reserve

    #[inline]
    pub fn reserve(&mut self, additional: usize) {
        let len = self.len();
        let rem = self.capacity() - len;

        if additional <= rem {
            // The handle can already store at least `additional` more bytes, so
            // there is no further work needed to be done.
            return;
        }

        // will always succeed
        let _ = self.reserve_inner(additional, true);
    }

    // In separate function to allow the short-circuits in `reserve` and `try_reclaim` to
    // be inline-able. Significantly helps performance. Returns false if it did not succeed.
    fn reserve_inner(&mut self, additional: usize, allocate: bool) -> bool {

bytes = "=1.12.1"

use std::alloc::{GlobalAlloc, Layout, System};
use std::sync::atomic::{AtomicUsize, Ordering::Relaxed};

use bytes::BytesMut;

// 计数分配器：分别数 alloc、realloc、dealloc，真正的分配交给 System
struct Counting;
static ALLOCS: AtomicUsize = AtomicUsize::new(0);
static REALLOCS: AtomicUsize = AtomicUsize::new(0);
static FREES: AtomicUsize = AtomicUsize::new(0);
// 新申请的字节数：alloc 记 size，realloc 记新的 size
static BYTES: AtomicUsize = AtomicUsize::new(0);
// 不小于 1 KiB 的 alloc：在下面的实验里就是「新缓冲」
static BIG_ALLOCS: AtomicUsize = AtomicUsize::new(0);

unsafe impl GlobalAlloc for Counting {
  unsafe fn alloc(&self, layout: Layout) -> *mut u8 {
    ALLOCS.fetch_add(1, Relaxed);
    BYTES.fetch_add(layout.size(), Relaxed);
    if layout.size() >= 1024 {
      BIG_ALLOCS.fetch_add(1, Relaxed);
    }
    unsafe { System.alloc(layout) }
  }
  unsafe fn realloc(&self, ptr: *mut u8, layout: Layout, new_size: usize) -> *mut u8 {
    REALLOCS.fetch_add(1, Relaxed);
    BYTES.fetch_add(new_size, Relaxed);
    unsafe { System.realloc(ptr, layout, new_size) }
  }
  unsafe fn dealloc(&self, ptr: *mut u8, layout: Layout) {
    FREES.fetch_add(1, Relaxed);
    unsafe { System.dealloc(ptr, layout) }
  }
}

#[global_allocator]
static GLOBAL: Counting = Counting;

#[derive(Clone, Copy)]
pub struct Snap {
  pub allocs: usize,
  pub reallocs: usize,
  pub frees: usize,
  pub bytes: usize,
  pub big: usize,
}

pub fn snap() -> Snap {
  Snap {
    allocs: ALLOCS.load(Relaxed),
    reallocs: REALLOCS.load(Relaxed),
    frees: FREES.load(Relaxed),
    bytes: BYTES.load(Relaxed),
    big: BIG_ALLOCS.load(Relaxed),
  }
}

pub fn delta(before: Snap) -> Snap {
  let now = snap();
  Snap {
    allocs: now.allocs - before.allocs,
    reallocs: now.reallocs - before.reallocs,
    frees: now.frees - before.frees,
    bytes: now.bytes - before.bytes,
    big: now.big - before.big,
  }
}

impl std::fmt::Display for Snap {
  fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
    write!(f, "alloc+{} realloc+{} ({}B) free+{}", self.allocs, self.reallocs, self.bytes, self.frees)
  }
}

// 指针落在最初那块分配 [base, base+size) 里就打印偏移，否则是别处
pub fn loc(p: *const u8, base: usize, size: usize) -> String {
  let p = p as usize;
  if base <= p && p < base + size { format!("base+{}", p - base) } else { "elsewhere".to_string() }
}

pub fn state(b: &BytesMut, base: usize, size: usize) -> String {
  format!("ptr={} len={} cap={}", loc(b.as_ptr(), base, size), b.len(), b.capacity())
}

use bytes::{Buf, BufMut, Bytes, BytesMut};

#[path = "../common.rs"]
mod common;
use common::*;

