Remove all unsafe usage

CHANGELOG.md

@@ -7,6 +7,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
 ### Added
 
 ### Changed
+ - All usages of `unsafe` are removed, causing serialization to be slightly slower, but safe.
 
 ### Removed
 

src/lib.rs

@@ -194,6 +194,7 @@
     unused_results,
     variant_size_differences
 )]
+#![forbid(unsafe_code)]
 // Enable feature(test) is enabled so that we can have benchmarks of private code
 #![cfg_attr(all(test, feature = "bench_private"), feature(test))]
 
@@ -605,7 +606,7 @@
         let old_max_lowest_equiv = self.lowest_equivalent(self.max());
 
         // If total_count is at the max value, it may have saturated, so we must restat
         let mut needs_restat = self.total_count == u64::max_value();
 
         for i in 0..subtrahend.distinct_values() {
             let other_count = subtrahend
@@ -738,7 +739,7 @@
         if low < 1 {
             return Err(CreationError::LowIsZero);
         }
         if low > u64::max_value() / 2 {
             // avoid overflow in 2 * low
             return Err(CreationError::LowExceedsMax);
         }
@@ -1042,7 +1043,7 @@
     /// // etc...
     /// ```
     pub fn iter_quantiles(
         &self,
         ticks_per_half_distance: u32,
     ) -> HistogramIterator<T, iterators::quantile::Iter<T>> {
         // TODO upper bound on ticks per half distance? 2^31 ticks is not useful
@@ -1104,7 +1105,7 @@
     /// );
     /// assert_eq!(perc.next(), None);
     /// ```
     pub fn iter_linear(&self, step: u64) -> HistogramIterator<T, iterators::linear::Iter<T>> {
         iterators::linear::Iter::new(self, step)
     }
 
@@ -1142,7 +1143,7 @@
     /// );
     /// assert_eq!(perc.next(), None);
     /// ```
     pub fn iter_log(&self, start: u64, exp: f64) -> HistogramIterator<T, iterators::log::Iter<T>> {
         iterators::log::Iter::new(self, start, exp)
     }
 
@@ -1180,7 +1181,7 @@
     /// );
     /// assert_eq!(perc.next(), None);
     /// ```
     pub fn iter_recorded(&self) -> HistogramIterator<T, iterators::recorded::Iter> {
         iterators::recorded::Iter::new(self)
     }
 
@@ -1239,7 +1240,7 @@
     /// );
     /// assert_eq!(perc.next(), Some(IterationValue::new(10, 1.0, 1.0, 0, 0)));
     /// ```
     pub fn iter_all(&self) -> HistogramIterator<T, iterators::all::Iter> {
         iterators::all::Iter::new(self)
     }
 
@@ -1473,8 +1474,8 @@
     ///
     /// Note that the return value is capped at `u64::max_value()`.
     pub fn highest_equivalent(&self, value: u64) -> u64 {
         if value == u64::max_value() {
             u64::max_value()
         } else {
             self.next_non_equivalent(value) - 1
         }
@@ -1615,7 +1616,7 @@
         // always have at least 1 bucket
         let mut buckets_needed = 1;
         while smallest_untrackable_value <= value {
             if smallest_untrackable_value > u64::max_value() / 2 {
                 // next shift will overflow, meaning that bucket could represent values up to ones
                 // greater than i64::max_value, so it's the last bucket
                 return buckets_needed + 1;
@@ -1705,7 +1706,7 @@
 
     fn reset_min(&mut self, min: u64) {
         let internal_value = min & !self.unit_magnitude_mask; // Min unit-equivalent value
         self.min_non_zero_value = if min == u64::max_value() {
             min
         } else {
             internal_value

src/serialization/v2_serializer.rs

@@ -93,11 +93,8 @@ impl Serializer for V2Serializer {
 
         debug_assert_eq!(V2_HEADER_SIZE, self.buf.len());
 
-        unsafe {
-            // want to treat the rest of the vec as a slice, and we've already reserved this
-            // space, so this way we don't have to resize() on a lot of dummy bytes.
-            self.buf.set_len(max_size);
-        }
+        // want to treat the rest of the vec as a slice
+        self.buf.resize(max_size, 0);
 
         let counts_len = encode_counts(h, &mut self.buf[V2_HEADER_SIZE..])?;
         // addition should be safe as max_size is already a usize
@@ -142,11 +139,11 @@ pub fn encode_counts<T: Counter>(
     let mut index = 0;
     let mut bytes_written = 0;
 
-    assert!(index_limit <= h.counts.len());
+    assert!(index_limit < h.counts.len());
 
     while index <= index_limit {
         // index is inside h.counts because of the assert above
-        let count = unsafe { *(h.counts.get_unchecked(index)) };
+        let count = h.counts[index];
         index += 1;
 
         // Non-negative values are counts for the respective value, negative values are skipping
@@ -157,9 +154,7 @@ pub fn encode_counts<T: Counter>(
             zero_count = 1;
 
             // index is inside h.counts because of the assert above
-            while (index <= index_limit)
-                && (unsafe { *(h.counts.get_unchecked(index)) } == T::zero())
-            {
+            while (index <= index_limit) && h.counts[index] == T::zero() {
                 zero_count += 1;
                 index += 1;
             }