[stdlib] add unsafe annotations

stdlib/public/core/Span/MutableRawSpan.swift

@@ -12,6 +12,7 @@
 
 // A MutableRawSpan represents a span of memory which
 // contains initialized `Element` instances.
+@safe
 @frozen
 @available(SwiftStdlib 6.2, *)
 public struct MutableRawSpan: ~Copyable & ~Escapable {
@@ -23,7 +24,7 @@ public struct MutableRawSpan: ~Copyable & ~Escapable {
 
   @_alwaysEmitIntoClient
   internal func _start() -> UnsafeMutableRawPointer {
-    _pointer.unsafelyUnwrapped
+    unsafe _pointer.unsafelyUnwrapped
   }
 
   @_alwaysEmitIntoClient
@@ -32,7 +33,7 @@ public struct MutableRawSpan: ~Copyable & ~Escapable {
     _unchecked pointer: UnsafeMutableRawPointer?,
     byteCount: Int
   ) {
-    _pointer = pointer
+    _pointer = unsafe pointer
     _count = byteCount
   }
 }
@@ -50,7 +51,7 @@ extension MutableRawSpan {
   ) {
     let baseAddress = bytes.baseAddress
     let span = MutableRawSpan(_unchecked: baseAddress, byteCount: bytes.count)
-    self = _overrideLifetime(span, borrowing: bytes)
+    self = unsafe _overrideLifetime(span, borrowing: bytes)
   }
 
   @_alwaysEmitIntoClient
@@ -58,9 +59,9 @@ extension MutableRawSpan {
   public init(
     _unsafeBytes bytes: borrowing Slice<UnsafeMutableRawBufferPointer>
   ) {
-    let rebased = UnsafeMutableRawBufferPointer(rebasing: bytes)
+    let rebased = unsafe UnsafeMutableRawBufferPointer(rebasing: bytes)
     let span = MutableRawSpan(_unsafeBytes: rebased)
-    self = _overrideLifetime(span, borrowing: bytes)
+    self = unsafe _overrideLifetime(span, borrowing: bytes)
   }
 
   @_alwaysEmitIntoClient
@@ -80,7 +81,7 @@ extension MutableRawSpan {
   ) {
     let bytes = UnsafeMutableRawBufferPointer(elements)
     let span = MutableRawSpan(_unsafeBytes: bytes)
-    self = _overrideLifetime(span, borrowing: elements)
+    self = unsafe _overrideLifetime(span, borrowing: elements)
   }
 
   @_alwaysEmitIntoClient
@@ -88,9 +89,9 @@ extension MutableRawSpan {
   public init<Element: BitwiseCopyable>(
     _unsafeElements elements: borrowing Slice<UnsafeMutableBufferPointer<Element>>
   ) {
-    let rebased = UnsafeMutableBufferPointer(rebasing: elements)
+    let rebased = unsafe UnsafeMutableBufferPointer(rebasing: elements)
     let span = MutableRawSpan(_unsafeElements: rebased)
-    self = _overrideLifetime(span, borrowing: elements)
+    self = unsafe _overrideLifetime(span, borrowing: elements)
   }
 
   @_alwaysEmitIntoClient
@@ -98,12 +99,12 @@ extension MutableRawSpan {
   public init<Element: BitwiseCopyable>(
     _elements elements: consuming MutableSpan<Element>
   ) {
-    let bytes = UnsafeMutableRawBufferPointer(
+    let bytes = unsafe UnsafeMutableRawBufferPointer(
       start: elements._pointer,
       count: elements.count &* MemoryLayout<Element>.stride
     )
     let span = MutableRawSpan(_unsafeBytes: bytes)
-    self = _overrideLifetime(span, copying: elements)
+    self = unsafe _overrideLifetime(span, copying: elements)
   }
 }
 
@@ -129,9 +130,9 @@ extension MutableRawSpan {
     _ body: (_ buffer: UnsafeRawBufferPointer) throws(E) -> Result
   ) throws(E) -> Result {
     guard let pointer = _pointer, _count > 0 else {
-      return try body(.init(start: nil, count: 0))
+      return try unsafe body(.init(start: nil, count: 0))
     }
-    return try body(.init(start: pointer, count: _count))
+    return try unsafe body(.init(start: pointer, count: _count))
   }
 
   @_alwaysEmitIntoClient
@@ -139,9 +140,9 @@ extension MutableRawSpan {
     _ body: (UnsafeMutableRawBufferPointer) throws(E) -> Result
   ) throws(E) -> Result {
     guard let pointer = _pointer, _count > 0 else {
-      return try body(.init(start: nil, count: 0))
+      return try unsafe body(.init(start: nil, count: 0))
     }
-    return try body(.init(start: pointer, count: _count))
+    return try unsafe body(.init(start: pointer, count: _count))
   }
 }
 