// 一个场景：造好 BytesMut（可能还有别的句柄活着），返回它、活着的句柄、最初那块分配的起点和大小
struct Case {
  buf: BytesMut,
  keep: Option<Bytes>,
  base: usize,
  size: usize,
}

fn filled(cap: usize, n: usize) -> (BytesMut, usize) {
  let mut buf = BytesMut::with_capacity(cap);
  let base = buf.as_ptr() as usize;
  buf.put_bytes(b'x', n);
  (buf, base)
}

fn vec_copy_back() -> Case {
  let (mut buf, base) = filled(16, 8);
  buf.advance(6); // KIND_VEC，off=6，len=2
  Case { buf, keep: None, base, size: 16 }
}

fn vec_off_lt_len() -> Case {
  let (mut buf, base) = filled(16, 12);
  buf.advance(4); // KIND_VEC，off=4，len=8
  Case { buf, keep: None, base, size: 16 }
}

fn vec_full() -> Case {
  let (buf, base) = filled(100, 100); // KIND_VEC，off=0，满
  Case { buf, keep: None, base, size: 100 }
}

fn arc_unique(cap: usize, n: usize, head: usize) -> Case {
  let (mut buf, base) = filled(cap, n);
  drop(buf.split_to(head)); // 提升成 KIND_ARC，再把另一半扔掉：只剩自己
  Case { buf, keep: None, base, size: cap }
}

fn arc_shared(make: fn() -> BytesMut) -> Case {
  let mut buf = make();
  let base = buf.as_ptr() as usize;
  let size = buf.capacity();
  buf.put_bytes(b'x', size);
  let head = buf.split_to(size - 192).freeze(); // head 活着，buf 剩 192 字节
  Case { buf, keep: Some(head), base, size }
}

fn cap8192() -> BytesMut {
  BytesMut::with_capacity(8192)
}

fn cap0_reserve8192() -> BytesMut {
  let mut b = BytesMut::with_capacity(0);
  b.reserve(8192);
  b
}

fn run(name: &str, make: &dyn Fn() -> Case, additional: usize) {
  println!("== {name}, additional={additional}");
  for try_only in [false, true] {
    let Case { mut buf, keep, base, size } = make();
    let before = state(&buf, base, size);
    let s = snap();
    let ok = if try_only { buf.try_reclaim(additional) } else { buf.reserve(additional); true };
    let d = delta(s);
    let op = if try_only { "try_reclaim" } else { "reserve" };
    println!("  {op:<11} -> {ok:<5} {before}  =>  {}  {d}", state(&buf, base, size));
    drop(keep);
  }
}

fn main() {
  run("KIND_VEC 挪回开头", &vec_copy_back, 12);
  run("KIND_VEC off<len", &vec_off_lt_len, 8);
  run("KIND_VEC 满", &vec_full, 1);
  run("KIND_ARC 唯一 挪回", &|| arc_unique(64, 16, 12), 56);
  run("KIND_ARC 唯一 扩大", &|| arc_unique(64, 40, 10), 60);
  run("KIND_ARC 唯一 扩大", &|| arc_unique(64, 40, 10), 100);
  run("KIND_ARC 共享 cap8192", &|| arc_shared(cap8192), 100);
  run("KIND_ARC 共享 cap8192", &|| arc_shared(cap8192), 9000);
  run("KIND_ARC 共享 cap0+reserve", &|| arc_shared(cap0_reserve8192), 100);
}

