title: Is it appropriate to mark functions unsafe if the user's inputs can break invariants?
body: <p>It's common in Rust to enforce invariants about the state of types by exposing a limited API. However, invariants can be easily broken if the invariant is difficult or prohibitively computationally expense to check and return an error.</p>
  <p>For example, imagine we have a function that takes an integer and, for whatever reason, fails if that integer is a prime number. It may be too expensive to check that the input is not prime. Is it appropriate to mark such a function unsafe as a way of saying, &quot;This method could potentially operate in an unexpected way if the input is prime, but we trust you and don't waste effort checking&quot;?</p>
  <p>If such an input could cause obvious undefined behavior (UB), then I imagine the answer is yes. But if it's not immediately clear if it could UB, I am uncertain whether such an API should be complicated with an unsafe attribute.</p>