diff --git a/src/libcore/comm.rs b/src/libcore/comm.rs
index 9fd6f1db793b0a6280cd1bc234fa083ab3f80d2f..d665bf311f362868c7fc9f01a6c9af4f77fe45a5 100644
--- a/src/libcore/comm.rs
+++ b/src/libcore/comm.rs
@@ -188,16 +188,14 @@ fn peek(&self) -> bool { port_peek(self) }
 
 #[inline(always)]
 fn port_peek<T:Owned>(self: &Port<T>) -> bool {
-    unsafe {
-        let mut endp = None;
-        endp <-> self.endp;
-        let peek = match &endp {
-            &Some(ref endp) => peek(endp),
-            &None => fail!(~"peeking empty stream")
-        };
-        self.endp <-> endp;
-        peek
-    }
+    let mut endp = None;
+    endp <-> self.endp;
+    let peek = match &endp {
+        &Some(ref endp) => peek(endp),
+        &None => fail!(~"peeking empty stream")
+    };
+    self.endp <-> endp;
+    peek
 }
 
 impl<T: Owned> Selectable for Port<T> {
diff --git a/src/libcore/io.rs b/src/libcore/io.rs
index 3853e7c8f2b0e4e513881ebc5f966a888310ea2b..3c5900f51a247d4ba8fa08ac2985a6e91a5aa048 100644
--- a/src/libcore/io.rs
+++ b/src/libcore/io.rs
@@ -1536,11 +1536,8 @@ pub fn with_bytes_writer(f: &fn(@Writer)) -> ~[u8] {
 pub fn with_str_writer(f: &fn(@Writer)) -> ~str {
     let mut v = with_bytes_writer(f);
 
-    // FIXME (#3758): This should not be needed.
-    unsafe {
-        // Make sure the vector has a trailing null and is proper utf8.
-        v.push(0);
-    }
+    // Make sure the vector has a trailing null and is proper utf8.
+    v.push(0);
     assert!(str::is_utf8(v));
 
     unsafe { ::cast::transmute(v) }
@@ -1640,16 +1637,14 @@ pub struct Arg<t> {
     // outer res
     pub fn FILE_res_sync(file: &FILERes, opt_level: Option<Level>,
                          blk: &fn(v: Res<*libc::FILE>)) {
-        unsafe {
-            blk(Res(Arg {
-                val: file.f, opt_level: opt_level,
-                fsync_fn: |file, l| {
-                    unsafe {
-                        os::fsync_fd(libc::fileno(file), l) as int
-                    }
+        blk(Res(Arg {
+            val: file.f, opt_level: opt_level,
+            fsync_fn: |file, l| {
+                unsafe {
+                    os::fsync_fd(libc::fileno(file), l) as int
                 }
-            }));
-        }
+            }
+        }));
     }
 
     // fsync fd after executing blk
diff --git a/src/libcore/managed.rs b/src/libcore/managed.rs
index 234b710d238b0c824840fdd82858f96e5f0c0558..2bd3959acf4de476bc28ba5aaa16f0e48e9536f9 100644
--- a/src/libcore/managed.rs
+++ b/src/libcore/managed.rs
@@ -38,13 +38,13 @@ pub struct BoxRepr {
 #[inline(always)]
 pub fn ptr_eq<T>(a: @T, b: @T) -> bool {
     //! Determine if two shared boxes point to the same object
-    unsafe { ptr::addr_of(&(*a)) == ptr::addr_of(&(*b)) }
+    ptr::addr_of(&(*a)) == ptr::addr_of(&(*b))
 }
 
 #[inline(always)]
 pub fn mut_ptr_eq<T>(a: @mut T, b: @mut T) -> bool {
     //! Determine if two mutable shared boxes point to the same object
-    unsafe { ptr::addr_of(&(*a)) == ptr::addr_of(&(*b)) }
+    ptr::addr_of(&(*a)) == ptr::addr_of(&(*b))
 }
 
 #[cfg(notest)]
diff --git a/src/libcore/num/float.rs b/src/libcore/num/float.rs
index 1ab0e24f62dc94dd8b08de9825f1dfe54cb2a047..87d04b05087c23dc7cbae85746b9bb91b98382b5 100644
--- a/src/libcore/num/float.rs
+++ b/src/libcore/num/float.rs
@@ -369,27 +369,27 @@ pub fn is_NaN(x: float) -> bool { f64::is_NaN(x as f64) }
 