== KIND_VEC 挪回开头, additional=12
  reserve     -> true  ptr=base+6 len=2 cap=10  =>  ptr=base+0 len=2 cap=16  alloc+0 realloc+0 (0B) free+0
  try_reclaim -> true  ptr=base+6 len=2 cap=10  =>  ptr=base+0 len=2 cap=16  alloc+0 realloc+0 (0B) free+0
== KIND_VEC off<len, additional=8
  reserve     -> true  ptr=base+4 len=8 cap=12  =>  ptr=elsewhere len=8 cap=28  alloc+0 realloc+1 (32B) free+0
  try_reclaim -> false ptr=base+4 len=8 cap=12  =>  ptr=base+4 len=8 cap=12  alloc+0 realloc+0 (0B) free+0
== KIND_VEC 满, additional=1
  reserve     -> true  ptr=base+0 len=100 cap=100  =>  ptr=elsewhere len=100 cap=200  alloc+0 realloc+1 (200B) free+0
  try_reclaim -> false ptr=base+0 len=100 cap=100  =>  ptr=base+0 len=100 cap=100  alloc+0 realloc+0 (0B) free+0
== KIND_ARC 唯一 挪回, additional=56
  reserve     -> true  ptr=base+12 len=4 cap=52  =>  ptr=base+0 len=4 cap=64  alloc+0 realloc+0 (0B) free+0
  try_reclaim -> true  ptr=base+12 len=4 cap=52  =>  ptr=base+0 len=4 cap=64  alloc+0 realloc+0 (0B) free+0
== KIND_ARC 唯一 扩大, additional=60
  reserve     -> true  ptr=base+10 len=30 cap=54  =>  ptr=elsewhere len=30 cap=118  alloc+0 realloc+1 (128B) free+0
  try_reclaim -> false ptr=base+10 len=30 cap=54  =>  ptr=base+10 len=30 cap=54  alloc+0 realloc+0 (0B) free+0
== KIND_ARC 唯一 扩大, additional=100
  reserve     -> true  ptr=base+10 len=30 cap=54  =>  ptr=elsewhere len=30 cap=130  alloc+0 realloc+1 (140B) free+0
  try_reclaim -> false ptr=base+10 len=30 cap=54  =>  ptr=base+10 len=30 cap=54  alloc+0 realloc+0 (0B) free+0
== KIND_ARC 共享 cap8192, additional=100
  reserve     -> true  ptr=base+8000 len=192 cap=192  =>  ptr=elsewhere len=192 cap=8192  alloc+1 realloc+0 (8192B) free+0
  try_reclaim -> false ptr=base+8000 len=192 cap=192  =>  ptr=base+8000 len=192 cap=192  alloc+0 realloc+0 (0B) free+0
== KIND_ARC 共享 cap8192, additional=9000
  reserve     -> true  ptr=base+8000 len=192 cap=192  =>  ptr=elsewhere len=192 cap=9192  alloc+1 realloc+0 (9192B) free+0
  try_reclaim -> false ptr=base+8000 len=192 cap=192  =>  ptr=base+8000 len=192 cap=192  alloc+0 realloc+0 (0B) free+0
== KIND_ARC 共享 cap0+reserve, additional=100
  reserve     -> true  ptr=base+8000 len=192 cap=192  =>  ptr=elsewhere len=192 cap=292  alloc+1 realloc+0 (292B) free+0
  try_reclaim -> false ptr=base+8000 len=192 cap=192  =>  ptr=base+8000 len=192 cap=192  alloc+0 realloc+0 (0B) free+0

        if kind == KIND_VEC {
            // ...
            unsafe {
                let off = self.get_vec_pos();

                // Only reuse space if we can satisfy the requested additional space.
                //
                // Also check if the value of `off` suggests that enough bytes
                // have been read to account for the overhead of shifting all
                // the data (in an amortized analysis).
                // Hence the condition `off >= self.len()`.
                //
                // This condition also already implies that the buffer is going
                // to be (at least) half-empty in the end; so we do not break
                // the (amortized) runtime with future resizes of the underlying
                // `Vec`.
                //
                // [For more details check issue #524, and PR #525.]
                if self.capacity() - self.len() + off >= additional && off >= self.len() {
                    // There's enough space, and it's not too much overhead:
                    // reuse the space!
                    //
                    // Just move the pointer back to the start after copying
                    // data back.
                    let base_ptr = self.ptr.as_ptr().sub(off);
                    // Since `off >= self.len()`, the two regions don't overlap.
                    ptr::copy_nonoverlapping(self.ptr.as_ptr(), base_ptr, self.len);
                    self.ptr = vptr(base_ptr);
                    self.set_vec_pos(0);

                    // Length stays constant, but since we moved backwards we
                    // can gain capacity back.
                    self.cap += off;
                } else {
                    if !allocate {
                        return false;
                    }
                    // Not enough space, or reusing might be too much overhead:
                    // allocate more space!
                    let mut v =
                        ManuallyDrop::new(rebuild_vec(self.ptr.as_ptr(), self.len, self.cap, off));
                    v.reserve(additional);

                    // Update the info
                    self.ptr = vptr(v.as_mut_ptr().add(off));
                    self.cap = v.capacity() - off;
                    debug_assert_eq!(self.len, v.len() - off);
                }

                return true;
            }
        }

        debug_assert_eq!(kind, KIND_ARC);
        let shared: *mut Shared = self.data;

