Contracts programming for C++20
|
|
|
- Louise Robertson
- 6 years ago
- Views:
Transcription
1 Contracts programming for C++20 Current proposal status J. Daniel Garcia ARCOS Group University Carlos III of Madrid Spain April, 28th, 2017 cbed J. Daniel Garcia 1/58
2 Warning c This work is under Attribution-NonCommercial- NoDerivatives 4.0 International (CC BY-NC-ND 4.0) license. You are free to Share copy and redistribute the material in any medium or format. b You must give appropriate credit, provide a link to the license, and indicate if changes were made. You may do so in any reasonable manner, but not in any way that suggests the licensor endorses you or your use. e d You may not use the material for commercial purposes. If you remix, transform, or build upon the material, you may not distribute the modified material. cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 2/58
3 Download this slides Download the slides: others/talks-and-seminars/ cbed J. Daniel Garcia 3/58
4 Who am I? A C++ programmer. Started writing C++ code in cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 4/58
5 Who am I? A C++ programmer. Started writing C++ code in A university professor in Computer Architecture. cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 4/58
6 Who am I? A C++ programmer. Started writing C++ code in A university professor in Computer Architecture. A ISO C++ language standards committee member. cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 4/58
7 Who am I? A C++ programmer. Started writing C++ code in A university professor in Computer Architecture. A ISO C++ language standards committee member. My goal: Improve applications programming. Performance faster applications. Energy efficiency better performance per Watt. Maintainability easier to modify. Reliability safer components. More at: cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 4/58
8 UC3M: A young, international, research oriented university. ARCOS: Applied research group: Lines: High Performance Computing, Big data, Cyberphisical Systems, and Programming Models for Application Improvement Improving Applications: REPARA: Reengineering and Enabling Performance and power of Applications. Funded by EU (FP7). RePhrase: REfactoring Parallel Heterogeneous Resource Aware Applications. Funded by EU (H2020). Standards: ISO/IEC JTC/SC22/WG21. ISO C++ Committee. cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 5/58
9 A brief history of contracts 1 A brief history of contracts 2 Introduction 3 Contracts in C++ 4 Contract checking 5 Contracts on interfaces 6 Final notes cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 6/58
10 A brief history of contracts Why correctness? cbed J. Daniel Garcia 7/58
11 A brief history of contracts Why correctness? If it doesn t have to produce correct results, I can make it arbitrarily fast. Gerald M. Weinberg cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 7/58
12 A brief history of contracts Why correctness? If it doesn t have to produce correct results, I can make it arbitrarily fast. Gerald M. Weinberg Correctness is clearly the prime quality. If a system does not do what it is supposed to do, then everything else about it matters little. Bertrand Meyer cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 7/58
13 A brief history of contracts Why are we here? Because we are concerned about writing correct software. cbed J. Daniel Garcia 8/58
14 A brief history of contracts Why are we here? Because we are concerned about writing correct software. Isn t a library solution enough? cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 8/58
15 A brief history of contracts Why are we here? Because we are concerned about writing correct software. Isn t a library solution enough? We already tried that! Compilers and static analyzers do not understand that approach. cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 8/58
16 A brief history of contracts Why are we here? Because we are concerned about writing correct software. Isn t a library solution enough? We already tried that! Compilers and static analyzers do not understand that approach. What did others do? cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 8/58
17 A brief history of contracts Why are we here? Because we are concerned about writing correct software. Isn t a library solution enough? We already tried that! Compilers and static analyzers do not understand that approach. What did others do? Several language solutions out there (D, Ada, C#). cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 8/58
18 A brief history of contracts Contracts in C++ First proposal for contracts programming in N1613: Proposal to add Design by Contract to C++. Throsten Ottosen. Died during the C++0x process. cbed J. Daniel Garcia 9/58
19 A brief history of contracts Contracts in C++ First proposal for contracts programming in N1613: Proposal to add Design by Contract to C++. Throsten Ottosen. Died during the C++0x process. Next attempt in N3604: Centralized Defensive-Programming Support for Narrow Contracts. John Lakos, Alexei Zakharov. cbed J. Daniel Garcia 9/58
20 A brief history of contracts Current contracts effort :Multiple proposals on contracts programming. Discussions in the standards committee. cbed J. Daniel Garcia 10/58
21 A brief history of contracts Current contracts effort :Multiple proposals on contracts programming. Discussions in the standards committee. 2016: Joint proposal trying to consider trade-offs. Gabriel Dos Reis, J. Daniel Garcia, John Lakos, Alisdair Meredith, Nathan Myers, Bjarne Stroustrup. Many others provided feedback and ideas. Targeting C++20!. cbed J. Daniel Garcia 10/58
22 Introduction 1 A brief history of contracts 2 Introduction 3 Contracts in C++ 4 Contract checking 5 Contracts on interfaces 6 Final notes cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 11/58
23 Introduction Correctness and Robustness In the design of a library two related properties need to be considered: robustness and correctness. cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 12/58
24 Introduction Correctness and Robustness In the design of a library two related properties need to be considered: robustness and correctness. Correctness Degree to which a software component matches its specification. cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 12/58
25 Introduction Correctness and Robustness In the design of a library two related properties need to be considered: robustness and correctness. Correctness Degree to which a software component matches its specification. Robustness Ability of a software component to react appropriately to abnormal conditions. cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 12/58
26 Introduction Correctness and Robustness In the design of a library two related properties need to be considered: robustness and correctness. Correctness Degree to which a software component matches its specification. Robustness Ability of a software component to react appropriately to abnormal conditions. Today many libraries use a single feature for managing both properties: exception handling. cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 12/58
27 Introduction Exceptions in use When a failure happens, we use exceptions as an error reporting mechanism. cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 13/58
28 Introduction Exceptions in use When a failure happens, we use exceptions as an error reporting mechanism. Notify that an error has occurred and needs to be handled. cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 13/58
29 Introduction Exceptions in use When a failure happens, we use exceptions as an error reporting mechanism. Notify that an error has occurred and needs to be handled. We decouple error identification from error handling. cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 13/58
30 Introduction Exceptions in use When a failure happens, we use exceptions as an error reporting mechanism. Notify that an error has occurred and needs to be handled. We decouple error identification from error handling. Example: Throwing bad_alloc. cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 13/58
31 Introduction Exceptions in use When a failure happens, we use exceptions as an error reporting mechanism. Notify that an error has occurred and needs to be handled. We decouple error identification from error handling. Example: Throwing bad_alloc. When library detects an assumption was not met, it needs a mechanism to react. cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 13/58
32 Introduction Exceptions in use When a failure happens, we use exceptions as an error reporting mechanism. Notify that an error has occurred and needs to be handled. We decouple error identification from error handling. Example: Throwing bad_alloc. When library detects an assumption was not met, it needs a mechanism to react. Assumption not met contract violation. cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 13/58
33 Introduction Exceptions in use When a failure happens, we use exceptions as an error reporting mechanism. Notify that an error has occurred and needs to be handled. We decouple error identification from error handling. Example: Throwing bad_alloc. When library detects an assumption was not met, it needs a mechanism to react. Assumption not met contract violation. What do we do on contract violations today? cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 13/58
34 Introduction Exceptions in use When a failure happens, we use exceptions as an error reporting mechanism. Notify that an error has occurred and needs to be handled. We decouple error identification from error handling. Example: Throwing bad_alloc. When library detects an assumption was not met, it needs a mechanism to react. Assumption not met contract violation. What do we do on contract violations today? Ignore reality. cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 13/58
