3 ms·

My guess is the reason is C++ is complicated. When you have restrictive conventions, it is easier for a new dev to get onboard, as well as for creating static

My guess is the reason is C++ is complicated. When you have restrictive conventions, it is easier for a new dev to get onboard, as well as for creating static analysis tools.

erik_seaberg 4y ago
Google C++ forbids exceptions, but C++ RAII works a lot better when a data member ctor can throw. The compiler will generate code tearing down a half-constructed object from that point, without you having to write a method that knows what to do and what not to.
- UncleMeat 4y ago
  What percentage of CVEs in Chromium are caused by half-complete objects where a constructor throw would have prevented the issue? I certainly don't have an exhaustive view of things but no example is coming to mind right now. With [[noexcept]] everywhere I'd expect a constructor failing to just crash Chrome rather than proceed in some indeterminate state.
  - erik_seaberg 4y ago
    https://google.github.io/styleguide/cppguide.html#Exceptions https://google.github.io/styleguide/cppguide.html#Exceptions calls for factories or init methods (probably returning error codes) so running with an invalid state isn’t prevented by terminating the process. I don’t have access to CVEs on crbug.com but the top two from https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop.html https://chromereleases.googleblog.com/2023/01/stable-channel... are a use-after-free and buffer overflow reported months ago, which is the kind of stuff that modern C++ tries to avoid using containers and smart pointers with RAII.
    - UncleMeat 4y ago
      Of course modern C++ tries to avoid this sort of thing now with smarter lifetime management, but what does that have to do with building with exceptions disabled?
      - erik_seaberg 4y ago
        I think they use their own containers and smart pointers which require explicit initialization (more scope for mistakes), to avoid standard C++ classes whose copy/move ctors can throw.

My guess is the reason is C++ is complicated. When you have restrictive conventions, it is easier for a new dev to get onboard, as well as for creating static analysis tools.

erik_seaberg 4y ago

Google C++ forbids exceptions, but C++ RAII works a lot better when a data member ctor can throw. The compiler will generate code tearing down a half-constructed object from that point, without you having to write a method that knows what to do and what not to.

UncleMeat 4y ago
What percentage of CVEs in Chromium are caused by half-complete objects where a constructor throw would have prevented the issue? I certainly don't have an exhaustive view of things but no example is coming to mind right now. With [[noexcept]] everywhere I'd expect a constructor failing to just crash Chrome rather than proceed in some indeterminate state.
- erik_seaberg 4y ago
  https://google.github.io/styleguide/cppguide.html#Exceptions https://google.github.io/styleguide/cppguide.html#Exceptions calls for factories or init methods (probably returning error codes) so running with an invalid state isn’t prevented by terminating the process. I don’t have access to CVEs on crbug.com but the top two from https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop.html https://chromereleases.googleblog.com/2023/01/stable-channel... are a use-after-free and buffer overflow reported months ago, which is the kind of stuff that modern C++ tries to avoid using containers and smart pointers with RAII.
  - UncleMeat 4y ago
    Of course modern C++ tries to avoid this sort of thing now with smarter lifetime management, but what does that have to do with building with exceptions disabled?
    - erik_seaberg 4y ago
      I think they use their own containers and smart pointers which require explicit initialization (more scope for mistakes), to avoid standard C++ classes whose copy/move ctors can throw.