Re: Controlled types and exception safety

["Jeffrey R. Carter" <spam@spam.com>]

Dmitry A. Kazakov wrote:

> generic
>    type Object is limited private;
>    with procedure Deep_Copy (Left : in out Object; Right : Object) is <>;
> package Container is
>    ...
> end Container;
> -------------------------------
> with Container;
> generic
>    type Object is private;
> package Specialized_Container is
>    procedure Deep_Copy (Left : in out Object; Right : Object);
>    pragma Inline (Deep_Copy);
>    package Copying_By_Assignment is new Container (Object);   
> end Specialized_Container;
> -------------------------------
> package body Specialized_Container is
>    procedure Deep_Copy (Left : in out Object; Right Object) is
>    begin
>       Left := Right;
>    end Deep_Copy;
> end Specialized_Container;

There's a gotcha in here. Suppose we have

subtype S is Integer range 3 .. 4;

and we instantiate

package S_Container is new Specialized_Container (Object => S);

Now suppose that Container has something like

procedure Op (Item : in Object) is
    X : Object;
begin -- Op
    Deep_Copy (Left => X, Right => Item);
    ...
end Op;

This is actually quite likely for a container, except X will be a component of 
the structure.

For scalars, there is a check on "in" and "in out" parameters that the actual 
value is of the subtype; Constraint_Error is raised if it is not. The check is 
likely to fail in this case; X probably is not in 3 .. 4.

So, for Container to work correctly for all possible actual types, the 
assignment procedure must have Left be mode "out". Now the uninitialized actual 
for Left is not checked on entry to the procedure, and it works correctly for 
scalars. For composite types, there is a whole collection of situations in which 
"out" really means "in out", so the user can still write a meaningful procedure 
that can inspect the contents of Left.

Personally, I would have preferred

procedure R'Assign (To : in out R; From : in R);

for any record type R. This can be redefined by the user:

for R'Assign use My_Assignment_Procedure;

I have seen objections to this approach, but none that aren't handled by one of 
the following rules:

* Within the body of a procedure used to implement 'Assign, ":=" refers to the 
predefined, bitwise copy assignment.

or

* There exists a procedure

R'Bitwise_Copy (To : in out R; From : in R);

that cannot be redefined by the user and is the default procedure for R'Assign. 
'Bitwise_Copy can be called explicitly inside a procedure used to implement 
'Assign to invoke default assignment.

Perhaps I'm missing something, but in any case, it's an elephant.

-- 
Jeff Carter
"English bed-wetting types."
Monty Python & the Holy Grail
15