Carbon and C++ Interoperability: Memory Safety Boundaries for Legacy Pointers

Confirmed Facts

Carbon’s safe dialect forbids raw pointer arithmetic, dereferencing, and reinterpret_cast. Any operation that performs these on a C++ pointer must appear inside an unsafe block; this is the definitive criterion for marking the interaction as unsafe.

Likely Explanation

When a C++ pointer enters Carbon, the compiler treats it as a foreign pointer with an attached lifetime annotation. If static analysis cannot prove that the pointed‑to object lives at least as long as the Carbon reference, the reference is considered unsafe and must be used within an unsafe block.

How the Compiler Enforces Safety

• Static lifetime analysis on annotated foreign pointers; compile‑time error if a safe context uses a pointer without sufficient guarantees.
• If the programmer supplies an explicit lifetime bound (e.g., via Carbon’s lifetime parameter), the same dereference is allowed in safe code.
• Without such an annotation, the compiler inserts a runtime validity check that traps on null or dangling pointers when the reference is dereferenced.
• Unsafe blocks bypass these checks but are limited to their lexical scope, isolating unsafe usage.

Next Step

To determine whether a particular C++ pointer interaction can stay in safe code, please confirm: Do you have an explicit lifetime annotation for the foreign pointer? If the answer is no, the interaction must be placed in an unsafe block; if yes, you may proceed with safe usage after verifying the annotation matches the object's actual lifetime.