66         // SAFETY: `&'a UnsafeCell<T>` is covariant in `'a` and invariant in `T`
78             // SAFETY: None of the invariants on `ptr` are affected by having  in clone()
87         /// # Safety
99             // SAFETY: The caller has promised to satisfy all safety invariants  in new()
108         /// way that violates the safety invariants of `self`.
119         /// way that violates the safety invariants of `self`.
133         // SAFETY:  in from_ref()
140         // [1] Per https://doc.rust-lang.org/1.85.0/std/primitive.reference.html#safety:  in from_ref()
159         // SAFETY:  in from_mut()
166         // [1] Per https://doc.rust-lang.org/1.85.0/std/primitive.reference.html#safety:  in from_mut()
181     /// # Safety
190         // SAFETY: `self`'s referent lives at a `NonNull` address, and is either  in project()
203         // SAFETY: As described in the preceding safety comment, `projected_raw`,  in project()
227         // SAFETY: By invariant on `PtrInner`, `self.as_non_null()` addresses no  in meta()
235     /// # Safety
248         // SAFETY:  in with_meta()
283     /// # Safety
307         // SAFETY: The caller promises that `l_len.get() <= self.meta()`.  in split_at_unchecked()
312         // SAFETY: The caller promises that `l_len <= self.meta() = slf.meta()`.  in split_at_unchecked()
316         // SAFETY: If `l_len.padding_needed_for() == 0`, then `left` and `right`  in split_at_unchecked()
343         // SAFETY:  in trailing_slice()
357         // SAFETY: By the preceding safety argument, `bytes` is within or one  in trailing_slice()
364         // SAFETY:  in trailing_slice()
372         //    range which is entirely contained in `A`, by previous safety proof  in trailing_slice()
388     /// # Safety
396         // SAFETY: The caller promises that `start <= end <= self.meta()`. By  in slice_unchecked()
408         // SAFETY: The caller promises that `start <= end`, and so this will not  in slice_unchecked()
415         // SAFETY: By invariant, `self`'s referent is either a ZST or lives  in slice_unchecked()
420         // SAFETY:  in slice_unchecked()
447             // SAFETY: If the following conditions are not satisfied  in iter()
480             // SAFETY: `elem` must not be null. `base` is constructed from a  in iter()
488             // SAFETY: The safety invariants of `Ptr::new` (see definition) are  in iter()
508     /// # Safety
518         // SAFETY: `slice` is not null, because it is derived from `start`  in as_slice()
521         // SAFETY: Lemma: In the following safety arguments, note that `slice`  in as_slice()
552     /// # Safety
588                 // SAFETY: Since `validate_cast_and_convert_metadata` returned  in try_cast_into()
597         // SAFETY: `validate_cast_and_convert_metadata` promises to return  in try_cast_into()
614         // SAFETY:  in try_cast_into()
642         // SAFETY: 8 is less than 16  in test_meta()
664                 // SAFETY: `i` is in bounds by construction.  in test_split_at()
666                 // SAFETY: `i` is in bounds by construction.  in test_split_at()
668                 // SAFETY: Points to a valid value by construction.  in test_split_at()
679                 // SAFETY: Points to a valid value by construction.  in test_split_at()
720                 // SAFETY: We assume this to be sound for the sake of this test,  in test_trailing_slice()
721                 // which will fail, here, in miri, if the safety precondition of  in test_trailing_slice()
731             // SAFETY: Points to a valid value by construction.  in test_trailing_slice()