35 Introduction Exceptions in use When a failure happens, we use exceptions as an error reporting mechanism. Notify that an error has occurred and needs to be handled. We decouple error identification from error handling. Example: Throwing bad_alloc. When library detects an assumption was not met, it needs a mechanism to react. Assumption not met contract violation. What do we do on contract violations today? Ignore reality. Document. cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 13/58
36 Introduction Exceptions in use When a failure happens, we use exceptions as an error reporting mechanism. Notify that an error has occurred and needs to be handled. We decouple error identification from error handling. Example: Throwing bad_alloc. When library detects an assumption was not met, it needs a mechanism to react. Assumption not met contract violation. What do we do on contract violations today? Ignore reality. Document. Throw exceptions. cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 13/58
37 Introduction Exceptions in use When a failure happens, we use exceptions as an error reporting mechanism. Notify that an error has occurred and needs to be handled. We decouple error identification from error handling. Example: Throwing bad_alloc. When library detects an assumption was not met, it needs a mechanism to react. Assumption not met contract violation. What do we do on contract violations today? Ignore reality. Document. Throw exceptions. Robustness and correctness are orthogonal properties and should be managed independently. cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 13/58
38 Introduction Robustness in the C++ standard library Robustness: Identification and handling of abnormal situations. cbed J. Daniel Garcia 14/58
39 Introduction Robustness in the C++ standard library Robustness: Identification and handling of abnormal situations. Those situations occur in completely correct programs. cbed J. Daniel Garcia 14/58
40 Introduction Robustness in the C++ standard library Robustness: Identification and handling of abnormal situations. Those situations occur in completely correct programs. Example: Failure to allocate memory. cbed J. Daniel Garcia 14/58
41 Introduction Robustness in the C++ standard library Robustness: Identification and handling of abnormal situations. Those situations occur in completely correct programs. Example: Failure to allocate memory. You might eventually recover from a robustness issue. cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 14/58
42 Introduction Robustness in the C++ standard library Robustness: Identification and handling of abnormal situations. Those situations occur in completely correct programs. Example: Failure to allocate memory. You might eventually recover from a robustness issue. Or at least gracefully shutdown. cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 14/58
43 Introduction Robustness in the C++ standard library Robustness: Identification and handling of abnormal situations. Those situations occur in completely correct programs. Example: Failure to allocate memory. You might eventually recover from a robustness issue. Or at least gracefully shutdown. Is end of file a robustness issue? cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 14/58
44 Introduction Robustness in the C++ standard library Robustness: Identification and handling of abnormal situations. Those situations occur in completely correct programs. Example: Failure to allocate memory. You might eventually recover from a robustness issue. Or at least gracefully shutdown. Is end of file a robustness issue? The C++ standard library identifies those cases by specifying cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 14/58
45 Introduction Robustness in the C++ standard library Robustness: Identification and handling of abnormal situations. Those situations occur in completely correct programs. Example: Failure to allocate memory. You might eventually recover from a robustness issue. Or at least gracefully shutdown. Is end of file a robustness issue? The C++ standard library identifies those cases by specifying i the condition firing the situation. cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 14/58
46 Introduction Robustness in the C++ standard library Robustness: Identification and handling of abnormal situations. Those situations occur in completely correct programs. Example: Failure to allocate memory. You might eventually recover from a robustness issue. Or at least gracefully shutdown. Is end of file a robustness issue? The C++ standard library identifies those cases by specifying i the condition firing the situation. ii the exception that will be thrown to notify. cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 14/58
47 Introduction Robustness in the C++ standard library Robustness: Identification and handling of abnormal situations. Those situations occur in completely correct programs. Example: Failure to allocate memory. You might eventually recover from a robustness issue. Or at least gracefully shutdown. Is end of file a robustness issue? The C++ standard library identifies those cases by specifying i the condition firing the situation. ii the exception that will be thrown to notify. T * allocator<t>::allocate(std::size_t n); Throws: bad_alloc if storage cannot be obtained. cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 14/58
48 Introduction Correctness and contracts Correctness Finding programming errors. Yes! Sometimes we write incorrect software. cbed J. Daniel Garcia 15/58
49 Introduction Correctness and contracts Correctness Finding programming errors. Yes! Sometimes we write incorrect software. Who s guilty? A contract violation happens because: A caller does not fulfil the expectations before calling a function. A callee does not fulfill what should be ensured after its own execution. cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 15/58
50 Introduction Correctness and contracts Correctness Finding programming errors. Yes! Sometimes we write incorrect software. Who s guilty? A contract violation happens because: A caller does not fulfil the expectations before calling a function. A callee does not fulfill what should be ensured after its own execution. A key difference: A program failure is usually due to external conditions and cannot be avoided. A contract violation should never happen in a correct program. cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 15/58
51 Introduction Correctness in the C++ standard library From the standard: Violation of the preconditions specified in a function s Requires: paragraph results in undefined behavior unless the functions Throws: paragraph specifies throwing an exception when the precondition is violated. cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 16/58
52 Introduction Correctness in the C++ standard library From the standard: Violation of the preconditions specified in a function s Requires: paragraph results in undefined behavior unless the functions Throws: paragraph specifies throwing an exception when the precondition is violated. In practice, there are two approaches in the standard library: Do nothing Undefined behaviour. Notify Throw an exception. cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 16/58
53 Introduction Can we do it better? Can we do more than just run-time checks? cbed J. Daniel Garcia 17/58
54 Introduction Can we do it better? Can we do more than just run-time checks? Can we use contracts information for optimizing-out code? Should we? cbed J. Daniel Garcia 17/58
55 Introduction Can we do it better? Can we do more than just run-time checks? Can we use contracts information for optimizing-out code? Should we? Can we make our semantics available to external tools? cbed J. Daniel Garcia 17/58
56 Introduction Can we do it better? Can we do more than just run-time checks? Can we use contracts information for optimizing-out code? Should we? Can we make our semantics available to external tools? Can we avoid the comment/code synch issue? cbed J. Daniel Garcia 17/58
57 Introduction Can we do it better? Can we do more than just run-time checks? Can we use contracts information for optimizing-out code? Should we? Can we make our semantics available to external tools? Can we avoid the comment/code synch issue? Can we learn from experiences in other programming languages? cbed J. Daniel Garcia 17/58
58 Introduction Can we do it better? Can we do more than just run-time checks? Can we use contracts information for optimizing-out code? Should we? Can we make our semantics available to external tools? Can we avoid the comment/code synch issue? Can we learn from experiences in other programming languages? Can we serve different communities with different needs? cbed J. Daniel Garcia 17/58
59 Contracts in C++ 1 A brief history of contracts 2 Introduction 3 Contracts in C++ 4 Contract checking 5 Contracts on interfaces 6 Final notes cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 18/58
60 Contracts in C++ What is a contract? A contract is the set of preconditions, postconditions and assertions associated to a function. cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 19/58
61 Contracts in C++ What is a contract? A contract is the set of preconditions, postconditions and assertions associated to a function. Precondition: What are the expectations of the function? cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 19/58
62 Contracts in C++ What is a contract? A contract is the set of preconditions, postconditions and assertions associated to a function. Precondition: What are the expectations of the function? Postconditions: What must the function ensure upon termination? cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 19/58
63 Contracts in C++ What is a contract? A contract is the set of preconditions, postconditions and assertions associated to a function. Precondition: What are the expectations of the function? Postconditions: What must the function ensure upon termination? Assertions: What predicates must be satisfied in specific locations of a function body? cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 19/58