@@ -153,7 +154,7 @@ extension RawSpan {
   public init(_unsafeMutableRawSpan mutableSpan: borrowing MutableRawSpan) {
     let start = mutableSpan._start()
     let span = RawSpan(_unsafeStart: start, byteCount: mutableSpan.byteCount)
-    self = _overrideLifetime(span, borrowing: mutableSpan)
+    self = unsafe _overrideLifetime(span, borrowing: mutableSpan)
   }
 }
 
@@ -174,9 +175,9 @@ extension MutableRawSpan {
   public borrowing func _unsafeView<T: BitwiseCopyable>(
     as type: T.Type
   ) -> Span<T> {
-    let bytes = UnsafeRawBufferPointer(start: _pointer, count: _count)
+    let bytes = unsafe UnsafeRawBufferPointer(start: _pointer, count: _count)
     let span = Span<T>(_unsafeBytes: bytes)
-    return _overrideLifetime(span, borrowing: self)
+    return unsafe _overrideLifetime(span, borrowing: self)
   }
 
   @unsafe
@@ -185,9 +186,11 @@ extension MutableRawSpan {
   public mutating func _unsafeMutableView<T: BitwiseCopyable>(
     as type: T.Type
   ) -> MutableSpan<T> {
-    let bytes = UnsafeMutableRawBufferPointer(start: _pointer, count: _count)
+    let bytes = unsafe UnsafeMutableRawBufferPointer(
+      start: _pointer, count: _count
+    )
     let span = MutableSpan<T>(_unsafeBytes: bytes)
-    return _overrideLifetime(span, mutating: &self)
+    return unsafe _overrideLifetime(span, mutating: &self)
   }
 }
 
@@ -221,7 +224,7 @@ extension MutableRawSpan {
       MemoryLayout<T>.size <= (_count &- offset),
       "Byte offset range out of bounds"
     )
-    return unsafeLoad(fromUncheckedByteOffset: offset, as: T.self)
+    return unsafe unsafeLoad(fromUncheckedByteOffset: offset, as: T.self)
   }
 
   /// Returns a new instance of the given type, constructed from the raw memory
@@ -247,7 +250,7 @@ extension MutableRawSpan {
   public func unsafeLoad<T>(
     fromUncheckedByteOffset offset: Int, as: T.Type
   ) -> T {
-    _start().load(fromByteOffset: offset, as: T.self)
+    unsafe _start().load(fromByteOffset: offset, as: T.self)
   }
 
   /// Returns a new instance of the given type, constructed from the raw memory
@@ -276,7 +279,7 @@ extension MutableRawSpan {
       MemoryLayout<T>.size <= (_count &- offset),
       "Byte offset range out of bounds"
     )
-    return unsafeLoadUnaligned(fromUncheckedByteOffset: offset, as: T.self)
+    return unsafe unsafeLoadUnaligned(fromUncheckedByteOffset: offset, as: T.self)
   }
 
   /// Returns a new instance of the given type, constructed from the raw memory
@@ -301,7 +304,7 @@ extension MutableRawSpan {
   public func unsafeLoadUnaligned<T: BitwiseCopyable>(
     fromUncheckedByteOffset offset: Int, as: T.Type
   ) -> T {
-    _start().loadUnaligned(fromByteOffset: offset, as: T.self)
+    unsafe _start().loadUnaligned(fromByteOffset: offset, as: T.self)
   }
 
   @_alwaysEmitIntoClient
@@ -313,7 +316,7 @@ extension MutableRawSpan {
       MemoryLayout<T>.size <= (_count &- offset),
       "Byte offset range out of bounds"
     )
-    storeBytes(of: value, toUncheckedByteOffset: offset, as: type)
+    unsafe storeBytes(of: value, toUncheckedByteOffset: offset, as: type)
   }
 
   @unsafe
@@ -321,7 +324,7 @@ extension MutableRawSpan {
   public func storeBytes<T: BitwiseCopyable>(
     of value: T, toUncheckedByteOffset offset: Int, as type: T.Type
   ) {
-    _start().storeBytes(of: value, toByteOffset: offset, as: type)
+    unsafe _start().storeBytes(of: value, toByteOffset: offset, as: type)
   }
 }
 
