vkuttyp/CeeSafe

Memory-safe systems programming, compiled to C.
CeeSafe is a systems programming language with C#-, Java- and TypeScript-style syntax and Rust-style ownership and
borrowing.
ceesafec compiles it ahead of time to portable, readable C11, so a CeeSafe program runs wherever a C compiler does:
Linux, macOS and Windows, bare metal, and inside an operating system kernel. There is no garbage collector and no
reference counting; values are destroyed deterministically. The compiler is written in CeeSafe and rebuilds itself to
the same bytes.
Documentation ·
Getting started ·
Specification ·
Releases ·
Performance
ceesafe
struct Account {
id: u64;
balance: i64;
public fn deposit(borrow mut this, amount: i64) {
this.balance += amount;
drop {
Console.write("closing account ");
Console.writeLine(this.id);
fn main() {
var account = Account { id: 7, balance: 0 };
account.deposit(100);
Console.writeLine(account.balance);
text
100
closing account 7
## Why CeeSafe
In safe code (everything outside an unsafe block), CeeSafe rules out:
use after free and double free: every value has one owner and is destroyed exactly once;
dangling references: a reference cannot outlive what it refers to, checked without lifetime annotations in most
code;
conflicting access: while something is borrowed it cannot be changed, and while it is borrowed mutably nothing
else can read it;
out-of-bounds access and uninitialised reads: indexes are checked, and variables must be assigned before use;
silent integer overflow: overflow stops the program in every build; wrapping is written explicitly
(x.wrappingAdd(y)).
And beyond safety:
Structured async and threads. async fn and await run many waits on one thread (timers, sockets, files,
channels, DNS) with no garbage collector and no task that outlives its caller: Async.scope starts children that may
borrow the caller's locals and have all returned when it does, Async.tasks starts them as work comes (a task per
connection, up to a limit), Async.race and Async.all take two, a failure cancels the rest, and Async.timeout
bounds any of it. Each task's frame has a size known at compile time and never
moves. TCP and UDP sockets speak IPv4 and IPv6 on epoll, kqueue, iouring and IOCP, with socket options, vectored
sends, files sent by the kernel (sendfile, TransmitFile), datagrams with ECN bits and segments, and portable
network errors. Async.runWorkers spreads
tasks over threads; Thread.spawn, Thread.both, Arc, Mutex and atomics share data, with Send and Share
checked.
Explicit, pluggable allocation. Each allocation chooses its allocator: the system heap, an arena, a pool, a fixed
buffer, a scratch frame, or your own. Allocation failure is a value, Result , handled or propagated
with ?. A box that cannot escape its function is placed on the stack.
C you can read. Structured, warning-clean C11 for clang, gcc and MSVC, with #line maps back to CeeSafe source
for lldb and gdb, and a reference interpreter that runs the same programs.
Ready for kernels. A freestanding profile with no C library, context effects that reject sleeping under a spin
lock, lock guards and kernel objects, and an async executor over the kernel's own hooks. CeeSafe states C's own