@@ -124,17 +124,19 @@ impl<'a, T> RawVec<'a, T> {
124124impl < ' a , T > RawVec < ' a , T > {
125125 /// Reconstitutes a RawVec from a pointer, capacity, and allocator.
126126 ///
127- /// # Undefined Behavior
127+ /// # SAFETY
128+ ///
129+ /// * `ptr` must be allocated (via the given allocator `a`), and with the given capacity.
130+ /// * `cap` cannot exceed `u32::MAX`, as capacity is stored as `u32`.
131+ /// * The capacity in bytes (`cap * size_of::<T>()`) cannot exceed `isize::MAX`
132+ /// (only a concern on 32-bit systems).
133+ /// * `len` must be `<= cap`. `len` is also therefore subject to same restrictions as `cap`.
128134 ///
129- /// The ptr must be allocated (via the given allocator `a`), and with the given capacity. The
130- /// capacity cannot exceed `isize::MAX` (only a concern on 32-bit systems) and also
131- /// cannot exceed `u32::MAX` as capacity is stored as `u32`.
132- /// If the ptr and capacity come from a RawVec created via `a`, then this is guaranteed.
135+ /// If all these value came from a `Vec` created in allocator `a`, then these requirements
136+ /// are guaranteed to be fulfilled.
133137 #[ expect( clippy:: cast_possible_truncation) ]
134138 pub unsafe fn from_raw_parts_in ( ptr : * mut T , a : & ' a Bump , cap : usize , len : usize ) -> Self {
135- alloc_guard ( cap) . unwrap_or_else ( |_| capacity_overflow ( ) ) ;
136- // `cap as u32` and `len as u32` are safe because `alloc_guard` ensures that
137- // `cap` and `len` cannot exceed `u32::MAX`.
139+ // Caller guarantees `cap` and `len` are `<= u32::MAX`, so `as u32` cannot truncate them
138140 RawVec { ptr : NonNull :: new_unchecked ( ptr) , a, cap : cap as u32 , len : len as u32 }
139141 }
140142}
0 commit comments