Mark trait U16UtfExt as unsafe as an incorrect implementation could lead to undefined behaviour.

[bmoxb]

There are parts of the code that depend on the implementation of U16UtfExt being correct in order to avoid undefined behaviour. Examples:

encode_unicode/src/decoding_iterators.rs

Line 380 in b764bc1

match first.borrow().utf16_needs_extra_unit() {

encode_unicode/src/decoding_iterators.rs

Line 383 in b764bc1

Some(second) => match second.borrow().utf16_needs_extra_unit() {

These call sites of the trait's methods do not defend against its implementation being incorrect. We therefore think it would be a good idea to mark the trait as unsafe to make it clear that the overall safety of the crate depends on it.