@@ -347,7 +350,9 @@ extension MutableRawSpan {
     var offset = byteOffset
     while offset + MemoryLayout<Element>.stride <= _count {
       guard let element = elements.next() else { break }
-      storeBytes(of: element, toUncheckedByteOffset: offset, as: Element.self)
+      unsafe storeBytes(
+        of: element, toUncheckedByteOffset: offset, as: Element.self
+      )
       offset &+= MemoryLayout<Element>.stride
     }
     return offset
@@ -403,8 +408,8 @@ extension MutableRawSpan {
   ) -> Int {
     if source.byteCount == 0 { return byteOffset }
     source.withUnsafeBytes {
-      _start().advanced(by: byteOffset)
-              .copyMemory(from: $0.baseAddress!, byteCount: $0.count)
+      unsafe _start().advanced(by: byteOffset)
+                     .copyMemory(from: $0.baseAddress!, byteCount: $0.count)
     }
     return byteOffset &+ source.byteCount
   }
@@ -443,7 +448,7 @@ extension MutableRawSpan {
       UInt(bitPattern: bounds.upperBound) <= UInt(bitPattern: _count),
       "Index range out of bounds"
     )
-    return _extracting(unchecked: bounds)
+    return unsafe _extracting(unchecked: bounds)
   }
 
   /// Constructs a new span over the items within the supplied range of
@@ -465,9 +470,9 @@ extension MutableRawSpan {
   @_alwaysEmitIntoClient
   @lifetime(borrow self)
   mutating public func _extracting(unchecked bounds: Range<Int>) -> Self {
-    let newStart = _pointer?.advanced(by: bounds.lowerBound)
+    let newStart = unsafe _pointer?.advanced(by: bounds.lowerBound)
     let newSpan = Self(_unchecked: newStart, byteCount: bounds.count)
-    return _overrideLifetime(newSpan, mutating: &self)
+    return unsafe _overrideLifetime(newSpan, mutating: &self)
   }
 
   /// Constructs a new span over the items within the supplied range of
@@ -488,7 +493,7 @@ extension MutableRawSpan {
   mutating public func _extracting(
     _ bounds: some RangeExpression<Int>
   ) -> Self {
-    _extracting(bounds.relative(to: byteOffsets).clamped(to: byteOffsets))
+    _extracting(bounds.relative(to: byteOffsets))
   }
 
   /// Constructs a new span over the items within the supplied range of
@@ -512,11 +517,10 @@ extension MutableRawSpan {
   mutating public func _extracting(
     unchecked bounds: some RangeExpression<Int>
   ) -> Self {
-    _extracting(
-      unchecked: bounds.relative(to: byteOffsets).clamped(to: byteOffsets)
-    )
+    unsafe _extracting(unchecked: bounds.relative(to: byteOffsets))
   }
 
+  @unsafe
   @_alwaysEmitIntoClient
   @lifetime(borrow self)
   mutating public func _extracting(
@@ -525,7 +529,7 @@ extension MutableRawSpan {
     let range = Range(
       _uncheckedBounds: (bounds.lowerBound, bounds.upperBound&+1)
     )
-    return _extracting(unchecked: range)
+    return unsafe _extracting(unchecked: range)
   }
 
   /// Constructs a new span over all the items of this span.
@@ -541,7 +545,7 @@ extension MutableRawSpan {
   @lifetime(borrow self)
   mutating public func _extracting(_: UnboundedRange) -> Self {
     let newSpan = Self(_unchecked: _start(), byteCount: _count)
-    return _overrideLifetime(newSpan, mutating: &self)
+    return unsafe _overrideLifetime(newSpan, mutating: &self)
   }
 }
 
@@ -570,7 +574,7 @@ extension MutableRawSpan {
     _precondition(maxLength >= 0, "Can't have a prefix of negative length")
     let newCount = min(maxLength, byteCount)
     let newSpan = Self(_unchecked: _pointer, byteCount: newCount)
-    return _overrideLifetime(newSpan, mutating: &self)
+    return unsafe _overrideLifetime(newSpan, mutating: &self)
   }
 
   /// Returns a span over all but the given number of trailing elements.
@@ -593,7 +597,7 @@ extension MutableRawSpan {
     _precondition(k >= 0, "Can't drop a negative number of elements")
     let dropped = min(k, byteCount)
     let newSpan = Self(_unchecked: _pointer, byteCount: byteCount &- dropped)
-    return _overrideLifetime(newSpan, mutating: &self)
+    return unsafe _overrideLifetime(newSpan, mutating: &self)
   }
 
   /// Returns a span containing the final elements of the span,
@@ -616,9 +620,9 @@ extension MutableRawSpan {
   mutating public func _extracting(last maxLength: Int) -> Self {
     _precondition(maxLength >= 0, "Can't have a suffix of negative length")
     let newCount = min(maxLength, byteCount)
-    let newStart = _pointer?.advanced(by: byteCount &- newCount)
+    let newStart = unsafe _pointer?.advanced(by: byteCount &- newCount)
     let newSpan = Self(_unchecked: newStart, byteCount: newCount)
-    return _overrideLifetime(newSpan, copying: self)
+    return unsafe _overrideLifetime(newSpan, copying: self)
   }
 