 #[inline(always)]
 pub fn abs(x: float) -> float {
-    unsafe { f64::abs(x as f64) as float }
+    f64::abs(x as f64) as float
 }
 #[inline(always)]
 pub fn sqrt(x: float) -> float {
-    unsafe { f64::sqrt(x as f64) as float }
+    f64::sqrt(x as f64) as float
 }
 #[inline(always)]
 pub fn atan(x: float) -> float {
-    unsafe { f64::atan(x as f64) as float }
+    f64::atan(x as f64) as float
 }
 #[inline(always)]
 pub fn sin(x: float) -> float {
-    unsafe { f64::sin(x as f64) as float }
+    f64::sin(x as f64) as float
 }
 #[inline(always)]
 pub fn cos(x: float) -> float {
-    unsafe { f64::cos(x as f64) as float }
+    f64::cos(x as f64) as float
 }
 #[inline(always)]
 pub fn tan(x: float) -> float {
-    unsafe { f64::tan(x as f64) as float }
+    f64::tan(x as f64) as float
 }
 
 #[cfg(notest)]
diff --git a/src/libcore/path.rs b/src/libcore/path.rs
index 7de0f355dd21d4dd3277c894a1e27c767b6a22e9..0e8dbd144b14395e2fe6c9a0a7c884542ca18b99 100644
--- a/src/libcore/path.rs
+++ b/src/libcore/path.rs
@@ -389,13 +389,11 @@ fn from_str(s: &str) -> PosixPath {
     }
 
     fn dirname(&self) -> ~str {
-        unsafe {
-            let s = self.dir_path().to_str();
-            if s.len() == 0 {
-                ~"."
-            } else {
-                s
-            }
+        let s = self.dir_path().to_str();
+        if s.len() == 0 {
+            ~"."
+        } else {
+            s
         }
     }
 
@@ -439,10 +437,8 @@ fn with_dirname(&self, d: &str) -> PosixPath {
     }
 
     fn with_filename(&self, f: &str) -> PosixPath {
-        unsafe {
-            assert!(! str::any(f, |c| windows::is_sep(c as u8)));
-            self.dir_path().push(f)
-        }
+        assert!(! str::any(f, |c| windows::is_sep(c as u8)));
+        self.dir_path().push(f)
     }
 
     fn with_filestem(&self, s: &str) -> PosixPath {
@@ -509,7 +505,7 @@ fn push_many(&self, cs: &[~str]) -> PosixPath {
             for str::each_split_nonempty(*e, |c| windows::is_sep(c as u8)) |s| {
                 ss.push(s.to_owned())
             }
-            unsafe { v.push_all_move(ss); }
+            v.push_all_move(ss);
         }
         PosixPath { is_absolute: self.is_absolute,
                     components: v }
@@ -521,14 +517,14 @@ fn push(&self, s: &str) -> PosixPath {
         for str::each_split_nonempty(s, |c| windows::is_sep(c as u8)) |s| {
             ss.push(s.to_owned())
         }
-        unsafe { v.push_all_move(ss); }
+        v.push_all_move(ss);
         PosixPath { components: v, ..copy *self }
     }
 
     fn pop(&self) -> PosixPath {
         let mut cs = copy self.components;
         if cs.len() != 0 {
-            unsafe { cs.pop(); }
+            cs.pop();
         }
         return PosixPath {
             is_absolute: self.is_absolute,
@@ -607,13 +603,11 @@ fn from_str(s: &str) -> WindowsPath {
     }
 
     fn dirname(&self) -> ~str {
-        unsafe {
-            let s = self.dir_path().to_str();
-            if s.len() == 0 {
-                ~"."
-            } else {
-                s
-            }
+        let s = self.dir_path().to_str();
+        if s.len() == 0 {
+            ~"."
+        } else {
+            s
         }
     }
 
@@ -770,7 +764,7 @@ fn push_many(&self, cs: &[~str]) -> WindowsPath {
             for str::each_split_nonempty(*e, |c| windows::is_sep(c as u8)) |s| {
                 ss.push(s.to_owned())
             }
-            unsafe { v.push_all_move(ss); }
+            v.push_all_move(ss);
         }
         // tedious, but as-is, we can't use ..self
         return WindowsPath {
@@ -787,14 +781,14 @@ fn push(&self, s: &str) -> WindowsPath {
         for str::each_split_nonempty(s, |c| windows::is_sep(c as u8)) |s| {
             ss.push(s.to_owned())
         }
-        unsafe { v.push_all_move(ss); }
+        v.push_all_move(ss);
         return WindowsPath { components: v, ..copy *self }
     }
 
     fn pop(&self) -> WindowsPath {
         let mut cs = copy self.components;
         if cs.len() != 0 {
-            unsafe { cs.pop(); }
+            cs.pop();
         }
         return WindowsPath {
             host: copy self.host,
@@ -820,18 +814,14 @@ fn normalize(&self) -> WindowsPath {
 
