new in safe contexts

[cmazakas]

Assume a simple function like:

box<T> box<T>::make() safe {
  unsafe { return box(new T()); }
}

It's easy to introduce a soundness hole here.

The intent is that this function is sound because even if allocation is unsafe and fails, we simply OOM so we panic and stop execution. We intend that in a safe context only a safe default constructor will be called but new being unsafe necessitates a block where it's easy to silently mask that we now also permit unsafe default constructors, which permits a soundness hole.

Also see: https://godbolt.org/z/xM556saPr

[seanbaxter]

May ultimately want safe new and safe delete operator names.
For safe delete, the operator should be safe and take a special type for the pointer that has an unsafe constructor. That moves the unsafe proof to the user.