   /// Returns a span over all but the given number of initial elements.
@@ -640,8 +644,8 @@ extension MutableRawSpan {
   mutating public func _extracting(droppingFirst k: Int) -> Self {
     _precondition(k >= 0, "Can't drop a negative number of bytes")
     let dropped = min(k, byteCount)
-    let newStart = _pointer?.advanced(by: dropped)
+    let newStart = unsafe _pointer?.advanced(by: dropped)
     let newSpan = Self(_unchecked: newStart, byteCount: byteCount &- dropped)
-    return _overrideLifetime(newSpan, mutating: &self)
+    return unsafe _overrideLifetime(newSpan, mutating: &self)
   }
 }

stdlib/public/core/Span/MutableSpan.swift

@@ -12,6 +12,7 @@
 
 // A MutableSpan<Element> represents a span of memory which
 // contains initialized `Element` instances.
+@safe
 @frozen
 @available(SwiftStdlib 6.2, *)
 public struct MutableSpan<Element: ~Copyable & ~Escapable>
@@ -24,7 +25,7 @@ public struct MutableSpan<Element: ~Copyable & ~Escapable>
 
   @_alwaysEmitIntoClient
   internal func _start() -> UnsafeMutableRawPointer {
-    _pointer.unsafelyUnwrapped
+    unsafe _pointer.unsafelyUnwrapped
   }
 
   @_alwaysEmitIntoClient
@@ -33,7 +34,7 @@ public struct MutableSpan<Element: ~Copyable & ~Escapable>
     _unchecked start: UnsafeMutableRawPointer?,
     count: Int
   ) {
-    _pointer = start
+    _pointer = unsafe start
     _count = count
   }
 }
@@ -58,13 +59,13 @@ extension MutableSpan where Element: ~Copyable {
   public init(
     _unsafeElements buffer: UnsafeMutableBufferPointer<Element>
   ) {
-    _precondition(
+    unsafe _precondition(
       ((Int(bitPattern: buffer.baseAddress) &
-        (MemoryLayout<Element>.alignment&-1)) == 0),
+        (MemoryLayout<Element>.alignment &- 1)) == 0),
       "baseAddress must be properly aligned to access Element"
     )
     let ms = MutableSpan<Element>(_unchecked: buffer)
-    self = _overrideLifetime(ms, borrowing: buffer)
+    self = unsafe _overrideLifetime(ms, borrowing: buffer)
   }
 
   @_alwaysEmitIntoClient
@@ -74,9 +75,9 @@ extension MutableSpan where Element: ~Copyable {
     count: Int
   ) {
     _precondition(count >= 0, "Count must not be negative")
-    let buffer = UnsafeMutableBufferPointer(start: start, count: count)
+    let buffer = unsafe UnsafeMutableBufferPointer(start: start, count: count)
     let ms = MutableSpan(_unsafeElements: buffer)
-    self = _overrideLifetime(ms, borrowing: start)
+    self = unsafe _overrideLifetime(ms, borrowing: start)
   }
 }
 
@@ -88,9 +89,9 @@ extension MutableSpan {
   public init(
     _unsafeElements elements: borrowing Slice<UnsafeMutableBufferPointer<Element>>
   ) {
-    let rb = UnsafeMutableBufferPointer(rebasing: elements)
+    let rb = unsafe UnsafeMutableBufferPointer(rebasing: elements)
     let ms = MutableSpan(_unsafeElements: rb)
-    self = _overrideLifetime(ms, borrowing: elements)
+    self = unsafe _overrideLifetime(ms, borrowing: elements)
   }
 }
 
@@ -102,20 +103,20 @@ extension MutableSpan where Element: BitwiseCopyable {
   public init(
     _unsafeBytes buffer: UnsafeMutableRawBufferPointer
   ) {
-    _precondition(
+    unsafe _precondition(
       ((Int(bitPattern: buffer.baseAddress) &
-        (MemoryLayout<Element>.alignment&-1)) == 0),
+        (MemoryLayout<Element>.alignment &- 1)) == 0),
       "baseAddress must be properly aligned to access Element"
     )
     let (byteCount, stride) = (buffer.count, MemoryLayout<Element>.stride)
     let (count, remainder) = byteCount.quotientAndRemainder(dividingBy: stride)
     _precondition(remainder == 0, "Span must contain a whole number of elements")
-    let elements = UnsafeMutableBufferPointer<Element>(
+    let elements = unsafe UnsafeMutableBufferPointer<Element>(
       start: buffer.baseAddress?.assumingMemoryBound(to: Element.self),
       count: count
     )
     let ms = MutableSpan(_unsafeElements: elements)
-    self = _overrideLifetime(ms, borrowing: buffer)
+    self = unsafe _overrideLifetime(ms, borrowing: buffer)
   }
 
