CompCert – Formally-verified C compiler
I think a lot of others here are going to have the question &quot;what does it do with UB&quot;, which is partially answered in the doc:<p><a href="https:&#x2F;&#x2F;compcert.org&#x2F;man&#x2F;manual005.html#language-reference" rel="nofollow">https:&#x2F;&#x2F;compcert.org&#x2F;man&#x2F;manual005.html#language-reference</a><p><i>Overflow in arithmetic over signed integer types is defined as taking the mathematically-exact result and reducing it modulo 2^32 or 2^64 to the range of representable signed integers. Bitwise operators (&amp;, |, ^, ~, &lt;&lt;, &gt;&gt;) over signed integer types are interpreted following two’s-complement representation.</i><p>...so at least for that case, it behaves sanely, but it&#x27;s unclear what happens for other types of UB.