 pub fn normalize(components: &[~str]) -> ~[~str] {
     let mut cs = ~[];
-    unsafe {
-        for components.each |c| {
-            unsafe {
-                if *c == ~"." && components.len() > 1 { loop; }
-                if *c == ~"" { loop; }
-                if *c == ~".." && cs.len() != 0 {
-                    cs.pop();
-                    loop;
-                }
-                cs.push(copy *c);
-            }
+    for components.each |c| {
+        if *c == ~"." && components.len() > 1 { loop; }
+        if *c == ~"" { loop; }
+        if *c == ~".." && cs.len() != 0 {
+            cs.pop();
+            loop;
         }
+        cs.push(copy *c);
     }
     cs
 }
diff --git a/src/libcore/ptr.rs b/src/libcore/ptr.rs
index 70bdb6f41d8baf54f65b078ed439898db145ee1f..14e17de4fbda08170f6d1d0adaa41d5932e74877 100644
--- a/src/libcore/ptr.rs
+++ b/src/libcore/ptr.rs
@@ -55,17 +55,13 @@ pub fn addr_of<T>(val: &T) -> *T { unsafe { rusti::addr_of(*val) } }
 /// Calculate the offset from a pointer
 #[inline(always)]
 pub fn offset<T>(ptr: *T, count: uint) -> *T {
-    unsafe {
-        (ptr as uint + count * sys::size_of::<T>()) as *T
-    }
+    (ptr as uint + count * sys::size_of::<T>()) as *T
 }
 
 /// Calculate the offset from a const pointer
 #[inline(always)]
 pub fn const_offset<T>(ptr: *const T, count: uint) -> *const T {
-    unsafe {
-        (ptr as uint + count * sys::size_of::<T>()) as *T
-    }
+    (ptr as uint + count * sys::size_of::<T>()) as *T
 }
 
 /// Calculate the offset from a mut pointer
diff --git a/src/libcore/rt/context.rs b/src/libcore/rt/context.rs
index 9dc9f5da8c1dac0998e166a02485189e38bdc03f..4714be9e3d520715c97c676e8467fdb3dc22340e 100644
--- a/src/libcore/rt/context.rs
+++ b/src/libcore/rt/context.rs
@@ -205,8 +205,6 @@ fn align_down(sp: *mut uint) -> *mut uint {
 #[inline(always)]
 pub fn mut_offset<T>(ptr: *mut T, count: int) -> *mut T {
     use core::sys::size_of;
-    unsafe {
-        (ptr as int + count * (size_of::<T>() as int)) as *mut T
-    }
+    (ptr as int + count * (size_of::<T>() as int)) as *mut T
 }
 
diff --git a/src/libcore/rt/thread_local_storage.rs b/src/libcore/rt/thread_local_storage.rs
index c8a9689bbc67a19f848a93f8f27826667ceaa6f7..366996fb93560b275b85e0aae62296258065c699 100644
--- a/src/libcore/rt/thread_local_storage.rs
+++ b/src/libcore/rt/thread_local_storage.rs
@@ -21,17 +21,17 @@
 
 #[cfg(unix)]
 pub unsafe fn create(key: &mut Key) {
-    unsafe { assert!(0 == pthread_key_create(key, null())); }
+    assert!(0 == pthread_key_create(key, null()));
 }
 
 #[cfg(unix)]
 pub unsafe fn set(key: Key, value: *mut c_void) {
-    unsafe { assert!(0 == pthread_setspecific(key, value)); }
+    assert!(0 == pthread_setspecific(key, value));
 }
 
 #[cfg(unix)]
 pub unsafe fn get(key: Key) -> *mut c_void {
-    unsafe { pthread_getspecific(key) }
+    pthread_getspecific(key)
 }
 
 #[cfg(target_os="macos")]
diff --git a/src/libcore/run.rs b/src/libcore/run.rs
index f6f4b9a397d81d09e8c97c5f70fcd9ad2d447686..49df2938afd4009c4ab7efd6e151b4f413faa78c 100644
--- a/src/libcore/run.rs
+++ b/src/libcore/run.rs
@@ -382,64 +382,62 @@ pub struct ProgramOutput {status: int, out: ~str, err: ~str}
  * the contents of stdout and the contents of stderr.
  */
 pub fn program_output(prog: &str, args: &[~str]) -> ProgramOutput {
-    unsafe {
-        let pipe_in = os::pipe();
-        let pipe_out = os::pipe();
-        let pipe_err = os::pipe();
-        let pid = spawn_process(prog, args, &None, &None,
-                                pipe_in.in, pipe_out.out, pipe_err.out);
-
-        os::close(pipe_in.in);
-        os::close(pipe_out.out);
-        os::close(pipe_err.out);
-        if pid == -1i32 {
-            os::close(pipe_in.out);
-            os::close(pipe_out.in);
-            os::close(pipe_err.in);
-            fail!();
-        }
+    let pipe_in = os::pipe();
+    let pipe_out = os::pipe();
+    let pipe_err = os::pipe();
+    let pid = spawn_process(prog, args, &None, &None,
+                            pipe_in.in, pipe_out.out, pipe_err.out);
 