   @_alwaysEmitIntoClient
@@ -125,9 +126,11 @@ extension MutableSpan where Element: BitwiseCopyable {
     byteCount: Int
   ) {
     _precondition(byteCount >= 0, "Count must not be negative")
-    let bytes = UnsafeMutableRawBufferPointer(start: pointer, count: byteCount)
+    let bytes = unsafe UnsafeMutableRawBufferPointer(
+      start: pointer, count: byteCount
+    )
     let ms = MutableSpan(_unsafeBytes: bytes)
-    self = _overrideLifetime(ms, borrowing: pointer)
+    self = unsafe _overrideLifetime(ms, borrowing: pointer)
   }
 
   @_alwaysEmitIntoClient
@@ -135,9 +138,9 @@ extension MutableSpan where Element: BitwiseCopyable {
   public init(
     _unsafeBytes buffer: borrowing Slice<UnsafeMutableRawBufferPointer>
   ) {
-    let bytes = UnsafeMutableRawBufferPointer(rebasing: buffer)
+    let bytes = unsafe UnsafeMutableRawBufferPointer(rebasing: buffer)
     let ms = MutableSpan(_unsafeBytes: bytes)
-    self = _overrideLifetime(ms, borrowing: buffer)
+    self = unsafe _overrideLifetime(ms, borrowing: buffer)
   }
 }
 
@@ -147,10 +150,13 @@ extension Span where Element: ~Copyable {
   @_alwaysEmitIntoClient
   @lifetime(borrow mutableSpan)
   public init(_unsafeMutableSpan mutableSpan: borrowing MutableSpan<Element>) {
-    let pointer = mutableSpan._pointer?.assumingMemoryBound(to: Element.self)
-    let buffer = UnsafeBufferPointer(start: pointer, count: mutableSpan.count)
+    let pointer =
+      unsafe mutableSpan._pointer?.assumingMemoryBound(to: Element.self)
+    let buffer = unsafe UnsafeBufferPointer(
+      start: pointer, count: mutableSpan.count
+    )
     let span = Span(_unsafeElements: buffer)
-    self = _overrideLifetime(span, borrowing: mutableSpan)
+    self = unsafe _overrideLifetime(span, borrowing: mutableSpan)
   }
 }
 
@@ -175,42 +181,20 @@ extension RawSpan {
   ) {
     let pointer = mutableSpan._pointer
     let byteCount = mutableSpan.count &* MemoryLayout<Element>.stride
-    let buffer = UnsafeRawBufferPointer(start: pointer, count: byteCount)
+    let buffer = unsafe UnsafeRawBufferPointer(start: pointer, count: byteCount)
     let rawSpan = RawSpan(_unsafeBytes: buffer)
-    self = _overrideLifetime(rawSpan, borrowing: mutableSpan)
+    self = unsafe _overrideLifetime(rawSpan, borrowing: mutableSpan)
   }
 }
 
-//@available(SwiftStdlib 6.2, *)
-//extension MutableSpan where Element: Equatable {
-//
-//  @_alwaysEmitIntoClient
-//  public func _elementsEqual(_ other: borrowing Self) -> Bool {
-//    _elementsEqual(Span(_unsafeMutableSpan: other))
-//  }
-//
-//  @_alwaysEmitIntoClient
-//  public func _elementsEqual(_ other: Span<Element>) -> Bool {
-//    Span(_unsafeMutableSpan: self)._elementsEqual(other)
-//  }
-//
-//  @_alwaysEmitIntoClient
-//  public func _elementsEqual(_ other: some Collection<Element>) -> Bool {
-//    Span(_unsafeMutableSpan: self)._elementsEqual(other)
-//  }
-//
-//  @_alwaysEmitIntoClient
-//  public func _elementsEqual(_ other: some Sequence<Element>) -> Bool {
-//    Span(_unsafeMutableSpan: self)._elementsEqual(other)
-//  }
-//}
-//
 @available(SwiftStdlib 6.2, *)
 extension MutableSpan where Element: ~Copyable {
 
