title: When is it appropriate to mark a trait as unsafe, as opposed to marking all the functions in the trait as unsafe?
body: <p>Saying the same thing in code, when would I pick either of the following examples?</p>
  
  <pre><code>unsafe trait MyCoolTrait {
      fn method(&amp;self) -&gt; u8;
  }
  
  trait MyCoolTrait {
      unsafe fn method(&amp;self) -&gt; u8;
  }
  </code></pre>
  
  <p>The <a href="https://github.com/rust-lang/rfcs/blob/master/text/0019-opt-in-builtin-traits.md" rel="noreferrer">opt-in builtin traits (OIBIT) RFC</a> states:</p>
  
  <blockquote>
    <p>An unsafe trait is a trait that is unsafe to implement, because it represents some kind of trusted assertion. Note that unsafe traits are perfectly safe to use. <a href="http://doc.rust-lang.org/std/marker/trait.Send.html" rel="noreferrer"><code>Send</code></a> and <code>Share</code> (<em>note: now called <a href="http://doc.rust-lang.org/std/marker/trait.Sync.html" rel="noreferrer"><code>Sync</code></a></em>) are examples of unsafe traits: implementing these traits is effectively an assertion that your type is safe for threading.</p>
  </blockquote>
  
  <p>There's another example of an unsafe trait in the standard library, <a href="http://doc.rust-lang.org/std/str/pattern/trait.Searcher.html" rel="noreferrer"><code>Searcher</code></a>. It says:</p>
  
  <blockquote>
    <p>The trait is marked unsafe because the indices returned by the <code>next()</code> methods are required to lie on valid utf8 boundaries in the haystack. This enables consumers of this trait to slice the haystack without additional runtime checks.</p>
  </blockquote>
  
  <p>Unfortunately, neither of these paragraphs really help my understanding of when it is correct to mark the entire trait unsafe instead of some or all of the methods.</p>
  
  <p><a href="https://stackoverflow.com/q/29050360/155423">I've asked about marking a function as unsafe</a> before, but this seems different.</p>