        // Reserving involves abandoning the currently shared buffer and
        // allocating a new vector with the requested capacity.
        //
        // Compute the new capacity
        let mut new_cap = match len.checked_add(additional) {
            Some(new_cap) => new_cap,
            None if !allocate => return false,
            None => panic!("overflow"),
        };

        unsafe {
            // First, try to reclaim the buffer. This is possible if the current
            // handle is the only outstanding handle pointing to the buffer.
            if (*shared).is_unique() {
                // This is the only handle to the buffer. It can be reclaimed.
                // However, before doing the work of copying data, check to make
                // sure that the vector has enough capacity.
                let v = &mut (*shared).vec;

                let v_capacity = v.capacity();
                let ptr = v.as_mut_ptr();

                let offset = self.ptr.as_ptr().offset_from(ptr) as usize;

                let new_cap_plus_offset = match new_cap.checked_add(offset) {
                    Some(new_cap_plus_offset) => new_cap_plus_offset,
                    None if !allocate => return false,
                    None => panic!("overflow"),
                };

                // Compare the condition in the `kind == KIND_VEC` case above
                // for more details.
                if v_capacity >= new_cap_plus_offset {
                    self.cap = new_cap;
                    // no copy is necessary
                } else if v_capacity >= new_cap && offset >= len {
                    // The capacity is sufficient, and copying is not too much
                    // overhead: reclaim the buffer!

                    // `offset >= len` means: no overlap
                    ptr::copy_nonoverlapping(self.ptr.as_ptr(), ptr, len);

                    self.ptr = vptr(ptr);
                    self.cap = v.capacity();
                } else {
                    // ...

                } else {
                    if !allocate {
                        return false;
                    }

                    // new_cap is calculated in terms of `BytesMut`, not the underlying
                    // `Vec`, so it does not take the offset into account.
                    //
                    // Thus we have to manually add it here.
                    new_cap = new_cap_plus_offset;

                    // The vector capacity is not sufficient. The reserve request is
                    // asking for more than the initial buffer capacity. Allocate more
                    // than requested if `new_cap` is not much bigger than the current
                    // capacity.
                    //
                    // There are some situations, using `reserve_exact` that the
                    // buffer capacity could be below `original_capacity`, so do a
                    // check.
                    let double = v.capacity().checked_shl(1).unwrap_or(new_cap);

                    new_cap = cmp::max(double, new_cap);

                    // No space - allocate more
                    //
                    // The length field of `Shared::vec` is not used by the `BytesMut`;
                    // instead we use the `len` field in the `BytesMut` itself. However,
                    // when calling `reserve`, it doesn't guarantee that data stored in
                    // the unused capacity of the vector is copied over to the new
                    // allocation, so we need to ensure that we don't have any data we
                    // care about in the unused capacity before calling `reserve`.
                    debug_assert!(offset + len <= v.capacity());
                    v.set_len(offset + len);
                    v.reserve(new_cap - v.len());

                    // Update the info
                    self.ptr = vptr(v.as_mut_ptr().add(offset));
                    self.cap = v.capacity() - offset;
                }

                return true;
            }
        }

        if !allocate {
            return false;
        }

        let original_capacity_repr = unsafe { (*shared).original_capacity_repr };
        let original_capacity = original_capacity_from_repr(original_capacity_repr);

        new_cap = cmp::max(new_cap, original_capacity);

        // Create a new vector to store the data
        let mut v = ManuallyDrop::new(Vec::with_capacity(new_cap));

        // Copy the bytes
        v.extend_from_slice(self.as_ref());

        // Release the shared handle. This must be done *after* the bytes are
        // copied.
        unsafe { release_shared(shared) };

        // Update self
        let data = (original_capacity_repr << ORIGINAL_CAPACITY_OFFSET) | KIND_VEC;
        self.data = invalid_ptr(data);
        self.ptr = vptr(v.as_mut_ptr());
        self.cap = v.capacity();
        debug_assert_eq!(self.len, v.len());
        true
    }

        let original_capacity_repr = original_capacity_to_repr(cap);
        let data = (original_capacity_repr << ORIGINAL_CAPACITY_OFFSET) | KIND_VEC;

fn original_capacity_to_repr(cap: usize) -> usize {
    let width = PTR_WIDTH - ((cap >> MIN_ORIGINAL_CAPACITY_WIDTH).leading_zeros() as usize);
    cmp::min(
        width,
        MAX_ORIGINAL_CAPACITY_WIDTH - MIN_ORIGINAL_CAPACITY_WIDTH,
    )
}

fn original_capacity_from_repr(repr: usize) -> usize {
    if repr == 0 {
        return 0;
    }

