> For bounds checking, sure I think the performance penalty is so small that it can be done.

Depends on how many times it's inlined and/or if it's in hot code. It can result in much worse assembly code.

Funny thing: C++17 string_view::substr has bound check + exception throw, whereas span::subspan has neither; I can see substr's approach being problematic performance- and code-size-wise if called many times yet being validated by caller.