src/stream/mod.rs
src/stream/mod.rs, line 195-225
///
/// </div>
///
/// # Safety
///
/// Callers of this function are responsible that these preconditions are satisfied:
///
/// * Indexes must be within bounds of the original input;
/// * Indexes must uphold invariants of the stream, like for `str` they must lie on UTF-8
/// sequence boundaries.
///
unsafe fn next_slice_unchecked(&mut self, offset: usize) -> Self::Slice {
// Inherent impl to allow callers to have `unsafe`-free code
self.next_slice(offset)
}
/// Split off a slice of tokens from the input
fn peek_slice(&self, offset: usize) -> Self::Slice;
/// Split off a slice of tokens from the input
///
/// # Safety
///
/// Callers of this function are responsible that these preconditions are satisfied:
///
/// * Indexes must be within bounds of the original input;
/// * Indexes must uphold invariants of the stream, like for `str` they must lie on UTF-8
/// sequence boundaries.
unsafe fn peek_slice_unchecked(&self, offset: usize) -> Self::Slice {
// Inherent impl to allow callers to have `unsafe`-free code
self.peek_slice(offset)
}
The Stream trait defines next_slice_unchecked and peek_slice_unchecked as unsafe methods with documented preconditions: offsets must be in-bounds and, for &str, must lie on UTF-8 character boundaries. All implementations in this module (for &[T], &str, Bytes, BStr, and wrapper types LocatingSlice, Partial, Stateful, TokenSlice, Recoverable) delegate to get_unchecked(..offset) with a // SAFETY: comment referencing the trait's contract. In debug builds, each unchecked override calls the safe (panicking) variant first via #[cfg(debug_assertions)]. The unchecked methods are never called outside the stream module; all public combinators (token, ascii, binary, combinator) use only next_slice and peek_slice. Justifies uses-unsafe, unsafe-safe, unsafe-documented, unsafe-minimal.
BStr and Bytes use core::mem::transmute(&[u8]) -> &Self. Both types are #[repr(transparent)] over [u8], making this transmute valid.