C++26 stumbles at finish line over Contracts dispute

The next version of the C++ programming language may be delayed at the last minute due to a dispute over a security-enhancing Contracts feature.

Contracts have deeply split C++ technical maintainers. One group backs the C++ creator Bjarne Stroustrup, who is against the technology in its present form in grounds it was hastily implemented. But others are eager to see Contracts implemented, even arguing the tech's detractors are poisoning the C++ development process itself.

The disagreement boiled over just before a vote to ratify the new version of the language.

In October, the Draft International Standard (DIS) of C++26 failed its ISO ballot - the next-to-last stage in the International Organization for Standardization's approval process during which a standard's technical details are formally ratified by a set of national standards bodies.

The ballot saw 13 votes cast in favor, 9 against, and 12 abstentions, failing to meet the ISO requirement of having no more than 25 percent negative votes. Contracts was the major sticking point for those voting nay.

Contracts dispute

Contracts allow developers to add preconditions and postconditions to code, as well as assertions that check whether specified conditions hold. Such checks can help catch programming errors that might otherwise lead to undefined behavior.

Design by Contract has long been a feature of languages like Ada and Eiffel.

Developers have proposed adding Contracts to C++ for at least a decade, after when they were abruptly yanked from C++20 owing to concerns over dangerous defaults.

But Stroustrup roasted the revised proposal (P2900) that made it into C++26.

The P2900 contracts and extensions aim to change the nature of C++ and are an existential threat to C++, adding complexity and bloat," Stroustrup and his colleagues wrote in a paper last August. They noted that the implementation is messy, outdated, not sufficiently tested, and could be more effectively implemented as a library.

Not everyone agrees. Andreas Fertig, a member of the C++ standardization committee, feels that the criticisms have already been vetted and that vetoing the proposal this late in the C++ release process is damaging to C++ itself.

The topic has been worked on for years and has received a majority vote multiple times in its current form. By voting no,' an established system, one based primarily on trust and respectful collaboration, has been shaken," Fertig wrote in a blog post.

The elephant in the room is, of course, the ongoing criticism of how easy it is for developers to accidentally create security holes in C++, leading more than a few projects to adpot Rust. Adding controls might, as Stroustrup notes, hamper C++'s chief attribute of being a blazing-fast language.

Sore losers

Fertig accused Stroustrup and Co. of being sore losers.

Every ISO standard is simply a set of compromises. Everyone loses sometimes, and everyone wins sometimes," he wrote. But in this case, the losing parties refused to accept their loss. The question that primarily determines how to move forward is whether the group can rebuild trust."

Unlike Fertig, Harry Bott, CEO of the C++ Alliance - which maintains the open source EDG C++ compiler front end - does not see the Contracts discussion as disruptive to C++ itself.

The draft being sent back isn't a failure of the process-it's the process working as intended," he wrote to The Register by email. That doesn't mean the process can't improve. The goal should be to learn from this and strengthen the process so C++ can continue to evolve in a way developers can rely on."

Where to now?

With the ballot failing at this late point of the standardization process - a rarity in C++ history - the language risks missing its expected shipping date of this year. That outcome may force everyone to refer to the new version as C++27" rather than C++26. (That's only the informal name; the official name of this eighth version of the language, should it be released next year, would be ISO/IEC 14882:2027.")

ISO C++ working group WG21 is meeting next week in Buzios, Brazil, for the confronto final.

According to a blog post from Thibault Ricord-Marchal, a software engineering consultant at the Paris-based Margo consultancy, the group faces a number of choices.

They can carve Contracts out of the spec so the rest of C++26 can ship. That will be messy work, though. The undo button has to be smashed on a lot of library hardening already done using Contracts.

Another option is moving Contracts into a separate technical specification, where work can continue to refine the technology.

Or they could do a minor revision, vote again and hope the balmy Brazilian weather chills everyone out.(R)