add comments about safety

src/libstd/ffi/os_str.rs

@@ -525,11 +525,15 @@ pub fn new<S: AsRef<OsStr> + ?Sized>(s: &S) -> &OsStr {
 
     #[inline]
     fn from_inner(inner: &Slice) -> &OsStr {
+        // Safety: OsStr is just a wrapper of Slice,
+        // therefore converting &Slice to &OsStr is safe.
         unsafe { &*(inner as *const Slice as *const OsStr) }
     }
 
     #[inline]
     fn from_inner_mut(inner: &mut Slice) -> &mut OsStr {
+        // Safety: OsStr is just a wrapper of Slice,
+        // therefore converting &mut Slice to &mut OsStr is safe.
         unsafe { &mut *(inner as *mut Slice as *mut OsStr) }
     }
 

src/libstd/sys/windows/os_str.rs

@@ -77,11 +77,17 @@ pub fn from_string(s: String) -> Buf {
     }
 
     pub fn as_slice(&self) -> &Slice {
+        // Safety: Slice is just a wrapper for Wtf8,
+        // and as_slice returns &Wtf8. Therefore,
+        // transmute &Wtf8 to &Slice is safe.
         unsafe { mem::transmute(self.inner.as_slice()) }
     }
 
     #[inline]
     pub fn as_mut_slice(&mut self) -> &mut Slice {
+        // Safety: Slice is just a wrapper for Wtf8,
+        // and as_slice returns &Wtf8. Therefore,
+        // transmute &mut Wtf8 to &mut Slice is safe.
         unsafe { mem::transmute(self.inner.as_mut_slice()) }
     }
 

src/libstd/sys_common/os_str_bytes.rs

@@ -106,11 +106,17 @@ pub fn shrink_to(&mut self, min_capacity: usize) {
 
     #[inline]
     pub fn as_slice(&self) -> &Slice {
+        // Safety: Slice just wraps [u8],
+        // and &*self.inner is &[u8], therefore
+        // transmuting &[u8] to &Slice is safe.
         unsafe { mem::transmute(&*self.inner) }
     }
 
     #[inline]
     pub fn as_mut_slice(&mut self) -> &mut Slice {
+        // Safety: Slice just wraps [u8],
+        // and &mut *self.inner is &mut [u8], therefore
+        // transmuting &mut [u8] to &mut Slice is safe.
         unsafe { mem::transmute(&mut *self.inner) }
     }