   @_alwaysEmitIntoClient
   public var _description: String {
-    let addr = String(UInt(bitPattern: _pointer), radix: 16, uppercase: false)
+    let addr = String(
+      unsafe UInt(bitPattern: _pointer), radix: 16, uppercase: false
+    )
     return "(0x\(addr), \(_count))"
   }
 }
@@ -261,11 +245,11 @@ extension MutableSpan where Element: ~Copyable {
   public subscript(_ position: Index) -> Element {
     unsafeAddress {
       _precondition(indices.contains(position), "index out of bounds")
-      return UnsafePointer(_unsafeAddressOfElement(unchecked: position))
+      return unsafe UnsafePointer(_unsafeAddressOfElement(unchecked: position))
     }
     unsafeMutableAddress {
       _precondition(indices.contains(position), "index out of bounds")
-       return _unsafeAddressOfElement(unchecked: position)
+       return unsafe _unsafeAddressOfElement(unchecked: position)
     }
   }
 
@@ -277,13 +261,14 @@ extension MutableSpan where Element: ~Copyable {
   ///     must be greater or equal to zero, and less than `count`.
   ///
   /// - Complexity: O(1)
+  @unsafe
   @_alwaysEmitIntoClient
   public subscript(unchecked position: Index) -> Element {
     unsafeAddress {
-      UnsafePointer(_unsafeAddressOfElement(unchecked: position))
+      unsafe UnsafePointer(_unsafeAddressOfElement(unchecked: position))
     }
     unsafeMutableAddress {
-      _unsafeAddressOfElement(unchecked: position)
+      unsafe _unsafeAddressOfElement(unchecked: position)
     }
   }
 
@@ -293,8 +278,8 @@ extension MutableSpan where Element: ~Copyable {
     unchecked position: Index
   ) -> UnsafeMutablePointer<Element> {
     let elementOffset = position &* MemoryLayout<Element>.stride
-    let address = _start().advanced(by: elementOffset)
-    return address.assumingMemoryBound(to: Element.self)
+    let address = unsafe _start().advanced(by: elementOffset)
+    return unsafe address.assumingMemoryBound(to: Element.self)
   }
 }
 
@@ -305,16 +290,17 @@ extension MutableSpan where Element: ~Copyable {
   public mutating func swapAt(_ i: Index, _ j: Index) {
     _precondition(indices.contains(Index(i)))
     _precondition(indices.contains(Index(j)))
-    swapAt(unchecked: i, unchecked: j)
+    unsafe swapAt(unchecked: i, unchecked: j)
   }
 
+  @unsafe
   @_alwaysEmitIntoClient
   public mutating func swapAt(unchecked i: Index, unchecked j: Index) {
-    let pi = _unsafeAddressOfElement(unchecked: i)
-    let pj = _unsafeAddressOfElement(unchecked: j)
-    let temporary = pi.move()
-    pi.initialize(to: pj.move())
-    pj.initialize(to: consume temporary)
+    let pi = unsafe _unsafeAddressOfElement(unchecked: i)
+    let pj = unsafe _unsafeAddressOfElement(unchecked: j)
+    let temporary = unsafe pi.move()
+    unsafe pi.initialize(to: pj.move())
+    unsafe pj.initialize(to: consume temporary)
   }
 }
 
@@ -331,11 +317,11 @@ extension MutableSpan where Element: BitwiseCopyable {
   public subscript(_ position: Index) -> Element {
     get {
       _precondition(indices.contains(position), "index out of bounds")
-      return self[unchecked: position]
+      return unsafe self[unchecked: position]
     }
     set {
       _precondition(indices.contains(position), "index out of bounds")
-      self[unchecked: position] = newValue
+      unsafe self[unchecked: position] = newValue
     }
   }
 
@@ -347,15 +333,20 @@ extension MutableSpan where Element: BitwiseCopyable {
   ///     must be greater or equal to zero, and less than `count`.
   ///
   /// - Complexity: O(1)
+  @unsafe
   @_alwaysEmitIntoClient
   public subscript(unchecked position: Index) -> Element {
     get {
       let offset = position&*MemoryLayout<Element>.stride
-      return _start().loadUnaligned(fromByteOffset: offset, as: Element.self)
+      return unsafe _start().loadUnaligned(
+        fromByteOffset: offset, as: Element.self
+      )
     }
     set {
       let offset = position&*MemoryLayout<Element>.stride
-      _start().storeBytes(of: newValue, toByteOffset: offset, as: Element.self)
+      unsafe _start().storeBytes(
+        of: newValue, toByteOffset: offset, as: Element.self
+      )
     }
   }
 }
@@ -373,18 +364,20 @@ extension MutableSpan where Element: ~Copyable {
 