    1 << (repr + (MIN_ORIGINAL_CAPACITY_WIDTH - 1))
}

use bytes::{BufMut, BytesMut};

#[path = "../common.rs"]
mod common;
use common::*;

// 用 with_capacity(c) 建缓冲（c=0 时再 reserve(8192)），写满，
// 切走前面一段并让它活着，剩 10 字节时 reserve(1)：走共享分支，新容量 = max(11, 原始容量)
fn after_shared_reserve(c: usize) -> (usize, Snap) {
  let mut buf = BytesMut::with_capacity(c);
  if c == 0 {
    buf.reserve(8192);
  }
  let cap = buf.capacity();
  buf.put_bytes(b'x', cap);
  let head = buf.split_to(cap - 10).freeze();
  let s = snap();
  buf.reserve(1);
  let d = delta(s);
  drop(head);
  (buf.capacity(), d)
}

fn main() {
  for c in [0usize, 1000, 1023, 1024, 5000, 8192, 65536, 1 << 20] {
    let (cap, d) = after_shared_reserve(c);
    println!("with_capacity({c:>7}) -> reserve(1) cap={cap:<6} {d}");
  }
}

with_capacity(      0) -> reserve(1) cap=11     alloc+1 realloc+0 (11B) free+0
with_capacity(   1000) -> reserve(1) cap=11     alloc+1 realloc+0 (11B) free+0
with_capacity(   1023) -> reserve(1) cap=11     alloc+1 realloc+0 (11B) free+0
with_capacity(   1024) -> reserve(1) cap=1024   alloc+1 realloc+0 (1024B) free+0
with_capacity(   5000) -> reserve(1) cap=4096   alloc+1 realloc+0 (4096B) free+0
with_capacity(   8192) -> reserve(1) cap=8192   alloc+1 realloc+0 (8192B) free+0
with_capacity(  65536) -> reserve(1) cap=65536  alloc+1 realloc+0 (65536B) free+0
with_capacity(1048576) -> reserve(1) cap=65536  alloc+1 realloc+0 (65536B) free+0

use std::collections::VecDeque;

use bytes::{BufMut, Bytes, BytesMut};

#[path = "../common.rs"]
mod common;
use common::*;

const ITERS: usize = 10_000;
const READ: usize = 4096;
const FRAME: usize = 1000;

// 每 every 帧里有一帧被上层留 hold 轮，其余帧切出来马上用完
fn run(label: &str, mut buf: BytesMut, reserve: usize, every: usize, hold: usize) {
  let chunk = [b'x'; READ];
  let mut alive: VecDeque<(usize, Bytes)> = VecDeque::with_capacity(ITERS);
  let mut n = 0;
  let s = snap();
  for i in 0..ITERS {
    while alive.front().is_some_and(|(until, _)| *until <= i) {
      alive.pop_front();
    }
    buf.reserve(reserve);
    buf.put_slice(&chunk);
    while buf.len() >= FRAME {
      let frame = buf.split_to(FRAME).freeze();
      if n % every == 0 {
        alive.push_back((i + hold, frame));
      }
      n += 1;
    }
  }
  let d = delta(s);
  println!(
    "{label:<34} reserve({reserve}) 1/{every} held {hold}: allocs={:<5} buffers={:<5} bytes={:<9} reallocs={}",
    d.allocs, d.big, d.bytes, d.reallocs
  );
}

fn cap8192() -> BytesMut {
  BytesMut::with_capacity(8192)
}

fn cap0_reserve8192() -> BytesMut {
  let mut b = BytesMut::with_capacity(0);
  b.reserve(8192);
  b
}

fn main() {
  for reserve in [READ, 8192] {
    for (every, hold) in [(1, 2), (16, 32), (64, 100), (256, 1000)] {
      run("with_capacity(8192)", cap8192(), reserve, every, hold);
      run("with_capacity(0) + reserve(8192)", cap0_reserve8192(), reserve, every, hold);
    }
  }
}

