> The issue is that the ctor checks for a property (all chars are under 256) then assumes that holds indefinitely. You could say that this is a classical TOCTO

> The issue is that the ctor checks for a property (all chars are under 256) then assumes that holds indefinitely. You could say that this is a classical TOCTOU bug as the ctor assumes that a mutable argument does not mutate. The core question[s] here are whether this assumption is and should be in the contract. Protection against these kinds of bugs is only possible with deep copies of mutable arguments or COW semantics. So you either implement callee defensively and slow down general case (remember, this is stdlib), or you leave concurrency control to the caller. Probably every sane general purpose language does the latter.