codereview @tgross35 & @ChrisDenton on pull request #135265

Author: pascaldekloe

library/core/src/fmt/num.rs

@@ -1,6 +1,6 @@
 //! Integer and floating-point number formatting
 
-use crate::mem::MaybeUninit;
+use crate::mem::{MaybeUninit, size_of};
 use crate::num::fmt as numfmt;
 use crate::ops::{Div, Rem, Sub};
 use crate::{fmt, ptr, slice, str};
@@ -244,15 +244,17 @@ macro_rules! impl_Display {
 
                 // Format per four digits from the lookup table.
                 // Four digits need a 16-bit $unsigned or wider.
-                while const { Self::MAX as u128 > 999 } && remain > 999.try_into().unwrap() {
-                    // SAFETY: All of the decimals fit in buf due to MAX_DEC_N.
+                while size_of::<Self>() > 1 && remain > 999.try_into().unwrap() {
+                    // SAFETY: All of the decimals fit in buf due to MAX_DEC_N
+                    // and the while condition ensures at least 4 more decimals.
                     unsafe { core::hint::assert_unchecked(offset >= 4) }
                     // SAFETY: The offset counts down from its initial buf.len()
-                    // without underflow due to the previous assertion.
+                    // without underflow due to the previous precondition.
                     unsafe { core::hint::assert_unchecked(offset <= buf.len()) }
                     offset -= 4;
 
-                    let scale: Self = 100_00.try_into().unwrap();
+                    // pull two pairs
+                    let scale: Self = 1_00_00.try_into().unwrap();
                     let quad = remain % scale;
                     remain /= scale;
                     let pair1 = (quad / 100) as usize;
@@ -265,10 +267,11 @@ macro_rules! impl_Display {
 
                 // Format per two digits from the lookup table.
                 if remain > 9 {
-                    // SAFETY: All of the decimals fit in buf due to MAX_DEC_N.
+                    // SAFETY: All of the decimals fit in buf due to MAX_DEC_N
+                    // and the while condition ensures at least 2 more decimals.
                     unsafe { core::hint::assert_unchecked(offset >= 2) }
                     // SAFETY: The offset counts down from its initial buf.len()
-                    // without underflow due to the previous assertion.
+                    // without underflow due to the previous precondition.
                     unsafe { core::hint::assert_unchecked(offset <= buf.len()) }
                     offset -= 2;
 
@@ -280,10 +283,11 @@ macro_rules! impl_Display {
 
                 // Format the last remaining digit, if any.
                 if remain != 0 || self == 0 {
-                    // SAFETY: All of the decimals fit in buf due to MAX_DEC_N.
+                    // SAFETY: All of the decimals fit in buf due to MAX_DEC_N
+                    // and the if condition ensures (at least) 1 more decimals.
                     unsafe { core::hint::assert_unchecked(offset >= 1) }
                     // SAFETY: The offset counts down from its initial buf.len()
-                    // without underflow due to the previous assertion.
+                    // without underflow due to the previous precondition.
                     unsafe { core::hint::assert_unchecked(offset <= buf.len()) }
                     offset -= 1;
 
@@ -294,10 +298,10 @@ macro_rules! impl_Display {
                     // not used: remain = 0;
                 }
 
-                // SAFETY: All buf content since offset is set with bytes form
-                // the lookup table, which consists of valid ASCII exclusively.
+                // SAFETY: All buf content since offset is set.
+                let written = unsafe { buf.get_unchecked(offset..) };
+                // SAFETY: Writes use ASCII from the lookup table exclusively.
                 f.pad_integral(is_nonnegative, "", unsafe {
-                    let written = buf.get_unchecked(offset..);
                     str::from_utf8_unchecked(slice::from_raw_parts(
                           MaybeUninit::slice_as_ptr(written),
                           written.len(),