Unsafe Code Cleanup

[qinsoon]

The current code base pervasively uses unsafe code, especially to get mutable references from immutable reference/objects. This could include potential race condition and bugs. We should clean up the unsafe code to maximize the benefits of thread safety we can get from Rust's checks.

We should diagnose each of the unsafe cases, and categorize them: either 1) we need to use unsafe (mostly for performance reasons), or 2) we can refactor them into safe code. For 1), we should always encapsulate the unsafe code and make sure that they are correct.

[qinsoon]

A quick summary of unsafe code in the current MMTk: https://docs.google.com/presentation/d/1X4unAoPeEPbnYoK95H2Fw54d0L139f8aYviDcoFFdqg/edit?usp=sharing

[qinsoon]

From our discussion, there are a few notes about unsafe code:

• report some unsafe statistics from our CI for each PR.
• properly document unsafe functions (# Safety in rustdoc) and document for the uses of those unsafe functions.
• document our design around unsafe code in a separate markdown file in docs.
• for intrinsic unsafety (e.g. accessing memory), we should think about how we can defend our code. They are unsafe, but we may provide some help for debugging if we can (e.g. in debug build, assert if an address is sane before accessing it?)

[qinsoon]

Related issues:

• Remove cast_ref_to_mut related to FreeList, PageResource and VMMap #853
  • Remove fl_map and refactor FreeListPageResoure #953
  • Let Map32 use proper synchronization. #951
• Remove cast_ref_to_mut related to Prepare and Release #852
  • Introduce ArcFlexMut for Space references #965