3 ms·

RAII solves lots of lifetime problems, but it's surprisingly easy to have refs outlive their targets (among other things). Static-analysis can spot a portion of

RAII solves lots of lifetime problems, but it's surprisingly easy to have refs outlive their targets (among other things). Static-analysis can spot a portion of these, but in general the lifetime of input and output values of functions/scopes needs to be explicitly stated by the user (part of the type) and can thus be verified by the compiler. I think Rust captures the core lifetime concepts pretty well, but the notation can be cumbersome, and I think C++'s rich type-system could make for a less-tedious solution. TFA mentions doing some implicit lifetime-analysis based on signatures (e.g. inferring ownership based on type-traits), but ultimately it is 'just' low-hanging fruit. It would be nice to capture in signatures/types that "the input must outlive the output" and have more meaningful error diagnostics and less implicit magic ("did I follow the iterator traits correctly?").

xiphias2 7y ago
I think the main problem for C++ programmers is not the notation of Rust, as Rust is a simpler language than C++. It's backwards compatibility: there are hundreds of millions, or probably billions of lines of C++ code out there. I found working with big code bases really hard, because the memory ownership situation is crazy, in fact impossible to keep track of. That's why my question was whether there's a future path for C++ Lifetime Profile to get programs to Rust like memory safety in the future, but I still don't know the answer.
- pjmlp 7y ago
  However that is also the reason why those billions of lines will stay C++, and no one will pay for porting them into Rust, or any other memory safe language. So any improvement to the status quo is pretty much welcomed, and here lies the big difference between the C++ (introducing lifetime profile) and C communities (making Annex K optional), regarding taking actions to fix memory corruption.
- safercplusplus 7y ago
  I think the answer is yes. There's a complementary project [1] that aims to enforce a slightly more restricted memory safe subset of C++ than the lifetime profile checker does (or eventually will). The restrictions do not manifest as limitations on the code, but rather as extra run-time checks in some scenarios. The C++ language maps one-to-one to the safe subset, so auto-conversion of (reasonable) existing C++ code to the safe subset should be a straightforward (if tedious) undertaking. The issue will be the performance of the converted code, which will depend on how pointers/references are used in the original code. Pointers that are expected to never point to (in addition to never dereference to) a destroyed object can be converted to "safe" pointers with little run-time overhead [2]. Otherwise the pointer would need to converted to one with more overhead [3]. Pointers that can be verified (by the static analyzer) to conform to "scope lifetime" rules (akin to Rust) can remain zero-overhead pointers. New code written in the safe subset would generally have performance in the ballpark of traditional C++ [4]. [1] https://github.com/duneroadrunner/scpptool https://github.com/duneroadrunner/scpptool [2] https://github.com/duneroadrunner/SaferCPlusPlus#norad-pointers https://github.com/duneroadrunner/SaferCPlusPlus#norad-point... [3] https://github.com/duneroadrunner/SaferCPlusPlus#registered-pointers https://github.com/duneroadrunner/SaferCPlusPlus#registered-... [4] https://github.com/duneroadrunner/SaferCPlusPlus-BenchmarksGame https://github.com/duneroadrunner/SaferCPlusPlus-BenchmarksG... (note that the benchmark code is quite old and will be updated soon)
  - muizelaar 7y ago
    Is there a document that describes roughly how to do the conversion? How are things like pointer arithmetic handled?
    - safercplusplus 7y ago
      Unfortunately, documentation [1] is still kind of lacking. Like Rust (and arguably modern C++ conventions?), the safe subset doesn't support pointer arithmetic directly. You would have to convert the pointer to an iterator (and its target to an appropriate container). Auto-conversion of code that uses pointer arithmetic is challenging, but has been demonstrated to be solvable in the general case [2]. [1] https://github.com/duneroadrunner/SaferCPlusPlus#getting-started-on-safening-existing-code https://github.com/duneroadrunner/SaferCPlusPlus#getting-sta... [2] https://github.com/duneroadrunner/SaferCPlusPlus-AutoTranslation https://github.com/duneroadrunner/SaferCPlusPlus-AutoTransla...
  - xiphias2 7y ago
    Thanks, it's really cool. I hope it gets enough backing from corporations that have big/huge C++ code bases.

xiphias2 7y ago

I think the main problem for C++ programmers is not the notation of Rust, as Rust is a simpler language than C++. It's backwards compatibility: there are hundreds of millions, or probably billions of lines of C++ code out there. I found working with big code bases really hard, because the memory ownership situation is crazy, in fact impossible to keep track of. That's why my question was whether there's a future path for C++ Lifetime Profile to get programs to Rust like memory safety in the future, but I still don't know the answer.

pjmlp 7y ago
However that is also the reason why those billions of lines will stay C++, and no one will pay for porting them into Rust, or any other memory safe language. So any improvement to the status quo is pretty much welcomed, and here lies the big difference between the C++ (introducing lifetime profile) and C communities (making Annex K optional), regarding taking actions to fix memory corruption.
safercplusplus 7y ago
I think the answer is yes. There's a complementary project [1] that aims to enforce a slightly more restricted memory safe subset of C++ than the lifetime profile checker does (or eventually will). The restrictions do not manifest as limitations on the code, but rather as extra run-time checks in some scenarios. The C++ language maps one-to-one to the safe subset, so auto-conversion of (reasonable) existing C++ code to the safe subset should be a straightforward (if tedious) undertaking. The issue will be the performance of the converted code, which will depend on how pointers/references are used in the original code. Pointers that are expected to never point to (in addition to never dereference to) a destroyed object can be converted to "safe" pointers with little run-time overhead [2]. Otherwise the pointer would need to converted to one with more overhead [3]. Pointers that can be verified (by the static analyzer) to conform to "scope lifetime" rules (akin to Rust) can remain zero-overhead pointers. New code written in the safe subset would generally have performance in the ballpark of traditional C++ [4]. [1] https://github.com/duneroadrunner/scpptool https://github.com/duneroadrunner/scpptool [2] https://github.com/duneroadrunner/SaferCPlusPlus#norad-pointers https://github.com/duneroadrunner/SaferCPlusPlus#norad-point... [3] https://github.com/duneroadrunner/SaferCPlusPlus#registered-pointers https://github.com/duneroadrunner/SaferCPlusPlus#registered-... [4] https://github.com/duneroadrunner/SaferCPlusPlus-BenchmarksGame https://github.com/duneroadrunner/SaferCPlusPlus-BenchmarksG... (note that the benchmark code is quite old and will be updated soon)
- muizelaar 7y ago
  Is there a document that describes roughly how to do the conversion? How are things like pointer arithmetic handled?
  - safercplusplus 7y ago
    Unfortunately, documentation [1] is still kind of lacking. Like Rust (and arguably modern C++ conventions?), the safe subset doesn't support pointer arithmetic directly. You would have to convert the pointer to an iterator (and its target to an appropriate container). Auto-conversion of code that uses pointer arithmetic is challenging, but has been demonstrated to be solvable in the general case [2]. [1] https://github.com/duneroadrunner/SaferCPlusPlus#getting-started-on-safening-existing-code https://github.com/duneroadrunner/SaferCPlusPlus#getting-sta... [2] https://github.com/duneroadrunner/SaferCPlusPlus-AutoTranslation https://github.com/duneroadrunner/SaferCPlusPlus-AutoTransla...
- xiphias2 7y ago
  Thanks, it's really cool. I hope it gets enough backing from corporations that have big/huge C++ code bases.