+    os::close(pipe_in.in);
+    os::close(pipe_out.out);
+    os::close(pipe_err.out);
+    if pid == -1i32 {
         os::close(pipe_in.out);
+        os::close(pipe_out.in);
+        os::close(pipe_err.in);
+        fail!();
+    }
 
-        // Spawn two entire schedulers to read both stdout and sterr
-        // in parallel so we don't deadlock while blocking on one
-        // or the other. FIXME (#2625): Surely there's a much more
-        // clever way to do this.
-        let (p, ch) = stream();
-        let ch = SharedChan(ch);
-        let ch_clone = ch.clone();
-        do task::spawn_sched(task::SingleThreaded) {
-            let errput = readclose(pipe_err.in);
-            ch.send((2, errput));
-        };
-        do task::spawn_sched(task::SingleThreaded) {
-            let output = readclose(pipe_out.in);
-            ch_clone.send((1, output));
-        };
-        let status = run::waitpid(pid);
-        let mut errs = ~"";
-        let mut outs = ~"";
-        let mut count = 2;
-        while count > 0 {
-            let stream = p.recv();
-            match stream {
-                (1, copy s) => {
-                    outs = s;
-                }
-                (2, copy s) => {
-                    errs = s;
-                }
-                (n, _) => {
-                    fail!(fmt!("program_output received an unexpected file \
-                               number: %u", n));
-                }
-            };
-            count -= 1;
+    os::close(pipe_in.out);
+
+    // Spawn two entire schedulers to read both stdout and sterr
+    // in parallel so we don't deadlock while blocking on one
+    // or the other. FIXME (#2625): Surely there's a much more
+    // clever way to do this.
+    let (p, ch) = stream();
+    let ch = SharedChan(ch);
+    let ch_clone = ch.clone();
+    do task::spawn_sched(task::SingleThreaded) {
+        let errput = readclose(pipe_err.in);
+        ch.send((2, errput));
+    };
+    do task::spawn_sched(task::SingleThreaded) {
+        let output = readclose(pipe_out.in);
+        ch_clone.send((1, output));
+    };
+    let status = run::waitpid(pid);
+    let mut errs = ~"";
+    let mut outs = ~"";
+    let mut count = 2;
+    while count > 0 {
+        let stream = p.recv();
+        match stream {
+            (1, copy s) => {
+                outs = s;
+            }
+            (2, copy s) => {
+                errs = s;
+            }
+            (n, _) => {
+                fail!(fmt!("program_output received an unexpected file \
+                           number: %u", n));
+            }
         };
-        return ProgramOutput {status: status,
-                              out: outs,
-                              err: errs};
-    }
+        count -= 1;
+    };
+    return ProgramOutput {status: status,
+                          out: outs,
+                          err: errs};
 }
 
 pub fn writeclose(fd: c_int, s: ~str) {
diff --git a/src/libcore/str.rs b/src/libcore/str.rs
index 521c8266e050563b01a493227cf7e4c60cadb508..b0653db365e03c97c1b8d6367ed4d9631d4ab59c 100644
--- a/src/libcore/str.rs
+++ b/src/libcore/str.rs
@@ -170,18 +170,16 @@ pub fn push_char(s: &mut ~str, ch: char) {
 /// Convert a char to a string
 pub fn from_char(ch: char) -> ~str {
     let mut buf = ~"";
-    unsafe { push_char(&mut buf, ch); }
+    push_char(&mut buf, ch);
     buf
 }
 
 /// Convert a vector of chars to a string
 pub fn from_chars(chs: &[char]) -> ~str {
     let mut buf = ~"";
-    unsafe {
-        reserve(&mut buf, chs.len());
-        for vec::each(chs) |ch| {
-            push_char(&mut buf, *ch);
-        }
+    reserve(&mut buf, chs.len());
+    for vec::each(chs) |ch| {
+        push_char(&mut buf, *ch);
     }
     buf
 }
@@ -226,9 +224,7 @@ pub fn push_str(lhs: &mut ~str, rhs: &str) {
 #[inline(always)]
 pub fn append(lhs: ~str, rhs: &str) -> ~str {
     let mut v = lhs;
-    unsafe {
-        push_str_no_overallocate(&mut v, rhs);
-    }
+    push_str_no_overallocate(&mut v, rhs);
     v
 }
 