64 Contracts in C++ What is a contract? A contract is the set of preconditions, postconditions and assertions associated to a function. Precondition: What are the expectations of the function? Postconditions: What must the function ensure upon termination? Assertions: What predicates must be satisfied in specific locations of a function body? It states rights and obligations of client and supplier. cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 19/58
65 Contracts in C++ Expectations Precondition A predicate that should hold upon entry into a function. It expresses a function s expectation on its arguments and/or the state of objects that may be used by the function. Expressed by attribute expects. cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 20/58
66 Contracts in C++ Expectations Precondition A predicate that should hold upon entry into a function. It expresses a function s expectation on its arguments and/or the state of objects that may be used by the function. Expressed by attribute expects. double sqrt(double x) [[expects: x>0]]; cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 20/58
67 Contracts in C++ Expectations Precondition A predicate that should hold upon entry into a function. It expresses a function s expectation on its arguments and/or the state of objects that may be used by the function. Expressed by attribute expects. double sqrt(double x) [[expects: x>0]]; class queue { //... void push(const T & x) [[expects:! full () ]]; //... }; cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 20/58
68 Contracts in C++ Expectations Precondition A predicate that should hold upon entry into a function. It expresses a function s expectation on its arguments and/or the state of objects that may be used by the function. Expressed by attribute expects. double sqrt(double x) [[expects: x>0]]; class queue { //... void push(const T & x) [[expects:! full () ]]; //... }; Preconditions use a modified attribute syntax. The expectation is part of the function declaration. cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 20/58
69 Contracts in C++ Assurances Postcondition A predicate that should hold upon exit from a function. It expresses the conditions that a function should ensure for the return value and/or the state of objects that may be used by the function. Postconditions are expressed by ensures attributes. cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 21/58
70 Contracts in C++ Assurances Postcondition A predicate that should hold upon exit from a function. It expresses the conditions that a function should ensure for the return value and/or the state of objects that may be used by the function. Postconditions are expressed by ensures attributes. double sqrt(double x) [[ expects: x>=0]] [[ ensures result: result >=0]]; cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 21/58
71 Contracts in C++ Assurances Postcondition A predicate that should hold upon exit from a function. It expresses the conditions that a function should ensure for the return value and/or the state of objects that may be used by the function. Postconditions are expressed by ensures attributes. double sqrt(double x) [[ expects: x>=0]] [[ ensures result: result >=0]]; Postconditions may introduce a name for the result of the function. cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 21/58
72 Contracts in C++ Assertions Assertions A predicate that should hold at its point in a function body. It expresses the conditions that must be satisfied, on objects that are accessible at its point in a body. Assertions are expressed by assert attributes. cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 22/58
73 Contracts in C++ Assertions Assertions A predicate that should hold at its point in a function body. It expresses the conditions that must be satisfied, on objects that are accessible at its point in a body. Assertions are expressed by assert attributes. double add_distances(const std::vector<double> & v) [[ ensurres r: r>=0.0]] { double r = 0.0; for (auto x : v) { [[ assert: x >= 0.0]]; r += x; } return r ; } cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 22/58
74 Contracts in C++ Effect of contracts A contract has no observable effect on a correct program (except performance). The only semantic effect of a contract happens if it is violated. cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 23/58
75 Contracts in C++ Effect of contracts A contract has no observable effect on a correct program (except performance). The only semantic effect of a contract happens if it is violated. Why do we use attributes syntax? Contract may be checked or not. Attributes are not part of function type. However, contracts are not an optional feature. As any other standardized attribute. cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 23/58
76 Contracts in C++ Effect of contracts A contract has no observable effect on a correct program (except performance). The only semantic effect of a contract happens if it is violated. Why do we use attributes syntax? Contract may be checked or not. Attributes are not part of function type. However, contracts are not an optional feature. As any other standardized attribute. Contracts checking and corresponding effects depend on build system settings. Default: Contract violation Program termination. cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 23/58
77 Contracts in C++ Repeating a contract Any redeclaration of a function has either the same contract or completely omits the contract. cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 24/58
78 Contracts in C++ Repeating a contract Any redeclaration of a function has either the same contract or completely omits the contract. int f (int x) [[ expects: x>0]] [[ ensures r: r >0]]; int f ( int x) ; // OK. No contract. int f ( int x) [[ expects: x>=0]]; // Error missing ensures and different expects int f (int x) [[ expects: x>0]] [[ ensures r: r >0]]; // OK. Same contract. cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 24/58
79 Contracts in C++ Repeating a contract But argument names may differ. cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 25/58
80 Contracts in C++ Repeating a contract But argument names may differ. int f (int x) [[ expects: x>0]] [[ ensures r: r >0]]; int f (int y) [[ expects: y>0]] [[ ensures z: z >0]]; cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 25/58
81 Contract checking 1 A brief history of contracts 2 Introduction 3 Contracts in C++ 4 Contract checking 5 Contracts on interfaces 6 Final notes cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 26/58
82 Contract checking Assertion level Every contract expression has an associated assertion level. cbed J. Daniel Garcia 27/58
83 Contract checking Assertion level Every contract expression has an associated assertion level. Contract levels: default, audit, axiom. Checks will be effectively performed depending on build mode. cbed J. Daniel Garcia 27/58
84 Contract checking Assertion level Every contract expression has an associated assertion level. Contract levels: default, audit, axiom. Checks will be effectively performed depending on build mode. Default level can be omitted. void f(element & x) [[ expects: x.valid () ]]; void g(element & x) [[ expects default: x.valid () ]]; cbed J. Daniel Garcia 27/58
85 Contract checking Assertion level Every contract expression has an associated assertion level. Contract levels: default, audit, axiom. Checks will be effectively performed depending on build mode. Default level can be omitted. void f(element & x) [[ expects: x.valid () ]]; void g(element & x) [[ expects default: x.valid () ]]; Cost of checking is expected to be small compared to function execution. cbed J. Daniel Garcia 27/58
86 Contract checking Audit checks An audit assertion level is expected to be used in cases where the cost of a run-time check is assumed to be large compared to function execution. Or at least significant. template <typename It, typename T> bool binary_search(it first, It last, const T & x) [[ expects audit: is_sorted( first, last ) ]]; cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 28/58
87 Contract checking Axiom checks An axiom assertion level is expected to be used in cases where the run-time check will never be performed. Still they need to be valid C++. They are formal comments for humans and/or static analyzers. cbed J. Daniel Garcia 29/58
88 Contract checking Axiom checks An axiom assertion level is expected to be used in cases where the run-time check will never be performed. Still they need to be valid C++. They are formal comments for humans and/or static analyzers. template <typename InputIterator> InputIterator my_algorithm(inputiterator first, InputIterator last ) [[ expects axiom: first!=last && reachable(first, last ) ]]; cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 29/58
89 Contract checking Axiom checks An axiom assertion level is expected to be used in cases where the run-time check will never be performed. Still they need to be valid C++. They are formal comments for humans and/or static analyzers. template <typename InputIterator> InputIterator my_algorithm(inputiterator first, InputIterator last ) [[ expects axiom: first!=last && reachable(first, last ) ]]; Axioms are not evaluated. They may contain calls to declared but undefined functions. cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 29/58
90 Contract checking Build levels Every translation is performed in a build level: off: No run-time checking is performed. default: Checks with default levels are checked. audit: Checks with default and audit levels are checked. cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 30/58
91 Contract checking Build levels Every translation is performed in a build level: off: No run-time checking is performed. default: Checks with default levels are checked. audit: Checks with default and audit levels are checked. How do you select the build level: No way of selecting in source code. An option from your compiler. cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 30/58
