CppCon 2024

The Common Package Specification (CPS) is an important initiative to improve the C and C++ tooling ecosystem (and developers life). Last year CppCon2023 talks and discussions have been followed up with continuous work in the specification. This talk advances in the topic by presenting a working implementation of usage of CPS files in Conan C++ package manager and describing the different challenges, approaches and lessons learned in the process.

First, it will be presented how the current package information in ConanCenter allows the automatic creation of CPS files for many tens of thousands of packages for most of the popular C and C++ open source libraries. Even if that is not the end goal and expected flow of the CPS, this can provide an invaluable resource for experimentation and validation of both the specification and tools using it.

Then, the generation and management of CPS files inside packages will be described, including the challenges of managing multiple binary configurations, how to mix them with system-installed packages and how to consume them, both in single and multi-configuration scenarios.

Finally, how the mapping from CPS files to the different build systems (CMake, Meson, Autotools, MSBuild) is implemented via the generation of build-system specific files will be presented.

The talk will conclude with a summary of the lessons learned, open issues and discussion about the future.

"ERROR: RealtimeSanitizer: call to malloc detected during execution of realtime function MyAudioCallback::process!"

"Warning: MyAudioCallback::process must not call blocking fuction ‘SkectchyCall`"

Realtime programmers working on mission-critical audio, autonomous vehicle, and aerospace code are well-acquainted with the golden rule: “Thou shalt not call time-unbounded operations in your realtime thread.” Despite its importance, tools to enforce this rule have been non-existent—until now!

In the latest version of Clang, two new features help uphold realtime guarantees by preventing `malloc`, system calls, and user-defined "unsafe" functions. First, we introduce the Realtime Sanitizer, which detects calls to `malloc`, `pthread_mutex_lock`, and other problematic functions in your realtime code at runtime. Next, we explore the `-Wperf-constraints` system, which provides similar feedback statically at compile time. We will compare and contrast these methods and offer recommendations on how to integrate them into your codebase effectively.

By leveraging these new tools, you can ensure your real-time systems remain robust, reliable, and ready for any challenge.

Efficient memory utilization is a critical aspect of software running in a multi-tenant environment, where resources are shared amongst different processes. Unlike languages with automatic memory management, C++ allows for manual memory management. Developers have control over when memory is allocated and released, which can lead to more efficient resource usage, but also can lead to mistakes causing problems in memory. 

You plugged new code in for a fancy feature and all functional tests were green! You clicked the deploy button, but 10 minutes later an alarm came -- machine memory usage had reached 90%! Things can get even more complicated when you work on a project with numerous contributors. How do you know which of the latest commits resulted in your process eating up all the memory of the OS and never releasing it back?

In this talk, I will try to put together some useful pieces from the real world in order to paint a comprehensive picture from the perspective of a novice C++ developer. By the end of the presentation, you'll have a basic understanding of C++ memory allocation, an awareness of potential memory issues, and the know-how to leverage tools for profiling and analyzing your C++ applications.

Most C++ developers are familiar with the type of errors that arise when a shared library is not found. If they are really unlucky, they are have also faced a situation where the the wrong version of a library is loaded. However, a lot of us resort to suboptimal solutions just to get going, without fully addressing the root causes.

A lot of the time, we focus on the “build” process, that is, producing our binaries and executables. But getting the runtime linker/loader to locate the right libraries (and the right versions!) has a unique set of challenges that  should not be overlooked - after all, running the executables is critical for running tests, continuous integration, and obviously end-users running our apps and services.

Managing dependencies continues to be one of the top frustrations of C++ developers as per the most recents ISO C++ Developer Surveys. When it comes to shared libraries - different applications try to locate them at different times: the build system (e.g. CMake or Autotools) when configuring the build, the linker at build time, and the dynamic linker/loader at runtime.

This talk will cover in detail the different scenarios in which shared libraries need to be located, and how this is handled by package managers, build systems, and the the OS level. Emphasis will be placed on familiarizing the developer with the relevant tooling across multiple platforms, as well as associated concepts (e.g. RPATHs).

An often overlooked aspect will also be covered: how to create a self-contained, relocatable bundle for our user-facing applications, decoupled from the developer environment, as opposed to “works on my machine”.

