3.5.1.1 Safe and Unsafe Calls

A call is a safe call if each of the following is either safe code or system code (other than system code that results from macro expansion of programmer code):

*

the call.

*

the definition of the function being called.

*

the point of functional evaluation

The following special cases require some elaboration:

*

If the function being called is a generic function, it is considered safe if all of the following are

safe code or system code:

–

its definition (if it was defined explicitly).

–

the method definitions for all applicable methods.

–

the definition of its method combination.

*

For the form (coerce x 'function), where x is a lambda expression, the value of the optimize quality safety in the global environment at the time the coerce is executed applies to the resulting function.

*

For a call to the function ensure-generic-function, the value of the optimize quality safety in the environment object passed as the :environment argument applies to the resulting generic function.

*

For a call to compile with a lambda expression as the argument, the value of the optimize quality safety in the global environment at the time compile is called applies to the resulting compiled function.

*

For a call to compile with only one argument, if the original definition of the function was safe, then the resulting compiled function must also be safe.

*

A call to a method by call-next-method must be considered safe if each of the following is

safe code or system code:

–

the definition of the generic function (if it was defined explicitly).

–

the method definitions for all applicable methods.

–

the definition of the method combination.

–

the point of entry into the body of the method defining form, where the binding of call-next-method is established.

–

the point of functional evaluation of the name call-next-method.

An unsafe call is a call that is not a safe call.

The informal intent is that the programmer can rely on a call to be safe, even when system code is involved, if all reasonable steps have been taken to ensure that the call is safe. For example, if a programmer calls mapcar from safe code and supplies a function that was compiled as safe, the implementation is required to ensure that mapcar makes a safe call as well.