Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
Sean Baxter: Safe C++ [video] (youtube.com)
46 points by awesomekling on May 9, 2024 | hide | past | favorite | 17 comments


What this guy has achieved with Circle is nothing short of incredible! Writing an entirely new compiler (even if it's "just" a front-end to LLVM) and giving a concrete demonstration of a borrow checker for a beast of a language like C++ is crazy (considering that he received zero help from anyone but himself).

However, I'm afraid that the ISO C++ group is not ready for his proposal. We're talking about a committee which has stubbornly and consistently shown that they are willing to sacrifice safety and ergonomics in the name of backward compatibility. The introduction of a borrow checker is a huge change that will get shut down because someone somewhere is unwilling to rewrite their (often broken) code and/or compile their binaries again.


The ISO committee is becoming increasingly less relevant. It's ineffectiveness has pushed numerous groups to create a successor to C++.

It's no doubt a lot of work but if any of the successors to C++ such as Carbon, Circle, or cpp2 manage to release a solid compiler that is mostly compatible with C++17, I think you'll see a large migration towards it.


The ISO committee is becoming increasingly less relevant. It's ineffectiveness has pushed numerous groups to create a successor to C++.

Maybe it is becoming less relevant, but language proposals and attendance has grown tremendously since 2010, with no signs of slowing down. The real issue is that it's functionally impossible for a single group to meet the needs of the entire community.

It's no doubt a lot of work but if any of the successors to C++ such as Carbon, Circle, or cpp2 manage to release a solid compiler that is mostly compatible with C++17, I think you'll see a large migration towards it.

Only time will tell, however I would bet against C++ successors. In particular, C++ is fundamentally hostile to cross-language interopt, to the degree that even C++ compilers struggle to maintain compatibility between themselves. For a language to work with C++, its compiler basically needs to contain a C++ compiler as well (as Carbon does). Moreover, simply being "compatible with C++17" is only the very first step to practical usage, e.g. consider how much work the Clang developers put into reverse engineering GCCisms. And that is before considering more exotic language extensions and APIs like OpenMP (and perhaps SYCL at some point as well). All the while C++ continues to change and evolve.


> In particular, C++ is fundamentally hostile to cross-language interopt

C++ adheres to Itanium C++ ABI [1] which in turn adheres to SystemV ABI [2].

> to the degree that even C++ compilers struggle to maintain compatibility between themselves.

"Struggle" is to follow the Itanium C++ ABI spec.

> For a language to work with C++, its compiler basically needs to contain a C++ compiler as well (as Carbon does). Moreover, simply being "compatible with C++17" is only the very first step to practical usage, e.g. consider how much work the Clang developers put into reverse engineering GCCisms.

I think you're conflating different terms. Carbon and other similar C++-like frontends are essentially transpilers from C++-like grammar to C++.

Being "compatible" requires no reverse engineering but as I said above it's just a matter of following the C++ ABI spec (for interop between C++ compilers) and following the SystemV ABI spec (for interop between fundamentally different languages).

[1] https://itanium-cxx-abi.github.io/cxx-abi/abi.html

[2] https://raw.githubusercontent.com/wiki/hjl-tools/x86-psABI/x...


* C++ adheres to Itanium C++ ABI [1] which in turn adheres to SystemV ABI [2].*

Uh.. MSVC does not adhere to the Itanium C++ ABI. ISO C++ does not specify any name mangling scheme, in fact I doubt the standard even mentions name mangling.

I think you're conflating different terms. Carbon and other similar C++-like frontends are essentially transpilers from C++-like grammar to C++.

Carbon resembles Rust far more than C++, to say the least. In my experience C++ developers criticize its difference in syntax more than anything else.

Anyway, setting aside the differences in syntax, the point I was trying to convey is that C++ is especially difficult to call from other languages, largely due to templates and/or sheer complexity. For a language to take a C++ header and be able to understand something as basic as std::vector, it needs to have quite a sophisticated understanding of C++ and its implementation. By comparison, Java is readily available in other JVM languages like Kotlin and Clojure, albeit those are managed languages.

Being "compatible" requires no reverse engineering but as I said above it's just a matter of following the C++ ABI spec

Not at all. A C++ ABI does not make it possible to magically understand C++ code. If you disagree, then please explain how a platform’s C++ ABI is sufficient to understand a type like std::string from another language. In particular even a vocabulary type like std::string is not compatible between libc++ and libstdc++, i.e. the two most binary compatible C++ standard library implementations available today.


Which is exactly the reason.

Now we have 300+ people voting on features that are never tested on a real compiler, before being set in stone.

Compilers now are in different states of ISO C++ compliance, between ISO C++14 and ISO C++23.

Several of those on paper features, deemed not quite right when implemented, and had to be redone between revisions, but naturally old ones kind of stay in, backwards compatibility.