@@ -236,7 +232,7 @@ pub fn append(lhs: ~str, rhs: &str) -> ~str {
 pub fn concat(v: &[~str]) -> ~str {
     let mut s: ~str = ~"";
     for vec::each(v) |ss| {
-        unsafe { push_str(&mut s, *ss) };
+        push_str(&mut s, *ss);
     }
     s
 }
@@ -245,8 +241,8 @@ pub fn concat(v: &[~str]) -> ~str {
 pub fn connect(v: &[~str], sep: &str) -> ~str {
     let mut s = ~"", first = true;
     for vec::each(v) |ss| {
-        if first { first = false; } else { unsafe { push_str(&mut s, sep); } }
-        unsafe { push_str(&mut s, *ss) };
+        if first { first = false; } else { push_str(&mut s, sep); }
+        push_str(&mut s, *ss);
     }
     s
 }
@@ -255,8 +251,8 @@ pub fn connect(v: &[~str], sep: &str) -> ~str {
 pub fn connect_slices(v: &[&str], sep: &str) -> ~str {
     let mut s = ~"", first = true;
     for vec::each(v) |ss| {
-        if first { first = false; } else { unsafe { push_str(&mut s, sep); } }
-        unsafe { push_str(&mut s, *ss) };
+        if first { first = false; } else { push_str(&mut s, sep); }
+        push_str(&mut s, *ss);
     }
     s
 }
@@ -2251,16 +2247,14 @@ pub unsafe fn slice_bytes_owned(s: &str, begin: uint, end: uint) -> ~str {
             assert!((end <= n));
 
             let mut v = vec::with_capacity(end - begin + 1u);
-            unsafe {
-                do vec::as_imm_buf(v) |vbuf, _vlen| {
-                    let vbuf = ::cast::transmute_mut_unsafe(vbuf);
-                    let src = ptr::offset(sbuf, begin);
-                    ptr::copy_memory(vbuf, src, end - begin);
-                }
-                vec::raw::set_len(&mut v, end - begin);
-                v.push(0u8);
-                ::cast::transmute(v)
+            do vec::as_imm_buf(v) |vbuf, _vlen| {
+                let vbuf = ::cast::transmute_mut_unsafe(vbuf);
+                let src = ptr::offset(sbuf, begin);
+                ptr::copy_memory(vbuf, src, end - begin);
             }
+            vec::raw::set_len(&mut v, end - begin);
+            v.push(0u8);
+            ::cast::transmute(v)
         }
     }
 
@@ -2304,7 +2298,7 @@ unsafe fn push_bytes(s: &mut ~str, bytes: &[u8]) {
     }
 
     /// Removes the last byte from a string and returns it. (Not UTF-8 safe).
-    pub unsafe fn pop_byte(s: &mut ~str) -> u8 {
+    pub fn pop_byte(s: &mut ~str) -> u8 {
         let len = len(*s);
         assert!((len > 0u));
         let b = s[len - 1u];
@@ -2313,7 +2307,7 @@ pub unsafe fn pop_byte(s: &mut ~str) -> u8 {
     }
 
     /// Removes the first byte from a string and returns it. (Not UTF-8 safe).
-    pub unsafe fn shift_byte(s: &mut ~str) -> u8 {
+    pub fn shift_byte(s: &mut ~str) -> u8 {
         let len = len(*s);
         assert!((len > 0u));
         let b = s[0];
diff --git a/src/libcore/sys.rs b/src/libcore/sys.rs
index 52ca0204126769b95ec0f5a1ee8c1442fab10e9f..678005ce06f9622bd3a50f9ff6ff882968a47332 100644
--- a/src/libcore/sys.rs
+++ b/src/libcore/sys.rs
@@ -127,10 +127,8 @@ pub fn refcount<T>(t: @T) -> uint {
 }
 
 pub fn log_str<T>(t: &T) -> ~str {
-    unsafe {
-        do io::with_str_writer |wr| {
-            repr::write_repr(wr, t)
-        }
+    do io::with_str_writer |wr| {
+        repr::write_repr(wr, t)
     }
 }
 
@@ -157,10 +155,8 @@ pub fn begin_unwind_(msg: *c_char, file: *c_char, line: size_t) -> ! {
 }
 
 pub fn fail_assert(msg: &str, file: &str, line: uint) -> ! {
-    unsafe {
-        let (msg, file) = (msg.to_owned(), file.to_owned());
-        begin_unwind(~"assertion failed: " + msg, file, line)
-    }
+    let (msg, file) = (msg.to_owned(), file.to_owned());
+    begin_unwind(~"assertion failed: " + msg, file, line)
 }
 
