Adopt unsafe annotations throughout the standard library

stdlib/public/core/StringGuts.swift

@@ -52,7 +52,7 @@ extension _StringGuts {
 
   @inlinable @inline(__always)
   internal init(_ bufPtr: UnsafeBufferPointer<UInt8>, isASCII: Bool) {
-    self.init(_StringObject(immortal: bufPtr, isASCII: isASCII))
+    unsafe self.init(_StringObject(immortal: bufPtr, isASCII: isASCII))
   }
 
   @inline(__always)
@@ -166,7 +166,7 @@ extension _StringGuts {
     if self.isSmall { return try _SmallString(_object).withUTF8(f) }
 
     defer { _fixLifetime(self) }
-    return try f(_object.fastUTF8)
+    return try unsafe f(_object.fastUTF8)
   }
 
   @inlinable @inline(__always)
@@ -174,8 +174,8 @@ extension _StringGuts {
     range: Range<Int>,
     _ f: (UnsafeBufferPointer<UInt8>) throws -> R
   ) rethrows -> R {
-    return try self.withFastUTF8 { wholeUTF8 in
-      return try f(UnsafeBufferPointer(rebasing: wholeUTF8[range]))
+    return try unsafe self.withFastUTF8 { wholeUTF8 in
+      return try unsafe f(unsafe UnsafeBufferPointer(rebasing: wholeUTF8[range]))
     }
   }
 
@@ -183,8 +183,8 @@ extension _StringGuts {
   internal func withFastCChar<R>(
     _ f: (UnsafeBufferPointer<CChar>) throws -> R
   ) rethrows -> R {
-    return try self.withFastUTF8 { utf8 in
-      return try utf8.withMemoryRebound(to: CChar.self, f)
+    return try unsafe self.withFastUTF8 { utf8 in
+      return try unsafe utf8.withMemoryRebound(to: CChar.self, f)
     }
   }
 }
@@ -222,11 +222,11 @@ extension _StringGuts {
     _ body: (UnsafePointer<Int8>) throws -> Result
   ) rethrows -> Result {
     if _slowPath(!_object.isFastZeroTerminated) {
-      return try _slowWithCString(body)
+      return try unsafe _slowWithCString(body)
     }
 
-    return try self.withFastCChar {
-      return try body($0.baseAddress._unsafelyUnwrappedUnchecked)
+    return try unsafe self.withFastCChar {
+      return try unsafe body($0.baseAddress._unsafelyUnwrappedUnchecked)
     }
   }
 
@@ -237,8 +237,8 @@ extension _StringGuts {
   ) rethrows -> Result {
     _internalInvariant(!_object.isFastZeroTerminated)
     return try String(self).utf8CString.withUnsafeBufferPointer {
-      let ptr = $0.baseAddress._unsafelyUnwrappedUnchecked
-      return try body(ptr)
+      let ptr = unsafe $0.baseAddress._unsafelyUnwrappedUnchecked
+      return try unsafe body(ptr)
     }
   }
 }
@@ -248,18 +248,18 @@ extension _StringGuts {
   // Contents of the buffer are unspecified if nil is returned.
   @inlinable
   internal func copyUTF8(into mbp: UnsafeMutableBufferPointer<UInt8>) -> Int? {
-    let ptr = mbp.baseAddress._unsafelyUnwrappedUnchecked
+    let ptr = unsafe mbp.baseAddress._unsafelyUnwrappedUnchecked
     if _fastPath(self.isFastUTF8) {
-      return self.withFastUTF8 { utf8 in
+      return unsafe self.withFastUTF8 { utf8 in
         guard utf8.count <= mbp.count else { return nil }
 
-        let utf8Start = utf8.baseAddress._unsafelyUnwrappedUnchecked
-        ptr.initialize(from: utf8Start, count: utf8.count)
+        let utf8Start = unsafe utf8.baseAddress._unsafelyUnwrappedUnchecked
+        unsafe ptr.initialize(from: utf8Start, count: utf8.count)
         return utf8.count
       }
     }
 
-    return _foreignCopyUTF8(into: mbp)
+    return unsafe _foreignCopyUTF8(into: mbp)
   }
   @_effects(releasenone)
   @usableFromInline @inline(never) // slow-path
@@ -269,19 +269,19 @@ extension _StringGuts {
     #if _runtime(_ObjC)
     // Currently, foreign  means NSString
     let res = _object.withCocoaObject {
-      _cocoaStringCopyUTF8($0, into: UnsafeMutableRawBufferPointer(mbp))
+      unsafe _cocoaStringCopyUTF8($0, into: UnsafeMutableRawBufferPointer(mbp))
     }
     if let res { return res }
 
     // If the NSString contains invalid UTF8 (e.g. unpaired surrogates), we
     // can get nil from cocoaStringCopyUTF8 in situations where a character by
     // character loop would get something more useful like repaired contents
-    var ptr = mbp.baseAddress._unsafelyUnwrappedUnchecked
+    var ptr = unsafe mbp.baseAddress._unsafelyUnwrappedUnchecked
     var numWritten = 0
     for cu in String(self).utf8 {
       guard numWritten < mbp.count else { return nil }
-      ptr.initialize(to: cu)
-      ptr += 1
+      unsafe ptr.initialize(to: cu)
+      unsafe ptr += 1
       numWritten += 1
     }
     
@@ -433,7 +433,7 @@ extension _StringGuts {
   // FIXME: Mark as obsoleted. Still used by swift-corelibs-foundation.
   @available(*, deprecated)
   public var startASCII: UnsafeMutablePointer<UInt8> {
-    return UnsafeMutablePointer(mutating: _object.fastUTF8.baseAddress!)
+    return unsafe UnsafeMutablePointer(mutating: _object.fastUTF8.baseAddress!)
   }
 
   // FIXME: Previously used by swift-corelibs-foundation. Aging for removal.
@@ -446,10 +446,10 @@ extension _StringGuts {
 // FIXME: Previously used by swift-corelibs-foundation. Aging for removal.
 @available(*, unavailable)
 public func _persistCString(_ p: UnsafePointer<CChar>?) -> [CChar]? {
-  guard let s = p else { return nil }
-  let bytesToCopy = UTF8._nullCodeUnitOffset(in: s) + 1 // +1 for the terminating NUL
-  let result = [CChar](unsafeUninitializedCapacity: bytesToCopy) { buf, initedCount in
-    buf.baseAddress!.update(from: s, count: bytesToCopy)
+  guard let s = unsafe p else { return nil }
+  let bytesToCopy = unsafe UTF8._nullCodeUnitOffset(in: s) + 1 // +1 for the terminating NUL
+  let result = unsafe [CChar](unsafeUninitializedCapacity: bytesToCopy) { buf, initedCount in
+    unsafe buf.baseAddress!.update(from: s, count: bytesToCopy)
     initedCount = bytesToCopy
   }
   return result