All languages are hostile to cross language interop, that is why everyone pretends to be C, or uses OS IPC.


Now we have 300+ people voting on features that are never tested on a real compiler, before being set in stone.

Would you prefer that only 30 people should be allowed to hold up the acceptance of half-baked proposals? How could lower participation in C++ language evolution and/or standardization possibly do anything to improve the rigor and field testing of proposals?

Compilers now are in different states of ISO C++ compliance, between ISO C++14 and ISO C++23.

And? MSVC didn’t even do two-phase name lookup correctly until 2017, a fundamental feature of C++, yet the non-conforming behavior was little more than a nuisance. It’s really no concern of mine that Clang/libc++ hasn’t completed pstl support for C++17 because I wouldn’t be using it anyway. It is concerning when implementations half-asses a feature to pencil whip their “compliance” with new C++ standards (particularly when it only takes one implementation to make a feature useless for portable code).

Several of those on paper features, deemed not quite right when implemented, and had to be redone between revisions, but naturally old ones kind of stay in, backwards compatibility.

The developers behind major C++ implementations are acutely aware of every wart and failure, more so than virtually any end user. If they could they would choose to test every proposal on multiple compilers, across thousands of projects, targeting as many platforms as possible. But the resources and expertise to do so simply aren’t there. At some point the committee must hope for the best, take a leap of faith, and commit to a decision. It’s admirable that the C++ committee chooses to prioritize the needs of end users over the interests of implementations.

All languages are hostile to cross language interop,…

Managed languages do it every day (Kotlin and Java). But yes, the situation is quite different for native languages. What’s different about C++ is that it’s a remarkably difficult language to wrangle. C bindings are almost trivial to write or generate, but C++ introduces a mountain of complexity and ambiguity.

There are dozens of projects which have incrementally rewritten C in Rust. But it’s practically impossible to do anything similar with C++.

…that is why everyone pretends to be C, or uses OS IPC.

No language wants to bear the cross of a stable ABI, much less an ossified ABI. A platform’s C implementation has already paid the price, everyone is welcome to freeload.

That said, nothing good is ever free and the poverty of C ABIs prove it. With hardly any exceptions, describing a type C ABI as “fragile” is an understatement at best.


Try to call Kotlin co-routines from Java to see how well it goes, even bytecode doesn't help when semantics aren't there, or languages build their little islands on top of the underlying platform.

Yes, a smaller group of people, and like any sane language evolution process, papers without implementations don't go in.

Words aren't a replacement for proper field testing.


I can't really evaluate your comment on relevance -- some things do seem to inexplicably bog down, but on others they move usefully and quickly. And the conservatism of compatibility really is incredibly important, which I say as someone who'd be happy (and relieved!) to blow away API compatibility (actually to use the API step capabilities already available behind the scenes, at least for ELF).

But the part about "numerous groups to create a successor" doesn't really make your case: one of the best ways for things to get into any standard is to have multiple efforts that can be used as experience and starting points for the evolution of a standard. This has already happened a lot in the history of C++


Someone please acquihire Sean and his compiler! This guy is a once-in-a-generation polymath: an expert in compilers (obviously), GPUs (worked on CUDA at NVIDIA), physics and topography (JPL etc).

Buy the compiler, get somebody who could build you a nuclear reactor, drug discovery simulator and a GPU architecture. Deal of the century.


He is out of the ordinary for sure and a very smart person. But I still think that taking a more Hylo-like path to safety would be nicer and would complicate things less.

FWIW, with Hylo you would rely on value semantics, you would not need Rust-style full-blown borrow checks with viral annotations, which is what he has been implementing and you would get rid of any kind of view types for parameter passing. You would just pass values.

I really think that is the path forward to bet on.

For whoever thinks Hylo is too new or experimental, it is not the language itself what is important but what C++ can learn from it. Hylo is based in experience implementing Swift by Dave Abrahams, Generic programming from Alex Stepanov and value semantics and structural polymorphism and value semantics and related work from Sean Parent.

So even if the implementation itself is not so advanced, it is just a natural evolution of all things I just named here which have a track record of like 30 years at least in total with a lot of generic code and value semantics lessons and runtime polynorphism lessons learned.


Maybe we could eventually get -fsafe, I guess dreaming is allowed.


Circle is the real Typescript for C++, still hopeful some of this stuff helps to steer C++ into the right direction.

Too much infrastructure code and industry standards, that will be kept being done in C++ for decades to come, and need a way for improving the whole security story.


It amazes me and makes me feel slightly more stupid to discover how much more easily I grok all this Rust stuff when it's expressed (elegantly) in what is basically C++.


Presenting a familiar syntax certainly makes it easier to follow.


Rust is a solid lang but wider adoption will always be kneecapped by its syntax imo.


Syntax is mostly a function of familiarity. People coming to C++ from Rust or other languages often say the same thing.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: