From 59939157f8fdbce119aea7b247746dce280d8388 Mon Sep 17 00:00:00 2001
From: Andrew Walbran <qwandor@google.com>
Date: Tue, 4 Aug 2026 13:15:36 +0100
Subject: [PATCH] Don't allow unsafe code in initialisation expression of
 #[percore] variables.

---
 CHANGELOG.md              | 6 ++++++
 percore-derive/src/lib.rs | 6 ++++--
 src/derive.rs             | 9 ++++++++-
 3 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d274473..41d0861 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,11 @@
 # Changelog
 
+## Unreleased
+
+### Bugfixes
+
+- Don't allow unsafe code in initialisation expression of `#[percore]` variables.
+
 ## 0.2.5
 
 ### New features
diff --git a/percore-derive/src/lib.rs b/percore-derive/src/lib.rs
index a5facff..d323999 100644
--- a/percore-derive/src/lib.rs
+++ b/percore-derive/src/lib.rs
@@ -34,8 +34,10 @@ pub fn percore(_attr: TokenStream, item: TokenStream) -> TokenStream {
     quote! {
         #[cfg_attr(target_os = "none", unsafe(link_section = ".percore"))]
         #(#attrs)*
-        #vis static #name: percore::derive::LinkedPerCore<#ty> =
-            unsafe { percore::derive::LinkedPerCore::new(#expr) };
+        #vis static #name: percore::derive::LinkedPerCore<#ty> = const {
+            let value = #expr;
+            unsafe { percore::derive::LinkedPerCore::new(value) }
+        };
     }
     .into()
 }
diff --git a/src/derive.rs b/src/derive.rs
index b53e597..f5c2396 100644
--- a/src/derive.rs
+++ b/src/derive.rs
@@ -240,7 +240,7 @@ mod tests {
     use super::*;
     use crate as percore;
     use crate::ExceptionFree;
-    use core::cell::RefCell;
+    use core::{cell::RefCell, num::NonZero};
 
     #[percore]
     static VALUE: ExceptionLock<RefCell<u64>> =
@@ -265,4 +265,11 @@ mod tests {
         *VALUE.get().borrow_mut(token) = 10;
         assert_eq!(10, *VALUE.get().borrow(token).borrow());
     }
+
+    #[test]
+    fn derive_unsafe() {
+        #[percore]
+        static VALUE: ExceptionLock<NonZero<u64>> =
+            ExceptionLock::new(unsafe { NonZero::new_unchecked(42) });
+    }
 }