   //FIXME: mark closure parameter as non-escaping
   @_alwaysEmitIntoClient
-  public mutating func withUnsafeMutableBufferPointer<E: Error, Result: ~Copyable>(
+  public mutating func withUnsafeMutableBufferPointer<
+    E: Error, Result: ~Copyable
+  >(
     _ body: (UnsafeMutableBufferPointer<Element>) throws(E) -> Result
   ) throws(E) -> Result {
     guard let pointer = _pointer, count > 0 else {
-      return try body(.init(start: nil, count: 0))
+      return try unsafe body(.init(start: nil, count: 0))
     }
     // bind memory by hand to sidestep alignment concerns
     let binding = Builtin.bindMemory(
       pointer._rawValue, count._builtinWordValue, Element.self
     )
     defer { Builtin.rebindMemory(pointer._rawValue, binding) }
-    return try body(.init(start: .init(pointer._rawValue), count: count))
+    return try unsafe body(.init(start: .init(pointer._rawValue), count: count))
   }
 }
 
@@ -404,11 +397,11 @@ extension MutableSpan where Element: BitwiseCopyable {
   public mutating func withUnsafeMutableBytes<E: Error, Result: ~Copyable>(
     _ body: (_ buffer: UnsafeMutableRawBufferPointer) throws(E) -> Result
   ) throws(E) -> Result {
-    let bytes = UnsafeMutableRawBufferPointer(
+    let bytes = unsafe UnsafeMutableRawBufferPointer(
       start: (_count == 0) ? nil : _start(),
       count: _count &* MemoryLayout<Element>.stride
     )
-    return try body(bytes)
+    return try unsafe body(bytes)
   }
 }
 
@@ -418,8 +411,8 @@ extension MutableSpan {
 
   @_alwaysEmitIntoClient
   public mutating func update(repeating repeatedValue: consuming Element) {
-    _start().withMemoryRebound(to: Element.self, capacity: count) {
-      $0.update(repeating: repeatedValue, count: count)
+    unsafe _start().withMemoryRebound(to: Element.self, capacity: count) {
+      unsafe $0.update(repeating: repeatedValue, count: count)
     }
   }
 
@@ -439,7 +432,7 @@ extension MutableSpan {
     var index = 0
     while index < _count {
       guard let element = elements.next() else { break }
-      self[unchecked: index] = element
+      unsafe self[unchecked: index] = element
       index &+= 1
     }
     return index
@@ -474,9 +467,11 @@ extension MutableSpan {
       source.count <= self.count,
       "destination span cannot contain every element from source."
     )
-    _start().withMemoryRebound(to: Element.self, capacity: source.count) { dest in
+    unsafe _start().withMemoryRebound(
+      to: Element.self, capacity: source.count
+    ) { dest in
       source.withUnsafeBufferPointer {
-        dest.update(from: $0.baseAddress!, count: $0.count)
+        unsafe dest.update(from: $0.baseAddress!, count: $0.count)
       }
     }
     return source.count
@@ -517,7 +512,7 @@ extension MutableSpan where Element: ~Copyable {
 //    let source = OutputSpan(_initializing: source, initialized: source.count)
 //    return self.moveUpdate(fromContentsOf: source)
     withUnsafeMutableBufferPointer {
-      $0.moveUpdate(fromContentsOf: source)
+      unsafe $0.moveUpdate(fromContentsOf: source)
     }
   }
 }
@@ -529,7 +524,9 @@ extension MutableSpan {
   public mutating func moveUpdate(
     fromContentsOf source: Slice<UnsafeMutableBufferPointer<Element>>
   ) -> Index {
-    moveUpdate(fromContentsOf: UnsafeMutableBufferPointer(rebasing: source))
+    unsafe moveUpdate(
+      fromContentsOf: UnsafeMutableBufferPointer(rebasing: source)
+    )
   }
 }
 
@@ -544,7 +541,8 @@ extension MutableSpan where Element: BitwiseCopyable {
     // rebind _start manually in order to avoid assumptions about alignment.
     let rp = _start()._rawValue
     let binding = Builtin.bindMemory(rp, count._builtinWordValue, Element.self)
-    UnsafeMutablePointer(rp).update(repeating: repeatedValue, count: count)
+    let rebound = unsafe UnsafeMutablePointer<Element>(rp)
+    unsafe rebound.update(repeating: repeatedValue, count: count)
     Builtin.rebindMemory(rp, binding)
   }
 
@@ -565,7 +563,7 @@ extension MutableSpan where Element: BitwiseCopyable {
     var index = 0
     while index < _count {
       guard let element = elements.next() else { break }
-      self[unchecked: index] = element
+      unsafe self[unchecked: index] = element
       index &+= 1
     }
     return index
@@ -603,8 +601,9 @@ extension MutableSpan where Element: BitwiseCopyable {
       "destination span cannot contain every element from source."
     )
     source.withUnsafeBufferPointer {
-      _start().copyMemory(
-        from: $0.baseAddress!, byteCount: $0.count&*MemoryLayout<Element>.stride
+      unsafe _start().copyMemory(
+        from: $0.baseAddress!,
+        byteCount: $0.count &* MemoryLayout<Element>.stride
       )
     }
     return source.count
@@ -643,7 +642,7 @@ extension MutableSpan where Element: ~Copyable {
       UInt(bitPattern: bounds.upperBound) <= UInt(bitPattern: _count),
       "Index range out of bounds"
     )
-    return _extracting(unchecked: bounds)
+    return unsafe _extracting(unchecked: bounds)
   }
 