92 Contract checking Contract checking If a function has multiple preconditions or postconditions that would be checked, their evaluation will be performed in the order they appear cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 31/58
93 Contract checking Contract checking If a function has multiple preconditions or postconditions that would be checked, their evaluation will be performed in the order they appear void f(int p) [[ expects: p!=nullptr]] [[ expects: p == 0]] // Only checked when p!=nullptr { p = 1; } cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 31/58
94 Contract checking Contract violation handlers A translation unit has an associated contract violation handler. cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 32/58
95 Contract checking Contract violation handlers A translation unit has an associated contract violation handler. A contract violation handler is the function to be called when a contract is broken. Function with specific signature. void (const std:: contract_violation &); cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 32/58
96 Contract checking Contract violation handlers A translation unit has an associated contract violation handler. A contract violation handler is the function to be called when a contract is broken. Function with specific signature. void (const std:: contract_violation &); If you do not supply a handler, the default is std::abort(). cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 32/58
97 Contract checking Contract violation handlers A translation unit has an associated contract violation handler. A contract violation handler is the function to be called when a contract is broken. Function with specific signature. void (const std:: contract_violation &); If you do not supply a handler, the default is std::abort(). If you want to supply a handler: cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 32/58
98 Contract checking Contract violation handlers A translation unit has an associated contract violation handler. A contract violation handler is the function to be called when a contract is broken. Function with specific signature. void (const std:: contract_violation &); If you do not supply a handler, the default is std::abort(). If you want to supply a handler: No way of setting through source code. cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 32/58
99 Contract checking Contract violation handlers A translation unit has an associated contract violation handler. A contract violation handler is the function to be called when a contract is broken. Function with specific signature. void (const std:: contract_violation &); If you do not supply a handler, the default is std::abort(). If you want to supply a handler: No way of setting through source code. No way of asking which is current handler. cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 32/58
100 Contract checking Contract violation handlers A translation unit has an associated contract violation handler. A contract violation handler is the function to be called when a contract is broken. Function with specific signature. void (const std:: contract_violation &); If you do not supply a handler, the default is std::abort(). If you want to supply a handler: No way of setting through source code. No way of asking which is current handler. An option in your compiler to supply it. cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 32/58
101 Contract checking Contract violation handlers A translation unit has an associated contract violation handler. A contract violation handler is the function to be called when a contract is broken. Function with specific signature. void (const std:: contract_violation &); If you do not supply a handler, the default is std::abort(). If you want to supply a handler: No way of setting through source code. No way of asking which is current handler. An option in your compiler to supply it. Security sensitive systems may prevent arbitrary handlers. cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 32/58
102 Contract checking Information for the handler Function with specific signature. void (const std:: contract_violation &); cbed J. Daniel Garcia 33/58
103 Contract checking Information for the handler Function with specific signature. void (const std:: contract_violation &); Minimum information inf contract_violation: class contract_violation { public: int line_number() const noexcept; const char file_name() const noexcept; const char function_name() const noexcept; const char comment() const noexcept; }; cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 33/58
104 Contract checking Information for the handler Function with specific signature. void (const std:: contract_violation &); Minimum information inf contract_violation: class contract_violation { public: int line_number() const noexcept; const char file_name() const noexcept; const char function_name() const noexcept; const char comment() const noexcept; }; Might get simplified by std::experimental::source_location. cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 33/58
105 Contract checking What happens after the violation handler? Two basic options: Program finishes execution. Program resumes execution. cbed J. Daniel Garcia 34/58
106 Contract checking What happens after the violation handler? Two basic options: Program finishes execution. Program resumes execution. An option in your compiler to select continuation mode: off: Do not resume execution. Default option. on: Resume execution. cbed J. Daniel Garcia 34/58
107 Contract checking What happens after the violation handler? Two basic options: Program finishes execution. Program resumes execution. An option in your compiler to select continuation mode: off: Do not resume execution. Default option. on: Resume execution. But remember: cbed J. Daniel Garcia 34/58
108 Contract checking What happens after the violation handler? Two basic options: Program finishes execution. Program resumes execution. An option in your compiler to select continuation mode: off: Do not resume execution. Default option. on: Resume execution. But remember: No way of setting through source code. cbed J. Daniel Garcia 34/58
109 Contract checking What happens after the violation handler? Two basic options: Program finishes execution. Program resumes execution. An option in your compiler to select continuation mode: off: Do not resume execution. Default option. on: Resume execution. But remember: No way of setting through source code. No way of asking which is current mode. cbed J. Daniel Garcia 34/58
110 Contract checking Why do we want to continue? Gradual introduction of contracts. cbed J. Daniel Garcia 35/58
111 Contract checking Why do we want to continue? Gradual introduction of contracts. Testing the contracts themselves. cbed J. Daniel Garcia 35/58
112 Contract checking Why do we want to continue? Gradual introduction of contracts. Testing the contracts themselves. Plugin management. cbed J. Daniel Garcia 35/58
113 Contract checking Continuation mode and optimizations Assertion information may be used by optimizers. [[ assert: ptr!=nullptr ]]; //... if ( ptr!=nullptr) { // Can be optimized out do_stuff () ; } cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 36/58
114 Contract checking Continuation mode and optimizations Assertion information may be used by optimizers. [[ assert: ptr!=nullptr ]]; //... if ( ptr!=nullptr) { // Can be optimized out do_stuff () ; } If continuation mode is off, then if is never reached. cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 36/58
115 Contract checking Continuation mode and optimizations Assertion information may be used by optimizers. [[ assert: ptr!=nullptr ]]; //... if ( ptr!=nullptr) { // Can be optimized out do_stuff () ; } If continuation mode is off, then if is never reached. If continuation mode is on, then if would be reached. cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 36/58
116 Contract checking Continuation mode and optimizations Assertion information may be used by optimizers. [[ assert: ptr!=nullptr ]]; //... if ( ptr!=nullptr) { // Can be optimized out do_stuff () ; } If continuation mode is off, then if is never reached. If continuation mode is on, then if would be reached. But the if might get optimized out! cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 36/58
117 Contract checking Continuation mode and optimizations Assertion information may be used by optimizers. [[ assert: ptr!=nullptr ]]; //... if ( ptr!=nullptr) { // Can be optimized out do_stuff () ; } If continuation mode is off, then if is never reached. If continuation mode is on, then if would be reached. But the if might get optimized out! Continuation after violation is technically undefined behavior. cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 36/58
118 Contract checking Contracts and noexcept What happens to noexcept function if its contract is broken? cbed J. Daniel Garcia 37/58
119 Contract checking Contracts and noexcept What happens to noexcept function if its contract is broken? With continuation mode set to off program finishes. cbed J. Daniel Garcia 37/58
120 Contract checking Contracts and noexcept What happens to noexcept function if its contract is broken? With continuation mode set to off program finishes. With continuation mode set to on program resumes. cbed J. Daniel Garcia 37/58
121 Contract checking Contracts and noexcept What happens to noexcept function if its contract is broken? With continuation mode set to off program finishes. With continuation mode set to on program resumes. But, what if the handler throws an exception? cbed J. Daniel Garcia 37/58
122 Contract checking Contracts and noexcept What happens to noexcept function if its contract is broken? With continuation mode set to off program finishes. With continuation mode set to on program resumes. But, what if the handler throws an exception? Program invokes terminate() as-if an exception was thrown inside functions. cbed J. Daniel Garcia 37/58
