Re: 'size attribute inheritance

[bobduff@world.std.com (Robert A Duff)]

In article <mheaney-ya023680001308972242460001@news.ni.net>,
Matthew Heaney <mheaney@ni.net> wrote:
>I figured to get this behavior you'd require support of the Safety Annex. 
>I didn't know Ada 95 comes that way out of the box.

What the Safety annex gives you is pragma Normalize_Scalars.  Given
"X: Natural;" without pragma N_S, X could be initialized to a valid or
invalid value.  With N_S, it will be initialized to some negative
number, which will increase the probability of getting an exception when
you use X.  But the rules about which uses of X need to do a range check
are the same, with or without N_S.

>Does unitialized variable checking only apply to array index variables?

No, but that's where it makes the most difference.  That and case
statements.  Array indexing can cause writes to arbitrary memory
locations, and case statements can cause wild jumps, and these things
make the error unbounded.

It's a bounded error to read from an uninit var.  You might get an
in-range value, an out-of-range value, or an exception.  If you say "if
X in Natural then ..." an Ada 83 compiler can optimize this into "if
True then ...", but an Ada 95 compiler must first prove that X was
initialized before doing such an optimization.

The Ada 9X team had a mandate to eliminate some erroneous situations.
That's why the concept of "bounded error" exists -- it's like
"erroneous", in that you can't be sure the error will be caught, but at
least you know it won't do as much damage as something erroneous might
(such as writing upon arbitrary memory locations, or taking wild jumps).
For a bounded error, you know that if the error is detected, you'll get
an exception, and otherwise, you'll get a well-defined effect.  The
point is to allow the compiler enough freedom to generate efficient
code, without doing "too much" damage when things go wrong.

>And do you have an AARM reference?

AARM-3.3.1(21-21.b), 13.9.1(2,9-11).

- Bob