> Instead, the only way I can think of to make foo1 commit UB is to give it an uninitialized index
Nah a `fclose(stderr)` before calling it will do it!
> A safe caller can't be "at fault" for memory corruption or other UB.
An example of where a safe caller can be at fault is after fork, or in a signal handler. Functions like malloc must not be called, but Rust does not model this and freely invokes malloc from safe functions.
In these regimes safety is inverted: File::open is NOT safe, and may invoke UB; while the "unsafe" libc::open IS safe and should be used instead.
Nah a `fclose(stderr)` before calling it will do it!
> A safe caller can't be "at fault" for memory corruption or other UB.
An example of where a safe caller can be at fault is after fork, or in a signal handler. Functions like malloc must not be called, but Rust does not model this and freely invokes malloc from safe functions.
In these regimes safety is inverted: File::open is NOT safe, and may invoke UB; while the "unsafe" libc::open IS safe and should be used instead.