123 Contract checking Contracts and noexcept What happens to noexcept function if its contract is broken? With continuation mode set to off program finishes. With continuation mode set to on program resumes. But, what if the handler throws an exception? Program invokes terminate() as-if an exception was thrown inside functions. cbed J. Daniel Garcia 37/58
124 Contract checking Contracts and noexcept What happens to noexcept function if its contract is broken? With continuation mode set to off program finishes. With continuation mode set to on program resumes. But, what if the handler throws an exception? Program invokes terminate() as-if an exception was thrown inside functions. void f(int x) noexcept [[expects: x > 0]]; void g() { f( 1); // Invokes terminate if handler throws } cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 37/58
125 Contracts on interfaces 1 A brief history of contracts 2 Introduction 3 Contracts in C++ 4 Contract checking 5 Contracts on interfaces 6 Final notes cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 38/58
126 Contracts on interfaces Repeating a contract Any redeclaration of a function has either the same contract or completely omits the contract. cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 39/58
127 Contracts on interfaces Repeating a contract Any redeclaration of a function has either the same contract or completely omits the contract. int f (int x) [[ expects: x>0]] [[ ensures r: r >0]]; int f ( int x) ; // OK. No contract. int f ( int x) [[ expects: x>=0]]; // Error missing ensures and different expects int f (int x) [[ expects: x>0]] [[ ensures r: r >0]]; // OK. Same contract. cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 39/58
128 Contracts on interfaces Preconditions on functions The expression of a precondition from a function may use: The function s arguments. Any non-local object. constexpr int max = 100; std :: string name{"daniel"}; bool f( int x, std :: string s) [[ expects: x>0]] // OK. x is an argument. [[ expects: x<max]] // OK max is non local [[ expects: s.length() >0]] // OK. s is an argument [[ expects: s!=name]]; // OK. name is non local cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 40/58
129 Contracts on interfaces Preconditions on constexpr functions The expression of a precondition from a constexpr function may use: The function s arguments. Any non-local object that is constexpr. but it cannot access non-local objects that are not constexpr. constexpr int max = 100; std :: string name{"daniel"}; constexpr bool f(int x, std :: string s) [[ expects: x>0]] // OK. x is an argument. [[ expects: x<max]] // OK max is constexpr [[ expects: s.length() >0]] // OK. s is an argument [[ expects: s!=name]]; // Error name is a non local variable cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 41/58
130 Contracts on interfaces Modifications in contracts A program with a contract expression that performs an observable modification of an object is ill-formed. Your compiler might give a diagnostic. cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 42/58
131 Contracts on interfaces Modifications in contracts A program with a contract expression that performs an observable modification of an object is ill-formed. Your compiler might give a diagnostic. int f (int x) [[ expects: x++ > 0]] // Error [[ ensures r: r == ++x]]; // Error cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 42/58
132 Contracts on interfaces Modified arguments and postconditions If a postcondition uses an argument and the function body modifies that value, the program is ill-formed. cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 43/58
133 Contracts on interfaces Modified arguments and postconditions If a postcondition uses an argument and the function body modifies that value, the program is ill-formed. int f (int x) [[ ensures r: r==x] { return ++x; // Error x used in postcondition } cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 43/58
134 Contracts on interfaces Modified arguments and postconditions If a postcondition uses an argument and the function body modifies that value, the program is ill-formed. int f (int x) [[ ensures r: r==x] { return ++x; // Error x used in postcondition } Workaround: int f (int x) { int oldx = x; auto r = ++x; [[ assert: r==oldx]]; } cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 43/58
135 Contracts on interfaces But you con modify pointer contents A pointer value is different from the pointed value. cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 44/58
136 Contracts on interfaces But you con modify pointer contents A pointer value is different from the pointed value. void f(int ptr ) [[ ensures: ptr!=nullptr ]] { ptr = 42 } cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es) 44/58
Contracts programming for C++20
Contracts programming for C++20 Current proposal status J. Daniel Garcia ARCOS Group University Carlos III of Madrid Spain February 27, 2018 cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es)
Avoiding undefined behavior in contracts
Document Number: P1290R0 Date: 2018-11-26 Reply to: J. Daniel Garcia e-mail: josedaniel.garcia@uc3m.es Audience: EWG Avoiding undefined behavior in contracts J. Daniel Garcia Computer Science and Engineering
Avoiding undefined behavior in contracts
Document Number: P1290R1 Date: 2019-01-21 Reply to: J. Daniel Garcia e-mail: josedaniel.garcia@uc3m.es Audience: EWG / CWG Avoiding undefined behavior in contracts J. Daniel Garcia Computer Science and
Exploring the design space of contract specifications for C++
Document Number: N4110 Date: 2014-07-06 Reply to: josedaniel.garcia@uc3m.es Exploring the design space of contract specifications for C++ J. Daniel Garcia Computer Architecture Group University Carlos
Contra Support Merged Proposal
Document Number: P0246R0 Date: 2016-02-12 Proje : ISO SC22/WG21 C++ Standard, Evolution Working Group Authors: John Lakos, Alisdair Meredith, Nathan Myers Reply to: Nathan Myers nmyers12@bloomberg.net
Three interesting questions about contracts
Document Number: P0166R0 Date: 2015-11-06 Reply to: J. Daniel Garcia e-mail: josedaniel.garcia@uc3m.es Audience: EWG Three interesting questions about contracts J. Daniel Garcia Computer Science and Engineering
Assertions, pre/postconditions
Programming as a contract Assertions, pre/postconditions Assertions: Section 4.2 in Savitch (p. 239) Specifying what each method does q Specify it in a comment before method's header Precondition q What
Contract Programming For C++0x
Contract Programming For C++0x WG21/N1800 and J16/05-0060 Lawrence Crowl and Thorsten Ottosen lawrence.crowl@sun.com and nesotto@cs.aau.dk 2005-04-27 Overview This is an annotated version of the presentation
Simple Contracts for C++ (R1)
P0287R0 2016-02-15 Reply-To: gdr@microsoft.com (R1) Gabriel Dos Reis Microsoft Manuel Fähndrich Google J. Daniel García Universidad Carlos III de Madrid Abstract Francesco Logozzo Facebook Shuvendu Lahiri
Laboratorio di Tecnologie dell'informazione
Laboratorio di Tecnologie dell'informazione Ing. Marco Bertini marco.bertini@unifi.it http://www.micc.unifi.it/bertini/ Exceptions What are exceptions? Exceptions are a mechanism for handling an error
std::assume_aligned Abstract
std::assume_aligned Timur Doumler (papers@timur.audio) Chandler Carruth (chandlerc@google.com) Document #: P1007R0 Date: 2018-05-04 Project: Programming Language C++ Audience: Library Evolution Working
Exception Namespaces C Interoperability Templates. More C++ David Chisnall. March 17, 2011
More C++ David Chisnall March 17, 2011 Exceptions A more fashionable goto Provides a second way of sending an error condition up the stack until it can be handled Lets intervening stack frames ignore errors
CS11 Advanced C++ Fall Lecture 3
CS11 Advanced C++ Fall 2006-2007 Lecture 3 Today s Topics C++ Standard Exceptions Exception Cleanup Fun with Exceptions Exception Specifications C++ Exceptions Exceptions are nice for reporting many errors
Axioms: Semantics Aspects of C++ Concepts
Doc no: N2887=09-0077 Date: 2009-06-21 Project: ISO/IEC JTC1/SC22/WG21 Reply-To: Gabriel Dos Reis gdr@cs.tamu.edu Axioms: Semantics Aspects of C++ Concepts Gabriel Dos Reis Bjarne Stroustrup Alisdair Meredith
Lecture 1 Contracts. 1 A Mysterious Program : Principles of Imperative Computation (Spring 2018) Frank Pfenning
Lecture 1 Contracts 15-122: Principles of Imperative Computation (Spring 2018) Frank Pfenning In these notes we review contracts, which we use to collectively denote function contracts, loop invariants,
Designing Robust Classes
Designing Robust Classes Learning Goals You must be able to:! specify a robust data abstraction! implement a robust class! design robust software! use Java exceptions Specifications and Implementations
CS11 Introduction to C++ Fall Lecture 6
CS11 Introduction to C++ Fall 2006-2007 Lecture 6 Today s Topics C++ exceptions Introduction to templates How To Report Errors? C style of error reporting: return values For C Standard Library/UNIX functions,
C++ Crash Kurs. Exceptions. Dr. Dennis Pfisterer Institut für Telematik, Universität zu Lübeck
C++ Crash Kurs Exceptions Dr. Dennis Pfisterer Institut für Telematik, Universität zu Lübeck http://www.itm.uni-luebeck.de/people/pfisterer C++ Exceptions: Introduction What are exceptions Exceptions are
Exceptions and Continuations. Lecture #19: More Special Effects Exceptions and OOP. Approach II: Non-Standard Return. Approach I: Do Nothing
Lecture #19: More Special Effects Exceptions and OOP Test #2 in two weeks (14 April), in class. Autograder runs Sunday night sometime. Exceptions and Continuations Exception-handling in programming languages
Lecture 1 Contracts : Principles of Imperative Computation (Fall 2018) Frank Pfenning
Lecture 1 Contracts 15-122: Principles of Imperative Computation (Fall 2018) Frank Pfenning In these notes we review contracts, which we use to collectively denote function contracts, loop invariants,
COSC 2P95. Procedural Abstraction. Week 3. Brock University. Brock University (Week 3) Procedural Abstraction 1 / 26
COSC 2P95 Procedural Abstraction Week 3 Brock University Brock University (Week 3) Procedural Abstraction 1 / 26 Procedural Abstraction We ve already discussed how to arrange complex sets of actions (e.g.