 #[cfg(test)]
diff --git a/src/libcore/task/mod.rs b/src/libcore/task/mod.rs
index e4ee430cdda64dc2d4f2f23b4512ab6b0455a667..d712bf8f98f44960f19141fdb8e24cef6e8a6e7a 100644
--- a/src/libcore/task/mod.rs
+++ b/src/libcore/task/mod.rs
@@ -39,10 +39,9 @@
 use comm::{stream, Chan, GenericChan, GenericPort, Port};
 use prelude::*;
 use result;
-use task::rt::{task_id, sched_id};
+use task::rt::{task_id, sched_id, rust_task};
 use util;
 use util::replace;
-use unstable::finally::Finally;
 
 #[cfg(test)] use comm::SharedChan;
 
@@ -566,28 +565,48 @@ pub fn get_scheduler() -> Scheduler {
  * ~~~
  */
 pub unsafe fn unkillable<U>(f: &fn() -> U) -> U {
-    unsafe {
-        let t = rt::rust_get_task();
-        rt::rust_task_inhibit_kill(t);
-        do (|| {
-            f()
-        }).finally {
-            rt::rust_task_allow_kill(t);
+    struct AllowFailure {
+        t: *rust_task,
+        drop {
+            unsafe {
+                rt::rust_task_allow_kill(self.t);
+            }
+        }
+    }
+
+    fn AllowFailure(t: *rust_task) -> AllowFailure{
+        AllowFailure {
+            t: t
         }
     }
+
+    let t = rt::rust_get_task();
+    let _allow_failure = AllowFailure(t);
+    rt::rust_task_inhibit_kill(t);
+    f()
 }
 
 /// The inverse of unkillable. Only ever to be used nested in unkillable().
 pub unsafe fn rekillable<U>(f: &fn() -> U) -> U {
-    unsafe {
-        let t = rt::rust_get_task();
-        rt::rust_task_allow_kill(t);
-        do (|| {
-            f()
-        }).finally {
-            rt::rust_task_inhibit_kill(t);
+    struct DisallowFailure {
+        t: *rust_task,
+        drop {
+            unsafe {
+                rt::rust_task_inhibit_kill(self.t);
+            }
         }
     }
+
+    fn DisallowFailure(t: *rust_task) -> DisallowFailure {
+        DisallowFailure {
+            t: t
+        }
+    }
+
+    let t = rt::rust_get_task();
+    let _allow_failure = DisallowFailure(t);
+    rt::rust_task_allow_kill(t);
+    f()
 }
 
 /**
@@ -595,17 +614,27 @@ pub unsafe fn rekillable<U>(f: &fn() -> U) -> U {
  * For use with exclusive ARCs, which use pthread mutexes directly.
  */
 pub unsafe fn atomically<U>(f: &fn() -> U) -> U {
-    unsafe {
-        let t = rt::rust_get_task();
-        rt::rust_task_inhibit_kill(t);
-        rt::rust_task_inhibit_yield(t);
-        do (|| {
-            f()
-        }).finally {
-            rt::rust_task_allow_yield(t);
-            rt::rust_task_allow_kill(t);
+    struct DeferInterrupts {
+        t: *rust_task,
+        drop {
+            unsafe {
+                rt::rust_task_allow_yield(self.t);
+                rt::rust_task_allow_kill(self.t);
+            }
         }
     }
+
+    fn DeferInterrupts(t: *rust_task) -> DeferInterrupts {
+        DeferInterrupts {
+            t: t
+        }
+    }
+
+    let t = rt::rust_get_task();
+    let _interrupts = DeferInterrupts(t);
+    rt::rust_task_inhibit_kill(t);
+    rt::rust_task_inhibit_yield(t);
+    f()
 }
 
 #[test] #[should_fail] #[ignore(cfg(windows))]
diff --git a/src/libcore/task/spawn.rs b/src/libcore/task/spawn.rs
index e1b645cd5627295affd495bfb3965682fab9b7a3..c71f7d26d40f1f51901330211651c7991f62378b 100644
--- a/src/libcore/task/spawn.rs
+++ b/src/libcore/task/spawn.rs
@@ -157,13 +157,13 @@ struct AncestorNode {
 // Accessors for taskgroup arcs and ancestor arcs that wrap the unsafety.
 #[inline(always)]
 fn access_group<U>(x: &TaskGroupArc, blk: &fn(TaskGroupInner) -> U) -> U {
-    unsafe { x.with(blk) }
+    x.with(blk)
 }
 
 #[inline(always)]
 fn access_ancestors<U>(x: &unstable::Exclusive<AncestorNode>,
                        blk: &fn(x: &mut AncestorNode) -> U) -> U {
-    unsafe { x.with(blk) }
+    x.with(blk)
