Re: more on safe-loop alternative

[bobduff@world.std.com (Robert A Duff)]

An ATC is a rather dangerous tool, because it causes an abort, and an
abort can do all kinds of damage.  If you're just going to print some
debugging info and shut down, then it's probably OK.  But if you're
going to try to continue after shutting down the supposedly-infinite
loop, using ATC seems like a bad idea, because to do it correctly, you
have to put in all kinds of protection and/or reason carefully about
places where you don't need protection.  It is far easier, IMHO, to
prove that your loop terminates, than it is to prove that you've done an
ATC correctly.

AARM-13.9.1 and 13.9.2 describe the potential damage caused by aborts,
if you're interested.  Also, 11.6(6).

Abort_statements are equally troublesome.

In article <dewar.828705553@schonberg>, Robert Dewar <dewar@cs.nyu.edu> wrote:
>Frankly I find the advice in the AQS a bit bogus. The best defence against
>run away recursion is careful reasoning about your program!

I agree.

By the way, ATC was rather controversial during the Ada 9X design.  Some
folks thought it to be so dangerous, it shouldn't be in the language at
all.  At one point, the syntax was changed from something
innocuous-looking to "then abort".  This made the nay-sayers *slightly*
happier -- Rudolf Landwehr called it "syntactic poison" (the opposite of
syntactic sugar).

My advice is, use static analysis (formal or informal, as appropriate)
to prove that things terminate.  If you insist on writing the extra
checking code, do it with a counter, not with a timed ATC.

- Bob