4 ms·

Can someone at least make a linter that ensures you only use a "safe" subset of C++?

0815test 8y ago
The answer is essentially no, at least if you're seeking substantial levels of assurance or safety. Even the C++ Core Guidelines effort, https://github.com/isocpp/CppCoreGuidelines https://github.com/isocpp/CppCoreGuidelines which is the closest thing to what you describe and is driven by influential members of the ISO C++ community including B. Stroustrup, does not claim that they'll be able to make C++ memory safe.
steveklabnik 8y ago
The Core Guidelines are an attempt at this, but it’s not fully safe. Safer, which matters! But not safe. There isn’t really any useful safe subset of C++. If there were, Rust may never have been created in the first place.
- ncmncm 8y ago
  This is not, in fact, the case. Back when Rust was begun, it had some merit, but C++ is a rapidly moving target. C++ still does not have an absolutely safe subset, but it has a safe-enough subset, and plenty of other merits that will ensure its continued competitiveness. Rust will continue improving, too, and someday may be as expressive as C++ is today, or perhaps even as expressive as C++ is then. That will be a good day, although by then some other language will be on the rise, its users hoping to displace C++ and, given enough luck and hard work, Rust. V could be interesting.
- pjmlp 8y ago
  Still, C++ is good enough for the unsafe low level bindings of a Java/.NET application. Until Rust's tooling catches up with C++/CLI, C++/CX, C++/WinRT + .NET or Java + C++ (Eclipse/Netbeans/Oracle Studio), CUDA, Unreal/Unity, GLSL/HLSL/Metal Shaders allow for, it will stay as a safe way to write CLI apps and a couple of UNIX libs. I like the language and advocate it often, but I am also very pragmatic regarding the areas I and customers work on.
pfultz2 8y ago
Clang's lifetime profile will catch the first example: <source>:8:16: warning: passing a dangling pointer as argument [-Wlifetime] std::cout << sv; ^ <source>:7:38: note: temporary was destroyed at the end of the full expression std::string_view sv = s + "World\n"; ^ And cppcheck will catch the second example: <source>:7:12: warning: Returning lambda that captures local variable 'x' that will be invalid when returning. [returnDanglingLifetime] return [&]() { return *x; }; ^ <source>:7:28: note: Lambda captures variable by reference here. return [&]() { return *x; }; ^ <source>:6:49: note: Variable created here. std::function<int(void)> f(std::shared_ptr<int> x) { ^ <source>:7:12: note: Returning lambda that captures local variable 'x' that will be invalid when returning. return [&]() { return *x; }; ^ Cppcheck could probably catch all the examples, but it needs to be updated to understand the newer classes in C++.
- felixguendling 8y ago
  For everyone interested in experimenting with this: https://gcc.godbolt.org/z/vmcnXh https://gcc.godbolt.org/z/vmcnXh Godbolt's compiler explorer is a great tool to try new features (language, compiler, standard library, etc.).
safercplusplus 8y ago
Others disagree, but I suggest that someone could make such a linter. As others point out, the Core Guidelines "lifetime profile checker"[1] is designed to be an advanced static analyzer that restricts how many C++ elements can be used. It's not finished yet, and the current version is not designed to achieve complete memory safety (and doesn't address data race safety). Whether or not subsequent versions could match the full safety enforcement of Rust's compiler seems to be a matter of some debate. But there is an alternative/complementary approach, which is to simply avoid potentially unsafe C++ elements, like pointers/references, arrays, std::string_views, std::threads, etc., substituting them with safe, largely compatible replacements[2]. This approach has the benefit that an associated safety-enforcing "linter" would not impose the same kinds of "severe" usage restrictions that the lifetime profile checker (or, say, the Rust compiler) does. [1] https://devblogs.microsoft.com/cppblog/lifetime-profile-update-in-visual-studio-2019-preview-2/ https://devblogs.microsoft.com/cppblog/lifetime-profile-upda... [2] https://github.com/duneroadrunner/SaferCPlusPlus https://github.com/duneroadrunner/SaferCPlusPlus edit: grammar

