Missing Safety Guarantee in `merge_down` Function Documentation (`smallsort` Module)

Location

The SAFETY comment in question is located in the merge_down function in the smallsort module in shared in sort in the slice module of the core crate.

Summary

While working on the Rust std-lib verification, I identified a missing requirement in the SAFETY comment in the merge_down function in the smallsort module.

Description of the problem

In the following code, the SAFETY comment does not guarantee that dst.sub(1) remains within the same allocated object as dst. This violates one of the safety requirements for pointer.sub.

unsafe fn merge_down<T, F: FnMut(&T, &T) -> bool>(
    mut left_src: *const T,
    mut right_src: *const T,
    mut dst: *mut T,
    is_less: &mut F,
) -> (*const T, *const T, *mut T) {
    // snip

    // SAFETY: The caller must guarantee that `left_src`, `right_src` are valid
    // to read and `dst` is valid to write, while not aliasing.
    unsafe {
        // snip
        dst = dst.sub(1);  // <- issue here
    }

    (left_src, right_src, dst)
}

Proposed fix

Update the SAFETY comment as follows.

    // SAFETY: The caller must guarantee that `left_src`, `right_src` are valid
-   // to read and `dst` is valid to write, while not aliasing.
+   // to read, `dst` is valid to write, while not aliasing, and `dst.sub(1)`
+   // is within the same allocated object as `dst`.

merge_up does not have the same problem

Although the SAFETY comment in the merge_up function may appear to have a similar issue, I believe this is not the case. Since dst must already be valid for a write, dst.add(1) will remain within the bounds of the same allocated object.

Read library/core/src/slice/sort/shared/smallsort.rs at the merge_down function and inspect its existing SAFETY comment, comparing it with the merge_up comment for context. Done means the comment explicitly states the requirement for dst.sub(1) to remain within the same allocated object; no test or test file is named in the issue.