   /// Constructs a new span over the items within the supplied range of
@@ -666,9 +665,9 @@ extension MutableSpan where Element: ~Copyable {
   @lifetime(borrow self)
   mutating public func _extracting(unchecked bounds: Range<Index>) -> Self {
     let delta = bounds.lowerBound &* MemoryLayout<Element>.stride
-    let newStart = _pointer?.advanced(by: delta)
+    let newStart = unsafe _pointer?.advanced(by: delta)
     let newSpan = Self(_unchecked: newStart, count: bounds.count)
-    return _overrideLifetime(newSpan, mutating: &self)
+    return unsafe _overrideLifetime(newSpan, mutating: &self)
   }
 
   /// Constructs a new span over the items within the supplied range of
@@ -713,7 +712,7 @@ extension MutableSpan where Element: ~Copyable {
   mutating public func _extracting(
     unchecked bounds: some RangeExpression<Index>
   ) -> Self {
-    _extracting(unchecked: bounds.relative(to: indices))
+    unsafe _extracting(unchecked: bounds.relative(to: indices))
   }
 
   @_alwaysEmitIntoClient
@@ -724,7 +723,7 @@ extension MutableSpan where Element: ~Copyable {
     let range = Range(
       _uncheckedBounds: (bounds.lowerBound, bounds.upperBound&+1)
     )
-    return _extracting(unchecked: range)
+    return unsafe _extracting(unchecked: range)
   }
 
   /// Constructs a new span over all the items of this span.
@@ -740,7 +739,7 @@ extension MutableSpan where Element: ~Copyable {
   @lifetime(borrow self)
   mutating public func _extracting(_: UnboundedRange) -> Self {
     let newSpan = Self(_unchecked: _start(), count: _count)
-    return _overrideLifetime(newSpan, mutating: &self)
+    return unsafe _overrideLifetime(newSpan, mutating: &self)
   }
 }
 
@@ -769,7 +768,7 @@ extension MutableSpan where Element: ~Copyable {
     _precondition(maxLength >= 0, "Can't have a prefix of negative length")
     let newCount = min(maxLength, count)
     let newSpan = Self(_unchecked: _pointer, count: newCount)
-    return _overrideLifetime(newSpan, mutating: &self)
+    return unsafe _overrideLifetime(newSpan, mutating: &self)
   }
 
   /// Returns a span over all but the given number of trailing elements.
@@ -792,7 +791,7 @@ extension MutableSpan where Element: ~Copyable {
     _precondition(k >= 0, "Can't drop a negative number of elements")
     let droppedCount = min(k, count)
     let newSpan = Self(_unchecked: _pointer, count: count &- droppedCount)
-    return _overrideLifetime(newSpan, mutating: &self)
+    return unsafe _overrideLifetime(newSpan, mutating: &self)
   }
 
   /// Returns a span containing the final elements of the span,
@@ -816,9 +815,9 @@ extension MutableSpan where Element: ~Copyable {
     _precondition(maxLength >= 0, "Can't have a suffix of negative length")
     let newCount = min(maxLength, count)
     let offset = (count &- newCount) * MemoryLayout<Element>.stride
-    let newStart = _pointer?.advanced(by: offset)
+    let newStart = unsafe _pointer?.advanced(by: offset)
     let newSpan = Self(_unchecked: newStart, count: newCount)
-    return _overrideLifetime(newSpan, mutating: &self)
+    return unsafe _overrideLifetime(newSpan, mutating: &self)
   }
 
   /// Returns a span over all but the given number of initial elements.
@@ -841,8 +840,8 @@ extension MutableSpan where Element: ~Copyable {
     _precondition(k >= 0, "Can't drop a negative number of elements")
     let droppedCount = min(k, count)
     let offset = droppedCount * MemoryLayout<Element>.stride
-    let newStart = _pointer?.advanced(by: offset)
+    let newStart = unsafe _pointer?.advanced(by: offset)
     let newSpan = Self(_unchecked: newStart, count: count &- droppedCount)
-    return _overrideLifetime(newSpan, mutating: &self)
+    return unsafe _overrideLifetime(newSpan, mutating: &self)
   }
 }