Why C++

Why C++

Sashfold is written in C++23. The choice was argued, not inherited. Five reasons, in the order they weigh.

1. The pledge changes the math

Most of what makes modern C++ miserable is dependency misery: vendored libraries, ABI drift, supply-chain rot. Sashfold is written from scratch wherever that is possible — it links the operating system and the standard runtime and nothing else (The Pledge) — so that misery never arrives.

Meanwhile the strongest practical argument for the alternatives, their package ecosystems, is exactly what the pledge sets aside. A Rust browser with zero crates gives up much of what makes Rust productive. Strip the ecosystems from both sides and you are comparing bare languages, and the gap narrows a great deal.

2. The problem is C++-shaped

Every mature engine — Blink, WebKit, Gecko — is C++, and so is the institutional literature of engine building: LayoutNG's design documents, WebKit's internals, the implementation notes in the specifications themselves. When Sashfold asks how the mature engines solved something, the answer arrives in its own language.

The specifications' core algorithms — the adoption agency, foster parenting, tree mutation with back-pointers everywhere — are aliasing-heavy graph surgery that safe Rust pushes into index arenas and unsafe blocks anyway, as Servo's history shows. The pointer discipline gets hand-rolled either way; here it is hand-rolled with forty years of reference material behind it.

3. The raw OS ABI is a C ABI

Sashfold sits directly on the operating system: Win32 calls, AppKit through objc_msgSend, the Wayland wire protocol over a socket. No bindings, no FFI layer, no generated glue — each of which, for anyone else, would be a dependency.

4. Safety is a process, not a checkbox

• Every parser is fuzzed from the week it is born.
• AddressSanitizer and UndefinedBehaviorSanitizer lanes run in CI on every push.
• Conformance baselines only ratchet upward, so a regression cannot land.
• Process isolation with sandboxed renderers is part of the design, because the language stops none of the logic bugs, specification violations or sandbox-escape classes a browser actually meets — which is why memory-safe browsers need it too.

The C++ itself is C++23 under a disciplined subset: RAII; single-owner arenas (the DOM is a node soup of unique_ptrs owned by the Document); -Werror behind a tall warning wall; no raw new/delete in engine code. The C++ people hate is C++98 plus a thousand unvetted dependencies. That is not what this is.

5. The honest scope note

A fifty-person team building for a decade under CISA memos would weigh the memory-safe-language pressure differently. For a from-scratch engine whose identity is written here, fuzzed from birth, isolated by design, and held to the best of the shipping browsers, C++23 is the pragmatic optimum — and the project's other purpose, a legible engineering signal to engine teams, who are all C++ shops, points the same way.