with_capacity(8192)                reserve(4096) 1/1 held 2: allocs=19839 buffers=9919  bytes=81653248  reallocs=0
with_capacity(0) + reserve(8192)   reserve(4096) 1/1 held 2: allocs=19997 buffers=9998  bytes=46311672  reallocs=0
with_capacity(8192)                reserve(4096) 1/16 held 32: allocs=5121  buffers=2560  bytes=21073960  reallocs=0
with_capacity(0) + reserve(8192)   reserve(4096) 1/16 held 32: allocs=5121  buffers=2560  bytes=32865456  reallocs=2318
with_capacity(8192)                reserve(4096) 1/64 held 100: allocs=1281  buffers=640   bytes=5268520   reallocs=0
with_capacity(0) + reserve(8192)   reserve(4096) 1/64 held 100: allocs=1281  buffers=640   bytes=8543048   reallocs=640
with_capacity(8192)                reserve(4096) 1/256 held 1000: allocs=321   buffers=160   bytes=1317160   reallocs=0
with_capacity(0) + reserve(8192)   reserve(4096) 1/256 held 1000: allocs=321   buffers=160   bytes=2030120   reallocs=160
with_capacity(8192)                reserve(8192) 1/1 held 2: allocs=19999 buffers=9999  bytes=87271808  reallocs=0
with_capacity(0) + reserve(8192)   reserve(8192) 1/1 held 2: allocs=19999 buffers=9999  bytes=87271808  reallocs=0
with_capacity(8192)                reserve(8192) 1/16 held 32: allocs=5121  buffers=2560  bytes=58328360  reallocs=2080
with_capacity(0) + reserve(8192)   reserve(8192) 1/16 held 32: allocs=5121  buffers=2560  bytes=58328360  reallocs=2080
with_capacity(8192)                reserve(8192) 1/64 held 100: allocs=1281  buffers=640   bytes=16453160  reallocs=640
with_capacity(0) + reserve(8192)   reserve(8192) 1/64 held 100: allocs=1281  buffers=640   bytes=16453160  reallocs=640
with_capacity(8192)                reserve(8192) 1/256 held 1000: allocs=321   buffers=160   bytes=3973160   reallocs=160
with_capacity(0) + reserve(8192)   reserve(8192) 1/256 held 1000: allocs=321   buffers=160   bytes=3973160   reallocs=160

    /// This method does not preserve data stored in the unused capacity.

use bytes::{Buf, BufMut, BytesMut};

#[path = "../common.rs"]
mod common;
use common::*;

// 读出备用容量里 [from, to) 这几个字节。调用方保证它们以前写过（已初始化）
fn spare(buf: &mut BytesMut, from: usize, to: usize) -> String {
  let spare = buf.spare_capacity_mut();
  let bytes: Vec<u8> = spare[from..to].iter().map(|b| unsafe { b.assume_init() }).collect();
  String::from_utf8(bytes).unwrap()
}

fn main() {
  // 1. 往备用容量里写了东西但还没 set_len，然后 reserve
  let mut buf = BytesMut::with_capacity(16);
  let base = buf.as_ptr() as usize;
  buf.put_slice(b"abcdefgh");
  buf.advance(6); // 读走 6 个字节：KIND_VEC，off=6，剩 "gh"
  buf.spare_capacity_mut()[..3].iter_mut().zip(b"XYZ").for_each(|(d, s)| { d.write(*s); });
  let sp = spare(&mut buf, 0, 3);
  println!("before: {} data={:?} spare[0..3]={sp:?}", state(&buf, base, 16), buf);
  buf.reserve(12);
  let (sp, sp6) = (spare(&mut buf, 0, 3), spare(&mut buf, 6, 9));
  println!("after:  {} data={:?} spare[0..3]={sp:?} spare[6..9]={sp6:?}", state(&buf, base, 16), buf);

  // 2. extend_from_within：先 reserve（可能把数据挪走），再按新的 as_ptr 取源
  let mut buf = BytesMut::with_capacity(16);
  let base = buf.as_ptr() as usize;
  buf.put_slice(b"abcdefghijklmnop");
  buf.advance(12); // 剩 "mnop"，off=12，cap=4
  println!("before: {} data={:?}", state(&buf, base, 16), buf);
  let s = snap();
  buf.extend_from_within(..);
  let d = delta(s);
  println!("after:  {} data={:?}  {d}", state(&buf, base, 16), buf);
}

before: ptr=base+6 len=2 cap=10 data=b"gh" spare[0..3]="XYZ"
after:  ptr=base+0 len=2 cap=16 data=b"gh" spare[0..3]="cde" spare[6..9]="XYZ"
before: ptr=base+12 len=4 cap=4 data=b"mnop"
after:  ptr=base+0 len=8 cap=16 data=b"mnopmnop"  alloc+0 realloc+0 (0B) free+0

                 let offset = self.ptr.as_ptr().offset_from(ptr) as usize;
 