 }
 
 // Iterates over an ancestor list.
diff --git a/src/libcore/unstable.rs b/src/libcore/unstable.rs
index 9ccce0cfe7654745e29840cf53755a2dc5a38f28..e43d321dc4d05b86057e7e7c5c22f41c1ee9aafb 100644
--- a/src/libcore/unstable.rs
+++ b/src/libcore/unstable.rs
@@ -152,45 +152,37 @@ fn ArcDestruct<T>(data: *libc::c_void) -> ArcDestruct<T> {
 pub unsafe fn shared_mutable_state<T:Owned>(data: T) ->
         SharedMutableState<T> {
     let data = ~ArcData { count: 1, data: Some(data) };
-    unsafe {
-        let ptr = cast::transmute(data);
-        ArcDestruct(ptr)
-    }
+    let ptr = cast::transmute(data);
+    ArcDestruct(ptr)
 }
 
 #[inline(always)]
 pub unsafe fn get_shared_mutable_state<T:Owned>(
     rc: *SharedMutableState<T>) -> *mut T
 {
-    unsafe {
-        let ptr: ~ArcData<T> = cast::reinterpret_cast(&(*rc).data);
-        assert!(ptr.count > 0);
-        let r = cast::transmute(ptr.data.get_ref());
-        cast::forget(ptr);
-        return r;
-    }
+    let ptr: ~ArcData<T> = cast::reinterpret_cast(&(*rc).data);
+    assert!(ptr.count > 0);
+    let r = cast::transmute(ptr.data.get_ref());
+    cast::forget(ptr);
+    return r;
 }
 #[inline(always)]
 pub unsafe fn get_shared_immutable_state<'a,T:Owned>(
         rc: &'a SharedMutableState<T>) -> &'a T {
-    unsafe {
-        let ptr: ~ArcData<T> = cast::reinterpret_cast(&(*rc).data);
-        assert!(ptr.count > 0);
-        // Cast us back into the correct region
-        let r = cast::transmute_region(ptr.data.get_ref());
-        cast::forget(ptr);
-        return r;
-    }
+    let ptr: ~ArcData<T> = cast::reinterpret_cast(&(*rc).data);
+    assert!(ptr.count > 0);
+    // Cast us back into the correct region
+    let r = cast::transmute_region(ptr.data.get_ref());
+    cast::forget(ptr);
+    return r;
 }
 
 pub unsafe fn clone_shared_mutable_state<T:Owned>(rc: &SharedMutableState<T>)
         -> SharedMutableState<T> {
-    unsafe {
-        let mut ptr: ~ArcData<T> = cast::reinterpret_cast(&(*rc).data);
-        let new_count = intrinsics::atomic_xadd(&mut ptr.count, 1) + 1;
-        assert!(new_count >= 2);
-        cast::forget(ptr);
-    }
+    let mut ptr: ~ArcData<T> = cast::reinterpret_cast(&(*rc).data);
+    let new_count = intrinsics::atomic_xadd(&mut ptr.count, 1) + 1;
+    assert!(new_count >= 2);
+    cast::forget(ptr);
     ArcDestruct((*rc).data)
 }
 
diff --git a/src/libcore/unstable/exchange_alloc.rs b/src/libcore/unstable/exchange_alloc.rs
index fdf99e9dffea67b38ecfe9fc88063af8a36161f7..8ca5486d929923b9682283b7a7a15d79f3c75f8c 100644
--- a/src/libcore/unstable/exchange_alloc.rs
+++ b/src/libcore/unstable/exchange_alloc.rs
@@ -19,27 +19,25 @@
 use intrinsic::TyDesc;
 
 pub unsafe fn malloc(td: *TypeDesc, size: uint) -> *c_void {
-    unsafe {
-        assert!(td.is_not_null());
+    assert!(td.is_not_null());
 
-        let total_size = get_box_size(size, (*td).align);
-        let p = c_malloc(total_size as size_t);
-        assert!(p.is_not_null());
+    let total_size = get_box_size(size, (*td).align);
+    let p = c_malloc(total_size as size_t);
+    assert!(p.is_not_null());
 
-        // FIXME #3475: Converting between our two different tydesc types
-        let td: *TyDesc = transmute(td);
+    // FIXME #3475: Converting between our two different tydesc types
+    let td: *TyDesc = transmute(td);
 
-        let box: &mut BoxRepr = transmute(p);
-        box.header.ref_count = -1; // Exchange values not ref counted
-        box.header.type_desc = td;
-        box.header.prev = null();
-        box.header.next = null();
+    let box: &mut BoxRepr = transmute(p);
+    box.header.ref_count = -1; // Exchange values not ref counted
+    box.header.type_desc = td;
+    box.header.prev = null();
