Compile-time contract checking with nn
summary
Dropbox’s C++ codebase uses a compile-time non-nullable pointer wrapper called nn wrapper that enforces nullability in the type system rather than with annotations; it provides NN make_unique/NN make_shared helpers, implicit conversions to the underlying pointer, operator* and -> forwarding, and macros that assert or throw on explicit boundary checks. Building it required heavy template tricks, workarounds for Clang/GCC conversion bugs, and revealed move-from dangers and dead code; source and tests live on GitHub.
AI-written summary · about
chapters (10)
- 0:00Introduction to compile-time null checks
- 1:02Motivation and C++ flexibility
- 4:09Why null is problematic
- 5:36What we built: NN wrapper
- 8:10NN constructor and conversion rules
- 12:09Real-world compiler bugs and workarounds
- 13:57Integration into Dropbox codebase
- 16:26Move semantics and non-null pointers
- 17:29Future directions and limitations
- 18:56Q&A session
related talks
01h 26mA Path to Practically Safe C++
46mC++: No more nulls! (Fixing the billion dollar mistake)
01h 31mWhat C++ Needs to be Safe
01h 05m“Contract Programming in C++(20) (part 2 of 2)”
01h 28mWhat C++ Needs to be Safe
01h 08mImplementing the C++ Core Guidelines’ Lifetime Safety Profile in Clang
01h 02mTowards Safety and Security in C++26
24mMemory-safe interoperation between safe and unsafe languages