Fil-C: memory safety with fanatical C/C++ compatibility
summary
A garbage‑collected, capability‑based C/C++ implementation enforces zero unsafe escape hatches and runs large real projects: zsh, XZ, bzip2, mg, PCRE, ncurses, CPython needs ~50KB patch, OpenSSH and OpenSSL compile and run. Runtime sits atop musl with a user/kernel sandwich and an LLVM pass called the pissinator that inserts checks and an abstract interpreter. Monocaps use 128‑bit descriptors with per‑16‑byte type words; GC is accurate, concurrent, non‑moving. Performance is currently 1.5x slower in good cases, ~5x in worst cases.
AI-written summary · about
chapters (9)
- 0:00Phil-C memory safe C
- 1:23Demo compiling real software
- 10:44Goals: safety, compatibility, speed
- 15:44Past memory-safe C attempts
- 17:53Phil-C design insights
- 24:55Lipy Sandwich runtime
- 28:12LLVM modifications for Phil-C
- 31:50Performance benchmarks
- 32:57Q&A
related talks
46mGNU C Library
29mSecuring C code that seems to work just fine
01h 28mKeynote: Safety, Security, Safety and C / C++ - C++ Evolution
45mThe existential threat against C++ and where to go from here
01h 06mModern C and What We Can Learn From It
14mEmbedded C and C++: A Security Perspective
01h 16mPolymorphism, Cohesion, and Coupling in C++
22mWriting safe and secure code