[cppcon 2016] CppCon 2016: Chandler Carruth “Garbage In, Garbage Out: Arguing about Undefined Behavior..."

reference:

defensive-programming
wide/narrow contract
Why is unsigned integer overflow defined behavior but signed integer overflow isn't?

Narrow contract:

• Checkable (probabilistically) at runtime.
• Provide significant value: bug finding, simplification, and/or optimization.
• Easily explained and taught to programmers.
• Not widely violated by existing code that works correctly and as intended.

Shifting unsigned int over 32 bit is _also_ an UB.

https://google.github.io/styleguide/cppguide.html#Integer_Types
Use signed int and take advantage of signed int arithmetic UB for optimization.
Especially on 64-bit platform due to pointer is 64-bit and int is 32 bit.