C++ is often criticized for its lack of inherent memory safety, but the spectrum of potential program validations extends far beyond just memory concerns. This talk delves into the necessity of early validation, emphasizing the benefits of compile-time checks in C++. By leveraging compile-time validation, developers can catch errors and enforce constraints before the code is even executed, enhancing both safety and correctness.

A functional programming approach to compile-time validation will be discussed, highlighting its benefits and demonstrating its application in ensuring code correctness.

Moreover, the talk will delve into the realm of compile-time unit tests, showcasing how they enable developers to validate code behavior at compile time, paving the way for more efficient debugging and maintenance.

Exploring advanced features, we'll discuss existing compile-time techniques to implement lifetimes, borrow checker, and other validation rules by leveraging template metaprogramming for memory safety and how they can be improved with the upcoming C++26 reflection proposal.

Additionally, we will review language extensions and compiler-specific features that augment compile-time validation capabilities. Finally, the talk will cover the role of static analysis tools in detecting potential issues early in the development process, thus complementing compile-time techniques. Attendees will gain a comprehensive understanding of the various strategies available for enhancing program reliability through compile-time validation in C++.

Cppcheck has been evolving for 17 years, guided by a clear philosophy: minimal false positives and ease of use. This presentation will share the insights we've gained during its development. Our approach to easy configuration is a double-edged sword, providing user-friendly setup while occasionally leading to lower recall. We maintain a strict definition of false positives, ensuring the tool does not warn about well-written, functional code. This principle, while challenging, drives us to fix rather than suppress false positives. A core philosophy of Cppcheck is to learn from mistakes. When an issue is identified, we strive to implement checkers to prevent similar mistakes in the future.

The open-source community plays a crucial role in Cppcheck's evolution. We collaborate to enhance the tool, scanning large codebases like Debian's source code to identify inconsistent or dangerous code and measure false positives. We also explore how abstractions, compiler annotations, and contracts can improve SCA tools' precision and performance. This talk will provide a comprehensive look at the lessons learned and the continuous improvement of Cppcheck.

You must have a certain skill set to write a scripting binding interface for C++ like luabind, sol2, pybind, or ChaiScript. This is a skill set that few seem to posses. But developing this skill set helps you to understand the language in a new, deeper, and more unique way.

We will start from the first principles of what we are trying to accomplish and why. We will then cover the basics of deducing function signatures with templates and the limitations that are hit when you have function overloads. We will wrap these user provided functions with a compile time <-> runtime interface, then demonstrate a simple function dispatch engine.

If we have time, we will then show function reference syntax and how you can use this to bind script engine functions back into the C++ statically typed world.

We will not get to an actual parser for a scripting language. That will be left as an exercise to the viewer.

Clang's compilation database specification has been a way for tools to understand what is happening within a build. It has been used to drive language server protocols for editor/IDE integration, facilitate static analysis over codebases, and more. Alas, it is not powerful enough to properly describe a build that includes C++ modules. Something more is needed: a build database.

In this talk, I'll explore the limitations of the compilation database when it comes to modules, why modules require further enhancement, and plans in the works to generate the additional information needed to understand how the build of a codebase using C++ modules really works.

Unit testing is a crucial practice for ensuring software safety. However, boundary cases, particularly those involving error handling and failure-tolerant logic, can be challenging to test in real-world applications. When writing test cases, the caller side of a target function may lack the necessary information to determine why an error occurred. Additionally, existing unit testing frameworks often cannot identify which path is exercised when multiple paths can produce similar outputs. These challenges are also present during fuzzing.

This talk introduces a lightweight, header-only C++11 library designed to address these issues. By including a single header file, users gain access to an integrated framework that combines assertion, logging, unit testing, and fuzzing, offering a more cohesive solution than using separate frameworks.

Attendees will learn about the design and unique features of this library, including:

* **Integrated Assertion and Logging**: The library's assertion/logging macros allow unit tests to be aware of assertion failures and logged data, incorporating this information into the test reports.
* **Structured Logging**: Developers can log structured data and access it during unit tests, making it easier to diagnose issues when errors occur.
* **Fuzzing API**: With a simple, structure-aware fuzzing API and support for Clang and libFuzzer, users can quickly run fuzzing tests within their unit testing framework, utilizing all the aforementioned features.

