qk_target_op_clear(op: *mut CTargetOp) {

		// SAFETY: As per documentation, data from pointers contained in CTargetOp
		// originates from rust code and are constructed internally with vecs and CStrings.

		// SAFETY: Per documentation, the params points is compatible with the gate and safe to read.
		let params = unsafe { parse_params(gate, params) };

Conversation

Cryoris commented Mar 13, 2026

Summary

Details and comments

Uh oh!

qiskit-bot commented Mar 13, 2026

Uh oh!

gadial left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

coveralls commented Apr 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Coverage Report for CI Build 27691072097

Coverage increased (+0.03%) to 87.559%

Details

Uncovered Changes

Coverage Regressions

Coverage Stats

💛 - Coveralls

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

alexanderivrii left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

coveralls commented Apr 29, 2026 •

edited

Loading