Do more housekeeping for documentation.

lexical-util/src/skip.rs

@@ -789,12 +789,12 @@ macro_rules! skip_iterator_bytesiter_base {
 
         #[inline(always)]
         fn read_u32(&self) -> Option<u32> {
-            unsafe { self.byte.read_u32() }
+            self.byte.read_u32()
         }
 
         #[inline(always)]
         fn read_u64(&self) -> Option<u64> {
-            unsafe { self.byte.read_u64() }
+            self.byte.read_u64()
         }
 
         #[inline(always)]

lexical-write-float/src/algorithm.rs

@@ -165,23 +165,19 @@ pub fn write_float_negative_exponent<F: DragonboxFloat, const FORMAT: u128>(
     if carried && cursor == 2 {
         // Rounded-up, and carried to the first byte, so instead of having
         // 0.9999, we have 1.0.
-        unsafe {
-            bytes[0] = b'1';
-            if options.trim_floats() {
-                cursor = 1;
-                trimmed = true;
-            } else {
-                bytes[1] = decimal_point;
-                bytes[2] = b'0';
-                cursor = 3;
-            }
+        bytes[0] = b'1';
+        if options.trim_floats() {
+            cursor = 1;
+            trimmed = true;
+        } else {
+            bytes[1] = decimal_point;
+            bytes[2] = b'0';
+            cursor = 3;
         }
     } else if carried {
         // Carried, so we need to remove 1 zero before our digits.
-        unsafe {
-            bytes[1] = decimal_point;
-            bytes[cursor - 1] = bytes[cursor];
-        }
+        bytes[1] = decimal_point;
+        bytes[cursor - 1] = bytes[cursor];
     } else {
         bytes[1] = decimal_point;
         cursor += digit_count;

lexical-write-float/src/lib.rs

@@ -60,7 +60,6 @@
 //!
 //! # Safety
 //!
-//! TODO: Validate this
 //! The `unsafe` usage in the options does not actually have any actual safety
 //! concerns unless the format is not validated: the float formatters assume
 //! NaN and Infinite strings are <= 50 characters. Creating custom format

lexical-write-float/src/shared.rs

@@ -182,19 +182,13 @@ macro_rules! write_float {
         let require_exponent = format.required_exponent_notation() || outside_break;
         if !format.no_exponent_notation() && require_exponent {
             // Write digits in scientific notation.
-            // SAFETY: safe as long as bytes is large enough to hold all the digits.
-            // TODO: No longer need to be unsafe
-            unsafe { $write_scientific::<$($generic,)? FORMAT>($bytes, $($args,)*) }
+            $write_scientific::<$($generic,)? FORMAT>($bytes, $($args,)*)
         } else if $sci_exp < 0 {
             // Write negative exponent without scientific notation.
-            // SAFETY: safe as long as bytes is large enough to hold all the digits.
-            // TODO: No longer need to be unsafe
-            unsafe { $write_negative::<$($generic,)? FORMAT>($bytes, $($args,)*) }
+            $write_negative::<$($generic,)? FORMAT>($bytes, $($args,)*)
         } else {
             // Write positive exponent without scientific notation.
-            // SAFETY: safe as long as bytes is large enough to hold all the digits.
-            // TODO: No longer need to be unsafe
-            unsafe { $write_positive::<$($generic,)? FORMAT>($bytes, $($args,)*) }
+            $write_positive::<$($generic,)? FORMAT>($bytes, $($args,)*)
         }
     }};
 }

lexical-write-integer/src/compact.rs

@@ -27,31 +27,21 @@ pub trait Compact: UnsignedInteger + FormattedSize {
         let mut digits: [u8; 128] = [0u8; 128];
         let mut index = digits.len();
 
