anchor.diff:  
   === `unsafe` as a block delimiter
   
  -In ordinary lrs code, the compiler is tasked to ensure that the execution of the
  -compiled code is not undefined behavior. If the compiler is unable to make this
  -guarantee, the compilation will fail. In this case, the user is able to override
  -the compiler's decision by using the `unsafe` keyword on a block of code.
  -Consider the following example:
  -
  +In ordinary lrs code, the compiler is tasked to ensure that every operation is
  +defined, independently of the input. If the compiler is unable to make this
  +guarantee, the compilation will fail. In some of these cases, the user is able
  +to override the compiler's decision by using the `unsafe` keyword on a block of
  +code. Consider the following example:
  +
  +[source]
   ----
   pub struct X(*const u8);
   
  
positive.code: 
  In the example above, `X::f` does not have the unsafe attribute. Since the
  `self.0` field of `X` objects is private, it is possible for the developer to
  ensure that dereferencing `self.0` is never undefined behavior. Hence, `X::f`
  need not be marked unsafe. But consider the following function:
  
  ----
  pub unsafe fn g(x: *const u8) -> u8 {
      unsafe {
  
negative.code: 
  toc::[]
  
  == Preface: On undefined behavior and operations
  
  The C++11 standard defines undefined behavior as
  
  [quote]
  behavior for which this International Standard imposes no requirements +
  [ __Note__: Undefined behavior may be expected when this International Standard
  omits any explicit definition of behavior or when a program uses an erroneous
  construct or erroneous data. [...] -- end note ]
  
  And furthermore it says with regards to the execution of programs containing
  undefined operations:
  
  [quote]
  [This] International Standard places no requirement on the implementation
  executing that program [...] (not even with regard to operations preceding the
  first undefined operation).
  
  Hence, the behavior of programs that execute undefined operations at any point
  is undefined at every point.
  
  One of the goals of rust is to ensure programmatically that, if a piece of code
  compiles, then it contains no undefined operations. But since there are many
  valid programs for which the compiler is unable to verify this, rust contains
  the `unsafe` keyword.
  
  == What `unsafe` is
  
  This section discusses the `unsafe` keyword in the following two contexts:
  