The Profiles framework brings language-level safety to C++: closing entire classes of undefined behavior at the source, and checking the rest.
A program that doesn’t violate the initialization profile runs exactly the same if the profile is enforced or not (or fails to compile if the profile isn’t enforced).Bjarne Stroustrup, “An initialization profile” (P4222)
Uninitialized reads are among the cheapest defects to write and among the most expensive to diagnose. An initialization profile makes them ill-formed: every object is initialized before it is read, a user-provided constructor must initialize every member, and the static initialization order fiasco becomes a compile error. Where raw storage is required, the hole is named.
A memory-safety profile starts from default-deny: an access is invalid unless the compiler can prove it belongs on the whitelist. When vector’s operator[] carries the bounds rule, every caller inherits the guarantee without annotating the call.
“Unprovable in the general case” is not the same as “unaddressable in the cases that dominate production.” Profiles target what the compiler can see. Those cases become ill-formed. The residue is enumerated and handled as runtime.
Profiles are adopted per translation unit. There is no flag day, and the annotations that are required are local, verifiable, and do not change semantics. A project can enforce initialization in new files this week and leave a device driver on a recorded suppress until it is ready.
Safety that cannot be locally waived is safety that will be globally disabled. A suppress is named, scoped, and carries a recorded justification. The hole is greppable. Silence is not a dialect.
For the runtime-checkable residue, a profile enumerates the cases, owns the check, and owns the response. The argued default is termination. Continuation past core-language undefined behavior is not the portable guarantee. The goal is not merely to avoid executing past undefined behavior but to eliminate it, which requires that the checks themselves cannot be optimized away by the undefined behavior they guard.
A profile attests that these rules hold, or the program is ill-formed / does not proceed. That is a different object from a named bundle of switches over someone else’s machinery. A preset only selects from available settings; an attestor can reject the whole program.
Library authors do the local work once; applications consume it. The annotations belong in a few specific places: constructors that must initialize every member, bounds checks inside operator[], and lifetime transitions at the allocator boundary.
A profile is a portable language rule. The same source, under the same profile, is intended to be ill-formed or well-formed regardless of which vendor compiled it. If two implementations can disagree about whether a safety rule held, users have a vendor option, not a rule.
| Number | Title | Focus Area |
|---|---|---|
| P3589 | C++ Profiles: The FrameworkGabriel Dos Reis | Framework |
| P3970 | Profiles and Safety: a call to action | Direction |
| P4222 | An initialization profile | Initialization |
| P4296 | Default-Deny + Provable-Whitelist Invalidation | Memory Safety |
| P4297 | Severing P3100’s Profiles Claim from Its Case-by-Case Review | Architecture |
| P4306 | Configuring Runtime Checking: Profiles and Implicit Contract Assertions | Configuration |
| P4308 | Eight Responses to a Throwing Implicit Contract Assertion | Contract Responses |
| P4318 | Transient Benefit, Perpetual Cost: Implicit Core-Language Assertions | Cost Analysis |
| P4238 | Returning C++26 for the Evaluation It Skipped | Process |
Eight worked examples of the initialization profile, live on Compiler Explorer.
Profiles-enabled Clang · -std=c++23 -fprofiles
// std::init: every object is initialized before it is read. [[profiles::enforce(std::init)]]; struct Options { int timeout_ms; bool verbose; }; int run(int argc, const char **argv) { Options opts; // error: indeterminate int retries; // error: uninitialized return opts.timeout_ms * retries; }
[[uninit]]Skip the zeroing without giving up the guarantee[[ref_to_uninit]]Tell raw storage apart from live objects, at every call site[[now_init]] / [[now_uninit]]The construct/destroy cycle, checked at compile timeContracts are a valuable tool for documentation, validation, and optimization. But they are not a safety net. Contracts can be disabled, ignored, or forgotten. Safety must not depend on programmer discipline or build modes.
Profiles bake safety into the language rules. They close entire classes of undefined behavior by construction, not convention.
Contracts can describe intent. Profiles guarantee it.
An alternative that is stripped by a build mode is not a safety net. The person who ships the binary is often not the person who wrote the annotation. Discipline is not a mechanism.P3100R8
The leading paper for the alternative states that existing implementations are already conforming with its wording transformation. A vendor may treat the new checks as assumptions and generate the same code as today.P3100R8
Some designs invoke a handler and then continue. At the core-language-undefined class, continuation is execution in a state the language does not define. That is a protocol for living with undefined behavior, not closing it.P4318R1
By the alternative’s own census, only 20 of 82 enumerated core-undefined-behavior cases are unconditionally locally runtime-checkable. A facility that cannot see most of the problem should not be the substrate every other story sits on.P3100R8
The same census concludes that none of the 82 cases can be unconditionally diagnosed at compile time. “Unprovable in general” is not “unaddressable in the common cases.”P3100R8
One documented example flips the result of a well-formed program: noexcept of an expression that would become a core-language check is no longer the noexcept programmers have been writing for a decade.P4308R1
The evaluation semantics are selected outside the source, by whoever owns the final build rather than the author of the code. C++26 defines four of them for explicit contract assertions; the proposal adds a fifth, assume, for the implicit assertions that guard core-language undefined behavior, letting the optimizer rely on a condition that was never checked.P4308R1
Additive at the wording level is how a substrate gets locked. Once every core-language check is routed through a single program-wide handler, every later safety feature inherits that routing.P4297R1
Arbitrary predicates are attractive in slides and expensive in tools. A rule fixed by the language gives an analyzer one thing to reason about across every call site; an arbitrary boolean expression has to be understood a case at a time.
A check that can throw can unwind, and unwinding is not free on every ABI. A check treated as an assumption can widen undefined behavior rather than close it. Cost studies leave the largest of these effects for future work.P4318R1
I just want C++ to let me enforce our already-well-known safety rules and best practices by default, and make me opt out explicitly if that’s what I want.Herb Sutter
SG23 and EWG have repeatedly (by massive votes) pointed to “Profiles” as the direction for addressing these urgent needs … The way to make progress is to build on the proposed Profiles framework.David Vandevoorde
To address the contemporary challenge of memory safety concerns, we need some standard profiles related to type and memory safety, guaranteed to be available in all C++ implementations.Gabriel Dos Reis