Function allow 

pub fn allow<T>(f: impl FnOnce() -> T) -> T

Run f with allocation permitted, then restore the previous state.

Every call to this is a claim that the work inside is off the command path. Wrapping a command path in it to silence an abort is the one way to misuse this module, so the calls are meant to be few and easy to find.

Cost

One relaxed load of a static when no thread in the process has ever been marked, and a thread local read and two writes when one has.

The load is in front of the rest because these calls are not all at the top of a function any more. The set algebra makes its claim around the insert that grows its table, which is once per member, because the alternative is one guard around the whole walk and that hides whatever the caller’s closure does. A thread local read and two writes per member of a union is not obviously free, and a laptop with other work on it could not resolve the difference either way: two runs of setops_small with the same code in place disagreed by more than the effect being looked for. So this stopped being an argument about how cheap a thread local is and became a load of a static that is false in every shipped binary and in every benchmark.