Andrey Semashev wrote:
I think, the answer to memory safety won't be the span as the argument type, which will only get in the way in the hasher implementation, but a markup of the pointer+size arguments so that the compiler is able to reason about the buffer size anyway. I think, MSVC and gcc already have attributes of that kind, though I'm not sure what exactly the compilers are able to do with them. Maybe, those attributes need to be standardized instead of pushing span everywhere.
Microsoft has tried these sorts of annotations pretty extensively, and they have moved towards requiring span. (In C they still need to rely on the annotations, of course, but in C++ code, they now prefer span.) std::span has actually been proposed by Microsoft, on the basis of that experience.