4 ms·

let's be serious, chromium and firefox are more 90s style codebases than 2010s. There's thousands of raw malloc calls when I grep in the chromium source tree, a

let's be serious, chromium and firefox are more 90s style codebases than 2010s. There's thousands of raw malloc calls when I grep in the chromium source tree, and let's not even start talking about firefox where in the same file you've got : - raw mallocs : https://github.com/mozilla/gecko/blob/central/dom/plugins/ipc/FunctionBroker.cpp#L1252 https://github.com/mozilla/gecko/blob/central/dom/plugins/ip... - new / delete : https://github.com/mozilla/gecko/blob/central/dom/plugins/ipc/FunctionBroker.cpp#L1374 https://github.com/mozilla/gecko/blob/central/dom/plugins/ip... - "whatever.Allocate<T>" : https://github.com/mozilla/gecko/blob/central/dom/plugins/ipc/FunctionBroker.cpp#L1186 https://github.com/mozilla/gecko/blob/central/dom/plugins/ip... and that's not limited to a single file... look at this : https://github.com/mozilla/gecko/blob/3e6d6e013400af38f85ceb92c09ba67a2a5c218b/netwerk/sctp/datachannel/DataChannel.cpp https://github.com/mozilla/gecko/blob/3e6d6e013400af38f85ceb... - some malloc and new, again - you also get some unique_ptr (because "modern" m'see) : https://github.com/mozilla/gecko/blob/3e6d6e013400af38f85ceb92c09ba67a2a5c218b/netwerk/sctp/datachannel/DataChannel.cpp#L846 https://github.com/mozilla/gecko/blob/3e6d6e013400af38f85ceb... - moz_xmalloc because why not ? https://github.com/mozilla/gecko/blob/3e6d6e013400af38f85ceb92c09ba67a2a5c218b/netwerk/sctp/datachannel/DataChannel.cpp#L846 https://github.com/mozilla/gecko/blob/3e6d6e013400af38f85ceb... - oh and did you know about our own custom reference counting pointer ? https://github.com/mozilla/gecko/blob/3e6d6e013400af38f85ceb92c09ba67a2a5c218b/netwerk/sctp/datachannel/DataChannel.cpp#L2021 https://github.com/mozilla/gecko/blob/3e6d6e013400af38f85ceb... etc etc... when you've got 35 different ways to allocate objects used willy-nilly of course things go wrong. Most modern codebases only ever use automatic storage, and unique / shared_ptr.

pcwalton 7y ago
The issues have nothing to do with the differences between STL smart pointers and Mozilla/Chromium smart pointers.
nwallin 7y ago
They are '90s codebases, they're not just "like" '90s codebases. Firefox obviously dates back to Netscape, and webkit (which Safari, Chromium, Opera, Vivaldi, and now Edge are based on) is a fork of KHTML. Mozilla could have achieved 90% of what it wanted from a rust rewrite with a modern C++11 rewrite at a quarter of the cost. Linter rules that say "no new or delete", "either unique_ptr<T> or shared_ptr<const T>", and "only construct unique or shared ptr via make_unique and make_shared" get them like three quarters of the way there. The thing that makes rust great is that the static analyzer is built into the compiler and has strict defaults. C++ is the same language, but clang-analyze and clang-tidy are shipped as separate packages and have more permissive defaults.
- pcwalton 7y ago
  Those rules are completely insufficient. It's worth looking at the actual vulnerabilities here. There is a reasonable argument that modern C++ is less safe than old C++, because features like lambdas are very prone to use-after-free.

pcwalton 7y ago

The issues have nothing to do with the differences between STL smart pointers and Mozilla/Chromium smart pointers.

nwallin 7y ago

They are '90s codebases, they're not just "like" '90s codebases. Firefox obviously dates back to Netscape, and webkit (which Safari, Chromium, Opera, Vivaldi, and now Edge are based on) is a fork of KHTML. Mozilla could have achieved 90% of what it wanted from a rust rewrite with a modern C++11 rewrite at a quarter of the cost. Linter rules that say "no new or delete", "either unique_ptr<T> or shared_ptr<const T>", and "only construct unique or shared ptr via make_unique and make_shared" get them like three quarters of the way there. The thing that makes rust great is that the static analyzer is built into the compiler and has strict defaults. C++ is the same language, but clang-analyze and clang-tidy are shipped as separate packages and have more permissive defaults.

pcwalton 7y ago
Those rules are completely insufficient. It's worth looking at the actual vulnerabilities here. There is a reasonable argument that modern C++ is less safe than old C++, because features like lambdas are very prone to use-after-free.