C The new standard
C++11 - The new standard Lars Kühne Institut für Informatik Lehrstuhl für theoretische Informatik II Friedrich-Schiller-Universität Jena January 16, 2013 Overview A little bit of history: C++ was initially
QStringView. everywhere. Marc Mutz, Senior Software Engineer at KDAB
QStringView QStringView everywhere Marc Mutz, Senior Software Engineer at KDAB Intro About me p.2 Intro (cont'd) Author of QStringView p.3 Overview QStringView Using QStringView API Patterns For QStringView
Assertions and Exceptions
CS 247: Software Engineering Principles Assertions and Exceptions Reading: Eckel, Vol. 2 Ch. 1 Exception Handling U Waterloo CS247 (Spring 2017) p.1/32 Defensive Programming The question isn t whether
Objectives for this class meeting. 1. Conduct review of core concepts concerning contracts and pre/post conditions
CSE1720 Click to edit Master Week text 01, styles Lecture 02 Second level Third level Fourth level Fifth level Winter 2015! Thursday, Jan 8, 2015 1 Objectives for this class meeting 1. Conduct review of
С++ Contracts. Antony Polukhin Полухин Антон
С++ Contracts Antony Polukhin Полухин Антон Author of Boost's TypeIndex, DLL, Stacktrace Maintainer of Boost Any, Conversion, LexicalСast, Variant ISO WG21 national body What are we going to talk about?
References: internet notes; Bertrand Meyer, Object-Oriented Software Construction; 10/14/2004 1
References: internet notes; Bertrand Meyer, Object-Oriented Software Construction; 10/14/2004 1 Assertions Statements about input to a routine or state of a class Have two primary roles As documentation,
Generalized pointer casts
Contents Doc No: N3235=11-0005 Date: 2011-02-23 Authors: Pablo Halpern Intel Corp.. phalpern@halpernwightsoftware.com Generalized pointer casts National Body Comments and Issues... 1 Document Conventions...
This examination has 11 pages. Check that you have a complete paper.
MARKING KEY The University of British Columbia MARKING KEY Computer Science 252 2nd Midterm Exam 6:30 PM, Monday, November 8, 2004 Instructors: K. Booth & N. Hutchinson Time: 90 minutes Total marks: 90
Repetition Through Recursion
Fundamentals of Computer Science I (CS151.02 2007S) Repetition Through Recursion Summary: In many algorithms, you want to do things again and again and again. For example, you might want to do something
Source-Code Information Capture
Source-Code Information Capture Robert Douglas 2015-04-08 Document Number: N4417 followup to N4129 Date: 2015-04-08 Project: Programming Language C++ 1 Introduction Logging, testing, and invariant checking
Doc. No.: WG21/N0937=X3J16/ Date: 28 May 1996 Project: C++ Standard Library Reply to: Nathan Myers
Doc. No.: WG21/N0937=X3J16/96-0119 Date: 28 May 1996 Project: C++ Standard Library Reply to: Nathan Myers Clause 20 (Utilities Library) Issues (Revision 4) ** Revision History: Revision
Advanced Systems Programming
Advanced Systems Programming Introduction to C++ Martin Küttler September 19, 2017 1 / 18 About this presentation This presentation is not about learning programming or every C++ feature. It is a short
void fun() C::C() // ctor try try try : member( ) catch (const E& e) { catch (const E& e) { catch (const E& e) {
TDDD38 APiC++ Exception Handling 134 Exception handling provides a way to transfer control and information from a point in the execution to an exception handler a handler can be invoked by a throw expression
Induction and Semantics in Dafny
15-414 Lecture 11 1 Instructor: Matt Fredrikson Induction and Semantics in Dafny TA: Ryan Wagner Encoding the syntax of Imp Recall the abstract syntax of Imp: a AExp ::= n Z x Var a 1 + a 2 b BExp ::=
C++ For Science and Engineering Lecture 15
C++ For Science and Engineering Lecture 15 John Chrispell Tulane University Wednesday September 29, 2010 Function Review Recall the basics you already know about functions. Provide a function definition.
The Contract Pattern. Design by contract
The Contract Pattern Copyright 1997, Michel de Champlain Permission granted to copy for PLoP 97 Conference. All other rights reserved. Michel de Champlain Department of Computer Science University of Canterbury,
n Specifying what each method does q Specify it in a comment before method's header n Precondition q Caller obligation n Postcondition
Programming as a contract Assertions, pre/postconditions and invariants Assertions: Section 4.2 in Savitch (p. 239) Loop invariants: Section 4.5 in Rosen Specifying what each method does q Specify it in
Lecture Topics. Administrivia
ECE498SL Lec. Notes L8PA Lecture Topics overloading pitfalls of overloading & conversions matching an overloaded call miscellany new & delete variable declarations extensibility: philosophy vs. reality
Outline. 1 About the course
Outline EDAF50 C++ Programming 1. Introduction 1 About the course Sven Gestegård Robertz Computer Science, LTH 2018 2 Presentation of C++ History Introduction Data types and variables 1. Introduction 2/1
Pages and 68 in [JN] conventions for using exceptions in Java. Chapter 8 in [EJ] guidelines for more effective use of exceptions.
![Pages and 68 in [JN] conventions for using exceptions in Java. Chapter 8 in [EJ] guidelines for more effective use of exceptions.](/thumbs/72/66806023.jpg "Pages and 68 in [JN] conventions for using exceptions in Java. Chapter 8 in [EJ] guidelines for more effective use of exceptions.")
CS511, HANDOUT 12, 7 February 2007 Exceptions READING: Chapter 4 in [PDJ] rationale for exceptions in general. Pages 56-63 and 68 in [JN] conventions for using exceptions in Java. Chapter 8 in [EJ] guidelines
21. Exceptions. Advanced Concepts: // exceptions #include <iostream> using namespace std;
- 147 - Advanced Concepts: 21. Exceptions Exceptions provide a way to react to exceptional circumstances (like runtime errors) in our program by transferring control to special functions called handlers.
