zz

com/products/ecv.php [6] https://trust-in-soft.com/

ve rise to undefined behaviour. Of course, there can still be bugs in a JVM, but that's another matter. All languages are vulnerable to compiler bugs. Other languages like JavaScript do the same. It's possible to leak memory, but it's never possible to trigger undefined behaviour from JavaScript. That's a vital part of its security model. > It is indeed quite possible to write memory safe C/C++ code... and it's done every day That doesn't sound right. There's a reason I gave the examples of the Linux kernel and Chromium. They're written by highly competent developers, but they still have subtle memory-management bugs. Most C/C++ codebases are written by less competent developers, but are of far less interest to attackers, so it's of less consequence. Their memory-management bugs are likely to go unnoticed forever. I agree it's possible to write C/C++ code without memory-management bugs (there are various formal development systems for C), but it's a significant challenge. I'd hope avionics software, for instance, would be entirely free of such bugs. > You never hear about how memory safe and performant all that code is... you only ever hear about the rare, high profile mistakes. They're not that rare, they're a major source of serious security vulnerabilities, and languages like Safe Rust can close the door on them entirely. > The problems with languages like C++ are more about how bloated it's become. There's 30 ways to do anything in that language, and 24 of them you're not supposed to use anymore! Agreed. C++ is quite a lumbering monster of complexity. Ada also has a reputation for being somewhat bloated, but it's not as far gone as C++. > if not for memory safety promises, then for it being a "fresh start" for systems programming without all the legacy baggage C++ has Keep an eye on Zig, too. Also D and Nim, and perhaps Vala. Also the lesser-known ZZ and Dafny languages, which look very interesting. https://github.com/aep/zz https://github.com/dafny-lang/dafny

by forcing them to behave the Java way. Java's long is defined to be 64-bit and use 2's complement representation, regardless of the workings of the underlying hardware. C supports full-speed execution on all such platforms as it permits its behaviour to vary depending on the target platform. This is part of why the C spec is so loose about how the compiler/platform may behave. What are the values of MAX_INT and MAX_LONG? The spec doesn't dictate their values, although it does give lower bounds. You can't have it all, especially with C where even allocating an array of long requires using sizeof(long). You could mandate in your IR that long is 64-bit, but this means you've changed the behaviour of the C program when running on an LLP64 [0] platform, which must now emulate the 64-bit behaviour. There's similar trouble with pointers. If you mandate that pointers are 64-bit, you'll damage performance on 32-bit machines, unless the (native-code) compiler is somehow smart enough to optimise it back down to the native 32-bits. And this is assuming no preprocessor trouble, which might be acceptable in a controlled environment but isn't acceptable in a universal C bytecode that can do everything C source-code can. Again I'm not saying you can't define an IR for C for certain purposes, my issue is with a universal IR. It's not the same as defining an IR for a family of related products, as we see with GPUs and mainframes. Could you define such a limited-portability IR for your new OS that runs on x86-64, RISC-V, and AArch64? Probably. Would it really help? I doubt it. You can already write portable C programs if you know what you're doing and do adequate testing. If you want a language that gives you robust assurances of platform-independence, you shouldn't be using C in the first place. (From our previous discussions I believe we're both of the opinion it's a bit of a pity Ada sees so little general use these days.) It would presumably be possible to define a coding-standard a bit like MISRA C that prohibited anything platform-specific, for instance by banning general use of int and long and insisting on using the fixed-width types. It would also have the difficult job of prohibiting undefined behaviour. There's the ZZ project which does something vaguely along these lines, but it defines a whole new language that compiles to C. [1] > Deciding that they don't want to keep backwards compatibility is definitely politics. At the risk of a boring discussion on semantics, that doesn't sound to me like politics. Declining to be saddled with a commitment to backward compatibility, is a technical decision intended to permit future improvements. LLVM chose a permissive licence to keep Apple happy, in contrast to GCC. That counts as politics. [0] https://en.wikipedia.org/wiki/64-bit_computing#64-bit_data_m... (I figure you know this already, pjmlp, but it might be useful for someone else) [1] https://github.com/aep/zz , see also https://news.ycombinator.com/item?id=22245409

://frama-c.com/acsl_tutorial_index.html [4] https://www.eschertech.com/products/ecv.php

++. [4] [0] https://en.wikipedia.org/wiki/L4_microkernel_family#High_ass... [1] https://en.wikipedia.org/wiki/SPARK_(programming_language) [2] https://github.com/aep/zz [3] https://news.ycombinator.com/item?id=22245409 [4] https://www.eschertech.com/articles/index.php