The answer is essentially no, at least if you're seeking substantial levels of assurance or safety. Even the C++ Core Guidelines effort, https://github.com/isocpp/CppCoreGuidelines https://github.com/isocpp/CppCoreGuidelines which is the closest thing to what you describe and is driven by influential members of the ISO C++ community including B. Stroustrup, does not claim that they'll be able to make C++ memory safe.

steveklabnik 8y ago

The Core Guidelines are an attempt at this, but it’s not fully safe. Safer, which matters! But not safe. There isn’t really any useful safe subset of C++. If there were, Rust may never have been created in the first place.

ncmncm 8y ago
This is not, in fact, the case. Back when Rust was begun, it had some merit, but C++ is a rapidly moving target. C++ still does not have an absolutely safe subset, but it has a safe-enough subset, and plenty of other merits that will ensure its continued competitiveness. Rust will continue improving, too, and someday may be as expressive as C++ is today, or perhaps even as expressive as C++ is then. That will be a good day, although by then some other language will be on the rise, its users hoping to displace C++ and, given enough luck and hard work, Rust. V could be interesting.
pjmlp 8y ago
Still, C++ is good enough for the unsafe low level bindings of a Java/.NET application. Until Rust's tooling catches up with C++/CLI, C++/CX, C++/WinRT + .NET or Java + C++ (Eclipse/Netbeans/Oracle Studio), CUDA, Unreal/Unity, GLSL/HLSL/Metal Shaders allow for, it will stay as a safe way to write CLI apps and a couple of UNIX libs. I like the language and advocate it often, but I am also very pragmatic regarding the areas I and customers work on.

pfultz2 8y ago

Clang's lifetime profile will catch the first example: <source>:8:16: warning: passing a dangling pointer as argument [-Wlifetime] std::cout << sv; ^ <source>:7:38: note: temporary was destroyed at the end of the full expression std::string_view sv = s + "World\n"; ^ And cppcheck will catch the second example: <source>:7:12: warning: Returning lambda that captures local variable 'x' that will be invalid when returning. [returnDanglingLifetime] return [&]() { return *x; }; ^ <source>:7:28: note: Lambda captures variable by reference here. return [&]() { return *x; }; ^ <source>:6:49: note: Variable created here. std::function<int(void)> f(std::shared_ptr<int> x) { ^ <source>:7:12: note: Returning lambda that captures local variable 'x' that will be invalid when returning. return [&]() { return *x; }; ^ Cppcheck could probably catch all the examples, but it needs to be updated to understand the newer classes in C++.

felixguendling 8y ago
For everyone interested in experimenting with this: https://gcc.godbolt.org/z/vmcnXh https://gcc.godbolt.org/z/vmcnXh Godbolt's compiler explorer is a great tool to try new features (language, compiler, standard library, etc.).

safercplusplus 8y ago

Others disagree, but I suggest that someone could make such a linter. As others point out, the Core Guidelines "lifetime profile checker"[1] is designed to be an advanced static analyzer that restricts how many C++ elements can be used. It's not finished yet, and the current version is not designed to achieve complete memory safety (and doesn't address data race safety). Whether or not subsequent versions could match the full safety enforcement of Rust's compiler seems to be a matter of some debate. But there is an alternative/complementary approach, which is to simply avoid potentially unsafe C++ elements, like pointers/references, arrays, std::string_views, std::threads, etc., substituting them with safe, largely compatible replacements[2]. This approach has the benefit that an associated safety-enforcing "linter" would not impose the same kinds of "severe" usage restrictions that the lifetime profile checker (or, say, the Rust compiler) does. [1] https://devblogs.microsoft.com/cppblog/lifetime-profile-update-in-visual-studio-2019-preview-2/ https://devblogs.microsoft.com/cppblog/lifetime-profile-upda... [2] https://github.com/duneroadrunner/SaferCPlusPlus https://github.com/duneroadrunner/SaferCPlusPlus edit: grammar