By the end of the talk, the audience will leave an understanding of how this library enhances the ease of writing unit tests and improves the overall safety of C++ applications.

When your code base is growing, the time it takes to compile is also growing. But why, where is the compiler spending time? Lots of focus in C++ is on the performance of compiled code, but when you're compiling millions of lines of code, its important to pay attention to the build times. Neglecting this aspect can lead to significant losses in developer productivity.

In this talk, I will explore some capabilities built into Clang and Ninja that C++ developers can use to identify, understand, and mitigate long build times.

Get ready to dive into the latest C++ developments in Visual Studio Code (VS Code) developed in the last year. Our focus has been on faster extension performance, from optimizing the time to colorization to faster symbol searching in your workspace. Also, discover how VS Code has been supercharged to boost your productivity through new features such as extracting to a function and an easier CMake integration process for your projects. Throughout this session, we will deep dive into how you can leverage GitHub Copilot, your AI-powered pair programmer, to create, maintain, and optimize your C++ projects. Whether you are a VS Code veteran or just getting started, join us to learn more about the newest features in VS Code.

C++20 modules represent a significant advancement in the language, promising to improve compile times, enhance code organization, and streamline dependency management. This talk is tailored for developers eager to harness the power of C++20 modules in their projects. We will explore the fundamentals of building both shared and static libraries using CMake, the de facto build system for C++.

Attendees will gain practical insights into setting up build files and organizing source code with modules. We will dissect real-world open-source module projects, offering a concrete understanding of how modules are being used in the wild. A key focus will be on the "import std" model, demonstrating how to create a module interface for large, existing libraries, facilitating a smoother transition to modular codebases.

Significantly, CMake released non-experimental support for C++20 modules in October 2023, marking a pivotal moment for developers. Visual Studio, Clang and GCC all have some level of support for modules. However, the adoption of this feature is still in its early stages, with relatively few projects currently leveraging it. This session will bridge that gap, providing the essential knowledge and hands-on techniques to confidently integrate C++20 modules into your development workflow.

By the end of this session, participants will be equipped with the knowledge to effectively use CMake for building projects with C++20 modules, making the most of this cutting-edge feature to enhance their codebases. Whether you're maintaining legacy code or starting a new project, this talk will provide the essential tools and techniques to master C++20 modules.

A practical guide to bridging the gap between C++ and Rust. We cover bindings, including a manual approach, and compare them with generated bindings using CXX.  We also show how to link CMake with Cargo and link with transitive C++ dependencies using Conan.

Code reflection is an extremely valuable feature for many areas in programming. By allowing you to reason about code as data. Reflection can be used for e.g. Serialization, Networking and content editors.

However, since reflection is not a C++ language feature yet. I will use a new tooling opportunity: ".ifc" Binary Module Interface files to implement a reflection library. Made possible by Gabriel Dos Reis‘s efforts to open source [the specification of MSVC’s Binary Module Interface](https://github.com/microsoft/ifc-spec).

This approach solves issues of current C++ reflection libraries. Which either rely on manual typeinfo registration, leading to constant work to keep them in sync. Or parsing C++ source code which is slow and needs deep integration into your desired build system.

If you want to find out all the new features and improvements we've made to Visual Studio, MSVC, and vcpkg for C++ developers in the last year, this is the talk for you.

The last year has seen a huge explosion in AI tooling. In Visual Studio, this comes in the form of GitHub Copilot: an AI pair programmer for providing in-editor suggestions, answering questions through a chat interface, and more.

Outside of AI, we've continued to improve the core Visual Studio experience regardless of the platform you're targeting. For example, we've made improvements to our CMake and remote Linux support, our Unreal Engine experience, tools for memory layout visualization and #include cleanups, new visualizations for C++ Build Insights, in-editor support for GitHub pull requests. Of course, we've also continued work on C++ standards conformance and the code generation of the MSVC compiler.

You'll see all of these features in action in a real-world codebase to see how they can improve your day-to-day development by augmenting your existing workflows and giving you new utilities to add to your toolbelt.