Abstract:

This presentation introduces extensions to C++, heavily inspired by Rust, aimed at achieving memory safety and thread safety guarantees comparable to Rust while maintaining compatibility with existing C++ code. The speaker, Sean Baxter, details five key areas of C++ unsafety (lifetime, null pointer, union/variant access, thread data races, bounds/arithmetic errors) and presents corresponding solutions integrated into a modified C++ compiler. These solutions include a borrow checker with lifetime analysis, relocation semantics (distinct from move semantics) enabling non-nullable types, first-class "Choice" types (sum types) with pattern matching to safely handle optional/expected-like scenarios, Send/Sync-like traits enforced by the type system for data race prevention, and runtime checks that panic instead of causing undefined behavior. The system uses a #feature directive for opt-in compatibility and introduces new keywords (safe, unsafe, unchecked) and syntax (borrows ^, lifetimes ^a, Choice, match). The talk provides numerous code examples demonstrating how these features prevent common C++ bugs like use-after-free, dangling pointers with string_view, iterator invalidation, and data races in concurrent code, often using wrappers around standard library concepts like thread, mutex, and shared_ptr. The presentation concludes with a Q&A addressing implementation details, adoption strategies for large codebases, and syntax considerations.

Enhancing C++ Safety: Integrating Rust-Inspired Memory and Thread Safety Features

• 0:00:09 The C++ Safety Challenge: The talk addresses the question of whether a safe, expressive, and compatible subset/superset of C++ can exist, similar to Rust's safety guarantees.
• 0:01:08 Five Domains of Memory Safety: To make C++ safer, alternatives must be provided in five key areas: lifetime safety (use-after-free), null pointer type safety, union/variant type safety, thread safety (data races), and runtime checks (e.g., bounds checking).
• 0:01:16 Lifetime Safety via Borrow Checking: Introduces a compile-time borrow checker, inspired by Rust, to manage object lifetimes and prevent dangling pointers/references for both heap and stack objects.
• 0:01:50 Null Pointer Safety & Relocation: Addresses undefined behavior from null unique_ptr dereferences by requiring types that cannot be null by default, which necessitates a new object model supporting relocation (moving data while invalidating the source, distinct from std::move).
• 0:02:21 Type Safety for Variants (Choice Types): Introduces first-class sum types (Choice) and pattern matching (match) to replace unsafe access patterns in std::optional, std::expected, and unions, preventing undefined behavior.
• 0:03:18 Thread Safety via Type System: Implements Rust's Send and Sync trait concepts and interior mutability rules at compile time to prevent data races in safe code.
• 0:03:51 Runtime Checks and Panics: Operations like out-of-bounds access or divide-by-zero trigger a panic (abort) in safe contexts by default, preventing undefined behavior.
• 0:04:34 Opt-in Safety with #feature: A #feature on safety directive enables the new safety model and keywords within a file without breaking compatibility with included standard or third-party headers.
• 0:05:40 The safe Keyword: Functions marked safe provide safety guarantees similar to Rust functions and cannot call unsafe functions or perform unsafe operations without an unsafe block.
• 0:06:41 The unchecked Keyword: Allows opting out of runtime checks (like bounds checks) within a specific block for performance reasons, while maintaining other safety guarantees (lifetime, type, thread).
• 0:07:23 Borrows (^): Uses the ^ symbol for borrows (e.g., int^ p = ^x; for a mutable borrow), replacing unsafe raw pointers in safe code.
• 0:07:53 Borrow Checker in Action (Use-After-Free): Demonstrates the borrow checker catching a use-after-free bug when a variable's scope ends before its borrow is last used, providing detailed error messages.
• 0:11:16 Borrow Checker (Invalidation): Shows the borrow checker preventing use of a borrow after the underlying object is dropped or relocated.
• 0:13:13 Lifetime-Aware string_view: Presents a reimplemented string_view using lifetime parameters to prevent dangling pointers, caught by the borrow checker.
• 0:14:46 Lifetime Parameters (^a, ^<a, b>): Explains the syntax and necessity of explicit lifetime parameters on function signatures (especially for return types borrowing from inputs) to track dependencies.
• 0:20:43 Variance: Discusses the importance of variance (how lifetimes relate in nested types, particularly with mutability) for the soundness of the borrow checker.
• 0:24:06 Preventing Iterator Invalidation: Shows how standard C++ range-for loops can cause undefined behavior via iterator invalidation, which the safe version prevents using the borrow checker.
• 0:26:06 Safe Iteration Model: Safe iteration uses a Rust-like Iterable interface with slice iterators (begin/end pointers + next() returning optional), avoiding C++ iterator invalidation issues.
• 0:27:20 First-Class Tuples and Arrays: New built-in tuple and array types are introduced to support relocation semantics, as standard types like std::tuple are incompatible.
• 0:35:37 Compile-Time Data Race Prevention: Introduces Rust's Send (safe to transfer ownership across threads) and Sync (safe to share references across threads) concepts, enforced at compile time.
• 0:36:04 Thread Safety Examples: Demonstrates how attempts to share non-Send types (like string^) or non-'static references fail at compile time due to type system constraints and lifetime rules (T: 'static requirement for thread arguments).
• 0:40:42 Safe Concurrency with shared_ptr and mutex: Explains how shared_ptr provides safe shared ownership but not safe shared mutation (dereferencing yields a const borrow). Safe shared mutation requires mutex<T> which uses interior mutability.
• 0:43:33 Interior Mutability: The safe mutex allows acquiring a mutable borrow (lock_guard) from a const reference to the mutex itself, enabling safe mutation of shared state under lock protection.
• 0:45:58 Safe Mutex Usage: Demonstrates the correct pattern using shared_ptr<mutex<T>> and shows how the borrow checker prevents errors like using data after the lock is released or dropping the underlying data while the lock guard is active.
• 0:52:20 Incremental Adoption: Suggests that adoption in large codebases can be incremental by replacing unsafe standard library types/patterns with their safe counterparts (e.g., std::to::unique_ptr, safe loops) gradually, reducing exposure to UB without immediately needing to mark everything safe.
• 0:53:46 Q&A Session: Covers topics like syntax conflicts (^), the necessity of 'static lifetimes for threads, safe keyword interaction with overload resolution, handling raw pointer array access (use safe slices: dyn T[]), adoption effort, comparison to Rust's implementation details (NLL borrow checking), lifetime annotations, and standardization strategy.