+    box.header.next = null();
 
-        let exchange_count = &mut *rust_get_exchange_count_ptr();
-        atomic_xadd(exchange_count, 1);
+    let exchange_count = &mut *rust_get_exchange_count_ptr();
+    atomic_xadd(exchange_count, 1);
 
-        return transmute(box);
-    }
+    return transmute(box);
 }
 /**
 Thin wrapper around libc::malloc, none of the box header
diff --git a/src/libcore/unstable/extfmt.rs b/src/libcore/unstable/extfmt.rs
index be2aecf0c2a3b30b4465cf1649773e5173abaa7d..ad3dce0a7499253ef7e7be4f63a6a55b1b1a3b96 100644
--- a/src/libcore/unstable/extfmt.rs
+++ b/src/libcore/unstable/extfmt.rs
@@ -512,7 +512,7 @@ pub fn conv_int(cv: Conv, i: int, buf: &mut ~str) {
                 None
             }
         } else { Some('-') };
-        unsafe { pad(cv, s, head, PadSigned, buf) };
+        pad(cv, s, head, PadSigned, buf);
     }
     pub fn conv_uint(cv: Conv, u: uint, buf: &mut ~str) {
         let prec = get_int_precision(cv);
@@ -524,7 +524,7 @@ pub fn conv_uint(cv: Conv, u: uint, buf: &mut ~str) {
               TyBits => uint_to_str_prec(u, 2, prec),
               TyOctal => uint_to_str_prec(u, 8, prec)
             };
-        unsafe { pad(cv, rs, None, PadUnsigned, buf) };
+        pad(cv, rs, None, PadUnsigned, buf);
     }
     pub fn conv_bool(cv: Conv, b: bool, buf: &mut ~str) {
         let s = if b { "true" } else { "false" };
@@ -533,7 +533,7 @@ pub fn conv_bool(cv: Conv, b: bool, buf: &mut ~str) {
         conv_str(cv, s, buf);
     }
     pub fn conv_char(cv: Conv, c: char, buf: &mut ~str) {
-        unsafe { pad(cv, "", Some(c), PadNozero, buf) };
+        pad(cv, "", Some(c), PadNozero, buf);
     }
     pub fn conv_str(cv: Conv, s: &str, buf: &mut ~str) {
         // For strings, precision is the maximum characters
@@ -546,14 +546,14 @@ pub fn conv_str(cv: Conv, s: &str, buf: &mut ~str) {
             s
           }
         };
-        unsafe { pad(cv, unpadded, None, PadNozero, buf) };
+        pad(cv, unpadded, None, PadNozero, buf);
     }
     pub fn conv_float(cv: Conv, f: float, buf: &mut ~str) {
         let (to_str, digits) = match cv.precision {
               CountIs(c) => (float::to_str_exact, c as uint),
               CountImplied => (float::to_str_digits, 6u)
         };
-        let mut s = unsafe { to_str(f, digits) };
+        let mut s = to_str(f, digits);
         let head = if 0.0 <= f {
             if have_flag(cv.flags, flag_sign_always) {
                 Some('+')
@@ -563,7 +563,7 @@ pub fn conv_float(cv: Conv, f: float, buf: &mut ~str) {
                 None
             }
         } else { None };
-        unsafe { pad(cv, s, head, PadFloat, buf) };
+        pad(cv, s, head, PadFloat, buf);
     }
     pub fn conv_poly<T>(cv: Conv, v: &T, buf: &mut ~str) {
         let s = sys::log_str(v);
diff --git a/src/libcore/unstable/lang.rs b/src/libcore/unstable/lang.rs
index dad990c0f97cf0e2d5b405196c20cbfba03501c1..be776a39742f0073439576460beb12aac07f45dc 100644
--- a/src/libcore/unstable/lang.rs
+++ b/src/libcore/unstable/lang.rs
@@ -44,7 +44,7 @@ pub fn fail_(expr: *c_char, file: *c_char, line: size_t) -> ! {
 }
 
 #[lang="fail_bounds_check"]
-pub unsafe fn fail_bounds_check(file: *c_char, line: size_t,
+pub fn fail_bounds_check(file: *c_char, line: size_t,
                                 index: size_t, len: size_t) {
     let msg = fmt!("index out of bounds: the len is %d but the index is %d",
                     len as int, index as int);
@@ -53,7 +53,7 @@ pub unsafe fn fail_bounds_check(file: *c_char, line: size_t,
     }
 }
 
-pub unsafe fn fail_borrowed() {
+pub fn fail_borrowed() {
     let msg = "borrowed";
     do str::as_buf(msg) |msg_p, _| {
         do str::as_buf("???") |file_p, _| {