Contracts, Safety, and the Art of Cat Herding
summary
C++26 adds language contract assertions with four evaluation semantics (ignore, observe, enforce, quick enforce) and the proposal P3100 catalogs 90 cases of UB across 12 categories, finding 17 where a well‑defined fallback is possible and ~79 that need runtime detection. The plan injects implicit contract assertions (compiler‑generated checks that hook the standard contract violation handler), introduces labels and profiles for grouping and opt‑in/opt‑out, and formalizes an assume semantic for compatibility; work is incremental, not a Rust‑style rewrite.
AI-written summary · about
chapters (42)
- 0:00Introduction
- 0:52What makes a good program?
- 2:12Defining program correctness
- 4:06The messiness of specifications
- 5:15The contract model
- 7:13Documenting contracts
- 8:10C++26 contract assertions
- 10:46Contract evaluation semantics
- 12:07Limitations of assertions
- 13:26Class invariants and ranges
- 15:17Summary of contract assertions
- 17:07What assertions are not
- 19:40Safety and security
- 21:02Definitions of safety
- 23:16Lamport safety properties
- 25:26Functional safety vs UB
- 27:37Safety beyond UB
- 29:10Security in C++
- 30:52Correctness, safety, and security
- 32:34Reducing undefined behavior
- 34:03Memory safety challenges
- 35:54Compile-time memory safety
- 37:09The salami tactic for UB
- 39:26Committee efforts on UB
- 41:36P3100: Runtime diagnosis of UB
- 44:14Categorizing UB cases
- 46:53Fallback behaviors and opt-outs
- 50:54Implicit contract assertions
- 52:37Implementing the checks
- 55:17Well-defined fallback example
- 58:44Labels and semantic control
- 1:00:56The big picture
- 1:03:32Roadmap for legacy and new code
- 1:06:00The role of profiles
- 1:08:52Committee planning and summary
- 1:10:03The art of cat herding
- 1:14:00Working in a committee
- 1:15:41Rules for consensus
- 1:18:48Logical fallacies in design
- 1:21:56A decision-making algorithm
- 1:26:01Example of decision algorithm
- 1:29:25Conclusion
related talks
01h 03mCpp Contracts - How Contracts in C++26 Can Improve C++ Code Safety and Correctness
01h 22mContracts, Safety and Correctness in C++
01h 31mContracts for C++
01h 17mFunction Contracts in Practice using C++
01h 32mContracts for C++
01h 21mProgramming with Contracts in C++20
01h 27mContractual Disappointment in C++
01h 19mEnforce Inform Ignore Assume - Gradual Adoption of Contracts In Production Code