Re: ANSI C and POSIX (was Re: C/C++ knocks the crap out of Ada)

[thp@cs.ucr.edu (Tom Payne)]

Mike Rubenstein (miker3@ix.netcom.com) wrote:
: Bradd W. Szonye <bradds@ix.netcom.com> wrote:
: 
: > Try to keep in mind the spirit of defensive programming:
: > If there's something ambiguous about the way you could implement
: > something, and one implementation is safe regardless of how you interpret
: > the ambiguity, the other implementation only works under one specific
: > interpretation, then defensive programming (and portable programming) will
: > encourage the code that works under all circumstances. Consider:
: > 
: > for (size_t i = 0; i < 10; i++) do_stuff();
: > 
: > versus
: > 
: > for (size_t i = 0; i != 10; i++) do_stuff();
: > 
: > Even though you *know* that i will never be greater than 10, even though
: > "not equals" should always stop the loop after the tenth iteration,
: > practically every programmer will write the first loop in preference to
: > the second. 
[...]
: Defensive programming is important, but coding so you'll exit a loop
: even if the hardware fails has nothing to do with it.

I'm not sure that I agree with the fundamental premise behind
defensive programming: "Don't make your program a sucker for bugs."
[p. 45, Software Tools, Kernighan and Plauger]

Granted, if its an embedded controller in a life-support system, I'd
like every routine to make every effort to muddle through even in the
presence of bizarre hardware faults, etc.  In general programs, however,
I'd like them to crash as soon as possible when something is wrong, and
for that reason I've gone back to the  i != 10  style for upper limits
on for-loops.

Tom Payne (thp@cs.ucr.edu)