Safe Rust has 0 UB, but the person you're responding to qualified that with: > that must be enforced at non-zero runtime cost. Some of Rust's behavior that pe

Safe Rust has 0 UB, but the person you're responding to qualified that with: > that must be enforced at non-zero runtime cost. Some of Rust's behavior that permits this is not zero runtime costs. Bounds-checking, for example, has a non-zero cost: the bounds check! Now, I greatly prefer Rust's approach: I'd rather have the marginal CPU cost: I value my time far higher, at least until the profiler speaks up, and in many cases the optimizer is pretty good at eliminating checks that I myself might look at and go "but I know $condition is true here!" — so too does the optimizer. (And these days, Godbolt makes testing that very simple.) And in the worse case, there's unsafe{}, and it is at least explicitly labelled as such to the next reader. > things are still a bit messy with integer overflow Integer overflow is well-defined behavior, but the behavior depends on compile settings. (https://doc.rust-lang.org/book/ch03-02-data-types.html#integer-overflow https://doc.rust-lang.org/book/ch03-02-data-types.html#integ...) I do hope that someday, the debug behavior becomes the behavior: IME most overflows are errors / the author did not intend for it to occur. And the "panic on overflow" behavior is removable by simply using one of the functions that specifies an overflow behavior, in which case then the author's intention is just explicitly stated.)