-        // SAFETY: safe as long as buffer is large enough to hold the max value.
-        // We never read unwritten values, and we never assume the data is initialized.
-        // Need at least 128-bits, at least as many as the bits in the current type.
-        // Since we make our safety variants inside, this is always safe.
-        //
-        // The logic is this: each iteration we remove a digit from the end, decrement
-        // the index, and assign it to the buffer. Since the longest digits possible
-        // would be radix 2, log2(128) == 128, so at most 128 digits.
-        let slc = unsafe {
-            // Decode all but the last digit.
-            let radix = Self::from_u32(radix);
-            let mut value = self;
-            while value >= radix {
-                let r = value % radix;
-                value /= radix;
-                index -= 1;
-                index_unchecked_mut!(digits[index]) = digit_to_char(u32::as_cast(r));
-            }
-
-            // Decode last digit.
+        // Decode all but the last digit.
+        let radix = Self::from_u32(radix);
+        let mut value = self;
+        while value >= radix {
             let r = value % radix;
+            value /= radix;
             index -= 1;
-            index_unchecked_mut!(digits[index]) = digit_to_char(u32::as_cast(r));
-            &index_unchecked_mut!(digits[index..])
-        };
+            digits[index] = digit_to_char(u32::as_cast(r));
+        }
+
+        // Decode last digit.
+        let r = value % radix;
+        index -= 1;
+        digits[index] = digit_to_char(u32::as_cast(r));
+        let slc = &digits[index..];
         copy_to_dst(buffer, slc)
     }
 }

lexical-write-integer/src/decimal.rs

@@ -102,7 +102,7 @@ pub fn fast_digit_count(x: u32) -> usize {
     // SAFETY: always safe, since fast_log2 will always return a value
     // <= 32. This is because the range of values from `ctlz(x | 1)` is
     // `[0, 31]`, so `32 - 1 - ctlz(x | 1)` must be in the range `[0, 31]`.
-    let shift = unsafe { index_unchecked!(TABLE[fast_log2(x)]) };
+    let shift = TABLE[fast_log2(x)];
     let count = (x as u64 + shift) >> 32;
     count as usize
 }
@@ -259,7 +259,7 @@ macro_rules! decimal_impl {
         impl Decimal for $t {
             #[inline(always)]
             fn decimal(self, buffer: &mut [u8]) -> usize {
-                // SAFETY: safe as long as buffer is large enough to hold the max value.
+                // SAFETY: safe since we've guaranteed the buffer is large enough to hold the max value.
                 let count = self.digit_count();
                 assert!(count <= buffer.len());
                 unsafe {
@@ -276,7 +276,7 @@ decimal_impl! { u32 u64 }
 impl Decimal for u128 {
     #[inline(always)]
     fn decimal(self, buffer: &mut [u8]) -> usize {
-        // SAFETY: safe as long as buffer is large enough to hold the max value.
+        // SAFETY: safe since we've guaranteed the buffer is large enough to hold the max value.
         let count = self.digit_count();
         assert!(count <= buffer.len());
         unsafe {

lexical-write-integer/src/index.rs

@@ -8,12 +8,6 @@
 #![cfg_attr(feature = "compact", allow(unused_macros, unused_macro_rules))]
 #![doc(hidden)]
 
-macro_rules! index_unchecked {
-    ($x:ident[$i:expr]) => {
-        *$x.get_unchecked($i)
-    };
-}
-
 /// Index a buffer and get a mutable reference, without bounds checking.
 // The `($x:ident[$i:expr] = $y:ident[$j:expr])` is not used with `compact`.
 // The newer version of the lint is `unused_macro_rules`, but this isn't

scripts/unsafe.sh

@@ -1,5 +1,7 @@
 #!/bin/bash
 # Print diagnostics on the amount of unsafe code used.
+# NOTE: This is currently unused since cargo-count is
+# unmaintained and requires an old version of clap.
 
 set -e
 
@@ -10,7 +12,7 @@ count() {
 }
 
 # Change to our project home.
-script_dir=`dirname "${BASH_SOURCE[0]}"`
+script_dir=$(dirname "${BASH_SOURCE[0]}")
 cd "$script_dir"/
 count "lexical-util"
 count "lexical-parse-integer"