refactor: Reduce unsafe blocks

sailfish-compiler/src/parser.rs

@@ -334,7 +334,7 @@ fn find_block_comment_end(haystack: &str) -> Option<usize> {
     let mut depth = 1;
 
     while let Some(p) = memchr2(b'*', b'/', remain.as_bytes()) {
-        let c = unsafe { *remain.as_bytes().get_unchecked(p) };
+        let c = remain.as_bytes()[p];
         let next = remain.as_bytes().get(p + 1);
 
         match (c, next) {
@@ -344,14 +344,14 @@ fn find_block_comment_end(haystack: &str) -> Option<usize> {
                     return Some(offset);
                 }
                 depth -= 1;
-                remain = unsafe { remain.get_unchecked(p + 2..) };
+                remain = &remain[p + 2..];
             }
             (b'/', Some(b'*')) => {
                 depth += 1;
-                remain = unsafe { remain.get_unchecked(p + 2..) };
+                remain = &remain[p + 2..];
             }
             _ => {
-                remain = unsafe { remain.get_unchecked(p + 1..) };
+                remain = &remain[p + 1..];
             }
         }
     }
@@ -364,16 +364,14 @@ fn find_string_end(haystack: &str) -> Option<usize> {
     let mut bytes = &haystack.as_bytes()[1..];
 
     while let Some(p) = memchr2(b'"', b'\\', bytes) {
-        unsafe {
-            if *bytes.get_unchecked(p) == b'\"' {
-                // string terminator found
-                return Some(haystack.len() - (bytes.len() - p) + 1);
-            } else if p + 2 < bytes.len() {
-                // skip escape
-                bytes = bytes.get_unchecked(p + 2..);
-            } else {
-                break;
-            }
+        if bytes[p] == b'\"' {
+            // string terminator found
+            return Some(haystack.len() - (bytes.len() - p) + 1);
+        } else if p + 2 < bytes.len() {
+            // skip escape
+            bytes = &bytes[p + 2..];
+        } else {
+            break;
         }
     }
 

sailfish-compiler/src/util.rs

@@ -64,7 +64,8 @@ pub fn rustfmt_block(source: &str) -> io::Result<String> {
     let output = child.wait_with_output()?;
 
     if output.status.success() {
-        let mut s = unsafe { String::from_utf8_unchecked(output.stdout) };
+        let mut s =
+            String::from_utf8(output.stdout).expect("rustfmt output is non-UTF-8!");
         let brace_offset = s.find('{').unwrap();
         s.replace_range(..brace_offset, "");
         Ok(s)

sailfish/src/runtime/buffer.rs

@@ -68,6 +68,11 @@ impl Buffer {
         self.len = new_len;
     }
 
+    pub(crate) fn truncate(&mut self, new_len: usize) {
+        assert!(new_len <= self.len);
+        self.len = new_len;
+    }
+
     /// Increase the length of buffer by `additional` bytes
     ///
     /// # Safety

sailfish/src/runtime/filter.rs

@@ -47,7 +47,7 @@ impl<'a, T: Render> Render for Upper<'a, T> {
         self.0.render(b)?;
 
         let s = b.as_str()[old_len..].to_uppercase();
-        unsafe { b._set_len(old_len) };
+        b.truncate(old_len);
         b.push_str(&*s);
         Ok(())
     }
@@ -67,7 +67,7 @@ impl<'a, T: Render> Render for Lower<'a, T> {
         self.0.render(b)?;
 
         let s = b.as_str()[old_len..].to_lowercase();
-        unsafe { b._set_len(old_len) };
+        b.truncate(old_len);
         b.push_str(&*s);
         Ok(())
     }
@@ -77,7 +77,7 @@ impl<'a, T: Render> Render for Lower<'a, T> {
         self.0.render_escaped(b)?;
 
         let s = b.as_str()[old_len..].to_lowercase();
-        unsafe { b._set_len(old_len) };
+        b.truncate(old_len);
         b.push_str(&*s);
         Ok(())
     }