Static versus dynamic polymorphism
Static versus dynamic polymorphism Flexibility versus performance J. Daniel Garcia ARCOS Group University Carlos III of Madrid Spain December 2, 2016 cbed J. Daniel Garcia ARCOS@UC3M (josedaniel.garcia@uc3m.es)
Lecture Notes on Contracts
Lecture Notes on Contracts 15-122: Principles of Imperative Computation Frank Pfenning Lecture 2 August 30, 2012 1 Introduction For an overview the course goals and the mechanics and schedule of the course,
Operator Dot Wording
2016-10-16 Operator Dot Wording Bjarne Stroustrup (bs@ms.com) Gabriel Dos Reis (gdr@microsoft.com) Abstract This is the proposed wording for allowing a user-defined operator dot (operator.()) for specifying
Exception Handling Introduction. Error-Prevention Tip 13.1 OBJECTIVES
1 2 13 Exception Handling It is common sense to take a method and try it. If it fails, admit it frankly and try another. But above all, try something. Franklin Delano Roosevelt O throw away the worser
C++ Programming Lecture 5 Software Engineering Group
C++ Programming Lecture 5 Software Engineering Group Philipp D. Schubert Contents 1. Error handling A. Return codes B. Assertions C. Exceptions 2. Function pointers 3. std::function Error handling How
Structured bindings with polymorphic lambas
1 Introduction Structured bindings with polymorphic lambas Aaryaman Sagar (aary800@gmail.com) August 14, 2017 This paper proposes usage of structured bindings with polymorphic lambdas, adding them to another
Software Development. Modular Design and Algorithm Analysis
Software Development Modular Design and Algorithm Analysis Precondition and Postcondition To create a good algorithm, a programmer must be able to analyse a precondition (starting state) and a postcondition
Assertions & Design-by-Contract using JML Erik Poll University of Nijmegen
Assertions & Design-by-Contract using JML Erik Poll University of Nijmegen Erik Poll - JML p.1/39 Overview Assertions Design-by-Contract for Java using JML Contracts and Inheritance Tools for JML Demo
Prelim 1 SOLUTION. CS 2110, September 29, 2016, 7:30 PM Total Question Name Loop invariants. Recursion OO Short answer
Prelim 1 SOLUTION CS 2110, September 29, 2016, 7:30 PM 0 1 2 3 4 5 Total Question Name Loop invariants Recursion OO Short answer Exception handling Max 1 15 15 25 34 10 100 Score Grader 0. Name (1 point)
Software Design and Analysis for Engineers
Software Design and Analysis for Engineers by Dr. Lesley Shannon Email: lshannon@ensc.sfu.ca Course Website: http://www.ensc.sfu.ca/~lshannon/courses/ensc251 Simon Fraser University Slide Set: 9 Date:
G52CPP C++ Programming Lecture 16
G52CPP C++ Programming Lecture 16 Dr Jason Atkin http://www.cs.nott.ac.uk/~jaa/cpp/ g52cpp.html 1 Last Lecture Casting static cast dynamic cast const cast reinterpret cast Implicit type conversion 2 How
C++ Module TS Issues List Gabriel Dos Reis Microsoft
P0501R3 2018-01-30 Reply-To: gdr@microsoft.com Active Issues C++ Module TS Issues List Gabriel Dos Reis Microsoft [5] Static local variables [John Spicer, 11/8/2016] Should there be a restriction on local
Eiffel: Analysis, Design and Programming. ETH Zurich, September-December Exception handling
Eiffel: Analysis, Design and Programming ETH Zurich, September-December 2008-6- Exception handling What is an exception? An abnormal event Not a very precise definition Informally: something that you don
The C Programming Language
The C Programming Language Bjarne Stroustrup www.stroustrup.com/programming Dennis M. Ritchie dmr C and C++ ken bwk bs doug Both were born in the Computer Science Research Department of Bell Labs in Murray
QUIZ. What are 3 differences between C and C++ const variables?
QUIZ What are 3 differences between C and C++ const variables? Solution QUIZ Source: http://stackoverflow.com/questions/17349387/scope-of-macros-in-c Solution The C/C++ preprocessor substitutes mechanically,
Chapter 4 Defining Classes I
Chapter 4 Defining Classes I This chapter introduces the idea that students can create their own classes and therefore their own objects. Introduced is the idea of methods and instance variables as the
High Quality Java Code: Contracts & Assertions
High Quality Java Code: Contracts & Assertions by Pedro Agulló Soliveres Writing correct code is really hard. Maybe the main reason is that, as Bertrand Meyer said, software correctness is a relative notion.
IBM Rational Rhapsody TestConductor Add On. Code Coverage Limitations
IBM Rational Rhapsody TestConductor Add On Code Coverage Limitations 1 Rhapsody IBM Rational Rhapsody TestConductor Add On Code Coverage Limitations Release 2.7.1 2 License Agreement No part of this publication
Types. Type checking. Why Do We Need Type Systems? Types and Operations. What is a type? Consensus
Types Type checking What is a type? The notion varies from language to language Consensus A set of values A set of operations on those values Classes are one instantiation of the modern notion of type
Lecture 9 Assertions and Error Handling CS240
Lecture 9 Assertions and Error Handling CS240 The C preprocessor The C compiler performs Macro expansion and directive handling Preprocessing directive lines, including file inclusion and conditional compilation,
CS1622. Semantic Analysis. The Compiler So Far. Lecture 15 Semantic Analysis. How to build symbol tables How to use them to find
CS1622 Lecture 15 Semantic Analysis CS 1622 Lecture 15 1 Semantic Analysis How to build symbol tables How to use them to find multiply-declared and undeclared variables. How to perform type checking CS
CSE 374 Programming Concepts & Tools. Hal Perkins Spring 2010
CSE 374 Programming Concepts & Tools Hal Perkins Spring 2010 Lecture 19 Introduction ti to C++ C++ C++ is an enormous language: g All of C Classes and objects (kind of like Java, some crucial differences)
COMP6771 Advanced C++ Programming
1.... COMP6771 Advanced C++ Programming Week 5 Part One: Exception Handling 2016 www.cse.unsw.edu.au/ cs6771 2.... Memory Management & Exception Handling.1 Part I: Exception Handling Exception objects
Chapter 17 vector and Free Store
Chapter 17 vector and Free Store Hartmut Kaiser hkaiser@cct.lsu.edu http://www.cct.lsu.edu/~hkaiser/fall_2010/csc1253.html Slides adapted from: Bjarne Stroustrup, Programming Principles and Practice using
Precise Semantics for Assertions
Document: P0681r0 Date: 2017-06-16 Reply-to: Lisa Lippincott Audience: Evolution Precise Semantics for Assertions Lisa Lippincott Abstract I ve seen a number of discussions
Pointer Basics. Lecture 13 COP 3014 Spring March 28, 2018
Pointer Basics Lecture 13 COP 3014 Spring 2018 March 28, 2018 What is a Pointer? A pointer is a variable that stores a memory address. Pointers are used to store the addresses of other variables or memory
Wording for lambdas in unevaluated contexts
Wording for lambdas in unevaluated contexts Document #: P0315R4 Date: 2017-11-10 Project: Programming Language C++ Audience: Core Working Group Reply-to: Louis Dionne Hubert Tong
Assertions. Assertions - Example
References: internet notes; Bertrand Meyer, Object-Oriented Software Construction; 11/13/2003 1 Assertions Statements about input to a routine or state of a class Have two primary roles As documentation,
Object Oriented Programming in C#
Introduction to Object Oriented Programming in C# Class and Object 1 You will be able to: Objectives 1. Write a simple class definition in C#. 2. Control access to the methods and data in a class. 3. Create
UC Santa Barbara. CS189A - Capstone. Christopher Kruegel Department of Computer Science UC Santa Barbara
CS189A - Capstone Christopher Kruegel Department of Computer Science http://www.cs.ucsb.edu/~chris/ Design by Contract Design by Contract and the language that implements the Design by Contract principles
Lecture Notes on Memory Layout
Lecture Notes on Memory Layout 15-122: Principles of Imperative Computation Frank Pfenning André Platzer Lecture 11 1 Introduction In order to understand how programs work, we can consider the functions,
The issues. Programming in C++ Common storage modes. Static storage in C++ Session 8 Memory Management
Session 8 Memory Management The issues Dr Christos Kloukinas City, UoL http://staff.city.ac.uk/c.kloukinas/cpp (slides originally produced by Dr Ross Paterson) Programs manipulate data, which must be stored
Program Verification (6EC version only)
Program Verification (6EC version only) Erik Poll Digital Security Radboud University Nijmegen Overview Program Verification using Verification Condition Generators JML a formal specification language
Fast Introduction to Object Oriented Programming and C++
Fast Introduction to Object Oriented Programming and C++ Daniel G. Aliaga Note: a compilation of slides from Jacques de Wet, Ohio State University, Chad Willwerth, and Daniel Aliaga. Outline Programming
Exception Safe Coding
Exception Safe Coding Dirk Hutter hutter@compeng.uni-frankfurt.de Prof. Dr. Volker Lindenstruth FIAS Frankfurt Institute for Advanced Studies Goethe-Universität Frankfurt am Main, Germany http://compeng.uni-frankfurt.de
Programming II (CS300)
1 Programming II (CS300) Chapter 04: Exception Handling MOUNA KACEM mouna@cs.wisc.edu Spring 2018 Creating Classes 2 Introduction Exception Handling Common Exceptions Exceptions with Methods Assertions
QUIZ. What is wrong with this code that uses default arguments?