+                let new_cap_plus_offset = match new_cap.checked_add(offset) {
+                    Some(new_cap_plus_offset) => new_cap_plus_offset,
+                    None if !allocate => return false,
+                    None => panic!("overflow"),
+                };
+
                 // Compare the condition in the `kind == KIND_VEC` case above
                 // for more details.
-                if v_capacity >= new_cap + offset {
+                if v_capacity >= new_cap_plus_offset {
                     self.cap = new_cap;
                     // no copy is necessary
                 } else if v_capacity >= new_cap && offset >= len {
@@ -713,14 +719,12 @@ impl BytesMut {
                     if !allocate {
                         return false;
                     }
-                    // calculate offset
-                    let off = (self.ptr.as_ptr() as usize) - (v.as_ptr() as usize);
 
                     // new_cap is calculated in terms of `BytesMut`, not the underlying
                     // `Vec`, so it does not take the offset into account.
                     //
                     // Thus we have to manually add it here.
-                    new_cap = new_cap.checked_add(off).expect("overflow");
+                    new_cap = new_cap_plus_offset;

use bytes::BytesMut;

// 同一个复现，只做到 reserve 为止：不写入，只看它报告的容量
fn main() {
  let r = std::panic::catch_unwind(|| {
    let mut a = BytesMut::from(&b"hello world"[..]);
    let mut b = a.split_off(5);
    drop(a);
    b.reserve(usize::MAX - 6);
    (b.len(), b.capacity())
  });
  match r {
    Ok((len, cap)) => println!("no panic, len={len} cap={cap}"),
    Err(e) => println!("panicked: {:?}", e.downcast_ref::<&str>()),
  }
  println!("debug_assertions: {}", cfg!(debug_assertions));
}

no panic, len=6 cap=18446744073709551615
debug_assertions: false

thread 'main' (1737978) panicked at ~/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/bytes-1.11.0/src/bytes_mut.rs:700:34:
attempt to add with overflow
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
panicked: Some("attempt to add with overflow")
debug_assertions: true

use bytes::{BufMut, BytesMut};

// GHSA-434x-w66g-qw3r 里的复现，放进 catch_unwind 看 1.12.1 的行为
fn main() {
  let r = std::panic::catch_unwind(|| {
    let mut a = BytesMut::from(&b"hello world"[..]);
    let mut b = a.split_off(5);
    drop(a);
    b.reserve(usize::MAX - 6);
    b.put_u8(b'h');
    b.capacity()
  });
  match r {
    Ok(cap) => println!("no panic, cap={cap}"),
    Err(e) => println!("panicked: {:?}", e.downcast_ref::<&str>()),
  }
  println!("debug_assertions: {}", cfg!(debug_assertions));
}

thread 'main' (1744703) panicked at ~/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/bytes-1.12.1/src/bytes_mut.rs:720:29:
overflow
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
panicked: Some("overflow")
debug_assertions: false

    #[inline]
    #[must_use = "consider BytesMut::reserve if you need an infallible reservation"]
    pub fn try_reclaim(&mut self, additional: usize) -> bool {
        let len = self.len();
        let rem = self.capacity() - len;

        if additional <= rem {
            // The handle can already store at least `additional` more bytes, so
            // there is no further work needed to be done.
            return true;
        }

        self.reserve_inner(additional, false)
    }

    pub fn extend_from_within(&mut self, range: impl core::ops::RangeBounds<usize>) {
        let (begin, end) = crate::range(range, self.len());

        let cnt = end - begin;
        self.reserve(cnt);

        // SAFETY: range is already checked
        let src = unsafe { self.as_ptr().add(begin) };
        let dst = self.spare_capacity_mut();

        // SAFETY: range doesn't overlap with spare capacity
        unsafe { ptr::copy_nonoverlapping(src, dst.as_mut_ptr().cast(), cnt) }

        // SAFETY: capacity is already reserved and filled with data
        unsafe { self.advance_mut(cnt) }
    }

reserve(32) -> ptr=base+0 len=8 cap=40  alloc+0 realloc+0 (0B) free+0
reserve(56) -> ptr=base+0 len=8 cap=64  alloc+0 realloc+0 (0B) free+0