I don't find testing as a solution very convincing, it's just the same problem all over again: more code which may ran yet fail to live up to expectations. It's

I don't find testing as a solution very convincing, it's just the same problem all over again: more code which may ran yet fail to live up to expectations. It's a tool, but static checks are better for things that can be statically checked. But I think you hinted at being in line with that, and yes you should still write tests. But it's not right to think of Rust as a safe C++ in the small, particularly because of the ban on shared mutable state. IIRC, Rust is partly a product of the difficulty C++ had in this area. I don't think they're rewriting Gecko. If the transitive property holds, the code in Servo is at least as different from the code in Gecko as Rust is from C++, and I think that's only amplified in the design. Servo aims to do things that are not realistic for Gecko, like parallelizing more of its operations. I don't think they'd be going this far with Servo at this point if it wasn't for that, I think Gecko would just see the necessary changes and that would be it. Either way, Servo exists. We're told it started as research, but it is obviously at the point where its promise is more concrete. When the lessons have been learned from Servo, it will be a complete, embeddable (this is one goal Gecko gave up on) engine. There's no sense in backporting its innards to the C++ engine when you can just drop it in place.