QUIZ What is wrong with this code that uses default arguments? Solution The value of the default argument should be placed in either declaration or definition, not both! QUIZ What is wrong with this code
Exceptions. CS162: Introduction to Computer Science II. Exceptions. Exceptions. Exceptions. Exceptions. Exceptions
CS162: Introduction to Computer Science II A typical way to handle error conditions is through the return value. For example, suppose we create a loadfile() function that returns true if it loaded the
An Incomplete Language Feature
N3139=10-0129 Bjarne Stroustrup 9/4/2010 An Incomplete Language Feature Abstract As the draft standard stands, we cannot use -style initialization in default arguments. This paper argues that this is a
Interface (API) Design
Interface (API) Design Architect s Perspective R. Kuehl/J. Scott Hawker p. 1 What is an API? Exposes the public facing functionality of a software component Operations, inputs, and outputs Exposes functionality
Software Engineering Concepts: Invariants Silently Written & Called Functions Simple Class Example
Software Engineering Concepts: Invariants Silently Written & Called Functions Simple Class Example CS 311 Data Structures and Algorithms Lecture Slides Friday, September 11, 2009 continued Glenn G. Chappell
Vector and Free Store (Pointers and Memory Allocation)
DM560 Introduction to Programming in C++ Vector and Free Store (Pointers and Memory Allocation) Marco Chiarandini Department of Mathematics & Computer Science University of Southern Denmark [Based on slides
Common Misunderstandings from Exam 1 Material
Common Misunderstandings from Exam 1 Material Kyle Dewey Stack and Heap Allocation with Pointers char c = c ; char* p1 = malloc(sizeof(char)); char** p2 = &p1; Where is c allocated? Where is p1 itself
a correct statement? You need to know what the statement is supposed to do.
Using assertions for correctness How can we know that software is correct? It is only correct if it does what it is supposed to do. But how do we know what it is supposed to do? We need a specification.
CS 161 Computer Security
Wagner Spring 2014 CS 161 Computer Security 1/27 Reasoning About Code Often functions make certain assumptions about their arguments, and it is the caller s responsibility to make sure those assumptions
Chapter 17 vector and Free Store
Chapter 17 vector and Free Store Bjarne Stroustrup www.stroustrup.com/programming Overview Vector revisited How are they implemented? Pointers and free store Allocation (new) Access Arrays and subscripting:
University of Waterloo Department of Electrical and Computer Engineering ECE 250 Data Structures and Algorithms. Final Examination
ECE 25 Data Structures and Algorithms University of Waterloo Department of Electrical and Computer Engineering ECE 25 Data Structures and Algorithms Instructor: Douglas Wilhelm Harder Time: 2.5 hours Aides:
1. Describe History of C++? 2. What is Dev. C++? 3. Why Use Dev. C++ instead of C++ DOS IDE?
1. Describe History of C++? The C++ programming language has a history going back to 1979, when Bjarne Stroustrup was doing work for his Ph.D. thesis. One of the languages Stroustrup had the opportunity
Guidelines for Writing C Code
Guidelines for Writing C Code Issue 01-bugfix Martin Becker Institute for Real-Time Computer Systems (RCS) Technische Universität München becker@rcs.ei.tum.de June 9, 2014 Contents 1 Introduction 1 2 Pragmatic
double d0, d1, d2, d3; double * dp = new double[4]; double da[4];
![double d0, d1, d2, d3; double * dp = new double[4]; double da[4];](/thumbs/91/107167668.jpg "double d0, d1, d2, d3; double * dp = new double[4]; double da[4];")
All multiple choice questions are equally weighted. You can generally assume that code shown in the questions is intended to be syntactically correct, unless something in the question or one of the answers
Language Support for Runtime Contract Validation (Revision 8)
Doc No: N4135 Date: 2014 10 09 Authors: John Lakos (jlakos@bloomberg.net) Alexei Zakharov (alexeiz@gmail.com) Alexander Beels (abeels@bloomberg.net) Nathan Myers (nmyers12@bloomberg.net) Language Support
C++ Programming Fundamentals
C++ Programming Fundamentals 281 Elvis C. Foster Lecture 12: Exception Handling One of the things you are required to do as a responsible programmer is to ensure that your program allows only valid data
When we program, we have to deal with errors. Our most basic aim is correctness, but we must
Chapter 5 Errors When we program, we have to deal with errors. Our most basic aim is correctness, but we must deal with incomplete problem specifications, incomplete programs, and our own errors. When
Source-Code Information Capture
Source-Code Information Capture Robert Douglas 2014-10-10 Document Number: N4129 followup to N3972 Date: 2014-10-10 Project: Programming Language C++ 1 Introduction Unchanged from N3972 Logging, testing,
Name: Username: I. 20. Section: II. p p p III. p p p p Total 100. CMSC 202 Section 06 Fall 2015
CMSC 202 Section 06 Fall 2015 Computer Science II Midterm Exam I Name: Username: Score Max Section: (check one) 07 - Sushant Athley, Tuesday 11:30am 08 - Aishwarya Bhide, Thursday 11:30am 09 - Phanindra
MSO Lecture Design by Contract"
1 MSO Lecture Design by Contract" Wouter Swierstra (adapted by HP, AL) October 8, 2018 2 MSO SO FAR Recap Abstract Classes UP & Requirements Analysis & UML OO & GRASP principles Design Patterns (Facade,
Announcements. Assignment 2 due next class in CSIL assignment boxes
Announcements Assignment 2 due next class in CSIL assignment boxes Call Stacks + On Writing Good Code Jan. 21 Lecture 8 Today: Function Call Stack Recursion Good Coding Principles Stacks - a Brief Introduction
Qualified std::function signatures
Document number: P0045R1 Date: 2017 02 06 To: SC22/WG21 LEWG Reply to: David Krauss (david_work at me dot com) Qualified std::function signatures std::function implements type-erasure of the behavior of