RawBlock: seal base and add Stack::index_dangling_or_frame

Direct accesses to `base` are replaced with dedicated methods with
explicit safety requirements.

src/machine/stack.rs

@@ -89,14 +89,20 @@ impl Index<usize> for Stack {
 
     #[inline]
     fn index(&self, index: usize) -> &Self::Output {
-        unsafe { &*self.buf.base.add(index).cast() }
+        unsafe {
+            let ptr = self.buf.get_unchecked(index);
+            &*ptr.cast::<HeapCellValue>()
+        }
     }
 }
 
 impl IndexMut<usize> for Stack {
     #[inline]
     fn index_mut(&mut self, index: usize) -> &mut Self::Output {
-        unsafe { &mut *self.buf.base.add(index).cast_mut().cast() }
+        unsafe {
+            let ptr = self.buf.get_unchecked(index);
+            &mut *ptr.cast_mut().cast::<HeapCellValue>()
+        }
     }
 }
 
@@ -241,33 +247,57 @@ impl Stack {
         }
     }
 
+    fn get_raw(&self, index: usize) -> *const u8 {
+        debug_assert!(index < self.buf.used_bytes());
+
+        unsafe { self.buf.get_unchecked(index) }
+    }
+
     #[inline(always)]
     pub(crate) fn index_and_frame(&self, e: usize) -> &AndFrame {
-        unsafe { &*self.buf.base.add(e).cast() }
+        let ptr = self.get_raw(e);
+
+        unsafe { &*ptr.cast::<AndFrame>() }
     }
 
     #[inline(always)]
     pub(crate) fn index_and_frame_mut(&mut self, e: usize) -> &mut AndFrame {
-        unsafe {
-            // This is doing alignment wrong
-            let ptr = self.buf.base.add(e);
-            &mut *(ptr as *mut AndFrame)
-        }
+        let ptr = self.get_raw(e);
+
+        unsafe { &mut *ptr.cast_mut().cast::<AndFrame>() }
     }
 
     #[inline(always)]
     pub(crate) fn index_or_frame(&self, b: usize) -> &OrFrame {
-        unsafe { &*self.buf.base.add(b).cast() }
+        let ptr = self.get_raw(b);
+
+        unsafe { &*ptr.cast::<OrFrame>() }
     }
 
     #[inline(always)]
     pub(crate) fn index_or_frame_mut(&mut self, b: usize) -> &mut OrFrame {
-        unsafe { &mut *self.buf.base.add(b).cast_mut().cast() }
+        let ptr = self.get_raw(b);
+
+        unsafe { &mut *ptr.cast_mut().cast::<OrFrame>() }
+    }
+
+    /// # Safety
+    ///
+    /// The stack must contain a valid OrFrame at [`self.top()`](Self::top),
+    /// which can only be achieved by allocating it in the first place and later truncating the stack.
+    ///
+    /// No allocation must have been done since the last call to [`truncate()`](Self::truncate).
+    #[inline(always)]
+    pub(crate) unsafe fn index_dangling_or_frame(&self) -> &OrFrame {
+        unsafe {
+            let ptr = self.buf.get_unchecked(self.top());
+            &*ptr.cast::<OrFrame>()
+        }
     }
 
     #[inline(always)]
     pub(crate) fn truncate(&mut self, b: usize) {
-        self.buf.shrink(b);
+        self.buf.shift_back(b);
     }
 }
 

src/machine/system_calls.rs

@@ -1327,8 +1327,10 @@ impl Machine {
                                 // the last clause of the retract
                                 // helper to delay deallocation of its
                                 // environment frame.
-                                let clause_b = self.machine_st.stack.top();
-                                self.machine_st.stack.index_or_frame(clause_b).prelude.biip as usize
+                                unsafe {
+                                    self.machine_st.stack.index_dangling_or_frame().prelude.biip
+                                        as usize
+                                }
                             };
 
                             return (