Re: ada compiler?

[Ludovic Brenta <ludovic@ludovic-brenta.org>]

Georg Bauhaus wrote:
> On Wed, 2007-11-14 at 07:09 -0800, Ludovic Brenta wrote:
> > But if the stack is exhausted or nearly so (perhaps because the last
> > in a long series of recursive calls raises Storage_Error), chances are
> > high that the exception handler itself will overflow the stack (e.g.
> > passing your string "Hey! You!" to a procedure might itself cause a
> > stack overflow). This, in my view, greatly reduces the benefit of the
> > exception. Also, what if raising the exception requires some stack
> > space? Maybe I should have said that explicitly.
>
> No, these are matters of course, and they are mentioned in the RM.

Not really. 11.5(23) says that a stack overflow raises Storage_Error
but, since the stack has overflowed, I'm not convinced that the
exception can still be raised, propagated and handled properly. The RM
is silent about that part and I believe this is an implementation
issue.

> However, I prefer being given a chance to run some emergency code,
> even knowing that I cannot in general rely on anything
> in the presence of Storage_Error (or exceptions with -O, for that
> matter). Perhaps I should mention that the programs that I have
> in mind are more mundane than hard real-time control programs.

The gnat package in Debian is for mundane programs; if you write
safety-critical software, you use a supported and certified compiler.
So, enabling -fstack-check by default is a viable option that I am
considering.  Like I said earlier, it would still be possible to
disable stack checking by saying -fno-stack-check explicitly.

You say that -fstack-check and the Storage_Error allow you to try and
"recover" but I'm not convinced that recovery is possible after a
stack overflow. In fact, I'm not even convinced that exception
propagation can be relied on after a stack overflow. Heap overflows
are different, of course, and are not affected by -fstack-check. Your
latest example was a heap overflow and therefore off-topic.

Does someone here know GNAT internals in sufficient detail as to
enlighten us? Also can someone explain what "reliable" stack checking
is in GNAT parlance?

--
Ludovic Brenta.